TWI831029B - System for confirming identity on different devices by verifying certification and verification code and method thereof - Google Patents

Abstract

A system for confirming identity on different devices by verifying a certification and a verification code and a method thereof are provided. By signing personal data to generate a signature value by a first client, generating a coded message by a server after verifying the signature value, transmitting the coded message from the server to the first client, obtaining the coded message through the first client by a second client, transmitting he personal data and a token from the second client to the server based on connection information after the second client decodes the coded message for obtaining the connection information, the personal data and the token, generating a verification code after the server confirms the token, transmitting the verification code from the server to the second client, obtaining the verification code via the second client by the first client, and transmitting the verification code from the first client to the server, and verifying the verification code by the server for confirming user identity, the system and the method can confirm user identity via server, and can achieve the effect of using certificates to confirm users of different devices are the same one.

Description

System and method for confirming identity on different devices based on certificates and verification data

An identity verification system and method thereof, specifically refers to a system and method for confirming identity on different devices based on certificates and verification data.

Electronic vouchers, also known as digital vouchers, are an identification mechanism used in computer systems. An electronic certificate is an identity certification agency that adds the signature of the identity certification agency to the digital identity certificate after confirming the user's digital identity certificate. This behavior indicates that the identity certification agency has identified the user as possessing the digital identity certificate. An electronic certificate is a computer file or a set of computer files, which records the owner's identity information and a set of public information (public keys). The public key corresponds to a set of private keys unique to the owner of the electronic certificate. The owner of the electronic certificate can authenticate his or her identity to the computer system through the private key to access or use a specific computer service.

In recent years, due to the popularity of Internet services, identification methods on the Internet have become increasingly important. Currently, one of the main methods of identification on the Internet is the use of electronic vouchers. However, the current application process for electronic vouchers requires identity confirmation, which means that the applicant must bring his or her identity document in person. Go to the counter for applying for electronic vouchers. Once the applicant is inconvenient to go to the counter in person due to personal or environmental factors, he will not be able to complete the application for electronic vouchers. This is inconvenient for applicants of electronic vouchers.

In summary, it can be seen that there has long been a problem in the prior art that applying for an electronic voucher requires the applicant to visit the counter in person to confirm the identity, causing inconvenience to the applicant. Therefore, it is necessary to propose improved technical means to solve this problem.

In view of the problem in the prior art that applying for an electronic voucher requires the applicant to come to the counter in person to confirm the identity, causing inconvenience to the applicant, the present invention discloses a system and method for confirming identity on different devices based on the voucher and verification data, wherein: The disclosed system for confirming identities on different devices based on certificates and verification data at least includes: a first client, which is used to input personal data and sign the personal data to generate a signature value; a server, which is used to receive the third The personal information and signature value sent by a client are verified, and used to generate a verification token after the personal information and signature value are verified, and generate a verification token including personal information, verification token, and The encoded message of the connection information, and sends the encoded message to the first client; the second client is used to obtain the encoded message through the first client, and decode the encoded message to send personal data and verification tokens to the server based on the connection information. The server enables the server to generate verification data after confirming the verification token, and is used to receive the verification data sent by the server, and provide the verification data to the first client; wherein, the first client is further used to send the verification data to the server. The server is further used to verify the verification data to generate an identity verification result, and send the identity verification result to the second client.

The method disclosed by the present invention for confirming identity on different devices based on certificates and verification data includes at least the following steps: the first client inputs personal information and signs the personal information to generate a signature value; the first client transmits the personal information The data and signature value are sent to the server, and the server verifies the personal data and signature value; after the personal data and signature value are verified, the server generates a verification token; the server generates personal information, verification token, and connection information. The encoded message is sent to the first client; the second client obtains the encoded message through the first client; the second client decodes the encoded message to send personal data and verification tokens to the server based on the connection information; the server After the server confirms the verification token, it generates verification data and sends the verification data to the second client; the first client obtains the verification data through the second client and sends the verification data to the server; the server verifies the verification data to generate an identity. Verify the result and send the identity verification result to the second client.

The system and method disclosed by the present invention are as above. The difference between them and the prior art is that the present invention generates an encoded message by the server after verifying the signature of the first client and sends it back to the first client. The second client verifies the signature through the first client. After a client obtains the encoded message, it decodes the encoded message to obtain connection information, personal data and verification tokens, and sends personal data and verification tokens to the server based on the connection information. The server generates and sends verification data after confirming the verification tokens. To the second client, the first client obtains the verification data through the second client and sends the verification data to the server for verification to generate an identity verification result, thereby solving the problems existing in the previous technology and enabling the use of electronic certificates to confirm different devices. The same technical functions as the users.

110:First client

120:Server

130: Second client

310:User interface

311:Block

320: Password input interface

Step 210: The first client enters personal information and confirms the password, and signs the personal information to generate a signature value

Step 220: The first client sends personal information and signature value to the server, and the server verifies the personal information and signature value.

Step 231: The server generates a verification token after the personal information and signature value are verified.

Step 235: The server generates an encoded message including personal information, verification token and connection information, and sends the encoded message to the first client.

Step 240: The second client obtains the encoded message through the first client

Step 250: The second client decodes the encoded message to send personal data and verification tokens to the server based on the connection information.

Step 260: The server generates verification data after confirming the verification token, and sends the verification data to the second client.

Step 261: The server confirms the verification token and sends the authentication information to the second client.

Step 265: The second client sends the verification password and authentication information to the server

Step 267: The server compares the verification password and the confirmation password to generate and send verification data to the second client.

Step 270: The first client obtains the verification data through the second client and sends the verification data to the server.

Step 280: The server verifies the verification data to generate an identity verification result, and sends the identity verification result to the second client.

Step 290: After the second client determines that the identity verification result indicates that the user has passed the verification, it uses personal information and verification password to apply for a digital certificate.

Figure 1 is a system architecture diagram for confirming identity on different devices based on certificates and verification data according to the present invention.

Figure 2A is a flow chart of the method for confirming identity on different devices based on certificates and verification data according to the present invention.

Figure 2B is a flow chart of an additional method for confirming identity on different devices based on certificates and verification data according to the present invention.

Figure 2C is a flow chart of a method for the server to confirm the verification password according to the present invention.

Figure 3A is a schematic diagram of the application opening operation screen according to the embodiment of the present invention.

Figure 3B is a schematic diagram of the verification password input screen according to the embodiment of the present invention.

The features and implementations of the present invention will be described in detail below with reference to the drawings and examples. The content is sufficient to enable any person familiar with the relevant art to easily fully understand the technical means used to solve the technical problems of the present invention and implement them accordingly, thereby achieving The effect that the present invention can achieve.

The present invention can verify the user's valid credentials on the first client through the server, so that the second client used by the user can confirm the user's identity through the server. Among them, the valid certificates mentioned in the present invention are digital certificates that can be verified by the certificate verification server (Validation Authority, VA) at the moment, including but not limited to financial certificates, natural person certificates, industrial and commercial certificates, etc.

The server, first client, and second client mentioned in the present invention can all be computing devices. The computing device mentioned in the present invention includes but is not limited to one or more processing modules, one or more memory modules, and buses and other hardware connecting different hardware components (including memory modules and processing modules). body components. Through the multiple hardware components included, the computing device can load and execute the operating system. Causes an operating system to run on a computing device and can also execute software or programs. In addition, the computing device also includes a casing, and the above-mentioned hardware components are arranged in the casing.

The bus of the computing device mentioned in the present invention may include one or more types, such as a data bus, an address bus, a control bus, and an extended function bus. expansion bus), and/or local bus (local bus) and other types of buses. Buses for computing equipment include, but are not limited to, Industry Standard Architecture (ISA) buses, Peripheral Component Interconnect (PCI) buses, Video Electronics Standards Association (VESA) Domain bus, serial Universal Serial Bus (USB), Peripheral Component Interconnect Express (PCI Express, PCI-E/PCIe) bus, etc.

The processing module of the computing device of the present invention is coupled to the bus. The processing module includes a register group or register space. The register group or register space can be completely set on the processing chip of the processing module, or all or part of it can be set outside the processing chip. and coupled to the processing chip via dedicated electrical connections and/or via busbars. The processing module can be a central processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processing modules, the processing modules included in the computing device are all the same or similar, and are coupled and communicated through a bus. The processing module can interpret a computer instruction or a series of multiple computer instructions to perform specific calculations or operations, such as mathematical operations, logical operations, data comparison, copying/moving data, etc., to drive other hardware in the computing device The components may run the operating system or execute various programs and/or modules.

Computing devices usually also contain one or more chipsets. The processing module of the computing device may be coupled to the chipset or electrically connected to the chipset through a bus. The chipset is composed of a It is composed of one or more integrated circuits (ICs), including memory controllers and peripheral input/output (I/O) controllers. In other words, memory controllers and peripheral I/O controllers can be included in Within one integrated circuit, it can also be implemented using two or more integrated circuits. The chipset usually provides input/output and memory management functions, as well as multiple general-purpose and/or special-purpose registers, timers, etc., where the above-mentioned general-purpose and/or special-purpose registers and timers can be coupled or One or more processing modules electrically connected to the chipset for access or use.

The processing module of the computing device can also access data in the memory modules and mass storage areas installed on the computing device through the memory controller. The above memory modules include any type of volatile memory (volatile memory) and/or non-volatile memory (NVRAM) memory, such as static random access memory (Static Random Access Memory, SRAM) , dynamic random access memory (Dynamic Random Access Memory, DRAM), read-only memory (Read-Only Memory, ROM), flash memory (Flash memory), etc. The above-mentioned mass storage area can include any type of storage device or storage media, such as a hard drive, optical disc, flash drive, memory card, solid state disk ,SSD), or any other storage device, etc. In other words, the memory controller can access data in static random access memory, dynamic random access memory, flash memory, hard disk drives, and solid state drives.

The processing module of the computing device can also connect and communicate with peripheral devices or interfaces such as peripheral output devices, peripheral input devices, communication interfaces, and GPS receivers through the peripheral I/O bus through the peripheral I/O controller. The peripheral input device can be any type of input device, such as keyboard, mouse, trackball, touch pad, joystick, etc. The peripheral output device can be any type of output device, such as a monitor, printer, etc. The peripheral input device It can also be the same device as the peripheral output device, for example Such as touch screen, etc. The communication interface may include a wireless communication interface and/or a wired communication interface. The wireless communication interface may include support for wireless local area network (such as Wi-Fi, Zigbee, etc.), Bluetooth, infrared, near-field communication (NFC), The interface of mobile communication networks (cellular networks) or other wireless data transmission protocols such as 3G/4G/5G. The wired communication interface can be an Ethernet device, a DSL modem, a cable modem, or asynchronous transmission. Mode (Asynchronous Transfer Mode, ATM) devices, or optical fiber communication interfaces and/or components, etc. The processing module can periodically poll various peripheral devices and interfaces, so that the computing device can input and output data through various peripheral devices and interfaces, and can also communicate with another computing device having the hardware components described above. Communicate.

The system operation of the present invention is first explained below with reference to "Figure 1", a system architecture diagram of the present invention for confirming identity on different devices based on certificates and verification data. As shown in "Figure 1", the system of the present invention includes a first client 110, a server 120, and a second client 130. Among them, data or signals can be transmitted between the first client 110 and the server 120 and between the server 120 and the second client 130 through wired or wireless networks.

The first client 110 is responsible for inputting personal information. Generally speaking, the first client 110 can provide a data input interface for inputting personal data. The personal information entered by the first client 110 includes user identification information. In some embodiments, the personal information may also include a confirmation password entered by the user, where the user identification information may be the user's identity card number. , passport number, etc., but the present invention is not limited to this; the confirmation password can be generated by a certain number of letters, numbers, and symbols.

The first client 110 is also responsible for signing the input personal data using the private key corresponding to the public key in the valid certificate to generate a signature value corresponding to the personal data. In some embodiments, the first client 110 may also delete the confirmation password in the personal data and then sign the personal data with the deleted confirmation password to generate a signature value.

The first client 110 is also responsible for transmitting the input personal information and the generated signature value to the server 120, and is responsible for receiving the encoded message sent by the server 120. The encoded information mentioned in the present invention is data that can obtain the connection method of the server 120 and obtain one or more data generated by the server 120. The encoded information can be presented in the form of text, barcode, or graphics, but the present invention It is not limited to this. Among them, the above-mentioned methods of obtaining data include but are not limited to decoding the encoded message or connecting to a specific target (such as a specific host or server) for downloading based on the encoded message.

The first client 110 is also responsible for obtaining verification data through the second client 130 and can transmit the obtained verification data to the server 120 . The first client 110 can input the verification information displayed by the second client 130 through the user, can also receive the verification information sent by the second client 130, or can scan and identify the verification information displayed by the second client 130. , but the method for the first client 110 to obtain the verification information through the second client 130 is not limited to the above. For example, the first client 110 can also receive the verification information pushed by the second client 130, the basis and the third The two clients 130 download the verification data from the pre-agreed data to the server 120, receive the verification data sent by the second client 130 via email or instant message, or receive the verification data from the second client 130 through cross APP. 2. Verification information of client 130.

It should be noted that the first client 110 can usually transmit the input personal information and the generated signature value to the server 120 at the first time during the same session (Session), and receive the received signature value at the second time. The verification data from the second client 130 is sent to the server 120 . That is to say, after the first client 110 transmits the personal data and signature value to the server 120, it does not need to interrupt the connection with the server 120. That is, the first client 110 can maintain the connection with the server 120. , and continues at least until the verification data is sent to the server 120 before interrupting the connection with the server 120; the first client 110 and the server 120 can also maintain the session by maintaining state, for example, in a hypertext transmission In the protocol (Hyper Text Transfer Protocol, HTTP), Session or cookie mechanisms are used to maintain the session period, etc., but the method of maintaining the session period between the first client 110 and the server 120 is not limited to the above.

The first client 110 can also receive the identity verification result sent by the server 120, and can display the corresponding verification result message according to the identity verification result, for example, displaying whether the identity verification is successful or failed.

The server 120 is responsible for receiving the personal information and signature value sent by the first client 110, and is responsible for verifying the personal information and signature value. Since the method of verifying personal data and the corresponding signature value is already known, the present invention will not describe it further.

The server 120 is also responsible for generating a verification token (token) after the personal information and signature value are verified. The verification token generated by the server 120 includes a verification value. Generally speaking, the verification value is generated by the server 120 in a certain manner, for example, randomly generated or using the current time value, but the present invention is not limited to this. In some embodiments, the verification token may also include a timestamp, where the timestamp may represent the current time or valid time.

The server 120 is also responsible for generating the encoded message and transmitting the generated encoded message to the first client 110 . Generally speaking, the server 120 can use various known algorithms to generate text, barcode, or graphic encoded information. The personal information received by the server 120, the verification token generated by the server 120, and the connection information of the server 120 can be obtained through the encoded message generated by the server 120. Among them, the connection information includes but is not limited to URI/URL Scheme and/or API provided by the server 120. In some embodiments, the personal information contained in the encoded message may not include a confirmation password.

In some embodiments, the server 120 can also provide the first client 110 to set the message hook value corresponding to the encoded message, and can change the corresponding message hook value when receiving the same message hook value sent by the second client 130. The corresponding encoded message is sent to the second client 130.

The server 120 is also responsible for storing the generated verification token and the confirmation password in the received personal data. Generally speaking, the server 120 can store the generated verification token and authentication data as a piece of data in the data correspondence table. In some embodiments, the server 120 can also generate authentication information when generating the verification token, that is, after the personal information and signature value are verified, and can use the generated verification token, confirmation password, and authentication information. It is stored in the data correspondence table as a piece of data. The server 120 can generate authentication data randomly or based on serial numbers, but the present invention is not limited to this. Any method that can generate unique values or is sufficient to identify multiple specific data within a certain period of time can be used. Can be used by server 120 to generate authentication information.

The server 120 is also responsible for receiving the personal information and verification token sent by the second client 130, and confirming the received verification token. For example, the server 120 can determine whether the received verification token exists in the data correspondence table. If so, the server 120 can determine that the received verification token has passed the verification, and can confirm the received verification token, The received verification token can also be recorded as received. If there is no identical verification token in the data correspondence table, or the verification token has been recorded as received, the server 120 can determine that the received verification token has not passed the verification. .

In some embodiments, when confirming the verification token, the server 120 can also check whether the validity period of the received verification token is valid, that is, determine whether the time represented by the timestamp in the verification token is within the valid time, for example , when the time represented by the timestamp is the current time when the verification token is generated, the server 120 can determine whether the validity period of the verification token is valid based on whether the time difference between the time represented by the timestamp and the current time is within a predetermined range. For example, time When the time represented by the stamp is the validity time of the verification token, the server 120 can determine whether the validity period of the verification token is valid based on whether the time represented by the timestamp is later than the current time. When the validity period of the verification token is valid, the server 120 It can be determined that the received verification token has not passed the verification. On the contrary, the server 120 can determine that the received verification token has not passed the verification. The received verification token has not passed the verification; the server 120 can also check whether the verification token has been confirmed, that is, whether the verification value in the verification token has been received before. If so, the server 120 can determine that the received verification token has not been received. Passes the verification, if not, the server 120 can determine that the received verification token passes the verification.

The server 120 is also responsible for generating verification data after confirming the verification token, and transmitting the generated verification data to the second client 130 . The verification data generated by the server 120 is usually composed of a certain number of letters, numbers, and symbols. The server 120 can randomly generate the verification data, but the present invention is not limited to this. For example, the server 120 can also generate the current verification data. The time, the network address or the hardware serial number of the first client 110 and/or the second client 130 are predetermined encoded to generate verification data. The above-mentioned predetermined coding includes but is not limited to hash operation or bit rearrangement.

After confirming the verification token, the server 120 may also read the authentication data stored as the same data as the verification token from the data correspondence table, and send the read authentication data together with the verification data to the second client 130 .

In some embodiments, the server 120 can also provide the second client 130 to set the data check value corresponding to the verification data, and can add the corresponding data check value when receiving the same data check value sent by the first client 110. The corresponding verification data is sent to the first client 110.

The server 120 can also receive the verification password and authentication data sent by the second client 130, and can read the confirmation password stored in the data correspondence table based on the received authentication data, and compare the received verification password. Is it the same as the confirmation password read out? Generally speaking, the verification password and authentication information can be included in the result query request. When the verification password and the confirmation password are different, the server 120 can directly generate an identity verification result indicating that the password has not passed verification or the identity has not passed verification. As a result, the generated identity verification result can be sent back to the second client 130, and when the verification password and the confirmation password are the same, the server 120 can generate verification data.

The server 120 is also responsible for receiving the verification data sent by the first client 110, verifying the received verification data to generate a corresponding identity verification result, and transmitting the generated identity verification result back to the first client 110. . In more detail, the server 120 can compare whether the received verification data is the same as the previously generated confirmation password to confirm the user's identity. When the verification data and the confirmation password are the same, the server 120 can determine whether the first client 110 is the same user as the second client 130 and generates an identity verification result indicating that the verification data is verified or the identity is verified. On the contrary, when the verification data is different from the confirmation password, the server 120 can require the first client 110 to re- Send verification data, and when the number of times the verification data fails to pass verification reaches a predetermined value, it can be determined that the users of the first client 110 and the second client 130 are different, and generate a message indicating that the verification data has not passed verification or the identity has not passed verification. Identity verification result.

The server 120 is also responsible for transmitting the generated identity verification result to the second client 130 . Generally speaking, the server 120 can send the identity verification result to the second client 130 only after receiving the result query request sent by the second client 130. However, the present invention is not limited to this, and the server 120 can also The identity verification result may be transmitted to the second client 130 after the identity verification result is generated.

The second client 130 is responsible for obtaining the encoded information generated by the server 120 through the first client 110 . In more detail, the second client 130 can retrieve the coded message displayed by the first client 110, receive the coded message pushed by the first client 110, and check the value based on the message pre-agreed with the first client 110. The server 120 downloads the encoded message, receives the encoded message sent by the first client 110 through email or instant message, or receives the encoded message from the first client 110 through a cross-application method.

The second client 130 is also responsible for decoding the obtained encoded message to obtain the connection information, personal information and verification token represented by the encoded message. The second client 130 can decode the encoded message using a decoding algorithm corresponding to the generated encoded message. message to obtain connection information, personal data and verification tokens, or the second client 130 can also connect to a specific target according to the encoded message to download connection information, personal data and verification tokens. However, the method in which the second client 130 decodes the encoded message is not limited to the above.

The second client 130 is also responsible for transmitting the obtained verification token and all or part of the personal data to the server 120 based on the obtained connection information. For example, the second client 130 can directly transmit the personal information and verification token to the server 120 according to the API of the server 120 included in the connection information; the second client 130 can also transmit the personal information and verification token to the server 120 according to the URL included in the connection information. Scheme opens a specific application and provides the API of the server 120 and personal data and verification tokens to the opened application, so that the opened application transmits all or part of the personal data and verification tokens to the server according to the API of the server 120 The server 120, but the method in which the second client 130 transmits the verification token and personal data to the server 120 based on the connection information is not limited to the above.

The second client 130 can also receive the authentication information sent by the server 120, enter the verification password, and can transmit the received authentication information and the entered verification password to the server 120. Generally speaking, the second client 130 can provide a password input interface for inputting the verification password.

The second client 130 is also responsible for receiving the verification data sent by the server 120, and can provide the received verification data to the first client 110; the second client 130 can also generate results after receiving the verification data. query request, and the generated result query request can be sent to the server 120 to download the identity verification result.

The second client 130 is also responsible for receiving the identity verification result generated by the server 120, and can when the identity verification result indicates that the verification data has been verified, that is, the user's identity has been verified. When using the obtained personal information and the entered verification information to apply for a digital certificate from the certificate server (not shown in the figure).

Next, an embodiment will be used to explain the operating system and method of the present invention, and please refer to "Figure 2A" for the flow chart of the method of confirming identity on different devices based on certificates and verification data according to the present invention. In this embodiment, it is assumed that the first client 110 is a personal computer or a laptop and the second client 130 is a smartphone, but the invention is not limited thereto.

When the user wants to confirm his identity on the second client 130 to apply for a digital certificate, if he chooses to use the present invention, the user can operate the first client 110 that already has a valid digital certificate, and apply for a digital certificate on the first client. Personal information is input on the client 110, so that the first client 110 signs the input personal information to generate a signature value (step 210). In this embodiment, it is assumed that the user can operate the first client 110 to execute the browser connection to the server 120. Then, the browser can display a data input interface to provide the user with input personal information, and can complete the personal information when the user completes the process. After the data is entered, the private key corresponding to the digital certificate is used to sign the entered personal data (excluding the confirmation password) to generate the corresponding signature value.

After the first client 110 generates the signature value, the first client 110 can transmit the input personal information and the generated signature value to the server 120. The server 120 can receive the signature value from the first client 110. After transmitting the personal information and signature value, the received personal information and signature value are verified (step 220). In this embodiment, it is assumed that the first client 110 can transmit the personal data that does not include the confirmation password and the signature value generated by signing the personal data that does not include the confirmation password to the server 120, and maintain it with the server. 120 connection, server 120 can verify personal information and signature value.

If the personal data and signature value do not pass the verification of the server 120, the server 120 may not generate a prompt message, and may send the generated prompt message back to the first client 110, so that the first client The client 110 displays the prompt message generated by the server 120; and if the personal information and signature value pass the verification of the server 120, the server 120 can generate a verification token (step 231). In this embodiment, it is assumed that the server 120 can generate the verification value in the verification token in a random manner, and can add a timestamp indicating the validity period to the verification token. At the same time, the server 120 can also process the received personal data. The user identification information (and confirmation password) and the generated verification token are stored in the data correspondence table as a piece of information.

After the server 120 generates the verification token, the server 120 may generate an encoded message, and may transmit the generated encoded message to the first client 110 (step 235). In this embodiment, it is assumed that the server 120 can generate an encoded message that records the personal data received from the first client 110, the generated verification token, and the connection information of the server 120, and the encoded message is presented as a QR code. .

After the first client 110 receives the encoded message sent by the server 120, the second client 130 can obtain the encoded message generated by the server 120 through the first client 110 (step 240). In this embodiment, it is assumed that the first client 110 can display the encoded message received from the server 120 through the included display module such as a touch screen, and the second client 130 can display the encoded message received from the server 120 through the included image capture module ( (such as a photographic lens and a photosensitive element) to capture the encoded information displayed by the first client 110.

After the second client 130 obtains the encoded message generated by the server 120, the second client 130 can decode the obtained encoded message to obtain the personal data, verification token, and connection information contained in the encoded message, and can based on The connection information transmits the verification token and all or part of the personal data to the server 120 (step 250). In this embodiment, assuming that the second client 130 can obtain the data recorded in the URL Scheme after decoding the encoded message, the second client 130 can obtain the corresponding application according to the application identifier in the URL Scheme. The program name is displayed in the user interface 310 as shown in "Figure 3A". When the user clicks on the "Open APP" area in the user interface 310 At block 311, the corresponding application program is opened, and the personal information, verification token, and connection information are sent as parameters to the opened application program through the operating system of the second client 130, so that the opened application program is After execution, the second client 130 can transmit the user identification information and verification token in the personal data to the server 120 based on the connection information.

After the server 120 receives the personal information and the verification token sent by the second client 130, it can confirm the received verification token. In this embodiment, it is assumed that the server 120 can read the verification token stored as the same data from the data correspondence table based on the user identification data in the received personal data, and can compare the read verification tokens. Whether the token is the same as the received verification token. If the two verification tokens are the same, the server 120 can confirm that the received verification token is valid. Otherwise, the server 120 can confirm that the verification token is invalid. The server 120 may also confirm whether the verification token is recorded as received, and if so, the server 120 may confirm that the received verification token is invalid. In addition, the server 120 can also determine whether the validity period contained in the verification token is earlier than the current time after comparing the read verification token with the received verification token. If so, the server 120 can confirm the verification token. Invalid, if not, the server 120 can confirm that the verification token is valid, or the server 120 can further determine whether the verification value in the verification token has been verified before, that is, determine whether the server 120 has ever received a verification token containing the same verification value. , if yes, the server 120 can confirm that the verification token is invalid; if not, the server 120 can confirm that the verification token is valid.

If the server 120 confirms that the received verification token is invalid, the server 120 can generate a confirmation result message indicating that the verification token is invalid, and can send the generated confirmation result message to the second client 130. The second client 130 The executed application that was previously opened may, after receiving the confirmation result message, determine that the confirmation result message indicates that the verification token is invalid, and display a prompt message corresponding to the confirmation result message; and if the server 120 confirms that the verification token is valid, the server 120 Device 120 can generate Verification information is generated, and the generated verification information may be transmitted to the second client 130 (step 260). In this embodiment, it is assumed that the server 120 can randomly generate verification data.

After the second client 130 receives the verification data sent by the server 120, the first client 110 can obtain the verification data generated by the server 120 through the second client 130, and can send the obtained verification data to Server 120 (step 270). In this embodiment, assuming that the second client 130 can display the received verification data, the user can input the verification data displayed by the second client 130 on the verification input interface provided by the first client 110, and The input verification information can be transmitted to the server 120 through the previously maintained connection with the server 120, so that the server 120 can receive the personal information/signature value successively during the same session with the first client 110. and verification information.

After the server 120 receives the verification data sent by the first client 110, it can verify the verification data to generate an identity verification result, and can send the generated identity verification result to the first client 110. In this embodiment, it is assumed that the server 120 can read the corresponding confirmation password based on the verification value in the received verification token, and compare the received verification data with the read confirmation password. When the verification data When different from confirming the password, the server 120 can generate an identity verification result indicating that the verification data confirmation failed and the identity verification failed and transmit the generated identity verification result to the first client 110 so that the first client 110 can The generated identity verification result displays a corresponding prompt message; and if the verification information and the confirmation password are the same, the server 120 can determine that the users of the first client 110 and the second client 130 are the same, and the server 120 can generate a message indicating verification. The data confirms the identity verification result of the successful identity verification, and the generated identity verification result can be sent to the first client 110 .

Similarly, after the server 120 verifies the verification data sent by the first client 110 to generate an identity verification result, the generated identity verification result can be sent to the second client 130 (step 280). In this embodiment, it is assumed that the second client 130 can generate and send a result query request to the server 120. After receiving the result query request, the server 120 can send the generated identity verification result back to the second client 130. .

In this way, through the present invention, the second client 130 can confirm the user's identity through the first client 110 and the server.

In the above embodiment, after the second client 130 receives the identity verification result sent by the server 120, it can determine whether the identity verification result indicates that the user's identity has been verified. If the identity verification result indicates that the verification data is confirmed successfully, that is, the user's identity is verified, the second client 130 can perform the operation that the user wants to perform. As shown in the process of "Figure 2B", the second client 130 can perform the operation according to the The received personal information and the verification information entered by the user apply for a digital certificate from the certificate server (step 290).

In addition, the above embodiment can also follow the process shown in "Figure 2C". Before or after the server 120 generates the verification token (step 231), the server 120 can generate authentication data, such as a serial number. Afterwards, after the second client 130 sends the personal information and verification token to the server 120 (step 250), the server 120 can send the generated confirmation result message and authentication information to the second client 130 (step 261). .

The application program executed by the second client 130 can, after receiving the confirmation result message, determine that the confirmation result message indicates that the verification token is valid, and provide a password input interface 320 containing the user identification data in the received personal data (such as (shown in "Figure 3B") to the user, so that the user can input the verification password into the application program executed by the second client 130 through the second client 130, and the application program executed by the second client 130 The program sends the entered verification password and the authentication information received from the server 120 to the server 120 (step 265).

After receiving the verification password and authentication information sent by the second client 130, the server 120 can read out the corresponding confirmation password based on the received authentication information, and can compare the received verification password with the read out verification password. Confirm the password. When the verification password is the same as the confirmation password, the server 120 can generate verification data and send the generated verification data to the second client 130 (step 267), so that the second client 130 provides the verification data to the first client. End 110.

In summary, it can be seen that the difference between the present invention and the prior art is that the server verifies the signature value generated by the first client's signature of personal data and then generates an encoded message and sends it back to the first client. After the client obtains the encoded message through the first client, it decodes the encoded message to obtain the connection information, personal data and verification token, and sends the personal data and verification token to the server based on the connection information. The server generates the verification token after confirming the verification token. And send the verification data to the second client. The first client obtains the verification data through the second client and sends the verification data to the server for verification to generate the identity verification result. This technical method can solve the problem of the previous technology. There is a problem that applying for an electronic voucher requires the applicant to come to the counter in person to confirm his or her identity, which causes inconvenience to the applicant. In this way, the same technical effect of using an electronic voucher to confirm users of different devices can be achieved.

Furthermore, the method of confirming identity on different devices based on certificates and verification data of the present invention can be implemented in hardware, software, or a combination of hardware and software. It can also be implemented in a centralized manner in a computer system or as different components. Implemented in a decentralized manner spread over several interconnected computer systems.

Although the embodiments of the present invention are disclosed above, the content described is not intended to directly limit the scope of patent protection of the present invention. Anyone with ordinary knowledge in the technical field to which the present invention belongs can make slight modifications and modifications to the form and details of the implementation of the present invention without departing from the spirit and scope disclosed by the present invention, which shall fall under the patent protection of the present invention. Scope. The scope of patent protection for this invention must still be defined by the scope of the attached patent application.

Step 210: The first client enters personal information and confirms the password, and signs the personal information to generate a signature value

Step 220: The first client sends personal information and signature value to the server, and the server verifies the personal information and signature value.

Step 231: The server generates a verification token after the personal information and signature value are verified.

Step 235: The server generates an encoded message including personal information, verification token and connection information, and sends the encoded message to the first client.

Step 240: The second client obtains the encoded message through the first client

Step 250: The second client decodes the encoded message to send personal data and verification tokens to the server based on the connection information.

Step 260: The server generates verification data after confirming the verification token, and sends the verification data to the second client.

Step 270: The first client obtains the verification data through the second client and sends the verification data to the server.

Step 280: The server verifies the verification data to generate an identity verification result, and sends the identity verification result to the second client.

Claims (10)

A system for confirming identity on different devices based on certificates and verification data. The system at least includes: a first client for inputting personal information and signing the personal information to generate a signature value; a server, For receiving the personal data and the signature value sent by the first client, verifying the personal data and the signature value, and for generating a verification after the personal data and the signature value are verified. token and an encoded message, and transmit the encoded message to the first client, wherein the encoded message includes the personal information input by the first client, the verification token generated by the server, and the server a connection information; and a second client, used to obtain the encoded message generated by the server through the first client, and decode the encoded message to obtain the personal information input by the first client , the verification token generated by the server, and the connection information of the server, and transmit the personal data and the verification token to the server based on the connection information, so that the server can confirm the verification token after Generate a verification data, and the second client is also used to receive the verification data sent by the server; wherein, the first client is further used to obtain the verification data generated by the server through the second client. , and transmits the verification information to the server. The server is further used to verify the verification information to generate an identity verification result, and transmit the identity verification result to the second client. As described in request 1, the system for confirming identity on different devices based on certificates and verification information, wherein the second client is further used to determine when the server determines that the verification information is the same as the confirmation password included in the personal information, Use this profile to apply for a digital voucher. The system for confirming identity on different devices based on certificates and verification data as described in request item 1, wherein the server sends the identity verification result to the second client when receiving the result query request sent by the second client. client. The system for confirming identity on different devices based on certificates and verification data as described in request item 1, wherein the first client sends the personal data, the signature value and the verification data to the server. The system for confirming identity on different devices based on certificates and verification information as described in request item 1, wherein the second client is further used to send a verification password to the server, and the server is further used to compare the verification password and whether a confirmation password contained in the personal information is the same. When the verification password is the same as the confirmation password, the verification data is generated. A method for confirming identity on different devices based on certificates and verification data. The method at least includes the following steps: a first client inputs a personal data, signs the personal data to generate a signature value, and transmits the personal data and the signature value to a server; the server verifies the personal data and the signature value, and generates a verification token after the personal data and the signature value are verified; the server generates an encoded message, and transmit the coded message to the first client, the coded message including the personal information input by the first client, the verification token generated by the server, and the connection information of the server; a first The second client obtains the encoded message generated by the server through the first client; The second client decodes the encoded message to obtain the personal information entered by the first client, the verification token generated by the server, and the connection information of the server, and transmits it based on the connection information. The personal information and the verification token are sent to the server; after the server confirms the verification token, it generates verification data and sends the verification data to the second client; the first client obtains it through the second client The server generates the verification data and sends the verification data to the server; and the server verifies the verification data to generate an identity verification result and sends the identity verification result to the second client. The method of confirming identity on different devices based on certificates and verification data as described in request item 6, wherein the method further includes the second client after the step of sending the identity verification result from the server to the second client When it is determined that the identity verification result indicates that the verification information has passed the verification, the steps are to use the personal information to apply for a digital certificate. The method for confirming identity on different devices based on certificates and verification data as described in request item 6, wherein the server sends the identity verification result to the second client, and further includes the second client sending a result query request Steps to reach this server. The method for confirming identity on different devices based on certificates and verification data as described in request item 6, wherein the step for the second client to obtain the encoded message through the first client is for the second client to retrieve the first The coded message displayed by the client, the first client pushes the coded message to the second client, and the second client downloads the code from the server based on the message hook value agreed with the first client. message, the first client sends the encoded message via email or instant message to the second client, or transmit the encoded message from the first client to the second client in a cross APP manner. The method for confirming identity on different devices based on certificates and verification information as described in request item 6, wherein the method further includes the server sending an authentication information to the second client before the step of generating the verification information by the server. At the end, the second client sends a verification password and the authentication information to the server, and the server compares the verification password with a step of confirming whether the passwords included in the personal data are the same.

Images