TWI700643B - Multi-dimensional barcode mobile identity authentication method - Google Patents

Abstract

A multi-dimensional bar code mobile identity authentication method, which enables a digital certificate device to display a multi-dimensional bar code including a verification information and an identification information, the identification information is provided by a verification server, and the verification information is sent to the verification server The organization requests an authentication parameter and uses a key to code the authentication parameter. An inspection device scans the multi-dimensional bar code and sends a verification instruction containing the authentication parameter to the authentication server to confirm the authentication in the verification instruction. After the parameters are correct, use a key to code the authentication parameters to generate a confirmation code, and after confirming that the verification information in the verification command is the same as the confirmation code, use the stored identification information for the identification in the verification command The information is authenticated and an authentication result is returned to the inspection device.

Description

Multi-dimensional barcode mobile identity authentication method

The invention relates to an identity authentication method, in particular to a multi-dimensional barcode mobile identity authentication method.

In order to confirm their identity when doing certain things, people often have to provide an identity certificate. For example, they need to provide their identity documents when going to the bank to withdraw money, they need to show their passports when traveling abroad, they need to provide health insurance cards for medical treatment, and they need to be blocked when driving. Show a driving license, etc., so people always remember to carry a variety of different physical documents with them to prevent missing or missing a relevant document and failing to complete related matters. Therefore, if these physical certificates can be digitized and stored in a mobile device, such as a mobile phone, the above-mentioned problem of missing or missing physical certificates can be solved. In addition, when the physical certificate is digitized and stored in the mobile device, how the certificate inspection unit determines that the person who presents the digital certificate is the true holder of the certificate, so as to prevent the certificate from being improperly counterfeited or embezzled, it is the inspection unit that needs to actively study Subject.

Therefore, the purpose of the present invention is to provide a multi-dimensional barcode mobile identity authentication method that can verify the authenticity of digital certificates and their holders.

Therefore, the multidimensional barcode mobile identity authentication method of the present invention is applied to a digital certificate device, a verification device, and an authentication server that can communicate with the digital certificate device and the verification device, and includes the following steps: (A) the digital The credential device displays a multi-dimensional bar code, the multi-dimensional bar code includes a verification information and an identification information; (B) the verification device scans the multi-dimensional bar code, and generates a verification command based on the multi-dimensional bar code and sends it to the authentication server; (C) ) The authentication server obtains the verification information from the verification instruction, and after verifying that the verification information is correct, authenticates the identification information in the verification instruction; and (D) the authentication server returns the identification information A related certification result is given to the inspection device.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is a fixed multi-dimensional barcode provided by the authentication server and stored in a hardware security carrier of the digital certificate device.

In some embodiments of the present invention, in step (A), the multi-dimensional bar code is a fixed multi-dimensional bar code provided by the authentication server, and a part of the multi-dimensional bar code is stored in a hardware of the digital certificate device A part of the security vehicle is stored in the certification server or a cloud server. When the digital certificate device wants to display the multi-dimensional barcode, it connects with the certification server or the cloud server to obtain the part of the multi-dimensional barcode. And combined with the part of the multi-dimensional bar code stored in the hardware safety carrier to form the multi-dimensional bar code.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode It is a fixed multi-dimensional barcode provided by the authentication server, and the multi-dimensional barcode is divided into multiple files and stored in a hardware security carrier of the digital certificate device. When the digital certificate device wants to display the multi-dimensional barcode , Which reads the files from the hardware security vehicle and assembles the multi-dimensional barcode.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is a fixed multi-dimensional barcode provided by the authentication server, and the multi-dimensional barcode is divided into at least two files and stored in the digital In a storage unit of the credential device, and at least one of the files is encrypted and protected, when the digital credential device wants to display the multi-dimensional bar code, it reads the files and will be encrypted and protected according to the entered at least one password After decrypting the at least one file, the files are combined into the multi-dimensional barcode.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is an application program installed in the digital certificate device through an online application method, which is obtained from the authentication server through the digital certificate device. Multi-dimensional bar code, and the application program stores the multi-dimensional bar code in it or a storage unit of the digital certificate device in a software encryption manner.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is an application program installed in the digital certificate device through an online application method, which is obtained from the authentication server through the digital certificate device. Multi-dimensional bar code, and the application program stores a part of the multi-dimensional bar code in a storage unit of the digital certificate device and/or a part in the application program and a part in the authentication server When the digital certificate device wants to display the multi-dimensional barcode, the application connects to the authentication server or the cloud server through the digital certificate device to obtain the part of the multi-dimensional barcode, and then stores it And/or the part of the multi-dimensional barcode stored in the storage unit is combined to form the multi-dimensional barcode.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is an application program installed in the digital certificate device through an online application method, which is obtained from the authentication server through the digital certificate device. Multi-dimensional bar code, and the application program divides the multi-dimensional bar code into multiple files and stores them in a storage unit of the digital certificate device or in the application program. When the digital certificate device wants to display the multi-dimensional bar code, the application The program reads the files from it or from the storage unit and combines them into the multi-dimensional bar code; or the application program divides the multi-dimensional bar code into at least two files, encrypts and protects at least one of the files, and then the When files are stored in the storage unit of the digital certificate device or in the application program, when the digital certificate device wants to display the multi-dimensional barcode, the application program reads the files from it or from the storage unit, and according to The entered at least one password decrypts the at least one file that is encrypted and protected, so as to combine the files into the multi-dimensional barcode.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is dynamically generated by a hardware security vehicle of the digital certificate device, and the identification information is issued and stored in advance by the authentication server In the hardware security vehicle, or the identification information is provided to the digital certificate device by the authentication server in advance, and the digital The digital certificate device extracts the corresponding identification information according to a certificate option input and provides it to the hardware security carrier. When the digital certificate device wants to display the multi-dimensional barcode, the hardware security carrier requires a password to be entered and After verifying that the password is correct, the digital certificate device requests an authentication parameter from the authentication server, and the hardware security vehicle uses a key to code the authentication parameter to generate the authentication information, and according to the authentication information And the identification information and the authentication parameters to generate the multi-dimensional barcode.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is dynamically generated by an application program installed in the digital certificate device, and the identification information is issued in advance by the authentication server and stored in In the application, or the identification information is provided to the digital certificate device by the authentication server in advance, and the digital certificate device retrieves the corresponding identification information according to a certificate option entered and provides it to the application. When the digital certificate device wants to display the multi-dimensional barcode to execute the application, the application requires a password. After verifying that the password is correct, the application requests an authentication parameter from the authentication server through the digital certificate device, and A key is used to code the authentication parameter to generate the authentication information, and the multi-dimensional bar code is generated according to the authentication information, the identification information and the authentication parameter.

In some embodiments of the present invention, the authentication server includes a business platform storing the key and the authentication parameters, and an operating unit that issues the identification information, and in step (A), the digital certificate device The hardware security vehicle requires the authentication parameter from the business platform. In step (B), the verification instruction also includes the authentication parameter In step (C), after the business platform receives the verification instruction and compares the verification parameters in the verification instruction with the verification parameters stored in the business platform itself, the business platform uses the verification parameters stored in the business platform The key of its own code the authentication parameter to generate a confirmation code, and after confirming that the verification information in the verification command is the same as the generated confirmation code, send the identification information in the verification command to the operating unit , Enabling the operating unit to authenticate the identification information sent from the business platform with the identification information stored by itself.

In some embodiments of the present invention, the authentication server includes a business platform and an operating unit that stores the key and the authentication parameters and issues the identification information, and in step (A), the digital certificate device The hardware security vehicle requires the authentication parameter from the operating organization. In step (B), the verification instruction also includes the authentication parameter. In step (C), the business platform receives the verification instruction and transmits it to the The operating organization, after the operating organization compares the authentication parameter in the verification instruction with the authentication parameter stored in the operating organization itself, the operating organization uses the key stored in the operating organization to code the authentication parameter with A confirmation code is generated, and after confirming that the verification information in the verification instruction is the same as the generated verification code, the identification information in the verification instruction is verified with the identification information stored by itself.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is dynamically generated by a hardware security vehicle of the digital certificate device, and the identification information is issued and stored in advance by the authentication server In the hardware safety vehicle, or the knowledge The identification information is provided to the digital certificate device by the authentication server in advance, and the digital certificate device extracts the corresponding identification information according to a certificate option entered and provides it to the hardware security vehicle. When the digital certificate device requires When displaying the multi-dimensional bar code, the hardware security vehicle requires a password, and after verifying that the password is correct, the hardware security vehicle generates the multi-dimensional bar code according to the verification information and the identification information stored therein.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is dynamically generated by an application program installed in the digital certificate device, and the identification information is issued in advance by the authentication server and stored in In the application, or the identification information is provided to the digital certificate device by the authentication server in advance, and the digital certificate device retrieves the corresponding identification information according to a certificate option entered and provides it to the application. When the digital certificate device wants to display the multi-dimensional bar code, the application program requires a password, and after verifying that the password is correct, the application program generates the multi-dimensional bar code according to the verification information and the identification information stored therein.

In some embodiments of the present invention, the authentication server includes a business platform that stores the verification information and an operating unit that issues the identification information, and in step (C), the business platform receives the verification instruction and After verifying that the verification information in the verification command is the same as the verification information stored by itself, the identification information is sent to the operating unit, so that the operating unit uses the identification information stored by itself to send the identification to the business platform Information is certified.

In some embodiments of the present invention, the authentication server includes a business Business platform and an operating organization that stores the verification information and issued the identification information, and in step (C), the business platform receives the verification instruction and sends the verification instruction to the business organization, and the business organization verifies the verification After the verification information in the command is the same as the verification information stored by itself, the identification information in the verification command is authenticated with the identification information stored by itself.

In some embodiments of the present invention, in step (A), the multi-dimensional barcode is provided and dynamically generated by the authentication server, and the identification information is stored in the authentication server, or by the authentication server According to a credential option provided by the digital credential device, the identification information corresponding to the credential option is retrieved from multiple identification information. When the digital credential device wants to display the multi-dimensional bar code, it connects to the authentication server and requests the multi-dimensional bar code At this time, the authentication server generates the multi-dimensional barcode according to the verification information and the identification information stored therein, or retrieves the identification information corresponding to the certificate option according to the certificate option provided by the digital certificate device, and the authentication server The multi-dimensional bar code is generated according to the identification information and the stored verification information, and the multi-dimensional bar code is sent to the digital certificate device.

In some embodiments of the present invention, the authentication server includes a business platform and an operating unit, and in step (A), the multi-dimensional barcode is dynamically generated by the business platform, and the identification information is stored in the The operating organization, or the operating organization extracts the identification information corresponding to the identification option from multiple identification information based on the identification option provided by the digital identification device; when the digital identification device needs to display the multiple identification information When connecting to the business platform and requesting the multi-dimensional bar code, the business platform generates the multi-dimensional bar code based on the verification information stored therein and the identification information provided by the operating unit, and transmits the multi-dimensional bar code to the digital certificate Device, and in step (C), the business platform receives the verification instruction and after verifying that the verification information in the verification instruction is correct, transmits the identification information to the operating organization so that the operating organization uses the stored The identification information authenticates the identification information transmitted from the business platform.

In some embodiments of the present invention, the authentication server includes a business platform and an operating organization, and in step (A), the multi-dimensional barcode is dynamically generated by the operating organization, and the identification information is stored in the The operating organization or the operating organization retrieves the identification information corresponding to the identification option from multiple identification information based on the identification option provided by the digital identification device; when the digital identification device needs to display the multi-dimensional barcode, it is connected to the operating organization When the multi-dimensional bar code is requested, the operating unit generates the multi-dimensional bar code according to the verification information and the identification information stored therein, or retrieves the corresponding identification information according to the certificate options provided by the digital certificate device, and according to the identification Information and the verification information stored therein generate the multi-dimensional barcode, and transmit the multi-dimensional barcode to the digital certificate device, and in step (C), the business platform receives the verification instruction and transmits the verification instruction to the operating unit, After the operating unit verifies that the verification information in the verification instruction is correct with the verification information stored by itself, the identification information in the verification instruction is verified with the identification information stored by itself.

In some embodiments of the present invention, in step (B), the inspection device Scan the multi-dimensional bar code but not decode the multi-dimensional bar code, and generate the verification instruction containing the multi-dimensional bar code and send it to the certification server, and in step (C), the certification server verifies the multi-dimensional bar code in the verification instruction Decode to obtain the identification information and the verification information.

In some embodiments of the present invention, in step (B), the inspection device scans the multi-dimensional barcode and decodes it to obtain the identification information and the verification information, and generates the identification information and the verification information. The verification command is sent to the certification server, and in step (C), the certification server retrieves the identification information and the verification information from the verification command.

In some embodiments of the present invention, the above-mentioned hardware security carrier is an identity identification card that is removably electrically connected to the digital ID device or an identity recognition module built in the digital ID device.

Furthermore, another multi-dimensional barcode mobile identity authentication method of the present invention is applied between a digital certificate device and a verification device, and includes the following steps: (A) the digital certificate device displays a multi-dimensional barcode, the multi-dimensional barcode includes One verification information and one identification information; (B) The inspection device scans the multi-dimensional barcode and decodes it to obtain the verification information and the identification information, and after verifying that the verification information is correct, authenticate the identification information; and (C) The inspection device records and displays an authentication result and returns the authentication result to the digital certificate device, or the inspection device records the authentication result and returns the authentication result to the digital certificate device, or the inspection device records and The authentication result is displayed.

According to the multi-dimensional barcode mobile payment method described in paragraph 0026, in some embodiments of the present invention, the multi-dimensional barcode in step (A) is based on the above paragraphs 0005 to 0011, 0016, and The methods described in paragraphs 0017 and 0020 are generated, so I will not repeat them here. And the hardware safety vehicle is as described in paragraph 0025 above.

In addition, a digital certificate device implementing the above method of the present invention can communicate with an authentication server, and the authentication server can communicate with an inspection device; the digital certificate device includes: a communication unit that can communicate with the The authentication server communicates; a display unit for displaying a multi-dimensional bar code, the multi-dimensional bar code including a verification information and an identification information; a processing unit electrically coupled to the display unit; a multi-dimensional bar code generation module; And an input unit for inputting a password and providing the password to the multi-dimensional bar code generation module through the processing unit; wherein the multi-dimensional bar code generation module verifies that the password is correct, according to the verification information and the identification information Generate the multi-dimensional bar code, and output the multi-dimensional bar code to the display unit for display through the processing unit for the inspection device to scan; thereby, the inspection device can generate a verification command based on the multi-dimensional bar code and send it to the authentication server Organization so that the authentication server can obtain the verification information from the verification instruction, and after verifying that the verification information is correct, authenticate the identification information in the verification instruction, and return a certification related to the identification information The results are given to the inspection device.

In some embodiments of the present invention, the multi-dimensional barcode generation module is a hardware security carrier or an application program installed in the digital certificate device, and the hardware The physical security carrier is an identity identification card that is removably electrically connected to the digital identification device or an identity identification module built in the digital identification device.

In addition, the present invention implements the above-mentioned method of a certification server, which can communicate with a digital certificate device and a verification device, and includes: a business platform that can communicate with the digital certificate device and the verification device via a network; and An operating organization that can communicate with the business platform; wherein the business platform provides a multi-dimensional bar code containing a verification information and an identification information to the digital certificate device, so that the digital certificate device can display the multi-dimensional bar code for the verification device Scan the multi-dimensional bar code, and the verification device generates a verification instruction based on the multi-dimensional bar code and sends it to the business platform; the business platform obtains the verification information from the verification instruction, and after verifying that the verification information is correct, transmits the verification instruction The identification information in the file is sent to the operating unit, so that the operating unit verifies the identification information and generates a verification result, and returns the verification result to the inspection device through the business platform; wherein the multi-dimensional barcode is a fixed multi-dimensional barcode , Or dynamically generated by the business platform, and the identification information is stored in the operating organization, or the operating organization extracts the identification information corresponding to the identification option from a plurality of identification information based on a identification option provided by the digital identification device Identification information. When the digital certificate device connects to the business platform to display the multi-dimensional bar code and requests the multi-dimensional bar code, the business platform generates the multi-dimensional bar code based on the verification information stored therein and the identification information provided by the operating unit Bar code, and transmit the multi-dimensional bar code to the digital certificate device.

The effect of the present invention is to display a multi-dimensional bar code by the digital certificate device For the inspection device to scan, and the inspection device generates a verification command based on the multi-dimensional barcode and sends it to the authentication server, so that the verification information and the identification information contained in the verification command are verified, or the verification device directly The verification information and the identification information contained in the barcode are verified and a verification result is generated for inspection by the inspection unit, thereby achieving the purpose of verifying the authenticity of the digital certificate and its holder.

1: Digital ID device

2: Inspection device

3: Authentication server

11: Communication unit

12: Display unit

13: processing unit

14: Hardware safety vehicle

15: Input unit

16: storage unit

31: Business Platform

32: Operating organization

S1~S9, S41~S48: steps

Other features and effects of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: FIG. 1 is a flowchart illustrating the main process steps of the first embodiment of the multi-dimensional barcode mobile identity authentication method of the present invention; Figure 2 is a circuit block diagram, mainly illustrating the circuit blocks included in the digital ID device in the first embodiment; Figure 3 is a circuit block diagram, mainly illustrating that the digital ID device omits the hardware security carrier and the processing unit executes an application Program; Figure 4 is a schematic diagram illustrating the multi-dimensional barcode (identity verification QR code) generated by the first embodiment; Figures 5 and 6 are schematic diagrams illustrating the digital certificate and its related information displayed in the first embodiment; and Figure 7 It is a flowchart illustrating the main process steps of the second embodiment of the multi-dimensional barcode mobile identity authentication method of the present invention.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are represented by the same numbers.

1 is a flowchart of the first embodiment of the multi-dimensional barcode mobile identity authentication method of the present invention. This embodiment is applied to a digital certificate device 1, a verification device 2 and a digital certificate as shown in FIG. The device 1 and the verification device 2 communicate via the authentication server 3 through the network; the digital certificate device 1 can be a smart phone, a tablet computer or other mobile electronic devices with wireless communication capabilities held by the user of the digital certificate The inspection device 2 can be a personal computer, notebook computer, tablet computer, smart phone, or other mobile electronic device with network communication capabilities provided by any inspection unit that needs to view the identity certificate.

As shown in Fig. 1, the mobile identity authentication method of the multi-dimensional barcode of this embodiment is as follows. First, when the inspection unit requires the user to present an identity certificate, the user opens an application 160 installed on the digital certificate device 1 (such as multi-dimensional barcode authentication software, which is represented by the processing unit shown in Figure 2 or Figure 3). 16) After execution), the application program 160 executes step S1 as shown in Figure 1, and displays a multi-dimensional bar code on the digital certificate device 1 for the inspection device 2 to scan. The multi-dimensional bar code can be a one-dimensional bar code, a two-dimensional bar code, a QR code or Three-dimensional bar code, etc., but not limited to this, and it mainly contains a verification information and an identification information, and the authentication server 3 stores the identification information and the verification Information-related data. Next, in step S2 of FIG. 1, after the inspection device 2 scans the multi-dimensional barcode, it executes steps S3 and S4 of FIG. 1, generates a verification command based on the multi-dimensional barcode, and transmits the verification command to the authentication server 3.

Then, in step S5 of FIG. 1, the authentication server 3 obtains the verification information from the verification command, and executes step S6 of FIG. 1 to verify whether the verification information is correct with the data related to the verification information stored in itself , If yes, execute step S7 of FIG. 1 to authenticate the identification information in the verification command with the identification information stored by itself, and then, as shown in step S8 of FIG. 1, the authentication server 3 returns and An authentication result related to the identification information is given to the inspection device 2. The authentication result may be authentication success or authentication failure. Therefore, as shown in step S9 of FIG. 1, the inspection device 2 displays the authentication result, and the inspection unit knows When the authentication result is that the authentication is successful, the user of the digital certificate device 1 can be asked to click on the multi-dimensional bar code shown in Figure 4 to make the application 160 (multi-dimensional bar code authentication software) display as shown in Figures 5 and 6 The digital certificate and related materials shown are for inspection by the inspection unit. In this way, the purpose of verifying the authenticity of the digital certificate and its holder is achieved.

In addition, it is worth mentioning that the authentication server 3 also stores the digital certificate and related data corresponding to the identification information. Therefore, in the above step S8, when the authentication server 3 transmits to the inspection device 2 When the verification result is that the authentication is successful, the verification result may also include the digital certificate and related data corresponding to the identification information, so that the inspection device 2 can directly display the digital certificate as shown in FIG. 5 and FIG. 6 And related materials for inspection by inspection units. Alternatively, when the verification result is that the verification is successful, the verification server 3 may also send the verification result to the digital certificate device 1, and trigger the application 160 of the digital certificate device 1 to automatically display as shown in FIGS. 5 and 6 The digital certificate and related materials shown are for inspection by the inspection unit.

If in the above step S6, the authentication server 3 verifies that the verification information is incorrect, as shown in step S10 in Figure 1, the authentication server 3 will send a verification failure message to the digital certificate device 1 and the verification device 2. Make the verification failure message displayed to notify the inspection unit that the verification is unsuccessful.

Specifically, as shown in FIG. 2, the digital certificate device 1 of this embodiment mainly includes a communication unit 11, a display unit 12, a storage unit 13, a hardware security carrier 14, an input unit 15, and a The aforementioned components are electrically connected to the processing unit 16. In addition, the authentication server 3 includes a business platform 31 that can communicate with the digital certificate device 1 and the verification device 2 via a network (such as the Internet), and an operating unit 32 that can communicate with the business platform 31.

The communication unit 11 can communicate with the business platform 31 of the authentication server 3 through a network (such as the Internet). The storage unit 13 stores the above-mentioned application 160; the hardware security carrier 14 stores the multi-dimensional barcode and is set A password, and the multi-dimensional bar code is a fixed multi-dimensional bar code provided in advance by the business platform 31 of the authentication server 3 (the identification information contained therein comes from the operating unit 32). In this embodiment, the hardware security carrier 14 is a removably connected to the digital certificate device 1 An electrically connected identity identification card (such as an SD card that can be inserted into a card slot of the digital identification device 1) or an identity identification module built into the digital identification device 1. The input unit 15 may be any input interface for a user to input to control the digital certificate device 1, such as a keyboard, a touch keyboard, or a touch screen.

Therefore, in the above step S1, when the user wants to use the multi-dimensional barcode and opens the application 160 installed in the digital certificate device 1 through the input unit 15, the processing unit 16 will ask the user to enter a password and provide the password to the hardware The security carrier 14, after the hardware security carrier 14 verifies that the password is correct, the multi-dimensional barcode is output to the display unit 12 via the processing unit 16 for display.

In addition, in the above step S1, there are the following ways of displaying the multi-dimensional barcode in this embodiment.

The digital certificate device 1 can divide the fixed multi-dimensional bar code into a plurality of files. At least one or more of these files are stored in the hardware security carrier 14 of the digital certificate device 1, and at least one of the files Or multiple files are stored in the business platform 31 of the authentication server 3 or a cloud server 4; when the user wants to use the multi-dimensional barcode to open the application 160 of the digital certificate device 1, the processing unit 16 will communicate with the communication unit 11 The business platform 31 of the authentication server 3 or the cloud server 4 is connected, and the user is required to enter a password, and provide the password to the hardware security vehicle 14 to verify that the password is correct, then from the authentication server 3’s business platform 31 or the cloud server 4 obtains the at least one or more files and combines them with The at least one or more files stored in the hardware security carrier 14 are combined into the multi-dimensional barcode and displayed on the display unit 12.

Alternatively, the multi-dimensional barcode can also be divided into multiple files by the processing unit 16 and stored in the hardware security carrier 14 of the digital certificate device 1. When the user wants to use the multi-dimensional barcode to open the application 160 of the digital certificate device 1 , The processing unit 16 will ask the user to enter a password, and provide the password to the hardware security vehicle 14. After the hardware security vehicle 14 verifies that the password is correct, the processing unit 16 can read from the hardware security vehicle 14 The files are taken and combined into the multi-dimensional barcode and displayed on the display unit 12.

Alternatively, when the digital document device 1 does not have the hardware security carrier 14, as shown in FIG. 3, the multi-dimensional barcode can also be divided into at least two files by the processing unit 16 and stored in the storage unit of the digital document device 1. 13, and at least one of these files is encrypted and protected. Therefore, when the user wants to use the multi-dimensional barcode to open the application 160 of the digital certificate device 1, the processing unit 16 will read the files from the storage unit 13 and request the user to enter at least one password, and the password will be After the encrypted and protected at least one file is decrypted, the files are combined into the multi-dimensional bar code and displayed on the display unit 12.

Alternatively, the multi-dimensional barcode can also be a fixed multi-dimensional barcode obtained by the application 160 installed in the digital certificate device 1 from the business platform 31 of the authentication server 3 through the digital certificate device 1 through an online application method, and the The application 160 also stores the multi-dimensional barcode or the digital certificate in software encryption The storage unit 13 of the device 1. Therefore, when the user wants to use the multi-dimensional barcode to open the application 160 installed in the digital certificate device 1 through the input unit 15, the application 160 will ask the user to enter a password, and the application 160 will verify that the password is correct. After 160, the multi-dimensional barcode is taken out from the storage unit 13 or decrypted, and then output to the display unit 12 via the processing unit 16 for display.

Alternatively, the aforementioned application 160 can also divide the multi-dimensional barcode into multiple files, and at least one or more of these files are stored in the storage unit 13 of the digital certificate device 1 and/or stored in the application 160 At least one or more of the files are stored in the business platform 31 or the cloud server 4 of the authentication server 3. Therefore, when the user wants to use the multi-dimensional barcode to open the application 160 of the digital certificate device 1, the application 160 will ask the user to enter a password, and after the application 160 verifies that the password is correct, the application 160 will pass the The digital certificate device 1 connects with the business platform 31 of the authentication server 3 or the cloud server 4 to obtain the at least one or more files, and then connects them with the storage unit 13 and/or the storage unit 13 After the at least one or more files are combined into the multi-dimensional barcode, it is output to the display unit 12 via the processing unit 16 for display.

Alternatively, the application program 160 may also divide the multi-dimensional barcode into multiple files and store them in the storage unit 13 of the digital certificate device 1 or in the application program 160. When the user wants to use the multi-dimensional barcode, the digital certificate device is opened 1, the application 160 will ask the user to enter a password, and the application will After formula 160 verifies that the password is correct, the application program 160 reads the files from it or from the storage unit 13 and combines them into the multi-dimensional barcode, and then outputs it to the display unit 12 via the processing unit 16 for display. Or, the application program 160 divides the multi-dimensional barcode into at least two files, encrypts and protects at least one of the files, and stores the files in the storage unit 13 of the digital certificate device 1 or in In the application program 160 itself, when the digital certificate device 1 wants to display the multi-dimensional barcode, the application program 160 reads the files from it or from the storage unit 13, and will be encrypted and protected according to at least one password entered After the at least one file is decrypted, the files are combined into the multi-dimensional bar code, and the multi-dimensional bar code is output to the display unit 12 through the processing unit 16 for display.

In addition, the multi-dimensional barcode can also be dynamically generated by the hardware security carrier 14 of the digital ID device 1. In this embodiment, when there is only one type of digital ID, for example, the user sets in the application 160 of the digital ID device 1. There is only one type of digital ID card, and the identification information corresponding to the digital ID card (unique identification code, such as a virtual account number or a user ID card number, etc.) will be pre-stored in the hardware security vehicle 14 , And the digital ID card and its corresponding identification information are provided by the operating unit 32, such as the Ministry of the Interior; or, when there are more than two types of digital certificates, for example, the user is in the application 160 of the digital ID device 1. When the set digital certificates include digital ID cards, digital passports, digital health insurance cards, digital driving licenses, etc., the display unit 12 of the digital certificate device 1 displays the digital certificates Multiple credential options corresponding to the document are available for the user to select, and the processing unit 16 generates the identification information corresponding to the credential option according to a credential option input by the user and provides the identification information to the hardware security carrier 14, and each of the digital digits The certificate and its corresponding identification information are provided by the corresponding operating unit 32 and stored in the storage unit 13 of the digital certificate device 1. For example, a digital passport is issued by the Ministry of Foreign Affairs, and a digital health insurance card is issued by the National Health Insurance Bureau. Therefore, when the digital certificate device 1 wants to display the multi-dimensional barcode, the hardware security carrier 14 will require the user to enter a password, and after verifying that the password is correct, the hardware security carrier 14 passes through the processing unit 16 and The communication unit 11 connects with the business platform 31 of the authentication server 3 to request an authentication parameter from the authentication server 3, and uses a key shared with the business platform 31 of the authentication server 3 to pledge the authentication parameters. Code to generate the verification information, and after generating the multi-dimensional bar code according to the verification information, the identification information and the authentication parameter, the multi-dimensional bar code is output to the display unit 12 via the processing unit 16 for display.

Alternatively, when the digital ID device 1 does not have a hardware security carrier 14, as shown in FIG. 3, the multi-dimensional barcode can also be dynamically generated by the application 160 installed on the digital ID device 1. In this embodiment, when the digital ID device 1 There is only one type of certificate. For example, the digital certificate set by the user in the application 160 of the digital certificate device 1 has only one digital ID card, and the identification information corresponding to the digital ID card will be pre-stored in the application 160, and the The digital ID card and its corresponding identification information are provided by the operating unit 32, such as the Ministry of the Interior; or when there are more than two types of digital certificates, such as using When the digital ID set by the user in the application 160 of the digital ID device 1 is, for example, a digital ID card, a digital passport, a digital health insurance card, a digital driving license, etc., it will be displayed by the digital ID device 1. The unit 12 displays a plurality of certificate options corresponding to the digital certificates for the user to select, and the processing unit 16 generates the identification information corresponding to the certificate options according to a certificate option input by the user and provides the identification information to the application program 160. Similarly, each digital certificate and its corresponding identification information are provided by the corresponding operating unit 32 and stored in the storage unit 13 of the digital certificate device 1. For example, a digital passport is issued by the Ministry of Foreign Affairs, and a digital health insurance card is issued by the health insurance company. Bureau approved and issued. Therefore, when the digital certificate device 1 displays the multi-dimensional barcode and executes the application program 160, the application program 160 requires the user to enter a password, and after verifying that the password is correct, the application program 160 passes through the digital certificate device 1 Request a certification parameter from the business platform 31 of the certification server 3, and use a key shared with the business platform 31 to code the certification parameter to generate the verification information, and based on the verification information, the identification information and the The authentication parameter generates the multi-dimensional barcode to output the multi-dimensional barcode via the processing unit 16 to the display unit 12 for display.

Therefore, in the above step S5, the commerce platform 31 stores the key and the authentication parameters, and when the commerce platform 31 receives the verification instruction and obtains the verification information from it, in the above step S6, the commerce platform 31 Compare whether the authentication parameter in the verification instruction is the same as the authentication parameter stored by the business platform 31 itself. If so, the business platform 31 uses the key stored by itself for the authentication parameter stored by itself. Staking the code to generate a confirmation code, and after confirming that the verification information in the verification command is the same as the verification code generated by itself (that is, the verification information is correct), the identification information in the verification command is sent to the operating unit 32. To execute the above steps S7 and S8, the operating unit 32 authenticates the identification information and generates the authentication result, and transmits the authentication result to the inspection device 2.

In addition, another alternative is that the above-mentioned operating unit 32 stores the key and the authentication parameters, and the hardware security vehicle 14 or the application 160 of the inspection device 1 is sent to the operating unit via the digital certificate device 1. 32 requires the authentication parameter, and uses a key shared with the operating unit 32 to code the authentication parameter to generate the authentication information. Therefore, in the above step S5, the business platform 31 will transmit the received verification instruction to the operating unit 32, and in the above step S6, the operating unit 32 compares the authentication parameter in the verification instruction with the authentication parameter stored in itself. Whether the authentication parameters are the same, if so, the operating unit 32 uses the key stored by itself to stake the authentication parameters stored by itself to generate a confirmation code, and confirms that the verification information in the verification command is the same as the one generated by itself After the confirmation code is the same (that is, the verification information is correct), the above steps S7 and S8 are executed, and the operating unit 32 authenticates the identification information in the verification command with the identification information stored by itself.

Furthermore, another way for the hardware security carrier 14 to dynamically generate multi-dimensional barcodes is to directly generate multi-dimensional barcodes without obtaining authentication parameters from the authentication server 3. In this embodiment, the hardware security carrier 14 and the authentication Servo 3's business platform 31 It is necessary to pre-store the verification information set (agreeed) in advance. Then when the digital certificate device 1 wants to display the multi-dimensional barcode, the hardware security carrier 14 requires the user to enter a password, and after verifying that the password is correct, the hardware security carrier 14 is based on the The verification information and the identification information (the method of obtaining the identification information is as described in paragraph 0049 above) generates the multi-dimensional barcode and outputs it to the display unit 12 via the processing unit 16 for display.

Or, when the digital certificate device 1 does not have a hardware security carrier 14, the above-mentioned multi-dimensional barcode can also be authenticated by the application 160 installed in the digital certificate device 1 from the authentication server 3 through the digital certificate device 1. In the case of parameters, it is dynamically generated, that is, the application 160 and the business platform 31 of the authentication server 3 need to store the verification information in advance. When the digital certificate device 1 displays the multi-dimensional barcode and executes the application 160, the application 160 The program 160 requires the user to enter a password, and after verifying that the password is correct, the application 160 generates the multi-dimensional image based on the verification information and the identification information stored therein (the method of obtaining identification information is described in paragraph 0049) The barcode is output to the display unit 12 via the processing unit 16 for display.

Therefore, in step S5, after the commerce platform 31 receives the verification instruction and obtains the verification information from it, in step S6, the commerce platform 31 verifies that the verification information retrieved from the verification instruction is correct with the verification information stored therein. Then, the identification information is transmitted to the operating unit 32, so that the operating unit 32 authenticates the identification information sent from the business platform 31 with the identification information stored by itself.

In addition, another alternative is that the aforementioned hardware security vehicle 14 and the operating unit 32 respectively store the pre-set (appointed) verification information in advance, and in the aforementioned step S5, the business platform 31 receives the verification instruction and sends it The verification command is given to the operating organization 32. Therefore, in the above step S6, the operating organization 32 uses the verification information stored by itself to verify that the verification information in the verification instruction is correct, and then executes the above step S7 with the stored verification information. The identification information authenticates the identification information in the verification command.

Alternatively, the multi-dimensional barcode can also be dynamically generated by the authentication server 3. In this embodiment, the verification information is pre-stored in the business platform 31 of the authentication server 3, and the identification information is pre-stored in the authentication server. In the operating unit 32 of organization 3 or as described in paragraph 0049 above, when there are multiple digital certificates, each digital certificate and its corresponding identification information are provided by the corresponding operating unit 32, so the operating unit 32 will According to a credential option provided by the digital credential device 1, the identification information corresponding to the credential option is retrieved from a plurality of digital credential. Therefore, when the digital certificate device 1 wants to display the multi-dimensional bar code and connects to the business platform 31 of the authentication server 3 and requests the multi-dimensional bar code, the business platform 31 of the authentication server 3 will require the user to enter a password. After verifying that the password is correct, the business platform 31 requests the operating unit 32 to provide the identification information, and generates the multi-dimensional barcode based on the verification information stored therein and the identification information provided by the operating unit 32; or the business platform 31 transmits the identification information The certificate option from the digital certificate device 1 is sent to the operating unit 32, so that Provide the identification information corresponding to the certificate option, generate the multi-dimensional barcode based on the identification information and the verification information stored therein, and transmit the multi-dimensional barcode to the digital certificate device 1.

Therefore, in the above step S5, the business platform 31 receives the verification instruction and obtains the verification information from it, and in the foregoing step S6, the business platform 31 verifies that the verification information in the verification instruction is correct before transmitting the verification instruction The identification information in the file is sent to the operating unit 32, so that the operating unit 32 authenticates the identification information sent from the business platform 31 with the identification information stored by itself.

Furthermore, another alternative is that both the identification information and the verification information mentioned above are pre-stored in the operating unit 32 of the authentication server 3, or the identification information is determined by the operating unit 32 based on the digital certificate. A certificate option provided by the device 1 is generated. Therefore, when the digital credential device 1 wants to display the multi-dimensional bar code and connects to the operating unit 32 and requests the multi-dimensional bar code, the operating unit 32 requires the user to enter a password, and after verifying that the password is correct, the operating unit 32. Then generate the multi-dimensional barcode based on the verification information and the identification information stored therein, or generate the identification information based on the certificate options provided by the digital certificate device 1, and generate the identification information based on the identification information and the verification information stored therein The multi-dimensional bar code and transmit the multi-dimensional bar code to the digital certificate device 1. Therefore, in the above step S5, the business platform 31 receives the verification instruction and transmits the verification instruction to the operating organization 32. In the above steps S6 and S7, the operating organization 32 verifies that the verification information in the verification instruction is correct. Then, the identification information in the verification command is authenticated with the identification information stored by itself.

In addition, in the above step S3, after the inspection device 2 scans the multi-dimensional bar code, the multi-dimensional bar code is not decoded, and the multi-dimensional bar code is included in the verification instruction, and the multi-dimensional bar code is transmitted in step S4. The verification instruction is given to the authentication server 3, and in step S5, the business platform 31 of the authentication server 3 decodes the multi-dimensional barcode in the verification instruction to obtain the identification information and the verification information, and verify the verification information When it is correct, the identification information is sent to the operating unit 32 so that the operating unit 32 can authenticate the identification information.

Or, in the above steps S3 and S4, the verification device 2 directly decodes the multi-dimensional barcode after scanning it to obtain the identification information and the verification information, and include the identification information and the verification information in the verification command Then it is sent to the certification server 3, and in step S5, the business platform 31 of the certification server 3 verifies that the verification information in the verification command is correct, and sends the identification information to the operating unit 32 so that the operating unit 32 The above step S7 is performed to authenticate the identification information.

It is worth mentioning that the hardware security vehicle 14 and the application program 160 that can dynamically generate multi-dimensional barcodes can also be referred to as a multi-dimensional barcode generation module. Moreover, the above steps performed by a single business platform 31 can also be performed by multiple business platforms 31 (that is, the authentication server 3 can include multiple business platforms 31), and the foregoing steps are performed by a single The steps performed by the operating unit 32 can also be executed by multiple operating units 32 (that is, the authentication server 3 can also include multiple operating units 32).

Referring to FIG. 7 again, it is a flowchart of the second embodiment of the multi-dimensional barcode mobile identity authentication method of the present invention. Unlike the first embodiment described above, this embodiment does not require the authentication server 3 to perform verification operations. , As long as both the digital certificate device 1 held by the user and the inspection device 2 owned by the inspection unit can complete the identity verification process, in addition, the digital certificate device 1 of this embodiment is similar to the first embodiment described above and FIG. 2 , Figure 3 shows the same, so it will not be repeated here.

The multi-dimensional barcode mobile identity authentication method of this embodiment is as follows. First, when the user wants to provide the digital certificate stored in the digital certificate device 1 for inspection by the inspection unit, the user opens an application 160 (such as multi-dimensional barcode payment software) installed on the digital certificate device 1 he holds. The application program 160 executes step S41 as shown in FIG. 7 to display a multi-dimensional barcode on the digital certificate device 1 for the inspection device 2 to scan. The multi-dimensional barcode includes verification information and identification information (the same as the identification in the first embodiment above). Information), and the verification device 2 stores the identification information and the data related to the verification information; then, in step S42 of FIG. 7, after the verification device 2 scans the multi-dimensional barcode, it executes step S43 of FIG. The barcode is decoded to obtain the verification information and the identification information.

Then, in step S44 of FIG. 7, the inspection device 2 uses its own stored data related to the verification information to verify whether the verification information is correct, and if so, execute Step S45 in FIG. 7 authenticates the identification information transmitted from the digital certificate device 1 with the identification information stored in itself, and generates an authentication result, and then in step S46 in FIG. 7, the inspection device 2 records and displays the authentication As a result, at the same time, in step S47 of FIG. 7, the inspection device 2 performs short-range wireless communication with the communication unit 11 of the digital certificate device 1 through a short-range wireless communication function, such as NFC, and transmits the authentication result to the digital certificate device 1 , And as shown in step S48 in FIG. 7, the digital certificate device 1 displays the authentication result so that the user can confirm the authentication result in real time. In addition, in the above steps S46 and S47, the inspection device 2 may only record the authentication result and transmit the authentication result to the digital certificate device 1, or the inspection device 2 may only execute the above step S46, record and display the authentication result , And omit the above step S47.

If, in step S44, the verification device 2 verifies that the verification information is incorrect, as shown in step S49 in FIG. 7, the verification device 2 sends a verification failure message to the digital certificate device 1 to display a verification failure message.

In addition, the multi-dimensional bar code of this embodiment is a fixed multi-dimensional bar code provided in advance by the business platform 31 of the authentication server 3 shown in FIG. 2, and the various ways of storing and reading the fixed multi-dimensional bar code are the same as those described above. The first embodiment is the same, so it will not be repeated here.

In addition, as described in the first embodiment, the multi-dimensional barcode of this embodiment can also be used by the hardware security carrier 14 or the application 160 of the digital ID device 1 without requiring It is dynamically generated when the authentication parameters are obtained, or is dynamically generated by the business platform 31 or the operating unit 32 of the authentication server 3, so it will not be repeated here.

To sum up, the present invention uses the digital certificate device 1 to display a multi-dimensional barcode for the inspection device 2 to scan, and the inspection device 2 generates a verification command based on the multi-dimensional barcode and sends it to the authentication server 3 so that the verification command The verification information and the identification information contained in the verification information are verified, or the verification information and the identification information contained in the multi-dimensional barcode are directly verified by the inspection device 2 and a verification result is generated for verification by the verification unit, thereby achieving verification digital The effect and purpose of the authenticity of the certificate and its holder.

However, the above are only examples of the present invention. When the scope of implementation of the present invention cannot be limited by this, all simple equivalent changes and modifications made in accordance with the scope of the patent application of the present invention and the content of the patent specification still belong to Within the scope of the patent for the present invention.

1‧‧‧Digital ID Device

2‧‧‧Inspection device

3‧‧‧Certification Servo Organization

S1~S9‧‧‧Step

Claims (6)

A multi-dimensional bar code mobile identity authentication method is applied to a digital certificate device, an inspection device, and an authentication server that can communicate with the digital certificate device and the inspection device, and includes the following steps: (A) Generated by the digital certificate device A multi-dimensional bar code, the multi-dimensional bar code contains a verification information and an identification information, wherein the identification information is issued by the certification server in advance and stored in the digital certificate device, or the identification information is provided in advance by the certification server To the digital certificate device, and the digital certificate device extracts the corresponding identification information according to a certificate option entered. When the digital certificate device wants to display the multi-dimensional bar code, the digital certificate device requires a password to be entered, and then verifies the After the password is correct, the digital certificate device requests an authentication parameter from the authentication server, and the digital certificate device uses a key to code the authentication parameter to generate the authentication information, and based on the authentication information and the identification information And the authentication parameter generates the multi-dimensional bar code; (B) the inspection device scans the multi-dimensional bar code, and generates a verification instruction based on the multi-dimensional bar code and transmits it to the authentication server, the verification instruction also includes the authentication parameter; (C) the After the authentication server receives the verification instruction and compares the authentication parameters in the verification instruction with the authentication parameters stored in the authentication server itself, the authentication server uses the key stored in the authentication server to The authentication parameter bet code to generate a confirmation code, and after confirming that the verification information in the verification command is the same as the generated confirmation code, authenticate the identification information in the verification command with the identification information stored by itself; And (D) the authentication server returns an authentication result related to the identification information to the inspection device. The multi-dimensional barcode mobile identity authentication method according to claim 1, wherein the digital certificate device has a hardware security carrier, and in step (A), the multi-dimensional barcode is dynamically generated by the hardware security carrier, and the The identification information is issued by the authentication server in advance and stored in the hardware security vehicle, or the identification information is provided to the digital certificate device by the authentication server in advance, and the digital certificate device is based on a certificate input Option to retrieve the corresponding identification information and provide it to the hardware security vehicle. When the digital ID device wants to display the multi-dimensional barcode, the hardware security vehicle requires a password. After verifying that the password is correct, the The digital certificate device requests an authentication parameter from the authentication server, and the hardware security vehicle uses a key to code the authentication parameter to generate the authentication information, and based on the authentication information, the identification information, and the authentication parameter Generate the multi-dimensional barcode. The multi-dimensional barcode mobile identity authentication method according to claim 1, wherein an application program is installed in the digital certificate device. In step (A), the multi-dimensional barcode is dynamically generated by the application program, and the identification information is generated by the application program. The authentication server is issued and stored in the application in advance, or the identification information is provided to the digital certificate device by the authentication server in advance, and the digital certificate device retrieves the corresponding identification information according to an input certificate option and Provided to the application program, when the digital certificate device displays the multi-dimensional barcode to execute the application program, the application program requires a password, and after verifying that the password is correct, the application program authenticates the application through the digital certificate device The server requests an authentication parameter, uses a key to code the authentication parameter to generate the authentication information, and generates the multi-dimensional barcode based on the authentication information, the identification information, and the authentication parameter. The multi-dimensional barcode mobile identity authentication method according to claim 1, wherein the authentication server includes a business platform storing the key and the authentication parameters and an operating unit that issues the identification information, and in step (A) , The digital certificate device requests the authentication parameter from the business platform. In step (C), the business platform receives the verification instruction and compares the authentication parameter in the verification instruction with the authentication parameter stored in the business platform itself After the same, the business platform uses the key stored in the business platform itself to code the authentication parameters to generate a confirmation code, and after confirming that the verification information in the verification command is the same as the confirmation code generated, it transmits The identification information in the verification instruction is given to the operating unit, so that the operating unit authenticates the identification information sent from the business platform with the identification information stored by itself. The multi-dimensional barcode mobile identity authentication method according to claim 1, wherein the authentication server includes a business platform and an operating unit that stores the key and the authentication parameters and issues the identification information, and in step (A) , The digital certificate device requests the authentication parameter from the operating organization. In step (C), the business platform receives the verification instruction and transmits it to the operating organization. The operating organization compares the authentication parameter in the verification instruction with the stored After the authentication parameters of the operating organization itself are the same, the operating organization uses the key stored in the operating organization to code the authentication parameters to generate a confirmation code, and confirm the verification information in the verification command and its generation After the confirmation codes of are the same, the identification information in the verification command is authenticated with the identification information stored by itself. The multi-dimensional barcode mobile identity authentication method according to claim 2, wherein the hardware security vehicle is an identity card that is removably electrically connected to the digital ID device or an identity built in the digital ID device Identification module.

Images