TW202213131A - System for using authentication mechanism of fast identity online to enable certificate and method thereof - Google Patents

Abstract

A system for using an authentication mechanism of fast identity online (FIDO) to enable a certificate and a method thereof are provided. By obtaining a private key corresponding to a selected certificate in accordance with an inputted biological characteristics, using the private key to generate a verification data, transmitting the verification data to a server for verifying the verification data based on a public key corresponding to the private key, and determining whether using the private key according to validation result of verifying the verification data, the system and the method can using biological characteristics to protect private key of PKI, and can achieve the effect of identifying without any password.

Description

System and method for enabling digital certificate with authentication mechanism of online fast authentication

A certificate enabling system and method, particularly a system and method for enabling digital certificates with an authentication mechanism of online rapid authentication.

Authentication Public Key Infrastructure (PKI), also known as public key infrastructure, public key infrastructure, authentication public key infrastructure, authentication public key infrastructure, or public cryptography infrastructure, etc., is a group of An infrastructure of hardware, software, actors, management policies, and processes designed to create, manage, distribute, use, store, and restore digital credentials. From a cryptographic perspective, public key infrastructure links the user's personal identity with the public key through a digital certificate authority (CA). At the same time, the identity of the user must be unique for each certification body.

Generally, in the process of using the authentication public key infrastructure, when a user generates a key pair and applies for a certificate, he needs to create a set of passwords, and use the created password to access the authentication private key in the key pair. However, with the continuous advancement of technologies that affect network security such as eavesdropping and stealing, the security of simply using passwords is no longer sufficient. Therefore, the security of the authentication public key infrastructure that uses passwords to protect the authentication private key may also be challenged. . In addition, in order to prevent passwords from being guessed and brute-force cracked, the complexity of passwords is increasing day by day, and it is also required to be changed regularly. Although this effect strengthens the strength of passwords, it also makes it difficult for users to remember passwords, causing users to use I feel inconvenient when I get a certificate.

To sum up, it can be seen that there has been a long-standing problem in the prior art that the public key infrastructure uses a password to protect the private key, which is inconvenient but needs to take into account security. Therefore, it is necessary to propose improved technical means to solve this problem.

In view of the problem in the prior art that using a password to protect a private key in a public key infrastructure may be inconvenient but also requires consideration of security, the present invention discloses a system and method for enabling a digital certificate with an authentication mechanism of online rapid authentication, wherein:

The system for enabling digital certificates with an authentication mechanism of online quick authentication disclosed in the present invention at least includes: an identity authentication server; a client, further comprising: an input module for inputting biometric features and selecting a digital certificate, The digital certificate corresponds to a key pair, and the key pair includes the authentication public key and the authentication private key; the data access module is used to obtain the authentication private key by using the biometric feature; the data processing module is used to use the authentication private key to generate the authentication data; The communication module is used for sending the verification data to the identity authentication server, so that the identity authentication server uses the authentication public key to verify the verification data to generate the corresponding verification result, and is used for receiving the verification result; the operation processing module is used for The verification result indicates that when the verification data passes the verification, the verification private key is used to sign and seal.

The method for enabling a digital certificate with an authentication mechanism of online fast authentication disclosed by the present invention at least includes the steps of: selecting a digital certificate by a client, a key pair corresponding to the digital certificate, and the key pair including the authentication public key and the authentication private key; the client Input biometrics, and use the biometrics to obtain the authentication private key; the client uses the authentication private key to generate authentication data, and sends the authentication data to the identity authentication server; the identity authentication server uses the authentication public key to verify the authentication data to generate the corresponding authentication and send the verification result to the client; when the verification result indicates that the verification data has passed the verification, the client uses the authentication private key to sign.

The system and method disclosed in the present invention are as above, and the difference between the system and the prior art is that the present invention obtains the authentication private key corresponding to the selected digital certificate through the client according to the inputted biometric features, and uses the authentication private key to generate the authentication data After that, send the verification data to the identity authentication server, so that the identity authentication server uses the authentication public key corresponding to the authentication private key to verify the authentication data, and selects whether to use the authentication private key to sign according to the verification result, so as to solve the problems existing in the prior art. problems, and can achieve the technical effect of using digital certificates on the FIDO framework. Public Key Infrastructure Password-protecting private keys may not be secure enough

The features and implementations of the present invention will be described in detail below in conjunction with the drawings and examples, and the content is sufficient to enable any person skilled in the relevant art to easily and fully understand the technical means applied to solve the technical problems of the present invention and implement them accordingly, thereby achieving The effect that the present invention can achieve.

The system operation of the present invention will be described below with reference to “FIG. 1” of the system architecture diagram of enabling digital certificates with the authentication mechanism of online rapid authentication proposed by the present invention. As shown in FIG. 1 , the system of the present invention includes an identity authentication server 110 , a client 150 , and an attachable certificate management server 120 and certificate verification server 130 .

The identity authentication server 110 is connected to the certificate management server 120 , the certificate verification server 130 , and the client 150 through a wired or wireless network.

The identity authentication server 110 can determine the type of service requested by the service request sent by the client 150. When the service request is a service requesting the FIDO framework, the identity authentication server 110 can provide corresponding information according to the data or signal sent by the client 150. FIDO services, such as registering the authentication public key (public key) corresponding to the authentication private key (private key) used by the client 150; and when the service request is a service requesting credential management or credential verification, the identity authentication server 110 can forward the service request sent by the client 150 to the certificate management server 120 or the certificate verification server 130, and can forward the data or signals generated by the certificate management server 120 or the certificate verification server 130 back to the client 150 .

The authentication server 110 can also generate a challenge value, and can generate confirmation data (such as a registration request in the FIDO framework) containing the generated challenge value and other parameters, and can transmit the generated confirmation data to the client end 150. The challenge value provided by the present invention is an encrypted string of a certain length; other parameters provided by the present invention include, but are not limited to, user information (eg, user identification code).

The certificate management server 120 can be connected to the identity authentication server 110 through a wired or wireless network, and can also receive data or signals sent by the identity authentication server 110 , and can transmit the data or signals to the identity authentication server 110 .

The credential management server 120 may receive the credential management request sent by the identity authentication server 110, and provide credential management services corresponding to the received credential management request. Among them, the certificate management request includes but is not limited to the certificate signing request (Certificate Signing Request, CSR) for applying for a digital certificate, the certificate query request for querying the digital certificate, and the certificate update request for updating the digital certificate; the certificate management service includes but is not limited to the certificate query, Voucher application, voucher extension/renewal, etc.

In more detail, the certificate management server 120 may be a certificate authentication server, or may include a certificate registration server and a certificate authentication server connected through a wired or wireless network. When the certificate management server 120 is the certificate authentication server, the certificate management server 120 can process all received certificate management requests (such as reading the validity period/status of the digital certificate, issuing the digital certificate, extending the validity period of the digital certificate, etc. ) and generate a corresponding processing result, and the generated processing result can be sent back to the client 150 through the identity authentication server 110 . And if the certificate management server 120 includes a certificate registration server and a certificate authentication server, the certificate registration server can be connected with the identity authentication server 110, and when receiving the certificate management request sent by the identity authentication server 110, it can be based on The received certificate management request chooses whether to be processed by itself or forwarded to the certificate authentication server. For example, when the certificate management request is a certificate validity/status query, the certificate registration server can choose to process it by itself, that is, read the validity period/status of the digital certificate and use the identity authentication server 110 to send the data of the digital certificate read out. The validity period/status is returned to the client 150; for another example, when the certificate management request is a certificate application, the certificate registration server may choose to forward the certificate processing request to the certificate authentication server for processing, that is, when the identity authentication server 110 forwards the request to the client When the certificate signing request sent by the terminal 150 is sent to the certificate registration server, the certificate registration server can transmit the certificate signing request to the certificate authentication server, so that the certificate authentication server can issue a digital certificate according to the information in the certificate signing request, and use the certificate The registration server and authentication server 110 transmit the issued digital certificate back to the client 150 that issued the certificate signing request.

The certificate verification server 130 is connected to the identity verification server 110 through a wired or wireless network, and is responsible for providing corresponding certificate verification services according to the data or signals transmitted by the identity verification server 110 . For example, when the identity verification server 110 forwards the certificate verification request sent by the client 150 to the certificate verification server 130, the certificate verification server 130 can verify the data in the certificate verification request according to the signature value in the certificate verification request , and send the verification result generated after verification back to the client 150 that issued the certificate verification request through the identity verification server 110 .

The client 150 can be connected to the authentication server 110 through a wired or wireless network. It should be noted that, whether the client 150 requests the FIDO service or the certificate-related service from the authentication server 110, the service request sent to the authentication server 110 will conform to the format defined by the FIDO framework.

The client 150 can provide the user to apply for the digital certificate and register and use the FIDO service, and can also provide the user to use the digital certificate through the FIDO service. The client 150 may include a secure element 201 and a browsing element 205 as shown in the schematic diagram of the components in FIG. 2 .

The secure element 201 may be a hardware element, such as a Trusted Platform Module (TPM), a Trusted Execution Environment (TEE), or a specific chip, and may also be executed by the client 150 There is no particular limitation in the present invention as to the virtual components that can be read and written to a specific storage space simulated by the above operating system or software program.

The secure element 201 is responsible for storing the authentication private key and digital certificate, and the secure element can also store the identification code (rawID). The identifier mentioned in the present invention is a unique value, which can usually represent the user of the client 150 . Generally speaking, the identification code can be generated from data such as user identification data, random data, time stamp, and/or device identification data of the client 150. For example, Base64 encoding is performed on one or more of the above-mentioned data, but the identification code is generated. The information and methods are not limited to the above. The user identification information includes but is not limited to the ID card number, passport number, visa number, etc. of the user of the client terminal 150 , which can represent the user of the client terminal 150 ; the device identification information includes but is not limited to the products of the client terminal 150 Serial numbers, serial numbers of specific hardware components on the client 150, etc.

The browsing component 205 can provide users to register and use FIDO services through a web page, and can also provide users to use digital certificates through the FIDO framework. The browsing component 205 may further include an input module 210 , a data access module 220 , a data processing module 230 , a communication module 240 , a job processing module 250 , and an attachable key generation module 270 .

The input module 210 is responsible for inputting biometrics. The biometric feature input by the input module 210 is usually a fingerprint or a human face, but the present invention is not limited thereto.

Input module 210 is also responsible for selecting digital credentials. In the present invention, the digital certificate selected by the input module 210 has been bound to the client 150 . Generally speaking, a digital certificate corresponds to a set of key pairs, and the key pair includes an authentication public key and an authentication private key. The key pair can be generated by any elliptic curve cryptography (Elliptic Curve Cryptography, ECC) algorithm.

The data access module 220 is responsible for obtaining the authentication private key and/or digital certificate stored in the secure element 201 using the biometrics input by the input module 210 . In general, the data access module 220 can call an application programming interface (API) for web page authentication included in the browsing element 205 to obtain the authentication private key and/or digital certificate stored in the secure element 201 .

The data access module 220 can also verify the biometric features input by the input module 210 first, and can read the authentication private key and/or the digital certificate from the secure element after the biometric feature is verified.

The communication module 240 can be connected to the identity authentication server 110 through a wired or wireless network. The communication module 240 can request confirmation data from the identity authentication server 110 and receive the confirmation data returned by the identity authentication server 110 .

The communication module 240 is also responsible for transmitting the certificate verification request including the verification data generated by the data processing module 230 to the identity verification server 110, so that the identity verification server 110 forwards the certificate verification request to the certificate verification server 130, and can The verification result returned by the certificate verification server 130 through the identity verification server 110 is received.

Similarly, the communication module 240 can also transmit the certificate management request generated by the data processing module 230 to the identity authentication server 110, so as to forward the certificate management request to the certificate management server 120 through the identity authentication server 110. In this embodiment, the communication module 240 can also receive the digital certificate returned by the certificate management server 120 through the identity authentication server 110 .

The data processing module 230 is responsible for generating authentication data using the authentication private key obtained by the data access module 220 . Generally speaking, the data processing module 230 can first use the authentication private key obtained by the data access module 220 to sign the confirmation data received by the communication module 240, and then generate a signature value including the signature value generated by the signature. verification data, but the present invention is not limited to this.

The data processing module 230 can also generate credential verification requests compatible with the FIDO framework. The certificate verification request generated by the data processing module 230 includes the generated verification data, and may also include the digital certificate obtained by the data access module 220 . In most embodiments, the credential verification request may also include confirmation data received by the communication module 240 or pre-generated transaction data.

The data processing module 230 can also generate authentication information including the identification code obtained by the data access module 220 . The authentication information generated by the data processing module 230 is compatible with the FIDO framework.

The data processing module 230 may also generate credential management requests in a format compatible with the FIDO framework. For example, the data processing module 230 may generate a certificate signing request first, and may generate a certificate management request including the certificate signing request and authentication information.

The job processing module 250 is responsible for selecting whether to use the authentication private key for signing according to the verification result received by the communication module 240 . When the verification result indicates that the verification data generated by the data processing module 230 has passed the verification, the job processing module 250 can use the authentication private key to sign; and when the verification result indicates that the verification data generated by the data processing module 230 has not passed the verification , the job processing module 250 may not use the authentication private key to sign.

The operation processing module 250 can also use the authentication private key obtained by the data access module 220 to receive the confirmation data from the sub-authentication server 110 or the pre-generated transaction to the communication module 240 when choosing to use the authentication private key for signing. Data signature to generate signature value.

The key generation module 270 is responsible for generating a key pair, and the key pair generated by the key generation module 270 can be stored in the secure element 201 by the data access module 220 . The key pair generated by the key generation module 270 can be used in the FIDO architecture, that is, the key generation module 270 can use any elliptic curve cryptography algorithm to generate the key pair.

Next, an embodiment is used to explain the operation device and method of the present invention, and please refer to "FIG. 3A" for the flow chart of the method for enabling digital certificate by the authentication mechanism of online fast authentication proposed by the present invention. In this embodiment, it is assumed that the client 150 is a smart phone, and an application program compatible with the present invention and including the browsing component 205 is installed in the client 150, but the present invention is not limited thereto. The application including the browsing element 205 may be a browser APP or any APP including the browsing element.

When the client 150 executes the application, the above-mentioned modules of the present invention can be generated. In this embodiment, if the application has completed the binding operation, that is, the secure element 201 in the client 150 has stored the authentication private key and one or more digital certificates owned by the user of the client 150 .

If the application requires the user to sign and seal when the user is using the application, for example, when checking out in a shopping website or shopping APP, the input module 210 of the application can provide the user to select the digital certificate to be used (step 320). In this embodiment, it is assumed that the input module 210 can display on the client 150 all relevant messages of the digital certificates that have been bound, so as to provide the user with the choice of the digital certificate to be used. When there is only one digital certificate, you can directly select the bound digital certificate.

After the input module 210 of the client 150 selects the digital certificate (step 320 ), the input module 210 may provide the user to input biometrics (step 330 ). In this embodiment, it is assumed that the biometric feature input by the user is a fingerprint.

After the input module 210 of the client 150 inputs the biometric feature (step 330 ), the data access module 220 of the client 150 can use the biometric input from the input module 210 to obtain authentication from the secure element 201 of the client 150 private key (step 350). In this embodiment, it is assumed that the data access module 220 can firstly call the application program interface for verifying biometrics in the FIDO framework to verify the entered biometrics, and can call the FIDO framework after the biometrics is verified. The application programming interface for reading data, whereby the identification code and the authentication private key are read out from the secure element 201 .

After the data access module 220 of the client 150 obtains the authentication private key, the data processing module 230 of the client 150 can use the authentication private key obtained by the data access module 220 to generate authentication data, and the communication between the client 150 The module 240 may transmit the verification data generated by the data processing module 230 to the authentication server (step 360). In this embodiment, it is assumed that the data processing module 230 can first connect to the identity authentication server 110 through the communication module 240 to obtain the confirmation data including the challenge value, and can use the authentication private key obtained by the input module 210 for confirmation After the data is signed to generate the signature value, verification data including the generated signature value and the identification code obtained by the data access module 220 can be generated, and the generated verification data can be transmitted to the data access module 240 through the communication module 240. Identity authentication server 110 .

After the authentication server 110 receives the authentication data sent by the client 150, the authentication server 110 can use the authentication public key possessed by the user of the client 150 to verify the received authentication data, and after the authentication A corresponding verification result is generated, and the generated verification result may be transmitted back to the client 150 (step 370). In this embodiment, it is assumed that the identity authentication server 110 can read the signature value and the identification code from the verification data, and can transmit the read out signature value and identification code and the confirmation data previously sent to the client 150 . To the certificate verification server 130; the certificate verification server 130 can obtain the authentication public key of the user of the client 150 according to the identification code after receiving the signature value, identification code, and confirmation data sent by the identity authentication server 110 , and can generate a verification result according to the obtained authentication public key, the received confirmation data and the signature value, and can send the generated verification result back to the identity authentication server 110; the identity authentication server 110 receives the certificate After verifying the verification result generated by the server 130 , the received verification result can be transmitted to the client 150 .

After the communication module 240 in the client 150 receives the verification result sent by the identity authentication server 110, the operation processing module 250 in the client 150 can select whether to use the authentication private key to sign according to the verification result (step 380 ). ). In this embodiment, when the verification result indicates that the verification data generated by the data processing module 230 has passed the verification, the job processing module 250 can choose to use the verification private key to sign the transaction data generated by the checkout, so as to complete the settlement. If the verification result indicates that the verification data does not pass verification, the job processing module 250 can choose not to use the verification private key to sign, and can display a prompt message on the client 150 that the certificate activation fails.

In this way, through the present invention, the advantages of FIDO and the authentication public key infrastructure can be combined, so that the authentication private key used in the FIDO architecture can also be used for certificate operations under the FIDO architecture.

In the above embodiment, after the client 150 executes the application, if the input module 210 of the client 150 determines that the client 150 has not completed the binding of any digital certificate, that is, the secure element 201 of the client 150 does not store any digital certificates. The authentication private key and the corresponding digital certificate, as shown in the flow of "Fig. 3B", the key generation module 270 of the client 150 can generate a key pair (step 301). In this embodiment, it is assumed that the key generation module 270 can generate a key pair by using an elliptic curve cryptographic algorithm through the FIDO command, and can generate an identification code including user identification data.

Next, the data processing module 230 of the client terminal 150 can connect to the identity authentication server 110 through the communication module 240 of the client terminal 150 to obtain another confirmation data including different challenge values (the second confirmation data will be indicated below), And the authentication private key generated by the key generation module 270 can be used to sign the second confirmation data to generate a signature value.

Afterwards, the data processing module 230 in the client 150 can generate a certificate signing request including the authentication public key generated by the key generation module 270 and can generate authentication information including the identification code obtained by the data access module 220, and can generate a service request including certificate signing requirements and authentication information, the communication module 240 in the client 150 can transmit the service request generated by the data processing module 230 to the identity authentication server 110 (step 305 ), so as to allow the client The terminal 150 registers with the identity authentication server 110 to use the FIDO service, and simultaneously applies for a digital certificate to the certificate management server 120 through the identity authentication server 110 .

After the identity authentication server 110 receives the service request sent by the client 150, the identity authentication server 110 can register the authentication public key included in the service request according to the authentication information in the service request, so as to allow the client 150 to register to use the FIDO service .

In addition, the identity authentication server 110 can also transmit the received certificate signing request to the certificate management server 120 , so that the certificate management server 120 can obtain the authentication certificate generated by the client 150 from the received certificate signing request. key and other data and sign the obtained data to generate a digital certificate. After receiving the digital certificate returned by the certificate management server 120, the identity authentication server 110 can transmit the received digital certificate to the client 150 (step 311), so that the client 150 can obtain the digital certificate and use it in signing digital certificate. In this embodiment, assuming that the certificate management server 120 includes a certificate registration server and a certificate authentication server, after the certificate registration server receives the certificate signing request sent by the identity authentication server, it can generate a certificate containing the received The certificate application data required by the certificate signing, and after the generated certificate application data is signed, the certificate application data and the corresponding signature value are sent to the certificate authentication server. Afterwards, the certificate authentication server can sign the authentication public key in the certificate signing request after successfully verifying the received certificate application data using the received signature value, and generate an authentication public key including the certificate signing request and the digital certificate corresponding to the signature value, and sending the digital certificate back to the certificate registration server, so that the certificate registration server sends the digital certificate to the identity authentication server 110 .

After the communication module 240 in the client 150 receives the digital certificate sent by the identity authentication server 110 , the data access module 220 of the client 150 can use the digital certificate received by the communication module 240 with the client 150 The authentication private key generated by the key generation module 270 is stored in the secure element 201 of the client 150 (step 315 ), so that the client 150 completes the binding of the digital certificate.

To sum up, it can be seen that the difference between the present invention and the prior art is that the client obtains the authentication private key corresponding to the selected digital certificate according to the inputted biometrics, and uses the authentication private key to generate the authentication data, and then transmits the authentication The data is sent to the identity authentication server, so that the identity authentication server uses the authentication public key corresponding to the authentication private key to verify the authentication data, and selects whether to use the technical means of signing the authentication private key according to the verification result. Solve the problem that the public key infrastructure in the prior art may not be secure enough to protect the private key with a password, and then achieve the technical effect of using digital certificates on the FIDO framework.

Furthermore, the method of using the authentication mechanism of online rapid authentication to enable digital certificates of the present invention can be implemented in hardware, software, or a combination of hardware and software, and can also be implemented in a centralized manner in a computer system or distributed with different components. Implemented in a decentralized manner across several interconnected computer systems.

Although the embodiments disclosed in the present invention are as above, the above-mentioned contents are not intended to directly limit the scope of the patent protection of the present invention. Any person with ordinary knowledge in the technical field to which the present invention pertains, without departing from the spirit and scope disclosed by the present invention, makes slight modifications to the form and details of the implementation of the present invention, all belong to the patent protection of the present invention scope. The scope of patent protection of the present invention shall still be defined by the appended patent application scope.

110: Authentication Server 120: Credential Management Server 130:Certificate Verification Server 150: Client 201: Secure Elements 205: Browse Components 210: Input module 220:Data Access Module 230: Data processing module 240: Communication module 250: Job Processing Module 270:Key Generation Module Step 301: The client generates a key pair Step 305: The client generates a service request including the certificate signing request and authentication information and sends the service request to the authentication server Step 311: The identity authentication server sends the certificate signing request to the certificate management server and transmits the digital certificate returned by the certificate management server to the client Step 315: The client stores the authentication private key and digital certificate Step 320: The client selects a digital certificate Step 330: Client inputs biometrics Step 350: The client uses the biometric feature to obtain the authentication private key Step 360: The client generates authentication data using the authentication private key, and sends the authentication data to the identity authentication server Step 370: The identity authentication server verifies the authentication data using the authentication public key to generate a verification result, and transmits the verification result to the client Step 380: The client selects whether to use the authentication private key to sign according to the verification result

FIG. 1 is a system architecture diagram for enabling digital certificates by the authentication mechanism of online fast authentication proposed by the present invention. FIG. 2 is a schematic diagram of the components of the client for enabling digital certificate by the authentication mechanism of online fast authentication proposed by the present invention. FIG. 3A is a flow chart of a method for enabling a digital certificate with an authentication mechanism of online quick authentication proposed by the present invention. FIG. 3B is a flowchart of a method for applying for a digital certificate using the authentication mechanism of online quick authentication proposed by the present invention.

Step 320: The client selects a digital certificate

Step 330: Client inputs biometrics

Step 350: The client uses the biometric feature to obtain the authentication private key

Step 360: The client generates authentication data using the authentication private key, and sends the authentication data to the identity authentication server

Step 370: The identity authentication server verifies the authentication data using the authentication public key to generate a verification result, and transmits the verification result to the client

Step 380: The client selects whether to use the authentication private key to sign according to the verification result

Claims (10)

A system for enabling digital certificates with an authentication mechanism of online rapid authentication, the system at least includes: an identity authentication server; and A client, which further includes: an input module for inputting a biometric feature and for selecting a digital certificate, the digital certificate corresponds to a key pair, and the key pair includes an authentication public key and an authentication private key; a data access module for obtaining the authentication private key using the biometric feature; a data processing module for generating a verification data by using the verification private key; a communication module for sending the verification data to the identity authentication server, so that the identity authentication server uses the authentication public key to verify the verification data to generate a corresponding verification result, and to receive the verification result; and A job processing module is used for signing with the authentication private key when the authentication result indicates that the authentication data has passed the authentication. As claimed in claim 1, the system for enabling digital certificates with an authentication mechanism of online fast authentication, wherein the data access module is further used to verify the biometric feature, and after the biometric feature is verified, read from the secure element The authentication private key. As described in claim 1, the system for enabling digital certificates with an authentication mechanism of online fast authentication, wherein the data processing module is further configured to request a confirmation data from the identity authentication server through the communication module, and use the authentication private key to sign the verification data to generate the verification data. As claimed in claim 1, the system for enabling digital certificates with an authentication mechanism of online fast authentication, wherein the system further comprises a certificate verification server for receiving the verification data sent by the identity verification server, and according to the verification The data is used to generate the verification result and to transmit the verification result to the identity authentication server. As claimed in claim 1, the system for enabling digital certificates with an authentication mechanism of online fast authentication, wherein the client further comprises a key generation module for generating the key pair, and the data processing module for generating A service request including a certificate signing request and an authentication information, the communication module is further configured to transmit the service request to the identity authentication server, and the identity authentication server is further used to transmit the certificate signing request to a certificate management server The device applies for the digital certificate and transmits the digital certificate to the client, and the data access module is further used for storing the authentication key and the digital certificate to the secure element. A method for enabling digital certificates with an authentication mechanism of online fast authentication, the method at least comprises the following steps: A client selects a digital certificate, the digital certificate corresponds to a key pair, and the key pair includes an authentication public key and an authentication private key; The client inputs a biometric feature, and uses the biometric feature to obtain the authentication private key; The client uses the authentication private key to generate authentication data, and transmits the authentication data to an identity authentication server; The identity authentication server verifies the authentication data using the authentication public key to generate a corresponding authentication result, and transmits the authentication result to the client; and When the verification result indicates that the verification data is verified, the client uses the verification private key to sign. The method for enabling a digital certificate with an authentication mechanism of online rapid authentication as described in claim 6, wherein the client uses the biometric feature to read the authentication private key, further comprising the client verifying the biometric feature, and displaying the biometric feature in the After the biometrics are authenticated, the authentication private key is read from the secure element. The method for enabling a digital certificate with an authentication mechanism of online fast authentication as described in claim 6, wherein the step of the client using the authentication private key to generate the authentication data is that the client uses the authentication private key pair to report to the identity authentication server The verification data requested by the device is signed to generate the verification data. The method for enabling a digital certificate with an authentication mechanism of online fast authentication as described in claim 6, wherein the identity authentication server uses the authentication public key to verify the authentication data to generate the corresponding authentication result. The server sends the verification data to a certificate verification server, so that the certificate verification server generates the verification result, and receives the verification result returned by the certificate verification server. The method for enabling a digital certificate with an authentication mechanism of online fast authentication as described in claim 6, wherein the method further includes the client generating the key pair before the client selects the digital certificate, and generating a key pair including a A certificate signing request and a service request for authentication information, and sending the service request to the identity authentication server, so that the identity authentication server sends the certificate signing request to a certificate management server to apply for the digital certificate and send the digital certificate The steps to send to the client.

Images