TW202240438A - System, device and method for checking password incorrect times through server to complete corresponding operation - Google Patents

Abstract

A system, a device and a method for checking password incorrect times through a server to complete a corresponding operation are provided. By determining a password transmitted from a client passes validation by the server, generating an error message based on an incorrect times of inputting password when the password is not passed validation, and performing an operation in correspondence with the error message, the system and the method can manage re-try times of password effectively, and can achieve the effect of improving security of using certificate.

Description

System, device and method for checking the number of wrong passwords by the server to complete the operation

A system, device and method for judging the number of wrong passwords, especially a system, device and method for checking the number of wrong passwords by a server to complete operations.

Electronic credentials, also known as digital credentials, are an identification mechanism used in computer systems. An electronic certificate is a computer file or a group of files, which record the owner's identity information and a set of public keys. The owner of the electronic certificate can authenticate his identity to the computer system to access or use a specific computer service.

The public key contained in the digital certificate will correspond to a private key. Generally speaking, the digital certificate and the corresponding private key will be recorded in the certificate file in a certain format, and the certificate file containing the digital certificate and the private key usually needs to be encrypted before it can be stored in the computer system . That is to say, the certificate file must be decrypted with the certificate password first, and then the digital certificate and/or private key can be obtained from the certificate file according to the format of the certificate file.

However, at present, some applications that use digital certificates may not set the number of times to enter the certificate password. That is to say, after obtaining the certificate file containing other people's digital certificates, you can keep trying to open the certificate file with different strings. until the credential password is guessed. In fact, although there are applications that limit the number of password input times, these applications only record the current number of errors on the local side. Those who are interested can back up the file that records the number of errors before starting to try the password. After the number of errors reaches a certain value, the backup file will be overwritten, so that the data recorded on the local side can be easily changed so that the application program cannot know the number of password attempts of the credential file.

To sum up, it can be seen that there has been a problem that the credential password can be tried continuously in the prior art for a long time, so it is necessary to propose an improved technical means to solve this problem.

In view of the problem that the certificate password can be tried continuously in the prior art, the present invention discloses a system, device and method for continuing to operate by checking the number of password errors by the server, wherein:

The system disclosed in the present invention, which checks the number of password errors by the server to complete the operation, at least includes: a client, used to obtain login information, the login information includes account information and certificate password; a service server, used to receive the login information, And when it is judged that the certificate password has not passed the verification, the number of errors is accumulated, and the corresponding error message is generated according to the number of errors, and the error message is sent to the client, so that the client executes the operation corresponding to the error message, and used to judge the certificate password When the verification is passed, a permission message is generated and sent to the client. After receiving the permission message, the client uses the certificate password to decrypt the certificate file to obtain the certificate data, and uses the certificate data to execute the target operation.

The device disclosed by the present invention for checking the number of wrong passwords by the server to complete the operation at least includes: an input module for obtaining login data including account information and certificate password; a communication module for sending the login data to the service server , and used to receive the error message or permission message returned by the service server; the certificate module is used to decrypt the certificate file using the certificate password to obtain the certificate data when the communication module receives the permission message; the execution module is used to When the communication module receives an error message, execute the operation corresponding to the error message, and use the certificate data to execute the target operation.

The method disclosed by the present invention for checking the number of password errors by the server to complete the operation, the steps at least include: the client obtains the login data, and sends the login data to the service server, the login data includes account information and certificate password; the service server When the server judges that the certificate password has not passed the verification, it accumulates the number of errors, generates a corresponding error message according to the number of errors, and sends the error message to the client, so that the client executes the operation corresponding to the error message; the service server judges that the certificate password passes During verification, a permission message is generated and sent to the client. After receiving the permission message, the client uses the certificate password to decrypt the certificate file to obtain the certificate data, and uses the certificate data to execute the target operation.

The system, device and method disclosed in the present invention are as above, and the difference between the present invention and the prior art is that the present invention transmits the certificate password to the service server through the client, and the service server judges whether the certificate password has passed the verification, and can The corresponding error message is generated by the number of errors, so that the client performs corresponding operations according to the error message, so as to solve the problems existing in the prior art, and achieve the technical effect of improving the security of using digital certificates.

The features and implementation methods of the present invention will be described in detail below in conjunction with the drawings and embodiments, the content is enough to enable anyone familiar with the relevant art to easily and fully understand the technical means used to solve the technical problems of the present invention and implement them accordingly, thereby realizing The effect that the present invention can achieve.

In the present invention, after the user enters the certificate password, the service server can generate a corresponding permission message or error message according to whether the certificate password is correct, and the client can choose to use the certificate password to decrypt the certificate file when the service server returns the permission message. And when the service server returns an error message, it can prompt the user to re-enter the certificate password or refuse to serve the user.

The system operation of the present invention will be described below with "Fig. 1", a system architecture diagram of the present invention that checks the number of password errors to complete the operation. As shown in "FIG. 1", the system of the present invention includes a client 110, a service server 120, and an optional certificate server 140. Wherein, the client 110 and the service server 120 can be connected through a wired or wireless network, so as to transmit data or signals to each other.

The client 110 is responsible for sending the login data to the service server 120, and executes corresponding operations according to the message returned by the service server. In some embodiments, the client 110 may further include an input module 111 , a credential module 112 , a communication module 114 , an execution module 115 , and an additional computing module 113 .

The input module 111 can select the digital certificate to be used, is also responsible for obtaining the login information, and is responsible for sending the obtained login information to the service server 120 . In general, the input module 111 can display a user interface for inputting login information. The login information obtained by the input module 111 includes account information and certificate password. Wherein, the account information includes but not limited to the ID card number and/or the account number pre-registered on the service server 120 .

The certificate module 112 can generate a key pair (in the present invention, public key and private key are used to represent the two keys included in the key pair), and can generate a certificate signing request (Certificate Signing Request) containing the public key. , CSR).

The credential module 112 can also use a predetermined format to generate a credential file containing the digital certificate corresponding to the credential signing request received by the communication module 114 and the generated private key. Generally speaking, when the credential module 112 generates the credential file, it will encrypt the content of the credential file with the credential password in the login data obtained by the input module 111, that is, the client 110 can combine the content of the credential file in a predetermined format Encrypt the data of the digital certificate and the private key to generate a certificate file. Wherein, the aforementioned predetermined format is a file format for recording digital certificates and private keys, such as PFX, PEM file format, etc., but the present invention is not limited thereto.

The certificate module 112 is also responsible for decrypting the corresponding certificate file generated by using the certificate password in the login data obtained by the input module 111 when the communication module 114 receives the permission message, and can obtain the certificate after decrypting the certificate file material. It should be noted that the certificate file may include a digital certificate and a private key corresponding to the digital certificate (the included public key), and the certificate module 112 may obtain the certificate data from the digital certificate. Among them, the certificate data is usually one or more data included in the digital certificate, such as certificate owner identification data (including but not limited to ID card number, passport number, etc.), certificate serial number, certificate validity period, etc., but the present invention does not As a limit, for example, the certificate data can also be all the data included in the digital certificate (that is, the certificate data can be a digital certificate).

The credential module 112 can also delete the credential when the error message received by the communication module 114 indicates that the credential is revoked. For example, the credential module 112 can delete the credential file selected by the input module 111. The deletion information can be obtained from and the certificate file corresponding to the deletion information can be deleted. The deletion information can include the storage path and file name of the certificate file, or the certificate serial number of the digital certificate contained in the certificate file, etc., which is enough to make the execution model Group 115 identifies the data of the credential file that needs to be deleted, but the invention is not limited thereto.

In some embodiments, the certificate module 112 can perform the certificate revocation operation in addition to the certificate deletion operation. More specifically, the certificate module 112 can generate and send a certificate revocation request to the certificate server 140 through the communication module 114 , so as to complete the certificate revocation operation. Wherein, the certificate revocation request includes information sufficient for the certificate server 140 to identify the digital certificate that needs to be deleted, such as the certificate serial number of the digital certificate, but the present invention is not limited thereto.

The computing module 113 can generate verification data according to the credential password in the login data obtained by the input module 111 . In more detail, the operation module 113 can use the complete or partial certificate password as the verification data, or perform specific operations on the certificate password to generate the verification data. Among them, the specific operation is an operation that can generate a one-to-one operation value with the certificate password and cannot be deduced from the operation value, such as a hash operation, or an operation that rearranges the positions of the bits contained in the certificate password , but the present invention is not limited thereto.

The communication module 114 can send the certificate signing request generated by the certificate module 112 to the certificate server 140, so as to apply for a digital certificate from the certificate server 140, for example, the communication module 114 can directly send the certificate signing request to the certificate server 140 , may also send the certificate signing request to the service server 120 , so as to indirectly send the certificate signing request to the certificate server 140 through the service server 120 .

The communication module 114 can also receive the digital certificate generated by the certificate server 140 . Generally speaking, the communication module 114 can receive the digital certificate in the same way as sending the certificate signing request to the certificate server 140. For example, the communication module 114 can directly receive the digital certificate sent back by the certificate server 140, or can pass The service server 120 receives the digital certificate sent back by the certificate server 140 , that is, receives the digital certificate forwarded by the service server 120 .

The communication module 114 can also send the account data in the login data obtained by the input module 111 and the certificate data obtained by the certificate module 112 from the digital certificate received by the communication module 114 to the service server 120 . In some embodiments, the communication module 114 can also transmit the verification data generated by the computing module 113 together with account data and certificate data to the service server 120 .

The communication module 114 is also responsible for receiving permission messages and error messages sent by the service server 120 . In some embodiments, the communication module 114 can also receive the security code sent by the service server 120 .

The communication module 114 can also transmit the account data obtained by the input module 111 , the certificate data obtained by the certificate module 112 , and the signature value generated by the execution module 115 to the service server 120 .

The communication module 114 can also receive related data sent by the service server 120 . The associated data mentioned in the present invention is data that can represent the identity of the owner of the account data input by the input module 111, including but not limited to the identity identification data of the owner of the account data (including but not limited to ID number, passport number etc.) or the certificate serial number of the digital certificate used by the owner of the account data to the service server 120, but the present invention is not limited thereto. Generally speaking, the associated information is provided when the owner of the account information registers the account information on the service server 120 .

The execution module 115 is responsible for using the voucher data extracted from the voucher file by the voucher module 112 to complete the corresponding target operation. The target operation performed by the execution module 115 usually includes a signature, such as logging into the service server 120 or trading with the service server 120, etc. In more detail, when the target operation is to log into the service server 120, the execution module 115 can use The certificate module 112 decrypts the private key obtained from the certificate file to generate a signature value, so that the communication module 114 can send the account data, certificate data and signature value to the service server 120 to log into the service server 120 . Wherein, the execution module 115 can use the private key obtained by the certificate module 112 to sign the account data and/or the certificate data to generate a signature value, and can also use the private key to sign the specific data contained in the license message to generate a signature value. And when the target operation is to trade with the service server 120, the client 110 can use the private key to sign the transaction data to generate a signature value, and can use the transaction data, digital certificate (or certificate data), and signature value Send to the service server 120, so as to complete the transaction with the service server 120.

The execution module 115 can also use the secure password received by the communication module 114 to encrypt the credential file generated by the credential module 112 to generate a secondary encrypted credential file (also represented by "encrypted file" in the present invention), Make the encrypted file replace the credential file; the execution module 115 can also use the security password to decrypt the generated encrypted file when the communication module 114 receives the permission message, so as to restore the encrypted file to a credential file that can be decrypted using the credential password. If the permission message includes a replacement password in addition to the security password, the execution module 115 can also use the replacement password as a new security password after the certificate module 112 decrypts the certificate file, and use the replacement password to encrypt the certificate file again. Generate an encrypted file that replaces the credential file.

The execution module 115 is also responsible for executing the operation corresponding to the error message when the communication module 114 receives the error message. For example, when the error message indicates that the password is wrong, the execution module 115 can perform a prompt operation. More specifically, the execution module 115 can generate a prompt message and display the prompt message to prompt the user to input the login information again, but the present invention does not This is the limit. Wherein, the prompt message may correspond to the error message and/or may include all or part of the content contained in the error message. For example, the prompt message may include the number of password errors recorded in the error message.

The execution module 115 can also determine whether the credential data obtained by the credential module 112 after decrypting the credential file is consistent with the associated data received by the communication module 114 . For example, when the associated data includes identification data and/or certificate serial number, the execution module 115 can determine whether the owner's ID number/certificate serial number in the certificate data is consistent with the ID number and/or certificate number included in the associated data. The serial numbers are the same.

The service server 120 is responsible for judging whether the certificate password obtained by the client 110 has passed the verification, and is responsible for accumulating the number of errors when the certificate password has not passed the verification, and is responsible for generating a corresponding result message based on whether the certificate password has passed the verification and the accumulated number of errors . Wherein, the service server 120 may further include a transmission module 121 , a processing module 122 , and a login module 123 .

The transmission module 121 is responsible for receiving the login information obtained by the client 110 , and is also responsible for receiving the account information, credential information and/or verification information obtained by the client 110 . The transmission module 121 is also responsible for transmitting error messages or permission messages generated by the processing module 122 to the client 110 .

The transmission module 121 can also receive the certificate signing request generated by the client 110, and can forward the received certificate signing request to the certificate server 140, and can receive the digital certificate returned by the certificate server 140, and can The received digital certificate is forwarded to the client 110 . The transmission module 121 can also transmit the certificate revocation request generated by the processing module 122 to the certificate server 140 to complete the certificate revocation operation.

The transmission module 121 can also transmit the security password generated by the processing module 122 to the client 110 . Generally speaking, the transmission module 121 can transmit the security password to the client 110 when transmitting the digital certificate received from the certificate server 140 , but the present invention is not limited thereto.

The processing module 122 can store the account data, certificate data and verification data received by the transmission module 121 as a record, or obtain the certificate data from the digital certificate received by the transmission module 121, and transfer the data to the transmission module 121 The received account information, verification information and obtained certificate information are stored as a record. In some embodiments, if the verification data received by the transmission module 121 is not generated by specific operations performed by the client 110, but is a complete or partial certificate password, the processing module 122 can perform specific operations on the verification data, And use the data generated by the calculation as the new verification data.

The processing module 122 is also responsible for judging whether the credential password received by the transmission module 121 passes the verification. Generally speaking, the processing module 122 can read the corresponding verification information according to the account information received by the transmission module 121, and can perform specific operations on the certificate password to generate corresponding operation values, and can compare the generated The calculated value and the verification data read out. When the calculated value is the same as the verification data, the processing module 122 can determine that the certificate password has passed the verification, and when the calculated value is different from the verification data, the processing module 122 can judge that the certificate password has not passed the verification.

The processing module 122 is also responsible for accumulating the number of errors corresponding to the account information received by the transmission module 121 when it is judged that the credential password received by the transmission module 121 has not passed the verification, and is responsible for generating an error corresponding to the accumulated number of errors. error message for . More specifically, the processing module 122 can determine whether the accumulated error times reach a predetermined threshold. If the accumulated number of errors does not reach the threshold value, the processing module 122 can generate an error message indicating that the password is wrong, and if the number of errors reaches the threshold value, the processing module 122 can generate an error message indicating that the certificate is revoked, and can generate a certificate Revocation request for credential revocation. In some embodiments, the error message may include an error count.

The processing module 122 is also responsible for generating a permission message when judging that the certificate password received by the transmission module 121 is verified. The processing module 122 can read the corresponding security password from the pre-stored record according to the account data received by the transmission module 121, and can generate a permission message including the read security password when generating the permission message. In some embodiments, the processing module 122 can generate a new security password (also referred to as a "replacement password" in the present invention) when reading the security password, and transfer it to the pre-stored record. The security password corresponding to the account information received by the module 121 is updated to a replacement password, and a permission message including the read security password and the newly generated replacement password can also be generated.

The processing module 122 can also read out the corresponding credential data from the pre-stored record according to the account data in the login data received by the transmission module 121, and can use the read credential data as associated data, and generate License message containing associated data. In some embodiments, the processing module 122 can add the related data to the SESSION connected with the client 110, so that the transmission module 121 can send the related data to the client when sending the permission message to the client 110 terminal 110.

The login module 123 can use the account information and credential information received by the transmission module 121 to select whether to allow the login to the client 110 . For example, the login module 123 may allow the client 110 to log into the service server 120 when it is judged that the received account data and certificate data have been logged in, that is, when there is a piece of data including the account data and certificate data; the login module 123 It is also possible to refuse (not allow) the client 110 to log in to the service server 120 when it is determined that the received account information and credential data have not been registered or there is no corresponding account data and credential data.

The login module 123 can also select whether to allow the client 110 to log in to the service server 120 according to the account information, certificate information and signature value received by the transmission module 121 . In more detail, when the login module 123 judges that the account data and certificate data have been logged in, it can also obtain the public key contained in the corresponding digital certificate according to the certificate data, and use the public key to verify the signature value. The login module 123 allows the client 110 to log in to the service server 120 if the signature value is verified; and if the signature value is not verified, the login module 123 does not allow the client 110 to log in to the service server 120 .

The certificate server 140 can receive the certificate signing request sent by the client 110 or the service server 120, and can transmit the digital certificate corresponding to the received certificate signing request to the client 110 or the service server that issued the certificate signing request 120.

The certificate server 140 can be a certificate signing server (CA). At this time, the certificate server 140 can generate a corresponding digital certificate according to the received certificate signing request; the certificate server 140 can also be a certificate registration server (RA) In this way, the certificate server 140 may transmit the received certificate signing request to the certificate signing server and receive the digital certificate returned by the certificate signing server.

The certificate server 140 can also receive the certificate revocation request sent by the client 110 or the service server 120, and can cancel the digital certificate indicated by the certificate revocation request.

Next, an embodiment is used to illustrate the operating system and method of the present invention, and please refer to "Fig. 2A" for the flow chart of the method for checking the number of password errors by the server to complete the operation proposed by the present invention. In this embodiment, it is assumed that the service server 120 is a financial service server, but the present invention is not limited thereto.

First, if the user does not have a digital certificate, the user can operate the client 110 to apply for the user's digital certificate from the certificate server 140 . In this embodiment, assuming the process shown in "Figure 2B", the user can operate the client 110 to connect to the service server 120, and after the client 110 is connected to the service server 120, the user can operate the client The terminal 110 applies for a digital certificate. In this way, the input module 111 of the client 110 can provide an input interface for the user to input account information and certificate password (login information), and the computing module 113 of the client 110 can generate the input module 111. The hash value of the certificate password, the certificate module 112 of the client 110 can generate a key pair including the public key and the private key, and use the public key to generate a certificate signing request, and the communication module 114 of the client 110 can send The account data input by the input module 111, the hash value of the certificate password generated by the operation module 113 and the certificate signing request generated by the certificate module 112 are sent to the service server 120, so as to send the certificate server to the certificate server through the service server 120 140 Apply for a digital certificate (step 201).

After the transmission module 121 of the service server 120 receives the account information, the hash value of the certificate password and the certificate signing request transmitted by the client 110, it can forward the received certificate signing request to the certificate server 140, so that the certificate The server 140 issues a digital certificate according to the certificate signing request, and the transmission module 121 can receive the digital certificate of the client 110 sent back by the certificate server 140, and then, the processing module 122 of the service server 120 can be transmitted by the transmission module 121 The voucher information is extracted from the received digital voucher (step 205), such as the voucher serial number.

Next, the processing module 122 of the service server 120 can store the account data received by the transmission module 121 of the service server 120, the hash value of the certificate password, and the serial number of the certificate taken out as a record, and the service server The transmission module 121 of 120 can transmit the digital certificate received from the certificate server 140 back to the client 110 (step 207 ).

After the communication module 114 of the client 110 receives the digital certificate sent by the service server 120, the certificate module 112 of the client 110 can pair the digital certificate received by the communication module 114 with the generated key The private key is encrypted with the certificate password input by the input module 111 of the client 110, so as to generate a certificate file including the digital certificate and the private key and store the generated certificate file.

Returning to "Fig. 2A", when the user of the client 110 needs to log in to the service server 120 to use the services provided by the service server 120, the input module 111 of the client 110 can be obtained through the provided user interface. The communication module 114 of the client 110 can transmit the login information obtained by the input module 111 to the service server 120 for the login information including the account information and the certificate password input by the user (step 220 ).

After the transmission module 121 of the service server 120 receives the login data sent by the client 110, the processing module 122 of the service server 120 can determine whether the certificate password contained in the login data received by the transmission module 121 is passed. Verify (step 230). In this embodiment, it is assumed that the processing module 122 can read and transmit the account information received by the module 121 from the record stored in the process of applying for a digital certificate from the client 110 through the service server 120 to the certificate server 140 The hash value (verification data) of the corresponding certificate password, and the hash operation can be performed on the certificate password to generate the corresponding calculation value, and the generated calculation value can be compared with the verification data read, and can be based on the calculation Whether the value is the same as the verification data determines whether the credential password is verified.

If the processing module 122 of the service server 120 judges that the certificate password received by the transmission module 121 of the service server 120 has not passed the verification, then as shown in the flow of "Fig. 2C", the processing module 122 can accumulate and The number of errors corresponding to the account data received by the transmission module 121 (step 241), and can further determine whether the accumulated number of errors reaches the threshold (step 243), if not, the processing module 122 can generate a message indicating that the password is wrong error message, and the transmission module 121 can transmit the error message generated by the processing module 122 to the client 110 (step 245), so that after the communication module 114 of the client 110 receives the error message, the execution of the client 110 The module 115 can prompt the user to re-enter the login information according to the error message received by the communication module 114, and the communication module 114 can also send the login information re-entered by the user to the service server 120 (step 220); if so, That is, when the number of errors corresponding to the account information received by the transmission module 121 of the service server 120 reaches the threshold value, the processing module 122 of the service server 120 can generate an error message indicating that the certificate is revoked, and the transmission module 121 can Send the error message generated by the processing module 122 to the client 110 (step 247). The relevant information included in the error message received by the module 114 deletes the certificate file containing the corresponding digital certificate (step 295 ). Wherein, the processing module 122 of the service server 120 can read out the certificate serial number (certificate data) corresponding to the account data received by the transmission module 121 from the pre-established record, and can generate The error message of the serial number enables the certificate module 112 of the client 110 to find the certificate file containing the digital certificate corresponding to the certificate serial number in the error message, and delete the found certificate file.

Returning to "Fig. 2A" again, when the processing module 122 of the service server 120 judges whether the certificate password included in the login data has passed the verification (step 230), if the processing module 122 of the service server 120 judges that the service server If the credential password received by the transmission module 121 of 120 is verified, the processing module 122 can generate a permission message, and the transmission module 121 can send the permission message generated by the processing module 122 back to the client 110 (step 250 ).

After the communication module 114 of the client 110 receives the permission message sent by the service server 120 , the credential module 112 of the client 110 can use the credential password in the obtained login data to obtain credential data (step 270 ). In this embodiment, it is assumed that the certificate module 112 can use the certificate password to decrypt the certificate file, and take out the digital certificate in the certificate file, and take out the certificate serial number from the digital certificate as the certificate data.

After the credential module 112 of the client 110 obtains the credential data, the communication module 114 of the client 110 can use the credential data obtained by the credential module 112 and the account number in the login data obtained by the input module 111 of the client 110 The data is sent to the service server 120, so as to log into the service server 120 (step 290). In this embodiment, it is assumed that after the transmission module 121 of the service server 120 receives the account data and certificate data, the login module 123 of the service server 120 can use the account data and certificate data received by the transmission module 121 Whether it has been logged in selects whether to allow the client 110 to log in to the service server 120 . For example, when there is a piece of registration information including account information and certificate information, the login module 123 can allow the client 110 to log in to the service server 120;

In this way, through the present invention, the service server 120 can judge whether the certificate password input by the user of the client 110 is correct, and accumulate the number of errors when the certificate password is wrong, so that it is possible to choose whether to continue to accept according to the accumulated number of errors of the service server. The user enters the credential password.

In the above-mentioned embodiment, as shown in the flow of "Figure 2D", after the transmission module 121 of the service server 120 receives the digital certificate returned by the certificate server 140 (step 205), the service server 120 The processing module 122 of the service server 120 can generate a security password, for example, the processing module 122 can use the Advanced Encryption Standard (Advanced Encryption Standard, AES) to generate a security password, and the transmission module 121 of the service server 120 can generate the security password generated by the processing module 122 The security password of is sent to the client 110 together with the digital certificate received from the certificate server 140 (step 209 ).

After the communication module 114 of the client 110 receives the digital certificate and security password sent by the service server 120, the certificate module 112 of the client 110 can use the digital certificate and the private key in the generated key pair as The credential password is encrypted using Advanced Encryption Standard to generate a credential file. Next, the execution module 115 of the client 110 can use the secure password received by the communication module 114 to encrypt the credential file to generate an encrypted file (step 210 ). , the execution module 115 of the client 110 can also store the security password.

In this way, after the processing module 122 of the service server 120 determines that the certificate password in the login data received by the transmission module 121 of the service server 120 has passed the verification (step 230), the processing module 122 of the service server 120 generates When sending a permission message to the client 110 (step 250), the processing module 122 can also read the security password corresponding to the account data in the login data from the pre-established record (step 253) and generate a password containing the read security password. password, and the transmission module 121 of the service server 120 may also transmit the permission message including the security password to the client 110 (step 255 ).

After the communication module 114 of the client 110 receives the permission message sent by the service server 120, the execution module 115 of the client 110 can use the security code in the permission message received by the communication module 114 to decrypt the previously generated Then, the certificate module 112 of the client 110 can use the certificate password to decrypt the certificate file restored by the execution module 115 to obtain the certificate data (step 270 ).

Furthermore, when the processing module 122 of the service server 120 generates a permission message to the client 110 (step 250), the processing module 122 can read the account data corresponding to the login data from the pre-established record. secure password (step 253) and generate a substitute password, and replace the secure password corresponding to the account information in the login data in the pre-established record with the substitute password, so that the substitute password becomes a new secure password, and then, the processing module 122 can A permission message containing the original security code and the newly generated replacement code is generated (step 255). In this way, the transmission module 121 of the service server 120 transmits the license message generated by the processing module 122 to the client 110, so that the communication module 114 of the client 110 receives the license message sent by the service server 120 , the execution module 115 of the client 110 can use the original security password in the permission message received by the communication module 114 to decrypt the previously generated encrypted file to restore the certificate file (step 260), the certificate module of the client 110 112 may use the certificate password to decrypt the certificate file restored by the execution module 115 to obtain the certificate data (step 270 ). After the certificate module 112 obtains the certificate data, the execution module 115 can use the substitution password in the permission message to encrypt the certificate file again to generate a new encrypted file. Different security passwords can be changed to avoid the possibility of the security password being stolen, and further improve the security of the credential file.

In addition, in the above-mentioned embodiment, after the processing module 122 of the service server 120 judges that the certificate password contained in the login data received by the transmission module 121 of the service server 120 has passed the verification (step 230), the processing module 122 When generating and sending the permission message to the client 110 (step 250), as shown in the flow of "FIG. 2E", the processing module 122 can read the account data corresponding to the login data from the pre-stored records. Credential data, such as the ID card number of the owner of the account data or the certificate serial number used by the owner of the account data, etc., and the read certificate data can be used as associated data (step 251), and the transmission module 121 can send The associated data is sent to the client 110 together with the permission message (step 259). Wherein, the processing module 122 can add the relevant data into the SESSION connected with the client 110, so that the transmission module 121 transmits the relevant data together with the permission message to the client 110 in the form of SESSION when transmitting the permission message.

In this way, the communication module 114 of the client 110 receives the permission message and related data sent by the service server 120, and the credential module 112 of the client 110 uses the login data obtained by the input module 111 of the client 110 After obtaining the credential data (step 270), the execution module 115 of the client 110 can judge whether the credential data obtained by the credential module 112 is consistent with the associated data received by the communication module 114 (step 280), for example Determine whether the owner's ID number/certificate serial number in the certificate data is the same as the corresponding data in the associated data. If not, the execution module 115 can generate and display an error message indicating that the identity verification failed (step 285) to prompt the user of the client 110, and if the execution module 115 judges that the credential data is consistent with the associated data, the client 110 The communication module 114 can send the account data in the certificate data obtained by the certificate module 112 and the login data obtained by the input module 111 of the client 110 to the service server 120, so as to log in to the service server 120 (step 290 ).

To sum up, it can be seen that the difference between the present invention and the prior art lies in that the certificate password is transmitted to the service server through the client, and the service server judges whether the certificate password has passed the verification, and can generate corresponding information based on the number of errors in the certificate password. The error message is a technical means that enables the client to execute the corresponding operation according to the error message. This technical means can solve the problem that the certificate password in the previous technology can be tried continuously, and then achieve the technical effect of improving the security of using digital certificates. .

Furthermore, the method of the present invention to complete the operation by checking the number of password errors by the server can be implemented in hardware, software, or a combination of hardware and software, and can also be implemented in a computer system in a centralized manner or with different components A decentralized implementation spread across several interconnected computer systems.

Although the embodiments disclosed in the present invention are as above, the content described is not intended to directly limit the scope of protection of the present invention. Anyone with ordinary knowledge in the technical field of the present invention, without departing from the spirit and scope disclosed in the present invention, makes some changes and modifications to the form and details of the implementation of the present invention, all of which belong to the patent protection of the present invention scope. The scope of patent protection of the present invention shall still be defined by the scope of the attached patent application.

110: client 111: Input module 112: Credential module 113: Operation module 114: Communication module 115:Execution module 120: service server 121: Transmission module 122: Processing module 123: Login module 140: Credential Server Step 201: The client applies for a digital certificate to the certificate server Step 205: The service server receives the digital certificate generated by the certificate server, and takes out the certificate data from the digital certificate Step 207: The service server sends the digital certificate to the client Step 209: The service server generates a security password and sends the security password to the client Step 210: The client encrypts the credential file with a secure password to generate an encrypted file Step 220: The client obtains and sends the account information and certificate password to the service server Step 230: the service server judges whether the certificate password is verified Step 240: The service server accumulates the number of errors, generates an error message according to the number of errors, and sends the error message to the client Step 241: Serving server accumulative error times Step 243: the service server determines whether the number of errors exceeds the threshold Step 245: The service server generates an error message indicating that the password is wrong, and sends the error message to the client Step 247: The service server generates and sends an error message indicating revoked certificate to the client Step 250: The service server generates and sends a permission message to the client Step 251: the service server reads the associated data Step 253: The service server reads the security code Step 255: The service server generates a permission message including a security password, and sends the permission message to the client Step 259: The service server sends the permission message and associated data to the client Step 260: The client uses the secure password to decrypt the encrypted file to restore the credential file Step 270: The client uses the certificate password to decrypt the certificate file to obtain the certificate data Step 280: The client judges whether the credential information matches the associated information Step 285: The client generates and displays an error message indicating identity verification failure Step 290: the client executes the target operation according to the credential data Step 295: The client deletes the certificate file containing the corresponding digital certificate according to the error message

Figure 1 is a structural diagram of the system proposed by the present invention to check the number of wrong passwords by the server to continue the operation. FIG. 2A is a flow chart of the method for checking the number of wrong passwords by the server to complete the operation proposed by the present invention. FIG. 2B is a flow chart of the method for the service server of the present invention to obtain digital certificate-related information. FIG. 2C is a flow chart of the password error handling process proposed by the present invention. FIG. 2D is a flow chart of a method for encrypting and decrypting a credential file using a secure password according to the present invention. FIG. 2E is a flow chart of the method for confirming the user's identity using associated data proposed by the present invention.

Step 220: The client obtains and sends the account information and certificate password to the service server

Step 230: the service server judges whether the certificate password is verified

Step 240: The service server accumulates the number of errors, generates an error message according to the number of errors, and sends the error message to the client

Step 250: The service server generates and sends a permission message to the client

Step 270: The client uses the certificate password to decrypt the certificate file to obtain the certificate data

Step 290: Execute the target operation with the client credential data

Claims (10)

A method for completing an operation by checking the number of wrong passwords by a server, the method at least includes the following steps: A client obtains a login data and sends the login data to a service server, the login data includes an account information and a certificate password; When the service server judges that the certificate password has not passed the verification, it accumulates an error number, generates an error message corresponding to the error number, and sends the error message to the client, so that the client executes the error message. corresponding work; and When the service server determines that the certificate password is verified, it generates and sends a permission message to the client. After receiving the permission message, the client uses the certificate password to decrypt a certificate file to obtain a certificate data, and uses The credential data performs the target operation. The method for checking the number of password errors by the server to complete the operation as described in claim 1, wherein the step for the service server to generate the corresponding error message according to the number of errors is that the service server reaches one when the number of errors reaches one When the threshold value is reached, the error message indicating that the certificate is revoked is generated, and when the number of errors does not reach the threshold value, the error message indicating that the password is wrong is generated, and the client executes the operation corresponding to the error message as the basis for the client to indicate The error message of revoking the certificate deletes the certificate file containing the corresponding digital certificate, or displays an error message based on the error message indicating that the password is wrong. The method for checking the number of password errors by the server to complete the operation as described in claim 1, wherein the method further includes receiving a security password generated by the service server before the client obtains the login data, and use the security password to encrypt the certificate file to generate an encrypted file, and the method further includes the client using the permission message contained in the certificate file before the client uses the certificate password to decode the certificate file to obtain the certificate data. The step of decrypting the encrypted file with the security password to restore the certificate file. The method for checking the number of password errors by the server to complete the operation as described in claim 1, wherein the method further includes the client connecting to the service server before the client sends the login data to the service server. After a certificate server applies for a digital certificate, it generates the certificate file containing the digital certificate and transmits the relevant information of the digital certificate and the certificate password to the service server, or includes the client through the service server The server applies for the digital certificate to the certificate server, so that the service server obtains the relevant information of the digital certificate and the certificate password, and transmits the digital certificate to the client, and the client generates the certificate including the digital certificate File steps. The method for checking the number of password errors by the server to complete the operation as described in claim 1, wherein the step of the service server generating and sending the permission message to the client further includes the service server reading according to the account information The step of obtaining an associated data and sending the associated data to the client, and the method further includes the client judging the certificate before the client uses the certificate password to decrypt the certificate file to obtain the certificate data. Steps to check whether the data matches the associated data. A system that checks the number of wrong passwords by the server to complete the operation, the system includes at least: A client, used to obtain a login information, the login information includes an account information and a certificate password; and a service server, used to receive the login data, and when judging that the certificate password has not passed the verification, accumulate an error count, generate a corresponding error message according to the error count, and send the error message to the client, Make the client execute the operation corresponding to the error message, and when it is used to judge that the certificate password is verified, generate and send a permission message to the client, and the client uses the certificate password after receiving the permission message Decrypt a credential file to obtain credential data, and use the credential data to execute a target operation. The system for completing operations by checking the number of password errors by the server as described in claim 6, wherein the service server generates the error message indicating that the certificate is revoked when the number of errors reaches a threshold value, and when the number of errors reaches a threshold, If the error message indicating that the password is wrong is generated when the threshold is not reached, the client deletes the certificate file containing the corresponding digital certificate based on the error message indicating that the certificate is revoked, or displays an error message based on the error message indicating that the password is incorrect. As described in claim 6, the system for checking the number of password errors by the server to complete the operation, wherein the service server is further used to generate a security password, and send the security password to the client, and to generate the password including the The permission message of the security password, the client is further used to use the security password to encrypt the certificate file to generate the encrypted file, and when receiving the permission message, use the security password to decrypt the encrypted file to generate the certificate file . As described in claim 6, the system for completing operations by checking the number of incorrect passwords by the server, wherein the service server is further used to read a related data based on the account data, and send the permission message and the related data to The client, and the client is further used to determine that the credential data matches the associated data when receiving the permission message, and when the credential data matches the associated data, send the credential data and the account information to The service server. A device that checks the number of incorrect passwords by the server to complete the operation, the device at least includes: an input module to obtain a login data, the login data includes an account information and a certificate password; A communication module, used to send the login data to a service server, and to receive an error message or a permission message returned by the service server; a certificate module, used to use the certificate password to decrypt a certificate file to obtain a certificate data when the communication module receives the permission message; and An execution module, used for executing the operation corresponding to the error message when the communication module receives the error message, and for executing the target operation using the certificate data.

Images