WO2006039832A1

WO2006039832A1 - Authentication method for storage and application of data, ic card, fingerprint scanner

Info

Publication number: WO2006039832A1
Application number: PCT/CN2004/001155
Authority: WO
Inventors: Hui Lin
Original assignee: Hui Lin
Priority date: 2004-10-12
Filing date: 2004-10-12
Publication date: 2006-04-20
Also published as: WO2006039832A8

Abstract

The present invention relates to an authentication method for storage and application of data, IC card, fingerprint scanner. In the method IC card device as well as fingerprint scanner is connected to a flash memory (taken-with disk) which is compatible to USB interface of computer and acts as the hardware for authentication, then put the authentication hardware into a IC card read device (Reader), wherein confirm user's identity by means of the mechanism of the fingerprint identification center, while the other kind of authentication is processed using identity checking cypher ICCID and international checking code GLN; The advantage of the method is that the practitioners of network station who supply files which have copyright and intellectual property will be controlled effectively by authorization, thus avoid the confusion occurring in which the files which have copyright and intellectual property are supplied to net friend to upload, download, share to or with each other by means of Peer-to-Peer transmission P2P (Peer to Peer), so that the rights of legal practitioners(the owner of copyright, intellectual property) are damaged badly.

Description

TECHNICAL FIELD The present invention relates to a data storage application, an IC card, and a fingerprint scanner authentication method, and more particularly to an authentication using an IC card and a fingerprint scanner. The mechanism is the data storage application authentication process that acts as a legitimate login medium. BACKGROUND OF THE INVENTION Herein is an illustration of an example of the current edge of the network moving away from the Intellectual Property Rights Act. Currently, the website for downloading singer songs MP3 on the Internet: many, and more P2P (Peer to Peer point-to-point transmission, one of the technical application modes), for users to automatically upload, download, share MP3 files, search function In order to allow users to easily search and share each other's documents; in general, such MP3 players have established a cooperative mode with the record industry, and seek balance between each other. MP ³ players provide the latest information on various music for members. Browsing, I hope to drive the buying of the record industry, but with the increasing number of MP3 players, the MP3 files uploaded by netizens have exploded, and all members who upload MP3 files can download for free, provided by MP3 players. The software platform emphasizes that the intelligent property rights of the software platform belong to the MP3 software industry due to the arrival of a considerable number of members, and then the monthly fee for software usage is charged. As a result of the explosion of membership, the revenue of the MP3 software platform provider is increasing proportionally. The rights of the record industry with legal property rights and intellectual property rights are seriously lost, resulting in the long record industry. Downturn, thereby affecting the creators of power and confidence.

Furthermore, the extension discusses the passwords adopted by the membership system on the current general knowledge website. The password set by the user or the system, but because the information is encrypted on the server side of the website, in order to prevent the leakage of the communication network information, there are programs and logics for designing the cryptographic technology, and it is hoped that the technology can It is relatively resistant to hackers, but it is still impossible to prevent it completely in the current situation.

The website audit member's confidential information entry is the member login system. The current website member login mode only logs in the user name and password directly on the web page. If the two match, you can enter the member's member function page. Use the information of the logged-in user to perform actions that the legitimate member can perform, and even query the relevant confidential information of the user and the record of the transaction; but with the coding technology adopted by the general application server (AP Server) today In other words, the operation of cryptographic codec on the web server of the application server (AP Server) alone can not ensure that it can be cracked by hackers, and today's Internet is far and wide, for convenient use and anytime, anywhere. The need to be able to access the Internet makes it easy for users to use different computers or other equipment to access the Internet in many places, and because of the current technology, it is difficult to set the user's authority and grading system, for example, using the library's public computer. Go online, or go online at the internet cafe, because using the same machine If there are many users, if you forget the deletion of the user name and password on the login screen and forget to delete it, it will be easily stolen by the next user or used by the hacker to use some backdoor programs of the easy operating system. Cracking and stealing confidential information, illegal transactions, resulting in user losses.

The current network security is full of loopholes, especially in:

Hackers use the Dict ionary At tack method to crack user passwords. It is most common to impersonate users. Generally, everyone knows that entering the computer system by entering the user ID and password is the simplest, but the most insecure way.

The reasons are as follows: .

1. The basis for the general person to choose a password is to facilitate the memory, few people will choose a string Randomly arranged and mixed with English letters and numbers. The famous cryptographer Daniel Kle in claims that the password on 40% of computers can be easily cracked by the Di et ionary At tack. At present, there are many password cracking software designed by students, system experts and hackers on the network to provide tools for intrusion inside and outside the enterprise.

2. Today's information systems are becoming more and more complex, and many heterogeneous systems are connected in series. As a result, users must enter the password again when they log in to different computer systems because of the requirements of each operating system. According to expert statistics, only a few people can simultaneously remember three different sets of passwords with a length of eight strings. The conclusion is that the vast majority of people will write down the password and place it where the user thinks it is safe. Obviously, this provides a conduit for intrusion within and outside the enterprise.

3. Even if the user has not violated the above two mistakes, it is obvious that the password exists in the form of plaintext before being transmitted from the user to the server. Hackers can intercept passwords via the Internet or at any point on the local area network, and then fake users (Rep lay) to start an illegal intrusion into the system. Many people think that renting a special line can not be invaded by hackers. This concept is wrong. Even if it is a dedicated line, it is also a line exchange through the public exchange system, which is more convenient for the hacker intrusion system. Once the line is established, the route through which the data flows will not change very much. In this way, hackers are more able to focus their resources on focusing on intercepting data flowing on fixed lines.

Again:

The hacker can also intercept and tamper with the unencrypted data in the peer-to-peer transmission. On the Internet, the communication protocol is TCP P. Before the two computers can transfer data, you must complete the Three-way Handing Shaking to establish the connection and start transmitting data. The hidden problems in this are good opportunities for hackers to invade.

The reasons are as follows:

1. The transmission of data for both parties is through the public internet, and the information transmitted is The form of the plaintext exists. Any computer connected to the Internet can monitor the data on the Internet (Sniff ing). As a result, personal privacy, property, and corporate business secrets are fully exposed on the Internet, with no privacy or confidentiality at all.

2. Sometimes, in order to fully grasp the above established connection and impersonate the original user identity to access the resources and services on the remote host, the hacker will simultaneously spoof the identity of the host and return a large amount of useless data to the user. Attempts to calculate the computing power of the client computer system (Denial of Service; DoS). In this way, the hacker can not only fake the original user identity, but also access the resources and services on the remote host, and arbitrarily publish, tamper or delete the data, so that the system administrator on the host side cannot detect it. What is more serious is that the hacker tampers with the information in such a way that the source of the information (user identity) cannot be confirmed, making it difficult for the original user to self-clear.

Again:

If the user uses a public computer to access the Internet in a public place, the external network (Internet) is connected through the local area network (LAN) of the public place. On the local area network (LAN), the Ethernet-based IP networks are taken as an example. All data (packets) flow to all PCs in the local area network in the form of broadcast (Broadcassing). Because each PC has a Network Interface Card, you can filter out packets that are not sent to you. And this hidden problem, another good opportunity for hackers to invade, intercepts the data transmitted on the LAN.

The reasons are as follows:

1. All the packets are transmitted to all PCs in the local area network in the form of broadcast (Broadcassing), and exist in the form of plain text. Therefore, any PC connected to the local area network can play the role of a listener (Sniffer), generously peek at other people's data.

2. Worse, once someone's password is intercepted, it is very likely that someone will be checked into the system illegally and do something unauthorized. For example, signing or signing out official documents, changing accounting Accounts, disseminate false news, steal research and development materials, sell to competitors, and so on.

Based on the above, the current network security vulnerabilities and the chaos of the operators who provide the MP3 software platform on the network to navigate the edge of intelligent property rights relatively reflect the importance and substantial progress and urgent need of the present invention. SUMMARY OF THE INVENTION The technical problem to be solved by the present invention is:

The invention mainly solves the current network security vulnerability, and performs the action of cipher coding and decoding on the web server of the application website server (AP Server) alone, which is really unable to ensure that it can be cracked by the hacker, and if the user uses in a public place. If the public computer, if it is negligent, left its user name and password on the login screen and forget to delete it, it is easy for the hacker to use some simple operating system backdoor programs to crack and steal the confidential information. Illegal transactions, resulting in the loss of user losses.

In addition, the use of the IC card and the fingerprint scanner's authentication hardware to effectively control, to avoid the current peer-to-peer P2P (Peer to Peer) mode on the network, to chase the chaos of the intellectual property rights law, so that legal The issue of property rights, intellectual property owners have a huge loss of the problem.

The technical means for solving the technical problem of the present invention are:

The main idea of the present invention comes from the fact that the current network security loopholes are numerous, and the user is less protective against using the private data on the Internet. Therefore, it is painstaking to study and use an IC card and a fingerprint scanner to match an authentication hardware and identify with the CA. The Yongzheng Server (Security Control Mechanism) and the Global Fingerprint Identification System work together to meet the five information security needs of the secure transmission of electronic data networks. To improve the secure transmission of electronic data networks, the following five information security requirements must be met:

(1) Confidentiality of information:

Ensuring that data information is not sneaked or stolen by third parties to protect the privacy of data transmission data can be accomplished through data encryption.

(2) Integrity of the data:

Ensure that the data transmission data has not been tampered with to ensure the correctness of the data transmission, and can be protected by digital signature or data encryption.

(3) Source identification (Authentication):

Confirm the source of the data transmission information to avoid the data transmission information being counterfeited. It can be prevented by digital signature or data encryption.

(4) Non-repudiation:

Transmitting and receiving information prevents users from denying subsequent data transmissions, which can be achieved through digital signatures and public key infrastructure.

(5) Access Control (Access Control):

Control the access to data according to the identity of the user. In addition, the execution authority of the security module function can be determined according to the identity of the user.

Furthermore, the present invention utilizes an IC card and a fingerprint scanner to authenticate the hardware to perform effective authorization control, and performs a special encoding and decoding operation on the stored file to make it more confidential and secure for data access. And maneuverability and uniqueness (only legitimate users can use the files they store) to avoid the P2P (Peer to Peer) method of peer-to-peer transmission on the network, and to chase the chaos of the intellectual property rights law, so that legal property rights The problem of the loss of the owners of intelligent property rights.

Therefore, the technical feature of the present invention is to use an IC card device in conjunction with a fingerprint scanner device on a flash memory (pen drive) generally compatible with a computer USB interface, as an authentication hardware. The hardware is first placed in an IC card reader (Reader), which first passes a fingerprint scanner to obtain the fingerprint through the global fingerprint identification center, and then an ID card built in an IC card to check the code ICCID and an international The verification code GLN checks the identity authentication, and the authentication hardware can be installed on a hardware that is generally compatible with a computer USB interface or a PS2 slot or has wireless communication, infrared transmission, and the like. The user can use the authentication hardware to enable the fingerprint scanner to connect the user's fingerprint to the global fingerprint identification center (or other fingerprint identification center) through the network. The fingerprint identification center can check the user through real-time comparison. Identity, after one or more successful comparisons, is one of the Server Resul ts for successful authentication of the hardware. If the fingerprint comparison result is incorrect, the system will also inform the user that the hardware authentication failed and the login is lost. Qualification, which is the first step of the certification process, and then log in to the user name (Username) and password (Pas sword), then the IC card will first pass its login process to the CA identity through the embedded program. The server performs the encryption and decryption operation, decrypts the value of the ICCID code through a special process, and compares the ICCID password to the CA identity database, and authorizes the EKI (Val idate=Y) to decrypt the KI first. And the result of generating a random value (Random) and encrypting with KI is stored in the database of the CA identity authentication server, and the encrypted result is the authentication hardware authentication. One of the Server Resul t, and can be used to record the number of times the user logs in using the authentication hardware, confirm the legality of the authentication hardware and whether the password ICCID has the right to log in to the website, and the granted The maximum number of permissions, after the hardware authentication is passed, the CA identity authentication server will transmit the generated random value (Random) back to the IC card. When the IC card receives the random value (Random), the IC card embedded program will first be inserted. The built ICCID code is first decrypted to obtain a KI value (the KI value here does not check whether it is the authentication hardware passed by the authorization, the audit right and the comparison right are in the CA identity authentication server), and then the received random number. The value of (Random) is encrypted to generate an IC card authentication (Cl ient Resul t) for the third party of the general application website server (AP Server). When the step authentication process is used for cross-matching with the CA identity authentication server; if the ICCID code set in the IC card on the authentication hardware is not authorized in the comparison result (Va l idate=N is not open), the system will Inform the user that the hardware authentication failed and the eligibility for the login is lost.

If the authentication process in the second step is successful, the authentication program of the general application website server (AP Server) first receives the ICCID code on the IC card, the IC card authentication (Cl ient Resul t), and the user name entered by the user. (Username) and the typed password (Pas sword). At this time, the general application website server (AP Server) first compares the user name (Username) and password (Pas sword) through its own database, and checks against it. Whether the user's effective use period expires, if the comparison is correct, the ICCID code and the IC card authentication (Cl ient Resul t) are transmitted back to the CA identity authentication server for cross-comparison, and the special process is first decrypted. The value of the ICCID code, and by comparing the CA identity database, to find the corresponding ICCID code and authorize the authentication (Val idate=Y) authentication hardware authentication (Server Resul t), the authentication hardware authentication is successful. Whether (Server Resul t) matches IC card authentication (CI ient Resul t), if it matches, the third step is passed, if the user passes If the comparison is determined to be a legal registrant, the user can log in to the portal with the legal use permission, continue to import the next Web Page, and clear the Server Resul t encrypted and decrypted on the CA authentication server, so that the user logs in next time. A new Server Resul t can be generated for temporary storage. If the comparison result does not match, the general application website server (AP Server) is notified that the hardware ICCID code error is incorrect, the authentication fails, and the qualification for the login is lost.

The file downloaded by the user will perform a special editing operation through the IC card embedded program. When the user wants to open the downloaded file, the file decoding operation must also be performed through the IC card authentication hardware. In order to open the file correctly, it can make the data access confidential, secure and mobile and unique (only legitimate users can use the stored text) Pieces).

If the user's login process data is intercepted by the hacker during the transmission process, only the random value (Random) generated by the CA identity authentication server during the encryption process can be intercepted, and the random value (Random) It is a variable random number. The value generated by the user each time the authentication is registered is different, so the hacker still cannot use his random value to make a valid login at the next login.

The data storage application authentication process, the IC card and the fingerprint scanner authentication hardware, and the user (User), the application website server (AP Server), and the CA identity authentication server (the security control terminal) form a ring structure, and the authentication device is authenticated. The control mechanism and program only automatically guide and perform encryption and decryption actions through the IC card embedded program on the authentication hardware and the internal program of the CA identity server, and the fingerprint identification center only identifies and authenticates the fingerprint data and confirms the user identity. (User) and the application server (AP Server) side do not cause their own problems. The integration is easy and the combination is strong, which will make the application layer wider and deeper. The application server (AP Server) only needs to add a corresponding small program to its login page (Login Page), which can greatly improve the security of the service provided by the server, and increase the security control mechanism for the user. The development is very promising; the user (User) brings a private key of its own. As a legitimate use, its hardware presentation is like the use of a general access control key. Its usage mode is more convenient for the average user. Accept, it will not be used for encryption and decryption technology products, because the use of the program is too complicated, for users who only accept the final result (User), will present the added value of multi-functionality and high value.

Moreover, the IC card matched with the invention is mainly burned in the chip in a firmware manner, and has the advantage of large storage capacity, and is not made by ordinary people to be edited by itself, and is not easy to be counterfeited, and its anti-counterfeiting and prevention are cracked. It is highly functional and can effectively prevent the malicious use of malicious users. It is also compatible with the destination server (AP Server) and the CA authentication server. The result of close-to-cross comparison is more effective for users to navigate in a safe network environment, and to appreciate the convenience that technology brings to humans.

Moreover, the design of the IC card and the fingerprint scanner matched by the invention can effectively control the flow of the application server (AP Server) and establish a classification system, manage the authority, prevent the malicious invasion and destruction of the hacker, and the future thereof. The development is very broad.

In addition, the flash memory of the device IC card and an IC card reader (Reader) does not allow the data to be stored in a fixed hard disk, thereby making the data access confidentiality and security more secure. Mobility and uniqueness, as a legitimate use, its hardware presentation is like the use of a general access control key, its usage mode is more acceptable to the average user, it is not used for encryption and decryption technology products, because the use of the program is too complicated For the average person to use the relevant encryption and decryption function due to inconvenient use, and wipe the technology to bring convenience to human beings.

Furthermore, another added value of the authentication hardware using the IC card and the fingerprint scanner used in the present invention is like a personal private key, which can protect a stand-alone system even when connected to the Internet, if the user uses a public computer. When a computer shared by a plurality of people such as an office computer or a school computer classroom is used, the present invention can also be used to set the reading authority of the personal file, and the unlocking method can be smoothly unlocked only by the present invention, which is convenient. Safe and detailed privacy protection of personal data, and even the use of peripheral hardware can be locked to prohibit unauthorized use.

According to the foregoing, the present invention can ensure the security of the login authentication of the user on the website through the above-mentioned protection and decryption and encoding, and avoid the leakage of the user's private data, and the CA identity authentication server can be appropriately used as the website. The company controls the flow, management authority and establish a grading system to provide a more secure network environment. Moreover, for those who are willing to provide services in the network environment, the establishment of the mechanism will make the service more relevant for equivalent feedback. To further provide quality services in the network environment, and to make online transactions more in line with the principle of fair trade order. And use the IC card and fingerprint scanner to authenticate the hardware, to effectively control the control, and to make the stored file a special encoding and decoding action, so that it has more confidentiality, security and mobility of data access. Uniqueness (only legitimate users can use the files they store) to avoid the P2P (Peer to Peer) method of peer-to-peer transmission on the network, and to chase the chaos of the intellectual property rights law, so that legal property rights and intellectual property rights are owned. The problem of people not losing a lot.

The technical effect of the present invention on the prior art is:

The data storage application, the IC card, and the fingerprint identification authentication method of the present invention are all connected by the user to the Web Server website by the browser to perform related operations, and then the authentication program sends the request information to the credential servo system and the fingerprint identification center. The user's credential confirmation and related functions can be easily executed, and the Web Server web server authentication program system is simple to install and makes it easy to execute.

Compared with the existing method for applying to the general application website server (AP Server) user login system, the present invention utilizes an IC card to store the user's private authentication data and an identity check code ICCID, and also utilizes a fingerprint. The scanner obtains the fingerprint and checks the authentication through the fingerprint identification center, and then the IC card and the fingerprint scanner are installed on the flash memory (pull disk) generally compatible with the USB interface of the computer, as the authentication hardware, and with an authentication program on the general application website. The server (AP Server) and an external authentication program are used on the output software. When the user uses the authentication hardware to log in to the user name and password, the user encrypts and encrypts the protection action to ensure the user is on the website. The security of the login authentication and the leakage of the user's private data are avoided, and the website operator can be appropriately controlled to control the traffic, manage the authority and establish a classification system, and provide a more secure network environment.

The authentication hardware with the IC card reader (Reader) can also be used as a storage medium, so that the data can only be stored in a single computer fixed hard disk, and The stored file is subjected to a special encoding and decoding action to make it more confidential, secure and mobile and unique to the data access (only legitimate users can use the stored file). BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a flow chart of steps of the present invention;

2 is a schematic flow chart of an IC card authentication entity according to the present invention;

3 is a schematic flowchart of a download file entity according to the present invention;

4 is a flow chart showing the steps of opening a file according to the present invention;

FIG. 5 is a schematic diagram of the process of opening a file entity according to the present invention.

Symbol Description:

10 ~ certified hardware

20 ~ CA 'Authentication Server

30 ~ Application Website Server BEST MODE FOR CARRYING OUT THE INVENTION The following description of the embodiments of the present invention will be further clarified. Figure 1 is a flow chart of the steps of the present invention, which includes five main steps of &, b, c, d, and e:

Step a: The user device is a combination of an IC card and a fingerprint scanner, and the device is inserted into an IC card reading device (Reader). At this time, the user first scans the fingerprint through the fingerprint scanner. The Internet is sent to the fingerprint identification center, and the identity of the user is authenticated through the fingerprint identification center. After the authentication is passed within the specified number of comparisons, the first layer authentication is passed; Step b: After passing the lower level authentication of fingerprint identification, the user will be required to log in, enter the user name (Useniame) and password (Pas sword) to enter the specified field, and press the login key (Login);

Step c: The IC card embedded program is used to guide the login process to the CA identity authentication server, and the ICCID code built into the IC card is transmitted to the CA identity authentication server, and the special authentication procedure of the CA identity authentication server is used to determine the authentication hardware. Whether the IC card is legal and auditing authority, if it is correct, the number of logins is recorded on the CA authentication server database, generating a server hardware reliability (Server Resul t), and returning the random value generated during the decoding process ( Random) to the IC card;

Step d: After the foregoing steps are correct, the IC card uses the IC card embedded program to use the acquired random value (Random) to decode the built-in ICCID code, and generates an IC card authentication (Cl ient Resul t), and The login process is guided to the application website server (AP Server), and the ICCID code, the IC card authentication (Cl ient Resul t), the user input information is transmitted to the application server P server), and the application website is made. The server (AP Server) determines whether the information input by the user is correct according to the database, and queries the use period (ava il date);

Step e: After the foregoing steps are correct, the application server (AP Server) transmits the accepted ICCID code and the IC card authentication (Cl ient Resul t) to the CA identity authentication server for decryption to confirm the authentication hardware and user information. The correctness.

I will explain the above steps in detail as follows:

Step a means: the user puts the fingerprint of the finger directly on the scanner portion of the fingerprint scanner for scanning, and then encrypts the scanned fingerprint to send the packet to the fingerprint identification center, and the fingerprint identification center will receive the fingerprint. Further comparison, to see if the user identity is correct, if it is wrong, it will be sent back to the sealed package to notify the user of the error message, the user must re-scan The fingerprint is fingerprinted, and then the encrypted packet is sent to the fingerprint identification center for authentication. The number of authentications can be increased to increase its security. If the identity is confirmed, the next step can be performed. This is the first authentication process.

Step b means that the user builds an identity verification code I CC ID and an international verification code GLN through an IC card, and places the IC card into an IC card reading device (Reader), and the device is generally compatible. On the flash memory (USB drive) of the computer USB interface, use it as the authentication hardware, and use this authentication hardware to log in to the user name (Username) and password (Pas sword) and press the login key (Login).

Step c means: After the user inputs the user name (Username) and password (Pas sword), the IC card embedded program first directs the login process to the CA identity authentication server for encryption and decryption, through special The process first decrypts the value of the ICCID secret code, and compares the CA identity authentication database, corresponding to the ICCID code and authorizes the (Val idated) EKI, decrypts the KI first, and generates a random value (Random) and The result of the KI encryption is stored in the database of the CA identity authentication server. The encrypted result is the server reliability of the authentication hardware authentication (Server Resul t), and can be used to record the number of times the user logs in using the authentication hardware, and confirms the The legality of the authentication hardware and whether the password ICCID has the right to log in to the website, and the permission granted. After the hardware authentication is passed, the CA identity authentication server will transmit the generated random value (Random) value back to the IC card. , as a KEY, used by the general application website server (AP Server) to pass the second authentication process and the CA authentication server For comparison; if the ICCID code in the IC card on the authentication hardware is not authorized in the comparison result (Val idated is not open), the system will inform the user that the hardware authentication fails and the gateway is lost. qualifications. This is the second step of the certification process.

Step d means: The authentication process of the second step is successful, and the general application website server (AP Server) first receives the KEY value transmitted by the CA identity authentication server on the IC card. ICCID password, user name (Username) and password (Pas sword) entered by the user, and then the process is directed to the general application website server (AP Server) for comparing the user name (Username) and password (Password). Is it correct, and check whether the effective use period of the user expires.

Step e means: Step d If the comparison is correct, the KEY value and the ICCID code are sent back.

The CA authentication server performs encryption and decryption, decrypts the value of the ICCID secret code through a special process, and compares the CA identity authentication database with the ICCID password and authorizes the EKI (Val idate=Y) and uses KEY. The value is to decrypt the EKI value, and the comparison is consistent with Server Resul t. If it matches, the third step is passed. If the user determines that the registrant is a valid registrant through cross-matching, then the member can log in through the member with legal use rights. Continue to import the next Web Page and clear the Server Resul t encrypted and decrypted on the CA authentication server, so that the user can generate a new Server Resul t for temporary storage when the user logs in next time, if the comparison result does not match. , the general application website server (AP Server) is certified to the hardware ICCID password error, the authentication fails, and the qualification for the login is lost. This is the three-step authentication process.

2 is a schematic flow chart of an IC card authentication entity according to the present invention. The figure shows the flow direction of the actual authentication operation of the present invention. In addition to the fingerprint authentication mode, the user has 5 routes through login to formal authentication. Please refer to the icon. Route 1 is a user IC card 10 that uses an authentication hardware to log in to the Web Server server 30 webpage Member Login window to log in its member information. After entering the Username and Pas sword, the user presses the login key (Login), and the IC card is inside. The embedded program firstly directs its login process to the CA identity authentication server 20, and implicitly transmits the ICCID code built into the IC card to the CA identity authentication server 20 for encryption and decryption, and then performs authentication of the CA identity authentication server 20. Process l (Winsock), in the authentication process (Winsock), first decrypt the value of the ICCID code through a special process, and borrow Compare the CA authentication database, corresponding to the ICCID code and authorize the EI (Validate=Y), decrypt the KI first, and generate a random value (Random) and encrypt the result with KI in the database of the CA authentication server. The encrypted result is the Server Result of the authentication hardware authentication, and can be used to record the number of times the user logs in using the authentication hardware, confirm the legality of the authentication hardware, and whether the password ICCID is logged in. The permissions of the website and the permissions granted. After the hardware authentication is completed, the route 2 is touched, and the random value (Random) generated by the CA authentication server is transmitted back to the IC card. When the IC card receives the random value. After (Random), the IC card embedding program first decrypts the built-in ICCID code to obtain a KI value (the KI value here does not check whether it is the authentication hardware passed by the authorization, and the review right and the comparison right are In the CA identity authentication server, and then by encrypting with the received random value (Random) to generate an IC card authentication (CI ient Result), for general use When the third server authentication process is performed on the website server (AP Server), the CA authentication server cross-matches with the CA authentication server; if the ICCID password in the IC card on the authentication hardware is not authorized in the comparison result (Validate=N) If the card is not opened, the system will inform the user that the hardware authentication failed and the eligibility for the login is lost.

If the authentication process of the second step is successful, then the route server 3 (AP Server) is touched, and the ICCID code and the IC card authentication (CI ient Result) on the IC card are first received, and the user inputs The user name (Personal name) and the typed password (Password). At this time, the general application web server (AP Server) first compares the user name (Username) and password (Password) through its own database, and Check whether the effective use period of the user expires. If the comparison is correct, then the route 4 is touched to perform the authentication process 2, and the ICCID code and the IC card authentication (Client Result) are transmitted back to the CA identity authentication server for cross comparison. Through the special process, the value of the ICCID code is decrypted first, and the CA identity database is compared to find the corresponding ICCID code and the authorization is passed. (Val idate=Y) After the successful authentication of the hardware authentication (Server Resul t), whether the server reliability of the authentication hardware authentication (Server Resul t) matches the CI ient Resul t, if it matches Then, the third step is passed, and the route 5 is touched. If the user determines that the registrant is a valid registrant by cross-matching, the user can log in to the portal through the legal use permission, and continue to import the next Web page and the CA identity authentication server. The Server Resul t is encrypted and cleared. This is the last step, routing eight. If the comparison result does not match, the general application website server (AP Server) is notified that the hardware ICCID password is incorrect, the authentication fails, and the login is lost. .

3 is a schematic diagram of the flow of the download file entity of the present invention, which is a schematic icon of FIG. 2, which clearly shows the flow direction of the download file entity process of the present invention, from the user login to the official login completion. After 4 routes, route 2 is the authentication mechanism (see Figure 2).

4 is a flow chart of the steps of opening a file according to the present invention. It can be clearly seen from the figure that when the user wants to open the encoded file, the original authentication hardware must first be inserted into the USB connector of the computer or the USB connector of other players. When the MP3 player software or application software is enabled, after the fingerprint identification is authenticated, the IC card embedded program first transmits the built-in ICCID code to the external authentication program or the MP3 player software that has the authentication program code itself. Or firstly decode the application software and judge the correctness of the authentication hardware < 3 61). 1>, then pass the authentication result back to the MP3 player software or application software <s tep. 2>, if the authentication is legal through the authentication hardware, After the IC card embedded program, the file to be opened is decoded by <s tep. 3>, and the decoded file is opened by the MP3 player software or application software using <^ _6. 4>, and if the hardware is authenticated. If the authentication fails, an error message will be generated to inform the user that the authentication hardware ICCID failed to be authenticated.

FIG. 5 is a schematic diagram of the process of opening a file entity according to the present invention, which is a schematic icon of FIG. 4, and the flow direction of the open file entity process of the present invention is clearly seen from the figure, The user uses the authentication hardware to insert into the USB connector of the computer or the USB connector of other players. When the MP3 player software or application software is turned on, the user can correctly open the file through 5 routes, where route 2 is the external authentication program or The MP3 playback software of the authentication program code itself has been described above. The data storage application authentication process and the IC card authentication hardware provided by the present invention can replace the existing application website server (AP Server) login mode, which utilizes An IC card has an identity verification code ICCID and an international verification code GLN built in, and the IC card is installed on a flash memory (flash drive) generally compatible with a computer USB interface, and is used as an authentication hardware, and the user utilizes the authentication hardware. When the login operation is performed, the user's legality and effective control flow can be effectively confirmed through a plurality of encryption and decryption and cross-matching systems of the destination end and the authentication end server. Furthermore, the matching IC card used in the present invention is utilized. Another added value of the certified hardware is the private key of the individual, the superior function of high protection and high security, and the application level is wide. And high security features, and unprecedented design, in addition to the invention, the website page (such as the record player) providing the property rights document or the intelligent property rights document can be effectively authorized to control, and can avoid the point-to-point transmission of P2P on the current network. (Peer to Peer) method for netizens to upload, download, and share documents with intellectual property rights or documents with intellectual property rights (such as singer's MP3) to move away from the intellectual property rights law, and make legal operators (authors) The serious loss of the rights of property rights and intellectual property owners is a design that is urgently needed today.

Claims

Rights request

1. A data storage application, an ic card, and a fingerprint identification authentication method. The main feature is that a fingerprint scanner is used to obtain fingerprints through the global fingerprint identification center, and an IC card is built into an identity verification code ICCID. And an international verification code GLN, the IC card is placed in an IC card reading device, and the two are installed on the hardware generally compatible with the computer, as the authentication hardware, mainly comprising the following steps: Step a: User The device is a combination of an IC card and a fingerprint scanner, and the device is inserted into an IC card reading device. At this time, the user first sends the fingerprint through the fingerprint scanner to the fingerprint identification center through the Internet. The identity of the user is authenticated through the fingerprint identification center, and the first layer of authentication is passed after the authentication is passed within the specified number of comparisons;

Step b: After passing the lower level authentication of fingerprint identification, the user will be required to log in, enter the user name and password to enter the specified field, and press the login button;

Step c: The IC card embedded program is used to guide the login process to the CA identity authentication server, and the ICCID code built into the IC card is transmitted to the CA identity authentication server, and the special authentication procedure of the CA identity authentication server is used to determine the authentication hardware. Whether the IC card is legal and auditing authority, this is the second layer authentication. Correctly, the number of logins is recorded on the CA authentication server database, which generates a successful authentication hardware authentication, and returns the random generated during the decoding process. The value is to the IC card; Step d: After the foregoing steps are correct, the IC card uses the IC card embedded program to use the obtained random value to decode the built-in ICCID code, and generates an IC card authentication, and logs in the process. Leading to the application website server, and passing the ICCID code and IC card authentication, the user input information is transmitted to the application website server, and the application website server determines whether the information input by the user is correct according to the database, and queries the use period; Step e: After the foregoing steps are correct, the application website server transmits the accepted ICCID code and the IC card authentication to the CA identity authentication server.

2. The data storage application, the IC card, and the fingerprint identification authentication method according to claim 1, wherein the authentication hardware of the IC card and the fingerprint scanner of the device is a hardware of a USB interface.

3. The data storage application, IC card, and fingerprint identification authentication method according to claim 1, wherein the authentication hardware of the device IC card and the fingerprint scanner is a hardware of a wireless USB interface.

4. The data storage application, IC card, and fingerprint identification authentication method according to claim 1, wherein the authentication hardware of the IC card of the device is a flash memory.

5. The data storage application, IC card, and fingerprint identification authentication method according to claim 1, wherein the fingerprint scanner is a CCD fingerprint scanner.

6. The data storage application, IC card, and fingerprint identification authentication method according to claim 1, wherein the fingerprint scanner is a C0MS fingerprint scanner.

7. The data storage application, IC card, and fingerprint identification authentication method according to claim 1, wherein the fingerprint scanner is a C0MS capacitive fingerprint scanner.

8. The data storage application, IC card, and fingerprint identification authentication method according to claim 1, wherein the fingerprint scanner is a C0MS resistive fingerprint scanner.