TWI722750B - Fido signature management system based on real-name authentication and method thereof - Google Patents

Abstract

The present invention is a FIDO signature management system based on real-name authentication and a method thereof. The system includes a user device, an online application service platform, an authentication platform, a FIDO server, a real-name authentication server, and a cloud signature server. The front-end interface of the authentication platform is connected to the online application service platform to provide a user interface, and a signature management service is provided by the authentication platform. The real-name authentication server interfaces with the back end of the authentication platform and provides verification of the user's real identity, and the FIDO server performs FIDO binding registration after completing the real-name authentication operation. After that, it is redirected to the cloud signature server to apply for user software certificate and the data is signed and returned to the authentication platform for users to obtain the signature data.

Description

FIDO signature management system and method based on real-name authentication

The present invention relates to the technology of signature management, in particular to a FIDO (Fast IDentity Online) signature management system and method based on real-name authentication.

Nowadays, for convenience, users often apply for various application services on the Internet. Therefore, in order for service providers to confirm the user's identity, the steps of identity verification are very important. At present, the traditional one-time password (OTP) authentication is usually used for identity verification. However, this OTP technology will mainly cause two security problems. The first problem is the short message sent through the basic telecommunication communication. There is a risk of being redirected to the mobile device of a caring person, and the second problem is that a Trojan horse program may be installed on the user's mobile device to intercept the text message OTP content, which will lead to the leakage of authentication information.

In addition to the above problems, the steps of identity verification of OTP technology are also very cumbersome. For users, when applying for different services, multiple identity verifications are often required, which is quite inconvenient. It can be seen from the above that identity verification is particularly important for information security. If the relevant information of the user is not obtained by the interested person, it will have a great impact on the user.

It can be seen that there is still room for improvement in the existing OTP technology for identity verification. Therefore, it is necessary to find an identity verification mechanism, such as signature management, in order to provide users with safe, convenient and fast identity verification services. The goal that those skilled in the art are eager to pursue.

The purpose of the present invention is to provide a real-name authentication mechanism for users, and through multiple verifications, to provide users with safer, more convenient and quicker signature management services.

The present invention proposes a FIDO signature management system based on real-name authentication, which includes: an online application service platform that receives and forwards the data signature request with data that needs to be signed by the user; the authentication platform receives the data from the For the data signing request of the online application service platform, the authentication platform forwards the data signing request to the FIDO authentication page, so that the user can input the personal data bound to FIDO registration through the user device and sent by the authentication platform FIDO certification request; the FIDO server receives the FIDO certification request from the certification platform and checks whether the user’s personal data has completed the FIDO registration binding, and reports the certification when the FIDO registration binding is not completed The platform also redirects the authentication platform to the real-name authentication KYC page for the user to input the personal information and authentication information through the user device; the real-name authentication server is used to verify the authenticity of the personal information and the authentication information After the real-name authentication server confirms that the personal data and the authentication data are authentic, the authentication platform generates a link barcode for the user to download a FIDO application to the user’s device and generate authentication with the real-name The registration code associated with the personal data in the server is given to the user device for the FIDO application to log in with the personal data and the registration code and the FIDO application collects Under the binding information of the user’s device, the authentication platform compares the user’s personal data with the personal data obtained from the real-name authentication server through the registration code to perform the FIDO registration and binding under the correct comparison ; And the cloud signature server, which is used to execute the signature of the data in the data signature request. After the FIDO registration binding is completed and the personal data provided by the authentication platform is correct, the cloud signature server The device receives the application for the user software certificate from the authentication platform, so that after the application is completed, the cloud signature server will sign the data to obtain the signature result, and then the signature result or the user software The certificate is returned to the authentication platform. After the authentication platform receives the signature result or the user software certificate, it stores it in a database, and the authentication platform generates an authorization code and calls back or returns it to The online application service platform.

The present invention further proposes a FIDO signature management method based on real-name authentication, which includes: ordering the online application service platform to issue a data signing request with data that needs to be signed by the user; ordering the authentication platform to receive the online application service platform Send the data signing request and forward the data signing request to the FIDO authentication page, so that the user can input the personal data bound to FIDO registration through the user device and the authentication platform sends the FIDO authentication request; The FIDO server receives the FIDO authentication request sent by the authentication platform and checks whether the user’s personal data has completed the FIDO registration binding; when the FIDO registration binding is not completed, the FIDO server is asked to report the authentication platform The authentication platform is redirected to the real-name authentication KYC page for the user to enter the personal information and authentication information through the user device; the real-name authentication server is asked to verify the authenticity of the personal information and the authentication information, so as to After the personal data and the authentication data are confirmed to be authentic, the authentication platform generates a link barcode for the user to download a FIDO application to the user's device and generate a connection with the personal data in the real-name authentication server The registration code is given to the user’s device; in the FIDO application, the individual When the data is logged in with the registration code and the FIDO application collects the binding information of the user’s device, the authentication platform will compare the personal data of the user with the personal data obtained from the real-name authentication server through the registration code. In order to perform the FIDO registration and binding under the correct comparison; after the FIDO registration and binding is completed and the personal information provided by the authentication platform is correct, the authentication platform is asked to apply for the user software certificate to the cloud signing server to serve After the application is completed, the cloud signature server is asked to sign the data to obtain the signature result, and then the signature result or the user software certificate is returned to the authentication platform; and the authentication platform receives the signature The result or the user software certificate is then stored in a database, and the authentication platform is asked to generate an authorization code and call back or return it to the online application service platform.

In one embodiment, when performing the FIDO registration binding, the authentication platform sends the binding information to the FIDO server, so that the FIDO server combines the binding information with a random number to generate a FIDO command (FIDO Token), the FIDO server returns the FIDO token to the FIDO application, so that the FIDO application uses the FIDO token and the binding information as credentials to initiate the FIDO registration binding to the FIDO server Make a request.

In one embodiment, after the FIDO server receives the FIDO registration binding request, it combines the binding information with the random number in the FIDO server to generate another FIDO token, and confirms the FIDO Whether the token is the same as the other FIDO token to determine the validity of the FIDO token and whether the FIDO registration binding request is legal, as long as the FIDO token is valid and the FIDO registration binding request is legal The FIDO registration binding is completed, wherein the FIDO server generates an identification code of the user device according to the binding information.

In one embodiment, when the FIDO server receives the FIDO authentication request and checks that the user’s personal data has completed the FIDO registration binding, the FIDO server is based on An identification code generated when the FIDO registration binding is completed, pushes the FIDO authentication request to the FIDO application, so that the user can perform FIDO authentication with the FIDO server through the FIDO application.

In one embodiment, after the FIDO server performs the FIDO authentication operation, an authentication result is generated and sent back to the authentication platform, so that when the authentication result is confirmed to pass, the authentication platform will sign the cloud The server submits the data signing request to obtain the signing result after the cloud signing server signs the data, and returns the signing result to the authentication platform.

In one embodiment, after the online application service platform receives the authorization code, a request for obtaining signature data is submitted to the authentication platform within a valid period of time, so that the authentication platform compares the request for obtaining signature data When the content of is valid, an identification credential is generated, and the identification credential is returned to the online application service platform. The content of the request to obtain the signature data includes the service ID, the service interface password, the authorization code, and the callback URL. The content of the identification credential includes the signature result.

In one embodiment, the authentication platform uses a platform private key to sign the identification credential to become an identification credential signature, and the online application service platform receives the authentication platform credential from the authentication platform, the identification credential, and the identification credential. After the credential is signed, a platform public key in the authentication platform credential is used to verify the signature of the identification credential, so as to obtain the signature data in the identification credential.

In summary, the present invention provides a FIDO signature management system and method based on real-name authentication, which is different from the current technology that uses OTP authentication to cause the SMS to be stolen, or the user device is installed with a Trojan horse program to intercept the SMS OTP content And so on, and there is leakage of verification information The present invention uses FIDO authentication technology to ensure the correctness of the user and the security of the data through multiple protections, and provides a safe, convenient and fast identity verification service for the user.

1‧‧‧FIDO signature management system based on real-name authentication

10‧‧‧User device

11‧‧‧Online Application Service Platform

12‧‧‧Authentication platform

13‧‧‧FIDO server

14‧‧‧Real-name authentication server

15‧‧‧Cloud Signature Server

Steps S21 to S28‧‧‧

S31 to S38‧‧‧Process

S361 to S366‧‧‧Process

S51 to S58‧‧‧Process

S61 to S65‧‧‧Process

Figure 1 is a system diagram of the FIDO signature management system based on real-name authentication of the present invention;

Figure 2 is a step diagram of the FIDO signature management method based on real-name authentication of the present invention;

Figure 3 is a flow chart of the method of the first embodiment of the present invention;

Figure 4 is a flowchart of the FIDO registration and binding operation method according to the first embodiment of the present invention;

Figure 5 is a flowchart of the method according to the second embodiment of the present invention; and

Figure 6 is a flow chart of the method for the user of the present invention to obtain the completed signature data.

The following describes the technical content of the present invention with specific specific embodiments. Those familiar with the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied by other different specific embodiments.

Figure 1 illustrates the system diagram of the FIDO signature management system 1 based on real-name authentication of the present invention. As shown in the figure, the FIDO signature management system 1 based on real-name authentication includes a user device 10, an online application service platform 11, and an authentication platform 12. FIDO (Fast IDentity Online, Online fast identity identification) server 13, real-name authentication server 14, and cloud signature server 15, where the user device 10 can be a smart phone, a smart watch, a portable/wearable device, or a notebook Computer or personal computer.

Specifically, the online application service platform 11 sends a data signing request submitted by the user (for example, an online application for data signing operation), the data signing request has a data that needs to be signed, and the authentication platform 12 receives the online application service The data signing request issued by the platform 11, where the authentication platform 12 receives the personal data (such as the ID card number) bound to FIDO registration entered by the user through a user device 10 (such as a smart phone) The authentication platform 12 sends out a FIDO authentication request, the FIDO server 13 receives the FIDO authentication request from the authentication platform 12 and checks whether the user’s personal data has completed the FIDO registration binding, where, if the FIDO server 13 checks If the FIDO registration binding is not completed, the authentication platform 12 is reported and the authentication platform 12 receives the personal data and authentication data entered by the user through the user device 10 (for example, a natural person certificate needs to enter a PIN Code, or If it is a telecom certification, enter the phone number).

The real-name authentication server 14 is used to verify the authenticity of the personal data and the authentication data. After the real-name authentication server 14 confirms that the personal data and the authentication data are authentic, the authentication platform 12 generates a link barcode for the user Download a FIDO application to the user device 10, and the authentication platform 12 will then generate a registration code on the user device 10. The registration code is a random number generated by the authentication platform 12 and registered The code is associated with the personal data in the real-name authentication server 14. The FIDO application uses the personal data and the registration code to perform login, and the FIDO application collects the binding information of the user device 10, and then The authentication platform 12 compares the personal data of the user with the personal data obtained from the real-name authentication server 14 through the registration code. If the comparison is correct, the FIDO registration binding is performed.

The cloud signing server 15 is used to perform the signing of the data in the data signing request. After the FIDO registration and binding is completed, the authentication platform 12 provides the personal data to the user to confirm whether it is correct. If the personal information is correct, the authentication platform 12 applies for a user software certificate from the cloud signing server 15. When the application is completed, the cloud signing server 15 signs the data to obtain the signing result, and then Return the signing result or the user software certificate (the user has the user software certificate for the first use) to the authentication platform 12, where the authentication platform 12 receives the signing result or the user software certificate , Store it in a database, and the authentication platform 12 will generate an authorization code, and call back or return the authorization code to the online application service platform 11.

In this embodiment, the online application service platform 11 first receives the registration of the online application service submitted by the user through the user device 10, and the user who has completed the registration of the online application service can use the online application The service platform 11 selects various online data signature management operations. Among them, the information required for registration of the online application service includes service ID, service name, service interface password, authentication level, callback URL (redirect_uri), registration time, Current status, etc.

In one embodiment, when the FIDO registration binding is performed, the authentication platform 12 sends the binding information to the FIDO server 13, and the FIDO server 13 combines the binding information with a random number to generate A FIDO token (FIDO Token), and then return the FIDO Token to the FIDO application. The FIDO application uses the FIDO Token and the binding information as credentials to initiate the FIDO registration binding to the FIDO server 13 The request. Specifically, the FIDO server 13 can use the SHA-256 hash algorithm to combine the binding information with a random number to generate a FIDO Token, where the binding information can include a device ID (deviceID), OS version, and device model ( Phone model).

In one embodiment, after receiving the FIDO registration binding request, the FIDO server 13 combines the binding information with the same random number to generate another FIDO Token. Here, the FIDO server 13 can also use SHA -256 hash calculation to generate the other FIDO Token, and then the FIDO server 13 confirms whether the FIDO Token is the same as the other FIDO Token, to determine the validity of the FIDO Token and the legality of the FIDO registration binding request If it is determined that the FIDO Token is the same as the other FIDO Token, the FIDO Token is valid and the FIDO registration binding request is legal, that is, the FIDO registration binding is completed, and the FIDO server 13 also uses the binding The information generates a registration token of the user device.

In another embodiment, if the FIDO server 13 checks that the FIDO registration binding has been completed, the FIDO server 13 pushes the FIDO authentication request according to an identification code generated when the FIDO registration binding is completed. Broadcast to the FIDO application, so that the user can perform FIDO authentication to the FIDO server 13 through the FIDO application.

In one embodiment, the FIDO server 13 generates an authentication result after completing the FIDO authentication operation, and the FIDO server 13 returns the authentication result to the authentication platform 12. If the authentication result is confirmed to be passed, then The authentication platform 12 submits the data signing request to the cloud signing server 15, and the cloud signing server 15 signs the data to obtain the signing result, and then sends the signing result back to the authentication platform 12.

In one embodiment, after the online application service platform 11 receives the authorization code, it submits a request to the authentication platform 12 to obtain the signature data within a valid period of time, and the authentication platform 12 compares the obtained signature data with Whether the requested content is valid, if it is confirmed to be valid, the authentication platform 12 generates an identification credential, and returns the identification credential to the online application service platform 11, which In the above, the content of the request to obtain the signature data may include a service ID, a service interface password, an authorization code, and a callback URL, and the content of the identification credential includes the signature result.

In one embodiment, the authentication platform 12 uses a platform private key to sign the identification credential to become an identification credential signature, and the online application service platform 11 receives an authentication platform credential sent by the authentication platform 12 , After the identification credential and the identification credential are signed, the online application service platform 11 uses a platform public key in the authentication platform credential to verify the signature of the identification credential, so as to obtain the signature of the identification credential. Chapter of the information.

Figure 2 illustrates the step diagram of the FIDO signature management method based on real-name authentication of the present invention. Please refer to Figure 1 together. In step S21, the online application service platform 11 is made to send a data signing request submitted by the user, and the data signing request has a data that needs to be signed.

In step S22, the authentication platform 12 is made to receive the data signing request sent by the online application service platform 11. Specifically, the authentication platform 12 receives the FIDO registration binding request input by the user through a user device 10. For personal data, the authentication platform 12 then issues a FIDO authentication request.

In step S23, the FIDO server 13 is made to receive the FIDO authentication request sent by the authentication platform 12, and check whether the personal data of the user has completed the FIDO registration binding.

In step S24, when the FIDO server 13 checks that the FIDO registration binding has not been completed, the authentication platform 12 receives the personal data and authentication data input by the user through the user device 10.

In step S25, the real-name authentication server 14 is asked to verify the authenticity of the personal information and the authentication information. After confirming that the personal information and the authentication information are authentic, the authentication platform 12 generates a link barcode for downloading a FIDO application to the user’s device 10, this At this time, the authentication platform 12 will generate a registration code for the user device 10, where the registration code is a random number generated by the authentication platform 12, and the registration code is used by the user in the real-name authentication server 14 for real-name authentication The profile of the assignment is relevant.

In step S26, the FIDO application is made to log in with the personal data and the registration code. Then, the FIDO application collects the binding information of the user device 10, and the authentication platform 12 compares the personal data of the user Whether it is the same as the personal data obtained from the real-name authentication server 14 through the registration code, so that when the comparison is correct, the FIDO registration binding is performed.

In step S27, after the FIDO registration and binding is completed, the authentication platform 12 provides the personal information to the user to confirm whether the personal information is correct. If the personal information is correct, the authentication platform 12 sends the cloud signature server 15 Apply for a user software certificate, and after the application is completed, order the cloud signing server 15 to sign the data to obtain the signing result, and then return the signing result or the user software certificate to the authentication platform 12. It should be noted that the user software certificate is returned only when the user uses it for the first time.

In step S28, after the authentication platform 12 receives the signature result or the user software certificate, it is stored in a database. At this time, the authentication platform will generate an authorization code and call back the authorization code Or send it back to the online application service platform 11.

Hereinafter, an embodiment is used to illustrate the present invention, please refer to Fig. 1 at the same time. When a user sends a data signing request through the online application service platform 11, and the data signing request has a data that needs to be signed, the authentication platform 12 will perform FIDO authentication after receiving the data signing request. Specifically, the authentication platform 12 provides a FIDO authentication page for the user to enter the personal data (such as an ID number) bound to FIDO registration through the user device 10 (such as a smart phone), and then the authentication platform 12 sends a request to FIDO The server 13 submits a FIDO certification request to allow the The FIDO server 13 performs FIDO authentication operations. It should be noted that when the same user uses different services in the online application service platform 11, they all use the same personal data bound to the FIDO registration.

FIDO server 13 will check whether the user’s personal data has completed FIDO registration and binding. There will be two situations: the first is the user’s first use, and the FIDO registration and binding has not been completed; the second is use It is not the first time to use, and FIDO registration and binding have been completed. The two cases are detailed below.

The first case is that the user has not completed FIDO registration and binding for the first time. In detail, when the FIDO server 13 checks that the user is using it for the first time, that is, the FIDO registration binding has not been completed, the authentication platform 12 can provide a real-name authentication KYC (Know Your Customer) page for the user to pass the user The device 10 inputs personal data (for example, personal data of an ID number) and authentication data (for example, a PIN Code is required for a natural person certificate or a phone number for telecommunication authentication), and then the authentication platform 12 interfaces with the real-name authentication server 14 for this use The real-name authentication operation of the personal data and authentication data of the user is used to verify the authenticity of the personal data and authentication data of the user. After the real-name authentication operation of the real-name authentication server 14 is completed, the authentication platform 12 provides a FIDO registration binding page , The authentication platform 12 generates a QR Code (link barcode) to guide the user to download a FIDO application (Application, APP) to the user device 10, and generates a registration code (registration code) in the user device 10 Wherein, the registration code is a random number generated by the authentication platform 12, and the registration code is related to the personal data used by the user in the real-name authentication server 14 for the real-name authentication operation.

Then, after the user downloads the FIDO application, the user uses the personal data and the registration code to log in to the FIDO application. Then, the FIDO application will collect the binding information of the user device 10, and Together with the user’s personal data and the registration code, it is sent to the authentication platform 12, and the authentication platform 12 compares the user’s personal data with transparency. Check whether the personal information obtained from the real-name authentication server 14 through the registration code is the same. If the comparison is correct, perform FIDO registration and binding. The binding information includes deviceID, OS version and device model (mobile phone model) .

When performing the FIDO registration binding, the authentication platform 12 sends the binding information collected by the FIDO application to the FIDO server 13, and the FIDO server 13 combines the binding information with a random number (the random number). After being stored in the FIDO server 13), a FIDO Token is generated by SHA-256 hash calculation. Then, the FIDO server 13 returns the FIDO Token to the FIDO application, and the FIDO application then sends the FIDO Token back to the FIDO application. Token and the binding information of the user device 10 are used as credentials to initiate the FIDO registration and binding request to the FIDO server 13. At this time, the FIDO server 13 will verify the validity of the FIDO Token, and the FIDO server will After the device 13 combines the binding information with the random number (previously stored in the FIDO server 13), it performs the SHA-256 hash calculation to generate another FIDO Token. At this time, the other FIDO Token and the FIDO Token are processed. By comparison, if the FIDO Token is the same as the other FIDO Token, that is, it is confirmed that the FIDO Token is issued to the user device 10 of the user, the FIDO Token is valid and the FIDO registration binding is completed. It should be noted that the FIDO Token can prevent malicious users from unrestricted registration or fraudulent use of the user device 10, and to confirm whether the FIDO registration binding request is legal.

If the validity of the FIDO Token is valid and the FIDO registration and binding request is also legal, the FIDO server 13 further performs SHA-256 hash calculation on the binding information to become an identification code unique to the user device 10 (Registration token), used for future message push to complete FIDO registration binding operation.

Furthermore, after completing the FIDO registration and binding, the authentication platform 12 provides a user software certificate application page in the user device 10, and the user can confirm the individual in the user software certificate application page After the information (such as the ID card number) is correct, the verification will be Station 12 applies for a user software certificate to the cloud signing server 15. When the application is completed, the cloud signing server 15 signs the data to obtain the signing result, and finally, the signing result or the use The software certificate is returned to the authentication platform 12.

The second case is that the user is not using it for the first time, that is, the FIDO registration binding has been completed. In detail, when the FIDO server 13 checks that the user is not using it for the first time and has completed FIDO registration and binding, the FIDO server 13 will transfer the FIDO according to the identification code generated when the FIDO registration and binding is completed. The authentication request is pushed to the FIDO application. Then, the user can perform FIDO authentication to the FIDO server 13 through the FIDO application. When the FIDO authentication operation is completed, an authentication result will be generated, and the FIDO server 13 The authentication result is returned to the authentication platform 12. If the authentication result is passed, the authentication platform 12 requests the cloud signing server 15 to sign the data, and the cloud signing server 15 signs the data. In the same way, the cloud signature server 15 will return the signature result to the authentication platform 12.

In the above two cases, the final signature result will be sent back to the authentication platform 12, and then the authentication platform 12 will receive the signature result or the user software certificate (the user is the first time the user has the user The software certificate) is then stored in a database, and an authorization code (AuthZ Code) is generated by the authentication platform 12. According to the callback URL of the registration information, the authorization code is called back (CallBack) or returned to the The online application service platform 11, wherein the authorization code is a random value generated randomly. After the online application service platform 11 receives the authorization code, it can make a request to the authentication platform 12 to obtain the signature data within the allowable valid time (for example, one hour or a few minutes), wherein the signature data is obtained The content of the request includes service ID, service interface password, authorization code and callback URL.

After the certification platform 12 receives the request to obtain the signature data, it compares whether the content of the request to obtain the signature data is valid. If the certification platform 12 confirms that it is valid, it will generate an identification The identification credentials are sent back to the online application service platform 11, where the content of the identification credentials includes the user’s personal data, service ID, data signing request time, signing results, user software credentials, and the identification credentials Time of release. At the same time, the authentication platform 12 also uses a platform private key to provide an identification credential signature to the identification credential, and the online application service platform 11 receives an authentication platform credential, the identification credential and the identification credential sent by the authentication platform 12 After the identification credential is signed, a platform public key in the authentication platform credential can be used to verify the identification credential signature, so as to obtain the data that has been signed in the signature result of the identification credential.

Fig. 3 illustrates the method flow chart of the first embodiment of the present invention, please refer to Fig. 1 together. The first embodiment is a process method of how to perform a signature when the user uses it for the first time and has not completed FIDO registration and binding.

In the process S31, the online application service platform 11 receives a data signing request submitted by the user through a user device 10, and the data signing request has a data that needs to be signed.

In the process S32, the online application service platform 11 sends the data signing request to the authentication platform 12. The authentication platform 12 provides a FIDO authentication page for the user to enter the personal information bound to FIDO registration, and then the authentication The platform 12 submits a FIDO authentication request to the FIDO server 13, and the FIDO server 13 performs the FIDO authentication operation. It should be noted that when the same user uses different services in the online application service platform 11, they all use the same personal data bound to the FIDO registration.

In the process S33, the FIDO server 13 checks whether the user has completed FIDO registration binding, and when the FIDO server 13 finds that the user has not completed FIDO registration binding, it notifies the authentication platform 12.

In process S34, the authentication platform 12 provides a real-name authentication KYC (Know Your Customer) page for the user to enter the personal information (such as the ID number) and authentication information (such as the PIN Code for the natural person certificate or the telecommunication authentication) telephone number).

In the process S35, the authentication platform 12 interfaces with the real-name authentication server 14 to perform real-name authentication of the user’s personal data and authentication data, thereby verifying the authenticity of the user’s personal data and authentication data. If the sex is negative, the whole process is ended, and if the authenticity is yes, then go to the process S36. In short, when the real-name authentication operation of the real-name authentication server 14 is completed, the authentication platform 12 will provide a FIDO registration binding page. At this time, the authentication platform 12 will generate a QR Code (link barcode) to guide the user Download the FIDO application to the user device 10 and generate a registration code in the user device 10.

In process S36, after the user downloads the FIDO application, the FIDO server 13 performs the FIDO registration and binding operation. After the FIDO registration and binding is completed, the authentication platform 12 provides an application for the user software certificate The page is on the user device 10.

In process S37, after the user confirms that the personal data is correct on the application page of the user software certificate, the authentication platform 12 applies for the user software certificate to the cloud signature server 15. When the application is completed, the cloud signature server The device 15 signs the data to obtain the signature result, and returns the signature result or the user software certificate to the authentication platform 12.

In the process S38, the online application service platform 11 obtains the signed data from the authentication platform 12.

Fig. 4 illustrates a flowchart of the FIDO registration and binding operation method according to the first embodiment of the present invention. Please refer to Fig. 1 together. The method described in this first embodiment is a further detail of the process S36 in FIG. 3, that is, after the user downloads the FIDO application, the FIDO server 13 performs the FIDO registration and binding operation in detail.

In process S361, after the user obtains the FIDO application, the user uses the personal data and the registration code to log in to the FIDO application. At this time, the FIDO application will collect the user device 10 (such as a smart phone). ), and send it to the authentication platform 12 together with the user's personal data and the registration code. The binding information includes deviceID, OS version, and device model (mobile phone model).

In the process S362, the authentication platform 12 compares the personal data of the user with the personal data obtained from the real-name authentication server 14 through the registration code. If the comparison is not the same, the entire process ends. If the comparison is correct, Then perform FIDO registration and binding operations.

In process S363, when the FIDO is registered and bound, the authentication platform 12 sends the binding information of the user device 10 sent by the FIDO application to the FIDO server 13, and the FIDO server 13 binds the After the information is combined with a random number (the random number will be stored in the FIDO server 13 later), a SHA-256 hash calculation is performed to generate a FIDO Token, and the FIDO server 13 returns the FIDO Token to the FIDO application.

In the process S364, the FIDO application program then uses the binding information of the FIDO Token and the user device 10 as credentials to initiate the FIDO registration and binding request to the FIDO server 13.

In process S365, after the FIDO server 13 receives the FIDO registration and binding request, it will verify the validity of the FIDO Token. At this time, the FIDO server 13 combines the binding information previously stored in the FIDO again. The random number in the server 13 uses the SHA-256 hash calculation to generate another FIDO Token, and compares it with the FIDO Token. If the FIDO Token is the same as the other FIDO Token, it is confirmed that the FIDO Token is issued. To the user device 10 of the user, the FIDO Token is valid and the FIDO registration binding is completed. On the contrary, if the verification result is invalid or illegal, the whole process is ended. The FIDO Token can prevent malicious The user of has unlimited registration or fraudulent use of the user device 10, and confirms whether the FIDO registration binding request is legal.

In the process S366, when the validity of the FIDO Token is valid and the FIDO registration and binding request is also legal, the FIDO server 13 further performs SHA-256 hash calculation on the binding information to become the user device 10 A unique identification code (registration token) is used to push and broadcast messages in the future to complete the FIDO registration binding operation.

Fig. 5 illustrates the method flow chart of the second embodiment of the present invention, please refer to Fig. 1 together. The second embodiment is a process method of how to perform a signature when the user is not using it for the first time and has completed FIDO registration and binding.

In the process S51, the online application service platform 11 receives a data signing request submitted by the user through a user device 10, and the data signing request has a data that needs to be signed.

In process S52, the online application service platform 11 sends the data signing request to the authentication platform 12. At this time, the authentication platform 12 provides a FIDO authentication page for the user to enter the personal information bound to FIDO registration, and then , The authentication platform 12 submits a FIDO authentication request to the FIDO server 13, so that the FIDO server 13 performs the FIDO authentication operation.

In the process S53, the FIDO server 13 checks whether the user has completed the FIDO registration binding and when it finds that the user has completed the FIDO registration binding, it notifies the authentication platform 12.

In the process S54, the FIDO server 13 pushes the FIDO authentication request to the FIDO application according to the identification code generated when the FIDO registration binding is completed.

In the process S55, the user can perform the FIDO authentication operation to the FIDO server 13 through the FIDO application. When the FIDO authentication operation is completed, an authentication result is generated, and the FIDO server 13 returns the authentication result to the authentication. Platform 12.

In the process S56, the authentication platform 12 checks whether the authentication result is passed, if not, the whole process is ended, and if it is passed, it proceeds to the process S57.

In the process S57, if the authentication result is passed, the authentication platform 12 submits the data signing request to the cloud signing server 15, and the cloud signing server 15 signs the data to obtain the signing result , And then return the signature result to the authentication platform 12.

In the process S58, the online application service platform 11 obtains the signed data from the authentication platform 12.

Figure 6 illustrates the flow chart of the method for the user of the present invention to obtain the completed signature data. Please also refer to Figure 1. This process method is a further description of the process S38 in the first embodiment and the process S58 in the second embodiment, that is, the detailed process for the online application service platform 11 to obtain the signed data from the authentication platform 12.

In the process S61, the authentication platform 12 receives the signature result or the user software certificate (the user only has the user software certificate for the first use) and stores it in a database, and the authentication platform 12 generates a Authorization code (AuthZ Code), according to the callback URL of the registration information, the authorization code is called back (CallBack) or returned to the online application service platform 11.

In the process S62, the online application service platform 11 makes a request to the authentication platform 12 to obtain the signature data. The content of the request to obtain the signature data includes the service ID, the service interface password, the authorization code, and the callback URL. .

In the process S63, after the authentication platform 12 receives the request to obtain the signature data, it compares whether the content of the request to obtain the signature data is valid, if it is invalid, the whole process is ended, and if it is valid, it proceeds to the process S64.

In the process S64, if the authentication platform 12 confirms that it is valid, it will generate an identification credential and send it back to the online application service platform 11. The content of the identification credential includes the user’s personal data, the service ID, and the data The time of the signature request, the signature result, the user software certificate, and the issuance time of the identification credential. At this time, the authentication platform 12 also uses a platform private key to provide an identification credential signature to the identification credential.

In process S65, after the online application service platform 11 receives an authentication platform certificate sent by the authentication platform 12, and the identification certificate is signed with the identification certificate, it can use a platform public key in the authentication platform certificate to verify The signature of the identification voucher is used to obtain the completed signature data in the signature result of the identification voucher.

In summary, the FIDO signature management system and method based on real-name authentication proposed by the present invention have the following advantages and technical effects: First, the present invention adopts a user real-name authentication mechanism. For online application services, it is based on real-name authentication. The authentication mechanism uses personal data to confirm the user’s identity. Compared with the general non-real-name authentication mechanism that uses an anonymous account, it can prove the user’s true identity; second, the present invention can register and bind users through FIDO Token technology to avoid malicious Users abuse the FIDO agreement to deceive the authentication platform; third, the present invention uses FIDO authentication technology for identity verification, which can replace traditional OTP authentication and can be combined with increasingly mature biometrics to provide safe and convenient identity verification. In addition, FIDO authentication technology can avoid the two security problems of OTP technology better than OTP technology. That is, the short message sent by OTP technology through the telecommunication communication infrastructure may have the risk of being transferred to the attacker's mobile device, and A Trojan horse program may be installed on the user’s mobile device to intercept the OTP content, which may lead to the leakage of verification information. Fourth, as long as the user completes the real-name authentication and FIDO registration binding for the first time, the user can perform data in different online application services The signature management operation can increase user convenience. Fifth, in the present invention, the authentication platform provides the service of obtaining the signature data to the online application service platform (server to server), which uses the authorization code (AuthZ Code) security mechanism to Control the acquisition of signature data and greatly improve the security of signature data acquisition.

1‧‧‧FIDO signature management system based on real-name authentication

10‧‧‧User device

11‧‧‧Online Application Service Platform

12‧‧‧Authentication platform

13‧‧‧FIDO server

14‧‧‧Real-name authentication server

15‧‧‧Cloud Signature Server

Claims (14)

A FIDO signature management system based on real-name authentication, which includes: an online application service platform, which receives and forwards data signing requests with data that needs to be signed by users; an authentication platform, which receives data from the online application service The data signing request of the platform, the authentication platform forwards the data signing request to the FIDO authentication page, so that the user can input the personal data bound to FIDO registration through the user device and the authentication platform sends the FIDO authentication request , Where the personal data includes the ID number; the FIDO server receives the FIDO authentication request from the authentication platform and checks whether the user’s personal data has completed the FIDO registration binding, and the FIDO registration binding If not completed, report to the authentication platform and transfer from the authentication platform to the real-name authentication KYC (Know Your Customer) page for the user to input the personal information and authentication information through the user device, where the authentication information includes PIN code or phone number; the real-name authentication server verifies the authenticity of the personal data and the authentication data, and after the real-name authentication server confirms that the personal data and the authentication data are authentic, the authentication platform generates a link The barcode is used for the user to download a FIDO application (Application) to the user device and to generate a registration code related to the personal data in the real-name authentication server to the user device, so that the FIDO application can When the personal data is logged in with the registration code and the FIDO application collects the binding information of the user’s device, the authentication platform compares the user’s personal data with the individual obtained from the real-name authentication server through the registration code The data, in order to perform the FIDO registration and binding under the correct comparison; and the cloud signature server, which executes the signature of the data in the data signing request, to complete the FIDO registration and binding and the authentication platform provides If the personal information is correct, the cloud signature The server receives the application for the user software certificate from the authentication platform, so that after the application is completed, the cloud signing server will sign the data to obtain the signing result, and then the signing result or the user The software certificate is returned to the authentication platform, where the authentication platform receives the signature result or the user software certificate and stores it in a database, and the authentication platform generates an authorization code and calls back or returns To this online application service platform. For example, the FIDO signature management system based on real-name authentication described in item 1 of the scope of patent application, wherein, when the FIDO registration binding is performed, the authentication platform sends the binding information to the FIDO server for the FIDO server The server combines the binding information with a random number to generate a FIDO token (FIDO Token), the FIDO server returns the FIDO token to the FIDO application, so that the FIDO application uses the FIDO token and The binding information is the credential to initiate the FIDO registration binding request to the FIDO server. For example, the FIDO signature management system based on real-name authentication described in item 2 of the scope of patent application, wherein, after the FIDO server receives the FIDO registration binding request, it combines the binding information with the FIDO server The random number is used to generate another FIDO token, and by confirming whether the FIDO token is the same as the other FIDO token, to determine the validity of the FIDO token and the legality of the FIDO registration binding request, so as to The FIDO registration binding is completed when the FIDO token is valid and the FIDO registration binding request is legal, wherein the FIDO server generates an identification code of the user device according to the binding information. For example, the FIDO signature management system based on real-name authentication described in item 1 of the scope of patent application, wherein, when the FIDO server receives the FIDO authentication request and checks that the user’s personal data has completed the FIDO registration binding, The FIDO server binds according to the FIDO registration An identification code generated upon completion, pushes the FIDO authentication request to the FIDO application, so that the user can perform FIDO authentication with the FIDO server through the FIDO application. For example, the FIDO signature management system based on real-name authentication described in item 4 of the scope of patent application, wherein after the FIDO server performs the FIDO authentication operation, a authentication result is generated and sent back to the authentication platform for the purpose of When the authentication result is confirmed to be passed, the authentication platform submits the data signing request to the cloud signing server to obtain the signing result after the cloud signing server signs the data. The chapter results are returned to the authentication platform. For example, the FIDO signature management system based on real-name authentication described in item 1 of the scope of patent application, in which, after the online application service platform receives the authorization code, it will submit a request to the authentication platform to obtain the signature information within a valid period of time. Request, to generate an identification credential when the authentication platform compares the content of the request to obtain the signature data to be valid, and return the identification credential to the online application service platform, wherein the request to obtain the signature data contains the content Including the service ID, service interface password, authorization code and callback URL, and the content of the identification credential includes the signature result. For example, the FIDO signature management system based on real-name authentication described in item 6 of the scope of patent application, wherein the authentication platform uses a platform private key to sign the identification credential to become an identification credential signature, and the online application service platform receives After obtaining the authentication platform certificate from the authentication platform, the identification certificate and the signature of the identification credential, a platform public key in the authentication platform certificate is used to verify the signature of the identification credential, so as to obtain the signature data in the identification credential. A FIDO signature management method based on real-name authentication, which includes: the online application service platform issues a data signature request with data that needs to be signed by the user; The authentication platform receives the data signing request issued by the online application service platform and forwards the data signing request to the FIDO authentication page, so that the user can input the personal data bound to FIDO registration through the user device and use the The authentication platform issues a FIDO authentication request, where the personal data includes an ID number; the FIDO server receives the FIDO authentication request issued by the authentication platform and checks whether the user’s personal data has completed the FIDO registration binding; When FIDO registration and binding are not completed, the FIDO server reports the authentication platform and redirects the authentication platform to the real-name authentication KYC (Know Your Customer) page for the user to enter the personal information and authentication through the user device Data, where the authentication information includes a PIN code or phone number; the real-name authentication server verifies the authenticity of the personal information and the authentication information, and after the personal information and the authentication information are confirmed to be authentic, the authentication platform generates a Link the barcode for the user to download a FIDO application (Application) to the user device and generate a registration code associated with the personal data in the real-name authentication server for the user device; in the FIDO application When the personal data is logged in with the registration code and the FIDO application collects the binding information of the user device, the authentication platform compares the personal data of the user with the personal data obtained from the real-name authentication server through the registration code , To perform the FIDO registration and binding under the correct comparison; after the FIDO registration and binding is completed and the personal information provided by the authentication platform is correct, the authentication platform applies for the user software certificate to the cloud signing server to serve After the application is completed, the cloud signature server signs the data to obtain the signature result, and then returns the signature result or the user software certificate to the authentication platform; and the authentication platform receives the signature The result or the user software certificate is then stored in a database, and the authentication platform generates an authorization code and calls back or sends it back to the online application service platform. For example, the FIDO signature management method based on real-name authentication described in item 8 of the scope of patent application, wherein when the FIDO registration binding is performed, the authentication platform sends the binding information to the FIDO server, and the FIDO The server combines the binding information with a random number to generate a FIDO token, and then returns the FIDO token to the FIDO application, and the FIDO application uses the FIDO token and the binding information as credentials to send The FIDO server initiates the FIDO registration binding request. For example, the FIDO signature management method based on real-name authentication described in item 9 of the scope of patent application, wherein, after the FIDO server receives the FIDO registration binding request, it combines the binding information with the FIDO server Random numbers are used to generate another FIDO token, and by confirming whether the FIDO token is the same as the other FIDO token, the validity of the FIDO token and the legality of the FIDO registration binding request can be judged. The FIDO registration binding is completed when the FIDO token is valid and the FIDO registration binding request is legal, wherein the FIDO server generates an identification code of the user device according to the binding information. For example, the FIDO signature management method based on real-name authentication described in item 8 of the scope of patent application, wherein, when the FIDO server receives the FIDO authentication request and checks that the user’s personal data has completed the FIDO registration binding, The FIDO server pushes the FIDO authentication request to the FIDO application according to an identification code generated when the FIDO registration and binding is completed, so that the user can perform FIDO authentication with the FIDO server through the FIDO application operation. For example, the FIDO signature management method based on real-name authentication described in item 11 of the scope of patent application, wherein after the FIDO server performs the FIDO authentication operation, a authentication result is generated and sent back to the authentication platform for the purpose of When the certification result is confirmed to be passed, the certification level The station submits the data signing request to the cloud signing server to obtain the signing result after the cloud signing server signs the data, and returns the signing result to the authentication platform. For example, the FIDO signature management method based on real-name authentication described in item 8 of the scope of patent application, wherein, after the online application service platform receives the authorization code, it will submit a request to the authentication platform to obtain the signature data within a valid period of time. Request, to generate an identification credential when the authentication platform compares the content of the request to obtain the signature data to be valid, and return the identification credential to the online application service platform, wherein the request to obtain the signature data contains the content Including the service ID, service interface password, authorization code and callback URL, and the content of the identification credential includes the signature result. For example, the FIDO signature management method based on real-name authentication described in item 13 of the scope of patent application, wherein the authentication platform uses a platform private key to sign the identification credential to become an identification credential signature, and the online application service platform receives After obtaining a certification platform certificate from one of the certification platforms, the identification credential and the signature of the identification credential, a platform public key in the certification platform credential is used to verify the signature of the identification credential, so as to obtain the signature data in the identification credential.

Images