TWI772225B - An attendance punch system and method based on fido, and computer-readable medium thereof - Google Patents

Abstract

The present invention provides an attendance punch system and method based on FIDO (Fast IDentity Online), and a computer-readable medium thereof, including an attendance management device, a FIDO device, a card punch device, and at least one mobile device, wherein the mobile device scans a punch bar code on the card punch device to send a punch authentication request with the punch bar code into the attendance management device, and the attendance management device sends back an initiating punch authentication packet to the mobile device, so that the mobile device triggers a FIDO authentication process to perform biometric authentication and produce a FIDO authentication packet. And the mobile device provides the FIDO authentication packet to the FIDO device for analysis. When the analysis is successful, complete the FIDO attendance punching operation. In this way, the present invention combines FIDO key and biometric authentication to perform card punching operation, so as to prevent others from fraudulent use of identity, thereby improving the company's personnel management efficiency and the security of the attendance punch system.

Description

A FIDO-based punch card system, method and computer-readable medium thereof

The present invention relates to a punch-in technology, in particular to a punch-in system and method based on FIDO (Fast IDentity Online) and a computer-readable medium thereof.

In the conventional technology, the company manages the attendance status of employees using traditional clock clocks or proximity cards for attendance clocking. However, in the existing punch-in method, it is only necessary to obtain the punch-in paper or the proximity card of another person to punch in with a fake identity.

In addition, although there are other attendance punch-in technologies in the prior art, which can prevent punch-in with counterfeit identities, they usually have the concern of infringing on employees' personal information.

In this regard, it is difficult for the company to use conventional techniques to effectively determine whether the employee punches in or not without infringing on the employee's personal information, which results in the company's inability to effectively manage employee absence from work, and creates many unpredictable hidden dangers.

Therefore, how to provide an attendance punch-in mechanism to confirm that the punch-in is indeed the employee himself without infringing on the employee's personal information, so as to effectively prevent others from using their identities to punch-in effectively. And improving the management efficiency of the company's personnel and the security of the punch-in system has become an urgent issue for the industry to solve.

In order to solve the aforementioned conventional technical problems or provide related effects, the present invention provides a card punching system based on FIDO (Fast IDentity Online), which includes: a punching device, which displays a first punching barcode; at least one terminal device, which is Scan the first punching barcode displayed by the punching device, so that after scanning the first punching barcode, a first punching authentication request with the first punching barcode and an identification data is sent; a management device is communicatively connected to the a terminal device, after receiving the first punch-in authentication request, to make the management device confirm whether the first punch-in barcode in the first punch-in authentication request is within the time limit and has not been used; a FIDO device, which is communicatively connected to the The management device, so that when the management device confirms that the first punch-in barcode is within the time limit and has not been used out of date, the management device obtains the identification data corresponding to the identification data from the FIDO device according to the identification data in the first punch-in authentication request A certificate identification code list, wherein after the management device generates a punch-in authentication packet according to the certificate identification code list, it transmits the punch-in authentication packet to the terminal device, so that the terminal device receives the punch-in authentication packet When the FIDO authentication process is triggered, the terminal device generates a FIDO authentication packet for the terminal device to provide the FIDO authentication packet to the FIDO device through the management device for parsing. After parsing by the FIDO device, if the FIDO If the authentication packet is legal, valid and/or correct, the FIDO device is made to notify the management device and the terminal device to complete the punch-in operation.

The present invention further provides a card punching method based on FIDO, which includes: scanning a first punching barcode displayed by a punching device by at least one terminal device, so that the terminal device scans the punching card After the first punching barcode, make the terminal device send a first punching authentication request with the first punching barcode and an identification data; a management device receives the first punching barcode and the identification data from the terminal device. The first punch-in authentication request, so that when the management device confirms that the first punch-in barcode in the first punch-in authentication request is within the time limit and has not been used out of date, the management device sends a punch-in authentication request based on the identification data in the first punch-in authentication request to a The FIDO device obtains a certificate identification code list corresponding to the identification data; and the management device generates a punch-in authentication packet according to the certificate identification code list, and then the management device transmits the punch-in activation authentication packet to the terminal device to When the terminal device receives the punch-in authentication packet, trigger the FIDO authentication process, so that the terminal device produces a FIDO authentication packet, and then the terminal device provides the FIDO authentication packet to the FIDO device through the management device for processing. Analysis, so that when it is confirmed that the FIDO authentication packet is legal, valid and/or correct after analysis by the FIDO device, the FIDO device notifies the management device and the terminal device to complete the punch-in operation.

In one embodiment, when the terminal device receives the activation punch-in authentication packet and triggers the FIDO authentication process, the terminal device is instructed to perform biometric authentication, and if the biometric authentication is successful, the terminal device is instructed to use the activation punch-in. The certificate identification code list in the authentication packet is compared with the binding certificate identification code of a FIDO private key in the terminal device, so that the binding certificate identification code of the FIDO private key that is compared by the terminal device does appear in the terminal device. When the certificate identification code is in the list, make the terminal device use the FIDO private key to generate the FIDO authentication packet.

In one embodiment, after the management device receives the FIDO authentication packet from the terminal device, it instructs the management device to transmit the FIDO authentication packet to the FIDO device, so that the FIDO device can rely on the FIDO in the FIDO authentication packet. The binding certificate identifier of the private key is derived from this Find the corresponding FIDO public key in the public key library of the FIDO device, and then make the FIDO device use the FIDO public key to parse the FIDO authentication packet through an asymmetric encryption algorithm.

In one embodiment, after the management device receives the FIDO authentication packet from the terminal device, it instructs the management device to generate an authentication barcode according to the FIDO authentication packet, and then returns the authentication barcode to the terminal device to It is displayed on the terminal device for the punching device to scan the authentication barcode.

In one embodiment, after the punching device scans the authentication barcode, the punching device is instructed to parse the authentication barcode to generate a second punching authentication request with the authentication barcode, and then transmit the second punching authentication request to the management device, After the management device confirms that the authentication barcode in the second punch-in authentication request is within the time limit and has not been used, the management device restores the authentication barcode to the FIDO authentication packet, so as to transmit the FIDO authentication packet to the FIDO device for analysis.

In one embodiment, the FIDO authentication packet produced by the terminal device further includes the positioning information of the terminal device, so that when the FIDO device notifies the management device that the FIDO authentication packet is legal, valid and/or correct, According to the positioning information of the terminal device in the FIDO authentication packet, the management device determines whether the terminal device is located in the legal area to perform the punch-in operation, so that the management device confirms that the terminal device is located in the legal area to perform the punch-in operation. , complete the punching job.

The present invention further provides a computer-readable medium for use in a computer or computing device having a processor and/or memory, the computer or the computing device executes an object program and the computer-readable medium through the processor and/or memory , and is used to execute the FIDO-based punching method described above when the computer-readable medium is executed.

As can be seen from the above, the FIDO-based card punching system, method and computer-readable medium of the present invention utilizes the FIDO authentication packet produced by the terminal device using the FIDO key, and triggers the FIDO authentication process to enable the terminal device to authenticate the user to the user. The biometric authentication is performed so that the relationship between the terminal device and the user can be clearly bound and verified. Therefore, compared with the conventional technology, the problem of punch-in will occur. The present invention combines the FIDO key and biometric authentication to perform punch-in operation. , and strengthen the security of the certification process through the FIDO agreement to achieve identity verification, prevent borrowing and use by others, and improve the management efficiency of the company's personnel and the security of the punch-in system.

1: Punch card system based on FIDO

10: Management device

101: Real-name audit module

102: Terminal binding module

103: punch-in authentication module

104: Barcode generation module

20: FIDO device

201:FIDO Verification Module

202: Public key library

30: Punch card device

301: Barcode Display Module

302: Barcode Scanning Module

40: Terminal device

S21 to S24: Steps

S31 to S37: Steps

S41 to S44: Steps

FIG. 1 is a schematic diagram of the architecture of the FIDO-based punch card system of the present invention;

2 is a schematic flowchart of a method for binding a terminal device according to the present invention;

FIG. 3 is a schematic flowchart of a method of punching a card according to a first embodiment of the present invention; and

FIG. 4 is a schematic flowchart of a method of punching a card according to a second embodiment of the present invention.

The following specific embodiments are used to illustrate the implementation of the present invention, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification.

It should be noted that the structures, proportions, sizes, etc. shown in the drawings in this specification are only used to cooperate with the contents disclosed in the specification for the understanding and reading of those who are familiar with the art, and are not intended to limit the implementation of the present invention. It has no technical substantive significance, and any The modification of the structure, the change of the proportional relationship or the adjustment of the size should still fall within the scope that the technical content disclosed in the present invention can cover without affecting the effect and the purpose that the present invention can produce. At the same time, terms such as "a", "first", "second", "upper" and "lower" quoted in this specification are only for the convenience of description and are not used to limit the scope of the present invention. The scope of implementation and the change or adjustment of its relative relationship shall be regarded as the scope of implementation of the present invention without substantially changing the technical content.

FIG. 1 is a schematic diagram of the structure of a punch card system 1 based on FIDO (Fast IDentity Online) of the present invention. As shown in FIG. 1 , the FIDO-based punch card system 1 includes: a management device 10 , a FIDO device 20 , a punch card device 30 and at least one terminal device 40 , wherein the management device 10 includes a real-name verification module 101 , a The terminal binding module 102, a punch card authentication module 103 and a barcode generation module 104; the FIDO device 20 includes a FIDO verification module 201 and a public key library 202; and the punch card device 30 includes a barcode display module 301 and a The barcode scanning module 302 . On the other hand, the management device 10 communicates with the FIDO device 20 , the card punching device 30 and the terminal device 40 by using various networks (eg, the Internet).

Specifically, both the management device 10 and the FIDO device 20 can be built in a server (such as a general-purpose server, a file-type server, a storage unit-type server, etc.) and an electronic device with a suitable computing mechanism, such as a computer. The device 30 can be built in a single-chip microcontroller, a tablet computer, a computer, or other electronic equipment with a suitable calculation mechanism, wherein, each module in the management device 10, the FIDO device 20 and the punching device 30 can be software, hardware, or software. firmware or firmware; in the case of hardware, it may be a processing unit, processor, computer or server with data processing and computing capabilities; in the case of software or firmware, it may include a processing unit, processor, computer or server It is an instruction that can be executed by the server, and can be installed on the same hardware device or distributed in different multiple hardware devices. In addition, the terminal device 40 is User A's smart phone, tablet computer, personal computer or other portable electronic device, etc., but not limited to the above.

FIG. 2 is a schematic flowchart of a method for binding a terminal device according to the present invention, and is also described with reference to FIG. 1 , wherein the method process includes the following steps S21 to S24:

In step S21, the terminal binding module 102 of the management device 10 receives a binding request with identification data from the terminal device 40 of a user, wherein, taking the employee of the company as an example, the identification data includes the employee. Name, employee number or mobile phone number, etc., but not limited.

In step S22, the real-name verification module 101 of the management device 10 performs real-name verification on the identification data in the binding request sent by the terminal device 40, so that after the terminal device 40 passes the real-name verification, the terminal binding module 102 An allow-binding packet is generated to transmit the allow-binding packet back to the terminal device 40 .

In step S23, after the terminal device 40 receives the permission binding packet from the management device 10, it triggers the FIDO authentication process for the terminal device 40 to perform biometric authentication on the employee. When the biometric authentication is successful, the employee who punched the card is confirmed. When it is the user, make the terminal device 40 generate the FIDO public key and the corresponding FIDO private key to generate a FIDO registration packet.

In one embodiment, the FIDO authentication process can use the FIDO1 or FIDO2 protocol, and the FIDO public key and the FIDO private key have the same unique binding certificate identification code (or binding certificate ID), and the FIDO registration packet contains the The terminal device 40 uses the identification data encrypted by the FIDO private key and the FIDO public key.

In one embodiment, the terminal device 40 uses biometric identification technologies such as fingerprint identification or face identification to perform biometric authentication on the employee to confirm whether the employee who punched the card is the person himself, which is not limited to any method in the present invention. Biometric authentication.

In step S24, the FIDO verification module 201 of the FIDO device 20 receives the FIDO registration packet from the terminal device 40 through the management device 10, so that the FIDO verification module 201 uses the FIDO public key in the FIDO registration packet to perform asymmetric encryption The algorithm parses the encrypted identification data in the FIDO registration packet. If the FIDO registration packet is legal, valid and/or correct, the FIDO verification module 201 will parse the FIDO public key and its binding certificate identification code, identification data, etc. The information is stored in the public key database 202 of the FIDO device 20 to complete the binding of the terminal device 40 .

In one embodiment, the public key library 202 records the bound certificate identifiers of the FIDO public key and the FIDO private key in a certificate identifier list of the employee. In other words, an employee can use different terminal devices to make a binding request, and the public key database 202 records the FIDO public key and The binding certificate identifier of the FIDO private key.

In one embodiment, the FIDO verification module 201 uses an asymmetric encryption algorithm based on Elliptic Curve Cryptography (ECC) to parse the FIDO registration packet.

FIG. 3 is a schematic flow chart of the method of punching a card according to the first embodiment of the present invention, and is described with reference to FIG. 1 and FIG. 2 , wherein the method flow includes the following steps S31 to S37:

In step S31, an employee scans a first punch-in barcode (such as a one-dimensional barcode or a two-dimensional barcode, etc.) displayed by the barcode display module 301 of a punch-in device 30 through the bound terminal device 40 to perform punch-in operation, so that Launch an attendance check-in webpage or an attendance check-in in the terminal device 40 A card application (Application, APP for short), and then send a first punch authentication request with the first punch barcode and identification information to the management device 10 through the attendance punch webpage or the attendance punch application, wherein the first punch barcode can be QR code, PDF417 code, etc., but this is not limited.

In step S32, the punch-in authentication module 103 of the management device 10 receives the first punch-in authentication request from the terminal device 40 for the punch-in authentication module 103 to confirm whether the first punch-in barcode in the first punch-in authentication request is within the time limit and not used.

In step S33, when the punch-in authentication module 103 confirms that the first punch-in barcode in the first punch-in authentication request is within the time limit and has not been used, the punch-in authentication module 103 notifies the barcode generation module 104 of the management device 10 to generate a barcode. The second punch-in barcode (such as a one-dimensional barcode or a two-dimensional barcode, etc.), wherein the second punch-in barcode may be a QR code, a PDF417 code, etc., but not limited thereto.

In step S34, the management device 10 transmits the second punch barcode generated by the barcode generating module 104 to the punch device 30, so that the barcode display module 301 replaces the first punch barcode and the second punch barcode with the second punch barcode. displayed on the punching device 30 .

In step S35, the punch-in authentication module 103 obtains a certificate identification code list corresponding to the identification data from the public key database 202 of the FIDO device 20 according to the identification data in the first punch-in authentication request.

In step S36, the punch-in authentication module 103 generates a punch-in authentication packet according to the certificate identification code list, and then transmits it to the terminal device 40, so that when the terminal device 40 receives the punch-in authentication packet, it triggers the FIDO authentication process. The terminal device 40 is asked to perform biometric authentication on the employee; if the biometric authentication is successful, the terminal device 40 compares the binding certificate identification code of the FIDO private key in the terminal device 40 with the certificate identification code list in the activation punch authentication packet. Therefore, when the terminal device 40 compares the bound certificate identifier of its FIDO private key to appear in the certificate identifier list, the terminal device 40 uses the FIDO private key to generate a FIDO authentication packet.

In step S37, after the FIDO authentication module 201 of the FIDO device 20 receives the FIDO authentication packet from the terminal device 40 through the management device 10, the FIDO authentication module 201 is made to rely on the binding certificate of the FIDO private key in the FIDO authentication packet The identification code finds the corresponding FIDO public key from the public key base 202, and the FIDO verification module 201 uses the FIDO public key to parse the FIDO authentication packet through an asymmetric encryption algorithm. After parsing, if the FIDO authentication packet is To be legal, valid and/or correct, that is, the management device 10 is notified to complete the punch-in operation, and the terminal device 40 is notified through the management device 10 to complete the punch-in operation.

In one embodiment, the FIDO authentication module 201 uses an asymmetric encryption algorithm based on Elliptic Curve Cryptography (ECC) to parse the FIDO authentication packet.

FIG. 4 is a schematic flowchart of a method of punching a card according to a second embodiment of the present invention, and is described with reference to FIGS. 1 to 3 together. In addition, the same points between the second embodiment and the first embodiment will not be repeated.

In this embodiment, the second embodiment executes the above steps S31 to S36 similarly to the first embodiment, so that after the terminal device 40 uses the FIDO private key to generate a FIDO authentication packet, the second embodiment executes the following method flow: To perform punch-in work. The method flow includes the following steps S41 to S44:

In step S41, the punch-in authentication module 103 of the management device 10 receives the FIDO authentication packet from the terminal device 40, and the barcode generating module 104 of the management device 10 generates an authentication barcode (such as a one-dimensional barcode or a two-dimensional barcode) according to the FIDO authentication packet. dimensional barcode, etc.), so that the management device 10 sends the authentication barcode back to the terminal device 40 through an attendance check-in webpage or an attendance check-in application program, The authentication barcode is then displayed on the terminal device 40, wherein the authentication barcode can be a QR code, a PDF417 code, etc., but is not limited thereto.

In step S42, the barcode scanning module 302 of the punching device 30 scans the authentication barcode displayed on the terminal device 40, so that the barcode scanning module 302 parses the authentication barcode to generate a second punching authentication request with the authentication barcode, and then The second punch-in authentication request is transmitted to the punch-in authentication module 103 of the management device 10 .

In step S43, the punch-in authentication module 103 confirms whether the authentication barcode in the second punch-in authentication request is within the validity period and has not been used, so that the punch-in authentication module 103 confirms that the authentication barcode in the second punch-in authentication request is within the validity period. If it is not used, the punch-in authentication module 103 restores the authentication barcode to a FIDO authentication packet, and then transmits the FIDO authentication packet to the FIDO device 20 .

In step S44, the FIDO verification module 201 finds out the corresponding FIDO public key from the public key database 202 according to the binding certificate identification code of the FIDO private key in the FIDO verification packet, and the FIDO verification module 201 uses the FIDO public key to obtain the corresponding FIDO public key. The key parses the FIDO authentication packet through an asymmetric encryption algorithm. After parsing, if the FIDO authentication packet is legal, valid and/or correct, the management device 10 is notified to complete the punch-in operation, and the terminal device is notified through the management device 10. 40 Complete the punch-in assignment.

In another embodiment, the FIDO authentication packet produced by the terminal device 40 further includes the positioning information of the terminal device 40 , such as the latitude and longitude of geographic coordinates, so that the FIDO authentication module 201 of the FIDO device 20 notifies the management device 10 of the punch card When the authentication module 103 FIDO authentication packet is legal, valid and/or correct, the punch-in authentication module 103 determines whether the terminal device 40 is located in a legal area to punch in according to the positioning information of the terminal device 40 in the FIDO authentication packet. Operation. Therefore, when the punch-in authentication module 103 confirms that the terminal device 40 is located in a legal area to perform the punch-in operation, the punch-in operation is completed.

In addition, the present invention also discloses a computer-readable medium, which is applied to a computing device or computer having a processor (eg, CPU, GPU, etc.) and/or memory, and stores instructions, and can utilize the computing device or computer. The computer executes the computer-readable medium through a processor and/or a memory, so as to execute the above-mentioned methods and steps when executing the computer-readable medium.

The following example illustrates an embodiment of the present invention for actually executing the FIDO attendance punching operation, and referring to FIG. 1 to FIG. 4 together.

In this embodiment, an employee scans the QR code (such as the first punch barcode) displayed on the punching device 30 through a bound smartphone (such as the terminal device 40 ) to perform the FIDO attendance punching operation, and the employee After scanning the QR code on the employee’s smartphone, start the browser APP (such as Google chrome, Safari, etc.) to display an attendance check-in webpage, or launch an attendance check-in application installed on the employee’s smartphone, so that The employee's smartphone sends a first punch-in authentication request with the QR code and the employee's identification information to the management device 10 through the attendance punch-in webpage or the attendance punch-in application.

Furthermore, after receiving the first punch-in authentication request from the employee's smartphone, the management device 10 will confirm whether the QR code in the first punch-in authentication request is within the time limit and has not been used, so as to confirm that the QR code is in the Within the time limit and not out of date, the management device 10 obtains the employee's certificate identification code list corresponding to the employee's identification data from the public key database 202 of the FIDO device 20 according to the employee's identification data in the first punch-in authentication request. .

Therefore, the management device 10 generates a punch-in authentication packet according to the employee's certificate identification code list, and then transmits it to the employee's smartphone, thereby triggering the FIDO authentication flow process, so that the employee's smartphone can perform biometric authentication such as fingerprint recognition and face recognition. The certificate identification code list of the employee is compared with the binding certificate identification code of the FIDO private key in the employee's smartphone, so that the binding certificate identification code of the FIDO private key of the employee's smartphone is compared to the certificate identification code. When it is in the code list, a FIDO authentication package is produced by the employee's smartphone using the FIDO private key.

In one embodiment, after the FIDO device 20 receives the FIDO authentication packet from the employee's smartphone, the FIDO device 20 searches the public key database 202 according to the binding certificate identifier of the FIDO private key in the FIDO authentication packet. The corresponding FIDO public key is then used by the FIDO device 20 to parse the FIDO authentication packet through an asymmetric encryption algorithm based on Elliptic Curve Cryptography (ECC). After parsing, if the FIDO authentication packet is valid , valid and/or correct, that is, the management device 10 and the employee's smart phone are notified to complete the FIDO attendance punch-in operation.

In another embodiment, the management device 10 produces an authentication QR code (such as an authentication barcode) according to the FIDO authentication packet, and then returns the authentication QR code through the attendance check-in webpage or attendance check-in application on the employee's smartphone Give the employee's smart phone to display the authentication QR code on the employee's smart phone, so that the employee can hold his smart phone and scan the authentication QR code for the punch-in device 30 to scan the punch-in device 30 After parsing the authentication QR code, a second punch-in authentication request with the authentication QR code is generated, so as to transmit the second punch-in authentication request to the management device 10 .

Next, after the management device 10 confirms that the authentication QR code in the second punch-in authentication request is within the time limit and has not been used, the management device 10 restores the authentication QR code to a FIDO authentication packet, Then, the FIDO authentication packet is transmitted to the FIDO device 20 for analysis of the FIDO authentication packet by the FIDO device 20 .

To sum up, the FIDO-based punch card system, method and computer-readable medium of the present invention utilize the FIDO authentication packet produced by the terminal device using the FIDO key, and trigger the FIDO authentication process to enable the terminal device to use the FIDO key. The user performs biometric authentication, which can clearly bind and verify the relationship between the terminal device and the user. Therefore, compared with the conventional technology, the problem of punching the card on behalf of the user can be avoided. And further improve the management efficiency of the company's personnel and the security of the punch card system.

In addition, the FIDO-based punch card system, method and computer-readable medium thereof of the present invention have the following advantages or technical effects.

1. The present invention solves the problem of swiping on behalf of traditional clocks or inductive card punching, and combines the FIDO key and the biometric authentication of the mobile device (such as a smart phone) to perform the FIDO attendance punching operation, thereby strengthening the present invention. Authentication process security to achieve identity audit and prevent others from being used for non-fraudulent use.

2. According to the EU General Data Protection Regulation (GDPR), the present invention takes into account the user's personal information. Through the above content, the present invention does not store the user's personal biometric privacy on a third-party system. , which can reduce the user's doubts in use, and it is not necessary for the company to spend effort to protect the leakage of employees' biological information, thereby avoiding increasing the company's operating costs and avoiding personal data problems.

3. The present invention can utilize the employee's mobile device (such as a smart phone) to directly perform the FIDO attendance check-in operation without additionally installing other application programs or purchasing a special device. Furthermore, the punching device can also be constructed by using smart devices (smartphones, tablet computers), so as to avoid companies from spending extra costs to construct punching systems, and increase the willingness to build punching systems.

4. The present invention disassembles the FIDO protocol network communication process under the principle of not destroying the FIDO protocol, so as to present the barcode on the punch card device and mobile device (such as a smart phone), and then connect the process through the behavior of scanning the barcode, to Prevent others from using their identities to punch cards. In addition, the present invention can also be applied to online login scenarios, access control, and fast real-name authentication and customs clearance scenarios.

The above-mentioned embodiments are only used to illustrate the principle and effect of the present invention, but are not intended to limit the present invention. Any person skilled in the art can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention should be listed in the scope of the patent application.

1: Punch card system based on FIDO

10: Management device

101: Real-name audit module

102: Terminal binding module

103: punch-in authentication module

104: Barcode generation module

20: FIDO device

201:FIDO Verification Module

202: Public key library

30: Punch card device

301: Barcode Display Module

302: Barcode Scanning Module

40: Terminal device

Claims (13)

A punch card system based on FIDO (Fast IDentity Online), including: a punch-in device, displaying a first punch-in barcode; At least one terminal device scans the first punching barcode displayed by the punching device, so as to issue a first punching authentication request with the first punching barcode and an identification data after scanning the first punching barcode; a management device, which is communicatively connected to the terminal device, so as to enable the management device to confirm whether the first punch-in barcode in the first punch-in authentication request is within the time limit and has not been used after receiving the first punch-in authentication request; A FIDO device, which is communicatively connected to the management device, so that when the management device confirms that the first punch-in barcode is within the time limit and has not been used out of date, the management device can send the FIDO to the FIDO according to the identification data in the first punch-in authentication request. The device obtains a certificate identification code list corresponding to the identification data, Wherein, after the management device generates a punch-in authentication packet according to the certificate identification code list, it transmits the punch-in authentication packet to the terminal device, so as to trigger the FIDO authentication process when the terminal device receives the punch-in authentication packet And make the terminal device produce a FIDO authentication packet for the terminal device to provide the FIDO authentication packet to the FIDO device through the management device for analysis. After the FIDO device is parsed, if the FIDO authentication packet is legal, If valid and/or correct, the FIDO device will notify the management device and the terminal device to complete the punch-in operation. The FIDO-based punch-in system according to claim 1, wherein when the terminal device receives the punch-in authentication packet and triggers the FIDO authentication process, the terminal device is instructed to enter the punch-in authentication process. Perform biometric authentication, if the biometric authentication is successful, then make the terminal device use the certificate identifier list in the punch-in authentication packet to compare the binding certificate identifier of a FIDO private key in the terminal device, so that the When the binding certificate identification code of the FIDO private key compared by the terminal device does appear in the certificate identification code list, the terminal device uses the FIDO private key to generate the FIDO authentication packet. The FIDO-based punch card system according to claim 1, wherein after the management device receives the FIDO authentication packet from the terminal device, it instructs the management device to transmit the FIDO authentication packet to the FIDO device, so that the FIDO The device finds out the corresponding FIDO public key from the public key database of the FIDO device according to the binding certificate identifier of the FIDO private key in the FIDO authentication packet, and then makes the FIDO device use the FIDO public key to perform asymmetric encryption The algorithm parses the FIDO authentication packet. The FIDO-based punch card system according to claim 1, wherein, after the management device receives the FIDO authentication packet from the terminal device, it instructs the management device to produce an authentication barcode according to the FIDO authentication packet, and then authenticate the The barcode is sent back to the terminal device to be displayed on the terminal device for the punching device to scan the authentication barcode. The FIDO-based card punching system according to claim 4, wherein after the punching device scans the authentication barcode, the punching device is instructed to parse the authentication barcode to generate a second punching authentication request with the authentication barcode, and then the first punching authentication request is generated. The second punch-in authentication request is sent to the management device, so that after the management device confirms that the authentication barcode in the second punch-in authentication request is within the time limit and has not been used, the management device restores the authentication barcode to the FIDO authentication packet , to transmit the FIDO authentication packet to the FIDO device for analysis. The FIDO-based punch card system according to claim 1, wherein the FIDO authentication packet produced by the terminal device further includes the positioning information of the terminal device, so that the FIDO device notifies the management device that the FIDO authentication packet is When it is legal, valid and/or correct, the management device determines whether the terminal device is located in the legal area according to the positioning information of the terminal device in the FIDO authentication packet, and if so, performs the punching operation. A punch-in method based on FIDO (Fast IDentity Online), comprising: At least one terminal device scans the first punching barcode displayed by a punching device, so that after the terminal device scans the first punching barcode, the terminal device sends out a first punching card having the first punching barcode and an identification data authentication request; The first punch-in authentication request is received by a management device, so that when the management device confirms that the first punch-in barcode in the first punch-in authentication request is within the time limit and has not been used out of date, the management device is based on the first punch-in authentication obtaining a list of certificate identifiers corresponding to the identification data from a FIDO device for the identification data in the request; and The management device generates a punch-in authentication packet according to the certificate identification code list, and then the management device transmits the punch-in authentication packet to the terminal device, so as to trigger the FIDO authentication when the terminal device receives the punch-in authentication packet The process is to make the terminal device produce a FIDO authentication packet, and then the terminal device provides the FIDO authentication packet to the FIDO device through the management device for analysis, so as to confirm that the FIDO authentication packet is parsed by the FIDO device. When it is legal, valid and/or correct, the FIDO device notifies the management device and the terminal device to complete the punch-in operation. The FIDO-based punch-in method as described in claim 7, further comprising: when the terminal device receives the punch-in authentication packet and triggers the FIDO authentication process, the terminal device performs biometric authentication, wherein if the biometric authentication is successful , then the terminal device compares the binding certificate identification code of a FIDO private key in the terminal device with the certificate identification code list in the activation punch authentication packet, so as to compare the FIDO private key with the terminal device When the binding certificate identification code of the certificate does appear in the certificate identification code list, the terminal device uses the FIDO private key to generate the FIDO authentication packet. The FIDO-based punching method according to claim 7, further comprising, after the management device receives the FIDO authentication packet from the terminal device, the management device transmits the FIDO authentication packet to the FIDO device, so that the FIDO authentication packet can be sent to the FIDO device by the management device. The device finds out the corresponding FIDO public key from the public key database of the FIDO device according to the binding certificate identifier of the FIDO private key in the FIDO authentication packet, so that the FIDO device can use the FIDO public key to perform asymmetric encryption The algorithm parses the FIDO authentication packet. The FIDO-based punching method as described in claim 7, further comprising, after the management device receives the FIDO authentication packet from the terminal device, the management device produces an authentication barcode according to the FIDO authentication packet, and then authenticates the The barcode is sent back to the terminal device to be displayed on the terminal device for the punching device to scan the authentication barcode. The FIDO-based punching method as described in claim 10, further comprising, after the punching device scans the authentication barcode, the punching device parses the authentication barcode to generate a second punching authentication request with the authentication barcode, so as to serve the first punching authentication request. The second punch-in authentication request is sent to the management device, and the management device confirms that the authentication barcode in the second punch-in authentication request is within the time limit and has not been After use, the management device restores the authentication barcode to the FIDO authentication packet, so as to transmit the FIDO authentication packet to the FIDO device for analysis. The FIDO-based punching method according to claim 7, wherein the FIDO authentication packet produced by the terminal device further includes the positioning information of the terminal device, so that the FIDO device notifies the management device that the FIDO authentication packet is When it is legal, valid and/or correct, the management device determines whether the terminal device is located in the legal area according to the positioning information of the terminal device in the FIDO authentication packet, and if so, performs the punching operation. A computer-readable medium used in a computing device or a computer and storing instructions to execute the FIDO-based punching method as described in any one of claims 7 to 12.

Images