TWI698766B - Three-party verification and one-time authentication method based on information security - Google Patents

Abstract

The present invention is a three-party authentication based on information security and its one-time authentication method. It mainly combines the operating system of a computer device and the password information of the boot firmware, and stores it in a mobile device, which would otherwise require two manual input The authentication process for logging in to the computer device with a password is simplified to obtain the relevant information of the operating system and the boot firmware through the personal mobile device, and automatically enter the boot firmware and the required account password of the operating system directly; Three-way authentication is completed between the mobile device, the boot firmware of the computer device, and the operating system of the computer device, so that the user can log in the boot firmware and the operating system without a password, so as to improve the convenience and security of use.

Description

Three-party verification based on information security and its one-time verification method

The present invention relates to a verification method based on information security, in particular to a three-party verification based on information security applied between a mobile device and a computer device and a one-time authentication method thereof.

With the progress of the times, current users generally consider personal information security when using personal computer devices. Therefore, the boot firmware of the personal computer device is usually set with a password, and the operation of the personal computer device On the system, another person’s password is also added to log in to a person’s account. The user uses multiple passwords to protect the use safety of personal computer devices and the information security in the operating system. However, the multiple passwords in the prior art Security control, in fact, in use will bring some other troubles to the user, for example: when the user forgets the password, other actions in order to retrieve the password are relatively more troublesome; another example is that the user uses personal When a computer device is used, the password must be entered once from the keyboard of the personal computer device.

According to the above-mentioned prior art, in order to improve information security when using a personal computer device, a user sets multiple passwords on the boot firmware and operating system, which increases the security control but adds more trouble to the user. At the same time as information security, it can also improve the convenience of users. It is indeed necessary to propose a better solution.

In view of the above-mentioned shortcomings of the prior art, the main purpose of the present invention is to provide a three-party verification based on information security and its one-time authentication method, which uses personal mobile devices to log personal security data and verify the legitimacy of the user, so that the personal computer device No need to enter the password of the boot firmware to boot, and allow the operating system of the computer device to directly log in to the designated personal account without a password to enhance the convenience and security.

The main technical means adopted to achieve the above purpose is to make the aforementioned three-party authentication method based on information security operate between a personal mobile device and a computer device, the personal mobile device installs and executes an application, and the computer device has A boot firmware and an operating system. The method includes the following steps: establishing a pairing between the operating system and the personal mobile device to obtain a device information, an authentication data and an automatic login account, and store it in the boot firmware; The boot firmware is paired with the personal mobile device to perform a user authentication, and after the authentication is completed, the device information and the automatic login account are stored in the operating system; and the operating system uses the device information, the The automatic login account directly obtains the password of a response account from the personal mobile device to automatically log in to the operating system.

According to the above method, three-way authentication is completed between the personal mobile device, the boot firmware of the computer device, and the operating system of the computer device, so that users can log in to the boot firmware and the operating system without a password, thereby improving the convenience of use Both have the purpose of safety.

Another main technical means adopted to achieve the above-mentioned purpose is to make the aforementioned one-time authentication method based on information security-based three-party verification, which operates between a personal mobile device and a computer device, and the personal mobile device installs and executes an application. , And the computer device has a boot firmware and an operating system. The method includes the following steps: a pairing is established between the operating system and the personal mobile device to obtain device information, authentication data and an automatic login account, and store them in The boot firmware; the boot firmware is paired with the personal mobile device to perform a user authentication, and after the authentication is completed, a direct login command, the automatic login account and the corresponding automatic login password are stored in the The operating system; and the operating system directly performs automatic login based on the automatic login account and the automatic login password.

According to the above method, three-way authentication is completed between the personal mobile device, the boot firmware of the computer device, and the operating system of the computer device, and finally the operating system directly uses the automatic login account and the automatic login password, The login action can be performed to enable the user to log in the boot firmware and the operating system without a password, so as to achieve the purpose of enhancing the convenience of use and security.

10: Personal mobile device

20: Boot firmware for computer devices

30: Operating system of computer device

Fig. 1 is a flowchart of a three-party verification method according to a preferred embodiment of the present invention.

FIG. 2 is a flowchart of the boot firmware write login command of the three-party verification method according to a preferred embodiment of the present invention.

FIG. 3 is a flow chart of the communication between the boot firmware and the device of the three-party authentication method according to a preferred embodiment of the present invention.

FIG. 4 is a communication flow chart of the operating system and the device of the three-party verification method according to a preferred embodiment of the present invention.

FIG. 5 is a flowchart of the boot firmware startup of the three-party verification method according to a preferred embodiment of the present invention.

Fig. 6 is a flow chart of operating system startup of a three-party verification method according to a preferred embodiment of the present invention.

FIG. 7 is a flowchart of unpairing the device and the operating system of the three-party authentication method according to a preferred embodiment of the present invention.

Fig. 8 is a flow chart of a three-party verification one-time authentication method according to a preferred embodiment of the present invention.

FIG. 9 is a flow chart of the boot firmware write login command of the one-time authentication method of three-party verification according to a preferred embodiment of the present invention.

FIG. 10 is a flow chart of the communication between the boot firmware and the device of the one-time authentication method for three-party verification according to a preferred embodiment of the present invention.

FIG. 11 is a flow chart of writing login data into the operating system of the one-time authentication method for three-party verification according to a preferred embodiment of the present invention.

FIG. 12 is a flowchart of booting firmware of a one-time authentication method for three-party verification according to a preferred embodiment of the present invention.

FIG. 13 is a flow chart of operating system startup of a one-time authentication method for three-party verification according to a preferred embodiment of the present invention.

FIG. 14 is a flow chart of unpairing the boot firmware and the operating system of the one-time authentication method for three-party verification according to a preferred embodiment of the present invention.

Regarding the first preferred embodiment of the present invention, it mainly provides a three-party authentication method based on information security. Please refer to FIG. 1, which includes a personal mobile device 10 (such as a smart phone) and a computer device (such as a personal computer). , Notebook computer), the personal mobile device 10 installs and executes an application, the computer device has a boot firmware 20, an operating system 30; in the preferred embodiment, the personal mobile device 10 can be connected via a wireless The communication protocol is connected to the computer device, and the wireless communication protocol includes a Bluetooth communication protocol; in the preferred embodiment, the Bluetooth communication protocol is a BLE (Bluetooth Low Energy) Bluetooth protocol, and the BLE Bluetooth protocol belongs to Bluetooth 4.0 The core technology, Bluetooth 4.0 specifications include traditional Bluetooth technology (such as Bluetooth 2.1+EDR), Bluetooth 3.0 high-speed technology (Bluetooth 3.0+High Speed) and the latest Bluetooth low energy (Bluetooth Low Energy) technology three categories, and among them Low power consumption technology is the biggest advantage of Bluetooth 4.0, so it is suitable for personal mobile devices 10.

As shown in FIG. 1, the method is mainly operated between the user's personal mobile device 10, the boot firmware 20 of the computer device, and the operating system 30 of the computer device to form a three-party authentication method based on information security. The method includes the following steps: establishing a pairing between the operating system 30 and the personal mobile device 10 to obtain a device information, an authentication data, and an automatic login account (S11), and store it in the boot firmware 20 (S12); The boot firmware 20 and the personal mobile device 10 are paired and a user authentication is performed (S13), and after the authentication is completed, the device information and the automatic login account are stored in the operating system 30 (S14); and The operating system 30 uses the device information and the automatic login account to directly obtain a password of a response account from the personal mobile device 10 to automatically log in to the operating system 30 (S15).

Three-way authentication is completed between the personal mobile device 10, the boot firmware 20 of the computer device, and the operating system 30 of the computer device, so that users can log in the boot firmware 20 and the operating system 30 without a password, which can achieve improved usage Convenience and safety.

Further, when the above steps are executed to "the operating system 30 and the personal mobile device 10 establish a pairing to obtain a device information, an authentication data and an automatic login account (S11), and store it in the boot firmware 20 (S12 )" step, as shown in Figure 1, the method further includes the following steps: the operating system 30 uses the Bluetooth protocol to search for the personal mobile device 10, pair it with it, and request the user to enter a password for the login account. In the preferred embodiment, the user can first select a login account, and the user enters the password of the login account; the personal mobile device 10 stores the login account and password, and responds to the status and secure authentication data To the operating system 30; written by the operating system 30 "the device information of the paired personal mobile device 10 and the secure authentication data, the secure authentication data of the operating system 30, and the automatic login account of the operating system 30 "To a shared memory, which can be read by the boot firmware 20.

Further, when the above steps are performed to "pairing of the boot firmware 20 and the personal mobile device 10 and performing a user authentication (S13), and after the authentication is completed, the device information and the automatic login account are stored in The steps of the operating system 30 (S14)" are shown in Fig. 1. The method further includes the following steps: When the boot firmware 20 executes a reboot, it reads the shared memory to retrieve the paired personal mobile device 10 and secure authentication data, and uses the Bluetooth protocol to search for the personal mobile device 10 and connect to it And request the personal mobile device 10 to perform the user authentication; the user uses a password/screen lock/fingerprint/iris recognition/face recognition through the application program of the personal mobile device 10 to complete the user authentication, and then The personal mobile device 10 responds to the boot firmware 20; when the boot firmware 20 receives the authentication completion response status, it writes "the device information of the paired personal mobile device 10 and the operating system 30 Automatic login account" to the shared memory, and can be read by the operating system 30.

It must be noted that the personal mobile device 10 (such as a smart phone or tablet computer) carries a large amount of personal privacy data, so the device manufacturer has set up a variety of user authentication mechanisms to open the mobile device or application (APP). Common security verifications such as passwords/screen locks, or biometrics such as fingerprints/eyes and iris/face recognition, so the ever-changing user verification methods are more secure user verification to ensure that the personal mobile device 10 The personal privacy information of will not be revealed by others.

Further, when the above steps are executed to the step of "the operating system 30 uses the device information and the automatic login account to directly obtain the password of a response account from the personal mobile device 10 to automatically log in to the operating system 30 (S15)" As shown in FIG. 1, the method further includes the following steps: when the operating system 30 executes an operating system restart, the operating system 30 reads the shared memory and takes out the paired personal mobile device 10 Information and the automatic login account, and use the Bluetooth protocol to search for the personal mobile device 10, connect with it and ask for the password of the login account; when the personal mobile device 10 receives the inquiry from the operating system 30, it immediately responds The password of the login account, the operating system 30 automatically logs in the account in the operating system 30 according to the password of the login account.

In this preferred embodiment, in order to explain how the boot firmware 20 writes the operating system 30 direct login command to the shared memory, please refer to FIG. 2 where, when the above steps are executed to "and in the authentication After completion, save the device information and the automatic login account in the operating system 30 (S14)", the method further includes the following steps: generate a random AES Key from the boot firmware 20, and take out the operating system One of 30 RSA Public Key is encrypted into another random AES Key, and the other random AES Key is used to encrypt the direct login command data of the operating system 30, and then write the encrypted AES Key and AES Key to encrypt the The direct login command data of the operating system 30; the operating system 30 reads the RSA-encrypted AES Key and the AES Key encrypted direct login command data of the operating system 30 from the shared memory, and uses one of the operating system 30 itself The RSA Private Key decrypts the AES Key, and uses the decrypted AES Key to decrypt the direct login command data of the operating system 30.

In this preferred embodiment, in order to illustrate the communication between the boot firmware 20 and the personal mobile device 10, please refer to FIG. 3, in which, when the above steps are executed to "the boot firmware 20 and the personal mobile device The mobile device 10 performs the steps of pairing and performing a user authentication (S13). The method further includes the following steps: generate a random AES Key from the boot firmware 20, and take out a designated RSA of the personal mobile device 10 The Public Key is encrypted into another random AES Key, and the other random AES Key is used to encrypt the command data asking for the password of the boot firmware 20, connect the designated personal mobile device 10 through the Bluetooth protocol, and Send an encrypted AES Key and an encrypted command data for asking the firmware password; when the personal mobile device 10 receives the data sent by the boot firmware 20, it uses its own RSA Private Key to decrypt the AES Key, and decrypt it After decrypting the AES Key, ask for the command information of the firmware password Data, find the password data of the paired boot firmware 20 and encrypt it with AES Key, send the encrypted boot firmware 20 password data through the Bluetooth protocol; the boot firmware 20 uses the AES Key to decrypt the boot firmware 20 password data and continue Turn on.

In this preferred embodiment, in order to illustrate the communication between the operating system 30 and the personal mobile device 10, please refer to FIG. 4, where the above steps are executed to "the operating system 30 uses the device information, The automatic login account directly obtains the password of a response account from the personal mobile device 10 to automatically log in to the operating system 30 (S15). The method further includes the following steps: the operating system 30 generates a random AES Key , Take out the designated RSA Public Key of the personal mobile device 10 and encrypt the random AES Key, use the random AES Key to encrypt the command data that asks the designated user account password, connect the designated personal mobile device 10 through the Bluetooth protocol and Send the encrypted AES Key and the command data to ask the specified user account password; when the personal mobile device 10 receives the data sent by the operating system 30, it uses its own RSA Private Key to decrypt the AES Key, and the decrypted AES Key to decrypt the query Specify the command data of the user account password, search for the password data of the matched specified user account and encrypt it with AES Key, and transmit the encrypted password data of the specified user account through the Bluetooth protocol; the operating system 30 uses AES Key to decrypt the specified Password information of the user account and log in to the user account.

In the present preferred embodiment, in order to illustrate the related process of the boot firmware 20 activation, please refer to FIG. 5, wherein, when the above steps are executed to "the boot firmware 20 is paired with the personal mobile device 10 And execute a user authentication (S13)" step, the method further includes the following steps: when the boot firmware 20 executes a restart boot, the boot firmware 20 checks whether the shared memory has paired data; If yes, scan the paired personal mobile device 10 through the Bluetooth protocol and connect; the boot firmware 20 generates a random AES Key and encrypts the AES Key with the RSA Public Key of the personal mobile device 10, and encrypts the login with the AES Key The data is sent to the personal mobile device 10; the personal mobile device 10 uses its own RSA Private Key to decrypt the AES Key; the personal mobile device 10 uses the decrypted AES Key to decrypt the login data and requires user authentication (fingerprint/face recognition/ Password), and the boot firmware 20 determines whether it is a legitimate user of the personal mobile device 10; if so, the personal mobile device 10 uses AES Key to encrypt the password of the boot firmware 20 and transmits it through the Bluetooth protocol connection To the boot firmware 20, the boot firmware 20 uses AES Key to decrypt the password of the boot firmware 20, and the boot firmware 20 verifies whether the password is correct; if so, the boot firmware 20 uses the operating system 30 The RSA Public Key encrypts the AES Key and encrypts the login account data with the AES Key. The boot firmware 20 writes the encrypted data into the shared memory, and the boot firmware 20 continues to boot.

Further, when the above steps are executed to the step of "check whether the shared memory has paired data by the boot firmware 20", if not, the boot firmware 20 will ask for the user password, and the boot firmware 20 20 Verify that the password is correct; if it is, continue to execute "Starting from the boot firmware 20 to continue booting".

Further, when the above steps are performed to the step of "determining whether the personal mobile device 10 is a legitimate user by the boot firmware 20", if not, the personal mobile device 10 uses the AES Key to encrypt the user authentication failure message And use the Bluetooth protocol connection to send a message to the boot firmware 20, the boot firmware 20 asks for the user password, and the boot firmware 20 verifies whether the password is correct; if so, continue to execute "from the boot firmware 20 Continue to boot".

Further, when the above steps are performed to the step of "the boot firmware 20 uses AES Key to decrypt the password of the boot firmware 20, and the boot firmware 20 verifies whether the password is correct", if If not, the boot firmware 20 will ask the user for the password, and the boot firmware 20 will verify whether the password is correct; if it is, then continue to execute "booting from the boot firmware 20".

In this preferred embodiment, in order to illustrate the related process of the operating system 30 activation, please refer to FIG. 6, where the above steps are executed to "the operating system 30 uses the device information and the automatic login account directly Obtain a password of a response account from the personal mobile device 10 to automatically log in to the operating system 30 (S15)", as shown in FIG. 6, the method further includes the following steps: when the operating system 30 starts to execute the operating system Restart and start a built-in unlocking application. The unlocking application checks whether the boot firmware 20 has a command to log in directly. If so, the unlocking application reads the shared memory and decrypts the AES with its own RSA Private Key Key, and use AES Key to decrypt the login account data; the operating system 30 determines whether the decryption is successful, if so, determines whether the account specified by the boot firmware 20 exists, and if so, determines the personal action after the Bluetooth protocol scan is paired Whether the device 10 is connected successfully; if it is, the unlocking application generates a random AES Key and encrypts the login account data with the RSA Public Key of the personal mobile device 10. The unlocking application connects the encrypted AES through the Bluetooth protocol connection The Key and the login information encrypted by AESKey are sent to the personal mobile device 10. The personal mobile device 10 uses RSA Private Key to decrypt the AES Key and uses the AES Key to decrypt the login account data, and the personal mobile device 10 checks whether the account exists; if so; , The personal mobile device 10 uses AES Key to encrypt the password of the login account, and transmits it to the unlocking application through the Bluetooth protocol connection. When the unlocking application verifies that the password is correct, the unlocking application is allowed to log in to the account.

Further, when the above steps are executed to the step of "the unlocked application checks whether the boot firmware 20 has a command to log in directly", the step of "determining whether the decryption is successful by the operating system 30", and the step of "determining whether the boot firmware 20 is specified "Does your account exist", "Determine the Bluetooth protocol Scan the paired personal mobile device 10 and whether the connection is successful" step, "check whether the account exists by the personal mobile device 10", if not, return to the login screen of the operating system 30.

In this preferred embodiment, a process for unpairing the personal mobile device 10 and the operating system 30 is further provided. Please refer to FIG. 7. The method further includes the following steps: unlocking an application program of the operating system 30, The personal mobile device 10 unpaired; and the pairing record of the personal mobile device 10 in the shared memory is deleted.

Regarding the second preferred embodiment of the present invention, it mainly provides a one-time authentication method based on information security three-party verification. The technical content of this preferred embodiment is roughly the same as that of the previous embodiment. Part of the process is slightly different. Please refer to FIG. 8. The method includes the following steps: the operating system 30 establishes a pairing with the personal mobile device 10 to obtain device information, authentication data and an automatic login account (S81), And stored in the boot firmware 20 (S82); the boot firmware 20 is paired with the personal mobile device 10 and a user authentication is performed (S83), and after the authentication is completed, a direct login command, the automatic The login account and the corresponding automatic login password are stored in the operating system 30 (S84); and the operating system 30 directly performs automatic login according to the automatic login account and the automatic login password (S85).

Three-way authentication is completed between the personal mobile device 10, the computer device’s boot firmware 20, and the computer device’s operating system 30, and finally the operating system 30 directly uses the automatic login account and the automatic login password to The login action can be performed to enable the user to log in the boot firmware 20 and the operating system 30 without a password, which can achieve the effect of improving the convenience of use and security.

Further, when the above steps are executed to "the operating system 30 establishes a pairing with the personal mobile device 10 to obtain a device information, an authentication data and an automatic login account (S81), And stored in the boot firmware 20 (S82)", as shown in FIG. 8, the method further includes the following steps: the operating system 30 uses the Bluetooth protocol to search for the personal mobile device 10, pair with it and request to use The user enters a password for a login account. In this preferred embodiment, the user can first click on a login account, and the user enters the password for the login account; the personal mobile device 10 will have the login account and password Store and respond with the status and security authentication data to the operating system 30; the operating system 30 writes "the device information of the paired personal mobile device 10 and the secure authentication data, and the secure authentication of the operating system 30 The data and the automatic login account of the operating system 30" are stored in a shared memory and can be read by the boot firmware 20.

Further, when the above steps are executed to "pairing of the boot firmware 20 and the personal mobile device 10 and performing a user authentication (S83), and after the authentication is completed, a direct login command, the automatic login account and Corresponding to the step of storing an automatic login password in the operating system 30 (S84)", as shown in FIG. 8, the method further includes the following steps: when the boot firmware 20 executes a reboot, read the shared memory Body, to retrieve the paired personal mobile device 10 and secure authentication data, and use the Bluetooth protocol to search for the personal mobile device 10, connect to it, request the personal mobile device 10 to perform the user authentication, and send the designated The password for the login account of the operating system 30; the user uses a password/screen lock/fingerprint/iris recognition/face recognition through the application of the personal mobile device 10 to complete the authentication of the user, and then the personal mobile device 10 Response status to the boot firmware 20 and the password of the specified login account of the operating system 30; when the boot firmware 20 receives the response status of the authentication completion and the password of the login account, it will write "Direct login command and the operation The account and password automatically logged in by the system 30 are stored in the shared memory and can be read by the operating system 30.

Further, when the above steps are executed to the step of "automatic login by the operating system 30 directly according to the automatic login account and the automatic login password (S85)", as shown in FIG. 8, the method further includes the following steps: When the operating system 30 executes the operating system restart, the operating system 30 reads the shared memory and retrieves the account and password for direct login, so that the operating system 30 automatically logs in to the account.

In the present preferred embodiment, based on security considerations, after the operating system 30 automatically logs in to the account, the operating system 30 further clears the shared memory and the direct login command and the operating system 30 automatically Login account and password.

In this preferred embodiment, in order to explain how the boot firmware 20 writes the operating system 30 direct login command to the shared memory, please refer to FIG. 9 where, when the above steps are executed to "and in the authentication After completion, store a direct login command, the automatic login account and the corresponding automatic login password in the operating system 30 (S84). The method further includes the following steps: generate a random random command from the boot firmware 20 Take out one of the RSA Public Keys of the operating system 30 and encrypt it into another random AES Key, and use the other random AES Key to encrypt the direct login command data of the operating system 30 and the operating system 30 directly The login account and password data are written into the encrypted AES Key and AES Key to encrypt the direct login command data of the operating system 30 and the direct login account and password data of the operating system 30; the operating system 30 will share The memory reads the RSA-encrypted AES Key and the direct login command data of the operating system 30 after being encrypted with the AES Key, and the account and password data of the operating system 30 directly logged in, and decrypts using an RSA Private Key of the operating system 30 itself The AES Key uses the decrypted AES Key to decrypt the direct login command data of the operating system 30 and the direct login account and password data of the operating system 30.

In this preferred embodiment, in order to illustrate the communication between the boot firmware 20 and the personal mobile device 10, please refer to FIG. 10, in which, when the above steps are executed to "from the boot firmware 20 Pairing with the personal mobile device 10 and performing a user authentication (S83)", the method further includes the following steps: generate a random AES Key from the boot firmware 20, and take out the designated personal mobile device 10 One RSA Public Key is encrypted into another random AES Key, and the other random AES Key is used to encrypt the command data that asks the password of the boot firmware 20 and the account and password of the operating system 30 to log in directly. Connect to the personal mobile device 10 specified by the Bluetooth protocol, and send an encrypted AES Key and an encrypted command data asking for the firmware password and the account and password for direct login to the operating system; when the personal mobile device 10 receives The data sent by the boot firmware 20 is decrypted using its own RSA Private Key to decrypt the AES Key, and the decrypted AES Key is used to decrypt the command data that asks for the firmware password 20 and the account and password directly logged in to the operating system 30 to find the paired boot The password of the firmware 20 and the password of the operating system 30 direct login account are encrypted with AES Key, and the encrypted boot firmware 20 password and the password data of the operating system 30 direct login account are transmitted through the Bluetooth protocol; the boot firmware 20 Use AES Key to decrypt the boot firmware 20 password and the password data of the operating system direct login account, and continue to boot.

In the present preferred embodiment, in order to illustrate the process of the operating system 30 writing login data to the shared memory, please refer to FIG. 11, where the above steps are performed to "the operating system 30 and the individual The mobile device 10 establishes a pairing to obtain a device information, an authentication data, and an automatic login account (S81), and store it in the boot firmware 20 (S82). The method further includes the following steps: from the operating system 30 Generate a random AES Key, take out an RSA Public Key of the operating system 30 and encrypt it into another random AES Key, and use the other random AES Key to encrypt the operating system 30 login account, and then write the encryption The following AES Key and AES Key encrypt the operating system 30 login account; The bootable firmware 20 reads the RSA-encrypted AES Key and the AES Key from the shared memory after encryption, the operating system 30 logs in to the account, uses an RSA Private Key of the operating system 30 to decrypt the AES Key, and decrypts it The subsequent AES Key decrypts the login account of the operating system 30.

In this preferred embodiment, in order to illustrate the related process of the boot firmware 20 activation, please refer to FIG. 12, wherein, when the above steps are executed to "the boot firmware 20 is paired with the personal mobile device 10 And the step of executing a user authentication (S83)", the method further includes the following steps: when the boot firmware 20 executes a restart boot, the boot firmware 20 checks whether the shared memory has matched data; if so , Scan the paired personal mobile device 10 through the Bluetooth protocol and connect; the boot firmware 20 generates a random AES Key and encrypts the AES Key with the RSA Public Key of the personal mobile device 10, and encrypts the login data with the AES Key Send to the personal mobile device 10; the personal mobile device 10 uses its own RSA Private Key to decrypt the AES Key; the personal mobile device 10 uses the decrypted AES Key to decrypt the login data and request user authentication (fingerprint/face recognition/password ), and the boot firmware 20 determines whether it is a legal user of the personal mobile device 10; if so, the personal mobile device 10 uses AES Key to encrypt a user authentication failure message, and uses the Bluetooth protocol connection to send the message To the boot firmware 20; and the personal mobile device 10 uses AES Key to encrypt the password of the boot firmware 20 and the password of the designated login account, and send it to the boot firmware 20 through the Bluetooth protocol connection, and then the boot The firmware 20 verifies whether the password is correct; if so, the boot firmware 20 uses the RSA Public Key of the operating system 30 to encrypt the AES Key and encrypts the login account and password data with the AES Key. The boot firmware 20 will encrypt the data Write to the shared memory, and then the boot firmware 20 continues to perform booting.

Further, when the above steps are executed to the step of "check whether the shared memory has paired data by the boot firmware 20", if not, the boot firmware 20 will ask for the user password, And the boot firmware 20 verifies whether the password is correct; if it is, then continue to execute "the boot firmware 20 continues booting".

Further, when the above steps are performed to the step of "determining whether the personal mobile device 10 is a legitimate user by the boot firmware 20", if not, the personal mobile device 10 uses AES Key to encrypt the user authentication failure Message, and use the Bluetooth protocol connection to send a message to the boot firmware 20, the boot firmware 20 asks for the user password, and the boot firmware 20 verifies whether the password is correct; if so, continue to execute "from the boot firmware Body 20 continues to perform booting".

Further, when the above steps are executed to the step of "the boot firmware 20 uses AES Key to decrypt the password of the boot firmware 20, and the boot firmware 20 verifies whether the password is correct", if not, the boot firmware 20 20 Ask the user for the password, and verify whether the password is correct by the boot firmware 20; if it is, continue to execute "Boot by the boot firmware 20".

In this preferred embodiment, in order to explain the related process of the operating system 30 activation, please refer to FIG. 13, where, when the above steps are executed to "the operating system 30 directly based on the automatic login account, the automatic login Password, perform automatic login (S85)" step, as shown in Figure 13, the method further includes the following steps: when the operating system 30 starts to execute the operating system restart, and a built-in unlocking application is activated, judge The unlocking application checks whether the boot firmware 20 has a command to log in directly. If so, the unlocking application reads the shared memory and decrypts the AES Key with its own RSA Private Key, and decrypts the login account data with the AES Key; by the operating system 30 judge whether the decryption is successful, if yes, judge whether the account specified by the boot firmware 20 exists; if yes, the operating system 30 uses the decrypted user account and password to log in to the operating system 30, and judge whether the login is successful; If yes, end this process.

Further, when the above steps are performed to the step of "determine whether the unlocked application checks whether the boot firmware 20 has a command to log in directly", "the operating system 30 determines whether the decryption is successful" If not, the steps of “determining whether the account specified by the boot firmware 20 exists”, the step of “determining whether the login is successful”, if not, all return to the login screen of the operating system 30.

In the present preferred embodiment, a process for unpairing the boot firmware 20 and the operating system 30 is further provided. Please refer to FIG. 14. The method further includes the following steps: unlocking an application program of the operating system 30, Unpair; and delete the pairing record of the shared memory.

Through the above-mentioned preferred embodiments, the present invention solves the current personal computer user’s consideration of personal information security by setting up multiple passwords to protect the boot firmware 20 and operating system 30, and the multiple security controls cause the user’s Trouble, inconvenience and trouble. Therefore, the present invention uses the personal mobile device 10 to log in personal security data and verify the user's legitimacy, so that the boot firmware 20 and operating system 30 of the personal computer device are not required to enter a password, and they are directly booted to log in. Therefore, the present invention does have both convenience and safety.

10‧‧‧Personal mobile device

20‧‧‧Boot firmware for computer devices

30‧‧‧Operating system of computer device

Claims (6)

A three-party authentication method based on information security is operated between a personal mobile device and a computer device. The personal mobile device installs and executes an application program, and the computer device has a boot firmware and an operating system. The method includes The following steps: establish a pairing between the operating system and the personal mobile device to obtain a device information, an authentication data and an automatic login account, and store it in the boot firmware; the boot firmware is paired with the personal mobile device Perform a user authentication, and after the authentication is completed, store the device information and the automatic login account in the operating system; and the operating system uses the device information and the automatic login account to directly obtain a response from the personal mobile device The password of the account to automatically log in to the operating system; when the above steps are executed to "the operating system and the personal mobile device are paired to obtain a device information, an authentication data and an automatic login account, and store it in the boot firmware The method further includes the following steps: the operating system searches for the personal mobile device, matches it with it, and requires the user to enter a password for a login account; the personal mobile device stores the login account and password, and responds Status and security authentication data to the operating system; the operating system writes "the paired device information and the secure authentication data, the operating system’s secure authentication data and the operating system’s automatic login account" into a shared Memory, and for the boot firmware to read; when the above steps are executed to "pair the boot firmware with the personal mobile device and perform a user authentication, and after the authentication is completed, the device information, the automatic The login account is stored in the operating system. The method further includes the following steps: When the boot firmware executes a reboot, it reads the shared memory to retrieve the paired personal mobile device and secure authentication data, searches for the personal mobile device, connects to it, and requests the personal mobile device to perform The user authentication; the user passes the personal mobile device to complete the authentication user, and then the personal mobile device responds to the boot firmware; when the boot firmware receives the authentication completion response status, write " The matched device information and the automatic login account of the operating system" are stored in the shared memory and read by the operating system. For the information security-based three-party authentication method described in claim 1, when the above steps are executed to "the operating system uses the device information and the automatic login account to directly obtain a response account password from the personal mobile device to automatically log in The operating system" step, the method further includes the following steps: when the operating system restarts the operating system, the operating system reads the shared memory, and retrieves the paired device information and the automatic login account, and Search for the personal mobile device, connect to it, and ask for the password of the login account; when the personal mobile device receives the query from the operating system, it immediately responds to the password of a login account. The operating system will respond to the password of the login account, Automatically log in to the account in the operating system. The three-party authentication method based on information security as described in claim 2 further provides a process of unpairing. The method further includes the following steps: unlocking the application from the operating system, unpairing the personal mobile device; and deleting The pairing record of the personal mobile device of the shared memory. A one-time authentication method based on information security for three-party verification, which operates between a personal mobile device and a computer device. The personal mobile device installs and executes an application program, and the computer device has a boot firmware and an operating system , The method includes the following steps: The operating system is paired with the personal mobile device to obtain a device information, an authentication data, and an automatic login account, and stored in the boot firmware; the boot firmware and the personal mobile device are paired and executed User authentication, and after the authentication is completed, a direct login command, the automatic login account, and the corresponding automatic login password are stored in the operating system; and the operating system directly performs operations based on the automatic login account and the automatic login password. Automatic login; when the above steps are performed to the step of "establishing a pairing between the operating system and the personal mobile device to obtain a device information, an authentication data, and an automatic login account, and store it in the boot firmware", the method further includes The following steps: the operating system searches for the personal mobile device, matches it with it, and requires the user to enter a password for a login account; the personal mobile device stores the login account and password, and responds with status and security authentication data to the Operating system; the operating system writes "the paired device information and the secure authentication data, the secure authentication data of the operating system and the automatic login account of the operating system" to a shared memory, and the boot firmware Body reading; when the above steps are performed to "pairing the boot firmware with the personal mobile device and performing a user authentication, and after the authentication is completed, a direct login command, the automatic login account and the corresponding automatic The step of storing the login password in the operating system", the method further includes the following steps: when the boot firmware executes a reboot, read the shared memory to retrieve the paired personal mobile device and secure authentication data , And search for the personal mobile device, connect to it, request the personal mobile device to authenticate the user, and send the password specifying the operating system login account; The user passes the personal mobile device to complete the authentication user, and then the personal mobile device responds to the boot firmware and the password of the specified login account of the operating system; when the boot firmware receives the authentication completion response status and The password of the login account is written into the shared memory for the command to log in directly and the account and password for automatic login of the operating system for the operating system to read. For the one-time authentication method based on information security-based three-party authentication as described in claim 4, when the above steps are executed to the step of "automatic login by the operating system directly based on the automatic login account and the automatic login password", the method It further includes the following steps: when the operating system executes the operating system restart, the operating system reads the shared memory, and retrieves the account and password for direct login, so that the operating system automatically logs in to the account. According to claim 5, the one-time authentication method based on information security-based three-party verification further provides a process of unpairing. The method further includes the following steps: unlocking an application of the operating system, unpairing; and deleting the Matching records of shared memory.

Images