WO2015188424A1 - 一种密钥存储设备及其使用方法 - Google Patents

一种密钥存储设备及其使用方法 Download PDF

Info

Publication number
WO2015188424A1
WO2015188424A1 PCT/CN2014/082518 CN2014082518W WO2015188424A1 WO 2015188424 A1 WO2015188424 A1 WO 2015188424A1 CN 2014082518 W CN2014082518 W CN 2014082518W WO 2015188424 A1 WO2015188424 A1 WO 2015188424A1
Authority
WO
WIPO (PCT)
Prior art keywords
module
information
key
authentication
identity verification
Prior art date
Application number
PCT/CN2014/082518
Other languages
English (en)
French (fr)
Inventor
韩晟
王盈
Original Assignee
北京石盾科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201420304960.2U external-priority patent/CN204046622U/zh
Priority claimed from CN201410254187.8A external-priority patent/CN104063650B/zh
Application filed by 北京石盾科技有限公司 filed Critical 北京石盾科技有限公司
Priority to US14/902,396 priority Critical patent/US20170085561A1/en
Publication of WO2015188424A1 publication Critical patent/WO2015188424A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/14—Digital output to display device ; Cooperation and interconnection of the display device with other functional units
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present invention relates to the field of information security technologies, and in particular, to a key storage device and a method for using the same. Background technique
  • the most commonly used authentication methods include passwords, keys, certificates, etc.
  • Passwords are usually composed of uppercase and lowercase letters, numbers, inputtable symbols, etc.
  • the keys are usually files or strings generated according to a specific algorithm, and the certificates are also specific.
  • the special documents issued by the organization, the above methods are the same on the shield.
  • the identity of the parties is verified by a unique data that only the parties know or hold. This data can be collectively referred to as a key.
  • other auxiliary authentication methods are usually used, such as mobile phone verification code, RSA SecurlD two-factor authentication token and smart card.
  • the password length has a certain limit
  • the password setting is too short and too simple, and it is easy to be cracked. Too long and too complicated is not easy to remember.
  • the password is input through the keyboard, it is easily stolen by malicious code in the terminal device, thereby reducing the security of the authentication.
  • the mobile phone verification code is used as an auxiliary authentication method, since the smart phone can be easily implanted with malicious code, it can intercept the mobile phone verification code sent by the network side, and thus the security of the identity verification cannot be guaranteed. Smart cards are difficult to popularize and versatile due to hardware limitations.
  • the RS A SecurlD two-factor authentication token it is widely used in important information systems all over the world, but since it is verified by 6 digits, it is only suitable for use as a verification code, and cannot be used as a user name and main authentication identity. password. And the method intelligence is used in a separate information system, and it is not universal. Users usually need to hold multiple different SecurlD tokens.
  • Embodiments of the present invention provide a key storage device and a method for using the same, which are used to improve key storage and usage. Fullness, which in turn increases the security of the authentication process.
  • the embodiment of the invention provides a key storage device, including:
  • An operation module configured to generate the authentication information when the authentication is required, where the authentication information includes at least the processed seed information obtained by processing the seed information by using a key stored by the security module, where the seed information is Any information that can be processed by a computer system;
  • An embodiment of the present invention provides a method for using the foregoing key storage device, including:
  • the operation module generates the authentication information when the authentication is required, and the authentication information includes at least the processed seed information obtained by processing the seed information by using the key stored by the security module, where the seed information is Any information that the computer system can handle;
  • the key interaction module interacts with the external device for the identity verification information.
  • the key storage device and the method for using the same generate identity verification information when the identity verification is required, and the identity verification information includes at least processing performed by the operation module by using the key stored by the security module to process the seed information.
  • the subsequent seed information, and the generated authentication information is provided to the external device for authentication by the key interaction module.
  • the key storage device and the method for using the same according to the embodiment of the present invention after using the key storage device to process the seed information by using the stored key, generating identity verification information in real time and providing the external authentication device for identity verification, The user does not need to memorize the user name and password and input through the keyboard, which simplifies the user operation and avoids the security problem of the password used when the password is stolen through the keyboard.
  • the authentication information is based on the processed
  • the seed information is generated with a higher complexity than the password that humans can remember, and it is unique and non-repeatable. Therefore, even if it is intercepted, it cannot be reused and forged again, thereby improving the security of password storage and use. In turn, the security of authentication can be improved.
  • FIG. 1 is a schematic structural diagram of a first type of key storage device according to an embodiment of the present invention
  • FIG. 1b is a schematic structural diagram of a second type of key storage device according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a method for using a key storage device according to an embodiment of the present invention
  • 3 is a schematic structural diagram of a first application system of a key storage device according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a usage method of a first application system according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a second application system of a key storage device according to an embodiment of the present disclosure
  • FIG. 6 is a schematic flowchart of a method for using a second application system according to an embodiment of the present invention. detailed description
  • an embodiment of the present invention provides a key storage device and a method for using the same.
  • a schematic structural diagram of a key storage device includes:
  • the security module 11 is configured to store a key, and the key is used to verify the identity of the user.
  • the operation module 12 is configured to generate authentication information when authentication is required.
  • the authentication information generated by the computing module 12 includes at least processed seed information obtained by processing the seed information by using a key stored by the security module 11, and the seed information is any information that can be processed by the computer system, as known.
  • the fixed information such as a name, a fixed number, and the like
  • the random number, the time, the accumulating counter, and the like are not limited as long as the information can be processed using the key.
  • the seed information may be the current time of the key storage device.
  • the key interaction module 13 is configured to exchange identity verification information with an external device.
  • the key interaction module 13 may include a display sub-module 131 and/or a communication sub-module 132, where: the display sub-module 131 may be used to display the authentication information generated by the operation module 12, and the external device may obtain the display by Authentication information is authenticated.
  • the authentication information displayed by the display sub-module 131 may be a graphic code, and the graphic code may be a one-dimensional code (barcode) and a two-dimensional code, wherein the two-dimensional code includes a standard two-dimensional code and a non-standard two-dimensional code.
  • the external device can obtain the identity verification information by scanning the identity verification information displayed by the display submodule 131.
  • the display sub-module 131 can be, but is not limited to, an LCD (Liquid Crystal Display), an LED (Light Emitting Diode) display, an OLED (Organic Light Emitting Diode) display, or an electronic ink display.
  • LCD Liquid Crystal Display
  • LED Light Emitting Diode
  • OLED Organic Light Emitting Diode
  • the communication sub-module 132 can be configured to establish a communication connection with the external device, and transmit the authentication information generated by the computing module 12 to the external device through the established communication connection.
  • the communication sub-module 132 can be, but is not limited to, used to establish a communication connection with the external device in any of the following ways: earphone interface, Bluetooth, infrared, FC (near field) Communication), WIFI (Wireless Fidelity), USB (Universal Serial Interface) or OTG (Data Transfer Interface).
  • the computing module 12 may, but is not limited to, processing the seed information by using the key stored by the security module 11 according to the following method: encrypting, signing, or hashing the seed information by using the key stored by the security module 11 to obtain a corresponding Hash value.
  • the operation module 12 may use the key stored by the security module 11 to encrypt the seed information to obtain the ciphertext information corresponding to the seed information.
  • the operation module may use the key stored by the security module 11 to sign the seed information to obtain a signature. After the seed information, the seed information can also be hashed to obtain a corresponding hash value.
  • FIG. 1b another possible structural diagram of a key storage device provided by an embodiment of the present invention is shown. It may also include a confirmation button 14, wherein the confirmation button 14 is connected to the arithmetic module 12. Based on this, when the user needs to perform identity verification when accessing the Internet, the operation module 12 of the key storage device can be triggered to generate the authentication information by pressing the confirmation button 14.
  • the key storage device may further include a physical protection module 15 , wherein the physical protection module 15 is connected to the computing module 12 .
  • the physical protection module 15 may be a password protection submodule 151 and/or a biometric protection submodule 152.
  • the password protection sub-module 151 can be, but is not limited to, a physical password keyboard (including at least a numeric key or a full keyboard) and an encryption chip.
  • the biometric protection sub-module 152 can be any of the following: Module, voiceprint recognition module or iris collection recognition module.
  • the key storage device can first authenticate the user identity when generating the authentication information, and generate the identity verification information if the identity verification is passed.
  • the user identity can be verified in any of two ways:
  • the password protection sub-module 151 pre-stores the password set by the legal user.
  • the key storage device prompts the user to input the set password.
  • the password protection When the sub-module 151 matches the password input by the user with the password stored by itself, the sub-module 151 notifies the operation module 12 to generate the identity verification information, otherwise, the user is notified that the operation has failed.
  • the biometric protection sub-module 152 can pre-store biometric information of a legitimate user, such as fingerprint information, iris information, or voiceprint information.
  • biometric information of a legitimate user such as fingerprint information, iris information, or voiceprint information.
  • the key storage device prompts the user to provide any of the above biometric information, and the biometric protection sub-module 152 collects any of the above biometric information, and compares the set.
  • the notification operation module 12 generates the identity verification information, otherwise the user is notified that the operation fails.
  • the embodiment of the present invention further provides a method for using a key storage device. Since the principle of the above method is similar to that of a key storage device, the implementation of the foregoing method may be referred to a key storage device. The implementation, the repetition will not be repeated.
  • the embodiment of the present invention further provides a corresponding use method. As shown in FIG. 2, the following steps may be included:
  • the computing module generates authentication information when authentication is required.
  • the authentication information includes at least processed seed information obtained by processing the seed information by using a key stored by the security module, and the seed information is any information that can be processed by the computer system.
  • the key interaction module interacts with the external device to perform the identity verification information.
  • the key interaction module may exchange identity verification information with the external device in any of the following manners:
  • Method 1 The display sub-module included in the key interaction module displays the authentication information generated by the operation module.
  • Manner 2 The communication sub-module included in the key interaction module establishes a communication connection with the external device, and transmits the authentication information generated by the operation module to the external device through the established communication connection.
  • the key storage device provided by the embodiment of the present invention can be applied to the following three application scenarios that need to be authenticated, which respectively correspond to three different implementation manners, which are respectively described below.
  • the first embodiment is a first embodiment.
  • FIG. 3 is a schematic structural diagram of a first application system of a key storage device according to an embodiment of the present invention, including a key storage device and an identity verification server, where:
  • a key storage device configured to generate user authentication information when authentication is required, where the user authentication information includes at least processed seed information obtained by processing the seed information by using the stored key;
  • the authentication server is configured to receive an authentication request sent by the terminal device, where the authentication request carries the processed seed information, where the processed seed information is obtained by the terminal device from the user identity verification information acquired by the key storage device. Finding the key corresponding to the key stored in the key storage device from the key stored by itself; using the found key to restore and/or verify the processed seed information; determining the identity verification according to the restoration result or the verification result; Whether it passed.
  • the seed information is taken as an example of the current time of the key storage device.
  • the authentication server can be used to determine the identity-verification pass when determining that the interval between the current time of the restored key storage device and its current time is within a preset time interval; When the verification of the current time of the key storage device is passed, it is determined that the authentication is passed.
  • the authentication information generated by the key storage device may be, but is not limited to, a graphic code.
  • the key storage device may generate the graphic code according to the following method:
  • the computing module is pre-stored by using the security module.
  • the key processes the seed information to obtain the processed seed information.
  • the arithmetic module generates a graphic code by using the processed seed information (the obtained ciphertext information or the signed seed information or the hash value) and displays it through the display sub-module.
  • the terminal device can obtain the processed seed information included in the graphic code by scanning the graphic code displayed by the display sub-module.
  • the terminal device carries the obtained processed seed information in an identity-verification request and sends it to the identity verification server on the network side.
  • the identity verification server searches for the key corresponding to the key stored by the key storage device from the key stored by the identity verification server.
  • the key uses the found key to restore and/or verify the processed seed information, and determines whether the authentication is passed according to the restoration result or the verification result.
  • the identity verification system may use a symmetric key encryption system, or may use an asymmetric key encryption system.
  • the security module stores the same key as the authentication server.
  • an asymmetric key encryption system is used, a set of public and private keys can be randomly generated for each key storage device, the security module of the key storage device stores the private key, and the authentication server stores the public key.
  • the asymmetric key encryption mechanism can further improve the security of the authentication system. In this case, even if the authentication server is intruded, the attacker cannot forge the user login.
  • the key storage device uses the private key to sign the seed information
  • the public key stored by the identity verification server can be used to verify the signed seed information
  • the storage device encrypts the seed information by using the private key
  • the public key stored by the identity verification server can be used to decrypt the encrypted seed information to obtain seed information.
  • the key storage device uses the stored key to sign the seed information, the key stored by the authentication server can be used to verify the signed seed information; if the key storage device uses The stored key encrypts the seed information, and the key stored by the identity verification server can be used to decrypt the encrypted seed information to obtain the seed information, and then verify the ciphertext without restoring directly; if the key storage device The hash information is hashed using a hash algorithm to obtain a hash value, and the authentication server can be used to verify the obtained hash value.
  • the time interval between the current time of the restored key storage device and the current time of the authentication server is within a preset time interval (eg, it can be set to A very short time interval)
  • determining that the authentication is passed, otherwise determining that the authentication fails; or determining that the verification of the current time of the key storage device passes, determining that the authentication is passed, otherwise determining that the authentication fails.
  • the identity verification server after receiving the identity verification request of the terminal device, the identity verification server needs to search for the key corresponding to the key stored in the key storage device from all the keys stored in the key to restore and/or verify the processed seed. information. Specifically, the authentication server can sequentially try each key stored by itself until it can restore and/or - verify the processed seed information.
  • the identity verification information generated by the key storage device may further include the device identifier of the key storage device.
  • the terminal device can obtain the device identifier from the authentication information, and carry it together with the processed seed information.
  • the authentication request is sent to the authentication server, and the authentication server can directly search for the key corresponding to the device identifier from the pre-stored device identifier and the key according to the device identifier, and use the key as the key storage device.
  • the key corresponding to the stored key may be used to the key storage device.
  • the embodiment of the present invention uses the user to access the online banking as an example for description, and the user logs in.
  • the process of online banking is shown in Figure 4, which can include the following steps:
  • the key storage device generates and displays a two-dimensional code for authenticating the user.
  • the user may access the online 4 lines in the following two ways:
  • the user accesses the online banking by using the terminal device that obtains the user authentication information.
  • the user accesses the online banking by using the mobile phone, and uses the mobile phone to obtain the user authentication information generated by the key storage device.
  • the login page of the online banking that the user accesses needs to provide an application interface encapsulated by the identity verification method provided by the embodiment of the present invention, and triggers the identity of the user by calling the application interface when the user needs to log in to the online banking. verification.
  • the user accesses the online banking using a terminal device other than the terminal device that obtains the user authentication information.
  • the user accesses the online banking using the computer, and uses his mobile phone to obtain the user authentication information generated by the key storage device.
  • the online banking login page needs to be embedded in the authentication method encapsulated by the identity verification method provided by the embodiment of the present invention, and displayed on the login page in the form of a graphic code (which may be, but not limited to, a two-dimensional code).
  • a graphic code which may be, but not limited to, a two-dimensional code.
  • the user After triggering the authentication of the user, the user generates the user authentication information by triggering the key storage device that the user owns (the device can provide the user with the bank account when the user registers the bank account).
  • the key storage device that the user owns (the device can provide the user with the bank account when the user registers the bank account).
  • the key storage device may further identify the user identity before generating the user identity verification information, for example, by using a fingerprint.
  • the user can also be identified by a password set by the user, which is not limited herein.
  • the key storage device may further include a digital button or a fingerprint collection device.
  • the terminal device scans the two-dimensional code generated by the key storage device, and obtains the processed current time information and the device identifier of the key storage device.
  • the identity verification application implemented by the identity verification method provided by the embodiment of the present invention can directly scan the user identity verification information generated by the key storage device.
  • the user activates the identity verification method implemented by the identity verification method provided by the embodiment of the present invention installed in the terminal device.
  • the application scans the user authentication information generated by the key storage device.
  • the terminal device sends an identity verification request to the identity verification server on the network side.
  • the obtained authentication request carries the obtained processed seed information and the device identifier of the key storage device.
  • the terminal device further needs to carry the application identifier or the application name of the Internet application accessed by the user and the unique identifier of the Internet application in the global scope in the identity verification request, where the unique identifier is a globally unique code, in different Internet applications. , different terminal equipment, and do not repeat at different times.
  • the unique identifier may be, but is not limited to, a UUID (Universal Unique Identifier) or a Globally Unique Identifier (GUID), or may be a global scope implemented by a similar technology. An identifier is described below for convenience of description.
  • the terminal device may directly obtain the current device of the user; if the user accesses the Internet application through the second method, the application code of the Internet application is included in the graphic code displayed on the generated login page.
  • the identifier or the application name and the UUID corresponding to the Internet application so that the terminal device can obtain the application identifier or the application name and the UUID corresponding to the Internet application by scanning the graphic code, and obtain the two-dimensional code generated from the key storage device.
  • the processed seed information is sent to the authentication server together with the device identifier of the key storage device.
  • the terminal device may send an identity verification request to the identity verification server on the network side through a wired network, a wireless network, a mobile communication network, or the like.
  • the identity verification server searches for a corresponding key according to the device identifier carried in the identity verification request.
  • the authentication server restores and/or verifies the processed current time information by using the found key.
  • the authentication server authenticates.
  • the key storage device encrypts the current time as an example, and the identity verification server compares the current time of the restored key storage device with its current time. If the time interval does not exceed the preset time interval, the verification is determined to pass. Otherwise, OK - the verification does not pass.
  • the authentication server sends the verification result to the application server that provides the Internet application.
  • the authentication server provides the verification result to the application server corresponding to the application identifier or the application name according to the application identifier or the application name carried in the authentication request, and carries the UUID of the Internet application currently accessed by the user in the sent verification result. .
  • the application server sends a response message to the terminal device to allow/deny access. And sending a response message allowing/denying access to the terminal device according to the verification result.
  • the security of the asymmetric key encryption technology has been fully theoretically proven and widely used. But its main drawback is that the key is too long, humans can not directly remember and input, user access It is often necessary to store the key in a computer file or hardware device and import it when it is used. As a result, there is a risk of key leakage and it is extremely inconvenient to use.
  • the graphic code is used as a convenient automatic machine identification technology, it can be used to represent ciphertext information, and is easily recognized and transmitted for decryption. This solves the problem that the key in the existing asymmetric key encryption mechanism is too long to be directly used.
  • the private key can be prevented from being stolen, copied, and tampered, and physically separated from the Internet application used by the user, thereby fundamentally avoiding the possibility of being hacked, which is extremely high. Security.
  • the private key is stored in the security module of the verification information generating device, and the public key is stored in the identity verification server, even if the identity verification server is hacked, the public key is completely leaked. The attacker can't fake any user's identity for verification, and never poses any threat.
  • the device identification of the authentication information generating device (which can be its unique number) can be directly used as the user name, and the ciphertext information or the signed information generated each time the seed information is encrypted.
  • the implementation of one-time secret, and the password complexity is much higher than the password set by ordinary humans, the security and convenience are greatly improved.
  • a schematic structural diagram of a second application system of a key storage device includes a key storage device, an identity verification server, and a terminal device, where:
  • the terminal device is configured to establish a communication connection with the verification information generating device when the access to the Internet application needs to be authenticated; and interact with the verification information generating device through the established communication connection to obtain the identity verification information generated by the verification information generating device, and then perform identity verification.
  • the server sends an authentication request, where the authentication request carries the authentication information.
  • the verification information generating device is configured to generate the authentication information, and interact with the terminal device by using the communication connection established with the terminal device, where the authentication information includes at least The processed seed information obtained by processing the seed information by using the stored first key, the seed information being any information that can be processed by the computer system; the identity verification server, configured to use the self storage after receiving the identity verification request
  • the second key corresponding to the first key restores and/or verifies the processed seed information included in the authentication information; and determines whether the identity verification passes according to the restoration result or the verification result.
  • the communication connection between the terminal device and the verification information generating device may be triggered.
  • the terminal device and the verification information generating device may be, but are not limited to, establishing a communication connection by using any of the following methods: a headphone interface, a Bluetooth, an infrared, an NFC (Near Field Communication), and a WIFI (Wireless Security). True), USB (Universal Serial Interface) or OTG (Data Transfer Interface).
  • the verification information generating device may interact with the terminal device to generate the identity verification information generated by itself through the established communication connection.
  • the terminal device may actively read the authentication information generated by the verification information generating device from the verification information, or may send the authentication information generated by the verification information generating device to the terminal device.
  • the authentication information generated by the verification information generating device includes at least the verification information generating device processing the seed information by using the stored first key. The processed seed information obtained afterwards.
  • the identity verification server may be configured to determine that the identity verification passes when determining that the interval between the current time of the restored verification information generating device and the current time of the device is within a preset time interval; When the verification of the current time of the verification information generating device is passed, it is determined that the authentication is passed.
  • the verification device may generate an authentication message according to the following method:
  • the operation module processes the seed information by using the key (ie, the first key) pre-stored by the security module to obtain the processed seed information. .
  • the operation module may use the key stored by the security module to encrypt the seed information to obtain the ciphertext information corresponding to the seed information; or the operation module may also use the key stored by the security module to sign the seed information to obtain a signature.
  • the seed information can also be hashed to obtain the corresponding hash value.
  • the communication sub-module carries the processed seed information obtained by the operation module in the identity verification information and sends the information to the terminal device, or the terminal device may actively obtain the identity verification information including the processed seed information from the communication sub-module.
  • the terminal device carries the obtained processed seed information in an identity verification request and sends it to the identity verification server on the network side.
  • the identity verification server searches for the key corresponding to the key stored by the verification information generating device from the key stored by the identity verification server. (ie, the second key) and use the found key to restore and/or verify the processed seed information, and determine whether the authentication is passed according to the restoration result or the verification result.
  • the interactive identity verification system may use a symmetric key encryption system or an asymmetric key encryption system.
  • a symmetric key encryption system the security module stored in the authentication information generation device stores the same key as the authentication server.
  • a set of public and private keys may be randomly generated for each verification information generating device, the security module of the verification information generating device stores the private key, and the authentication server stores the public key.
  • the asymmetric key encryption mechanism can further improve the security of the authentication system. In this case, even if the authentication server is intruded, the attacker cannot forge the user login.
  • the verification information generating device uses the private key to sign the seed information
  • the public key stored by the identity verification server may be used to verify the signed seed information
  • the information generating device encrypts the seed information by using the private key
  • the public key stored by the identity verification server can be used to decrypt the encrypted seed information to obtain seed information.
  • the verification information generating device signs the seed information using the stored key
  • the key stored by the authentication server can be used to verify the signed seed information
  • the verification information generating device uses The stored key encrypts the seed information
  • the key stored by the identity verification server can be used to decrypt the encrypted seed information to obtain the seed information, and then verify the ciphertext without restoring directly
  • the verification information generating device The hash information is hashed using a hash algorithm to obtain a hash value, and the authentication server can be used to verify the obtained hash value.
  • the time interval between the current time and the current time of the authentication server is within a preset time interval (eg, can be set to a very short time interval), determining that the authentication is passed, otherwise, determining that the authentication fails; or determining When the verification of the current time of the verification information generating device passes, it is determined that the authentication is passed, otherwise it is determined that the authentication fails.
  • a preset time interval eg, can be set to a very short time interval
  • the identity verification server after receiving the identity verification request of the terminal device, the identity verification server needs to search for the key corresponding to the key restored and/or verified by the key stored in the verification information generating device from all the keys stored by the identity verification server. information. Specifically, the authentication server can sequentially try each key stored by itself until it can restore and/or verify the processed seed information.
  • the verification information generating device may further include the device identifier of the verification information generating device when generating the identity verification information.
  • the terminal device can obtain the device identifier from the received authentication information, and carry it together with the processed seed information in the identity verification request, and send the identifier to the identity verification server, and the identity verification server can The key corresponding to the device identifier is directly searched for in the corresponding relationship between the stored device identifier and the key, and is used as a key corresponding to the key stored in the verification information generating device.
  • the terminal device may be configured to obtain an application identifier of the Internet application accessed by the user before sending the identity verification request to the identity verification server, and carry the acquired application identifier in the identity verification request and send the identifier to the identity verification server.
  • the authentication server obtains the authentication result
  • the obtained authentication result is notified to the application server corresponding to the application identifier.
  • the identity verification server may search for the application server identifier corresponding to the application identifier from the corresponding relationship between the application identifier and the application server identifier, and send the identity verification result to the application server identifier according to the found application server identifier.
  • Application server may search for the application server identifier corresponding to the application identifier from the corresponding relationship between the application identifier and the application server identifier, and send the identity verification result to the application server identifier according to the found application server identifier.
  • the user may access the Internet application by using the terminal device that performs the authentication, and may access the Internet application through the other terminal device. Therefore, in the embodiment of the present invention, the terminal device may be in any of the following two manners. Obtain the application ID of the Internet application accessed by the user:
  • the terminal device can obtain the application identifier of the Internet application by calling an interface provided by the Internet application. If the user accesses the Internet application by using other terminal devices, the terminal can use the terminal.
  • the device scans the graphic code provided by the Internet application (can be, but is not limited to, a two-dimensional code) to obtain an application identifier of the Internet application.
  • the terminal device may also acquire an application identification code of the Internet application accessed by the user, and acquire the obtained application.
  • the identification code is sent to the verification information generating device, and after the authentication information generating device processes the application identification code by using the first key stored by the verification information generating device, it is carried in the identity verification information and sent to the terminal device, and the terminal device will receive the processing.
  • the application identifier is carried in the authentication request and sent to the authentication server.
  • the manner in which the terminal device obtains the application identifier is the same as the manner in which the terminal device obtains the application identifier, and is no longer Narration.
  • the application identifier is a globally unique code that is not repeated in different Internet applications, different terminal devices, and different times.
  • the application identifier can be, but is not limited to, a UUID (Universal Unique Identifier) or a GUID (Globally Unique Identifier), or a global scope implemented by a similar technology.
  • UUID Universal Unique Identifier
  • GUID Globally Unique Identifier
  • the UUID is taken as an example for description.
  • the authentication server After the authentication server receives the processed application identification code, if the verification information generating device performs encryption processing on the application identification code, the identity verification server needs to use the second key stored by itself to decrypt the application and the identity verification.
  • the result is sent to the corresponding application server, and the application server can determine the terminal device that the user accesses the Internet application according to the received application identification code, and send a response to allow/deny access to the terminal device according to the identity verification result sent by the identity verification server. Message.
  • the embodiment of the present invention uses the user to access the online banking as an example for description, and the user logs in.
  • the process of online banking is shown in Figure 6, which can include the following steps:
  • the user accesses the online banking by using the terminal device that obtains the authentication information.
  • the user accesses the online banking by using the mobile phone, and uses the mobile phone to obtain the authentication information generated by the verification information generating device.
  • the login page of the online banking that the user accesses needs to provide an application interface encapsulated by the identity verification method provided by the embodiment of the present invention, and triggers the identity of the user by calling the application interface when the user needs to log in to the online banking. verification.
  • the user accesses the online bank using a terminal device other than the terminal device that obtains the authentication information, for example, the user accesses the online bank using the computer, and uses the mobile phone of the user to obtain the authentication information generated by the verification information generating device.
  • the online banking login page needs to be embedded in the authentication method encapsulated by the identity verification method provided by the embodiment of the present invention, and displayed on the login page in the form of a graphic code (which may be, but not limited to, a two-dimensional code).
  • a graphic code which may be, but not limited to, a two-dimensional code.
  • the verification information generating device generates identity verification information.
  • the user After triggering the authentication of the user, the user generates authentication information by triggering the authentication information generating device owned by the user (which can be provided by the bank to the user when the user registers the bank account), for example, the user provides the authentication information generating device.
  • the key triggering verification information generating device generates the authentication information.
  • the verification information generating device may further identify the user identity before generating the identity verification information, for example, may identify by using a fingerprint,
  • the user can be identified by a password set in advance by the user, which is not limited herein.
  • the verification information generating device may further include a digital button or a fingerprint collecting device.
  • the step S62 may be performed before the step S61, that is, the verification information generating device is configured as the identity verification information, and then the communication connection is established with the terminal device, and the two may be simultaneously executed, which is not limited by the embodiment of the present invention.
  • the verification information generating device interacts with the terminal device to generate identity verification information generated by itself.
  • the verification information generating device processes the seed information by using the stored key to obtain the processed seed information, and carries the processed seed information and the device identifier in the identity verification information to the terminal device, or
  • the identity verification information including the processed seed information may be actively obtained by the terminal device to the communication submodule.
  • the terminal device sends an identity verification request to the identity verification server on the network side.
  • the authentication request carries the obtained processed seed information and the device identifier of the verification information generating device.
  • the terminal device can also obtain the application identifier and the application identifier of the Internet application accessed by the user, and carry it in the identity verification request and send it to the identity verification server.
  • the terminal device may acquire an application identifier of the Internet application accessed by the user before establishing a communication connection with the verification information generating device, or obtain an application identifier of the Internet application accessed by the user after establishing a communication connection with the verification information generating device.
  • the application identifier of the Internet application accessed by the user may be obtained after receiving the authentication information, as long as it is obtained before the identity verification request is sent, which is not limited by the present invention.
  • the terminal device may directly obtain the user ID server; if the user accesses the Internet application through the second manner, the graphic code displayed on the generated login page includes the Internet application. Applying the identifier or the application name and the UUID corresponding to the Internet application, so that the terminal device can obtain the application identifier or the application name and the UUID corresponding to the Internet application by scanning the graphic code, and the two-dimensional code generated by the verification information generating device. The obtained processed seed information and the device identifier of the verification information generating device are sent to the identity verification server.
  • the terminal device may send the acquired UUID to the verification information generating device for processing, and then send it to the identity verification server to prevent it from being tampered with during transmission. It should be understood that if the terminal device transmits the UUID to the authentication information generating device for processing, it needs to acquire the UUID and the application identifier before establishing the communication connection or obtain the authentication information before receiving the connection communication.
  • the verification information generating device carries the processed UUID in the authentication information and sends it to the terminal device.
  • the terminal device may send an identity verification request to the identity verification server on the network side through a wired network, a wireless network, a mobile communication network, or the like.
  • the identity verification server searches for a corresponding key according to the device identifier carried in the identity verification request.
  • the authentication server restores and/or verifies the processed current time information by using the found key.
  • the authentication server authenticates.
  • the authentication information generating device encrypts the current time as an example, and the identity verification server compares the current time of the restored-authentication information generating device with the current time of the device, and determines the verification if the time interval does not exceed the preset time interval. Pass, otherwise, make sure the verification does not pass.
  • the authentication server sends the verification result to the application server that provides the Internet application.
  • the authentication server provides the verification result to the application server corresponding to the application identifier or the application name according to the application identifier or the application name carried in the authentication request, and carries the UUID of the Internet application currently accessed by the user in the sent verification result. .
  • the application server sends a response message to the terminal device to allow/deny access. And sending a response message allowing/denying access to the terminal device according to the verification result.
  • the use of independent hardware to generate identity verification information can prevent the private key from being stolen, copied, and falsified, and has extremely high security.
  • the private key is stored in the security module of the verification information generating device, and the public key is stored in the identity verification server, even if the identity verification server is hacked, the public key is completely leaked. The attacker can't fake any user's identity for verification, and never poses any threat.
  • the device identification of the authentication information generating device (which can be its unique number) can be directly used as the user name, and the ciphertext information or the signed information generated each time the seed information is encrypted.
  • the implementation of one secret, and the password complexity is much higher than the password set by ordinary humans, the security and convenience are greatly improved.
  • the identity verification system provided by the embodiment of the present invention can also be used in an enterprise access control system, that is, an enterprise only needs to install a graphic code scanning device (for example, a camera), and each employee is provided with a key storage device, which can pass through when entering. Scan the user authentication information generated by the key storage device to verify it, and allow access when passing, and also record information such as the door open time.
  • the identity verification system provided by the embodiment of the present invention may provide a key storage device for different Internet applications, and may also provide a separate key storage device for Internet applications with high security requirements, such as online banking, online payment, and the like.
  • the authentication server needs to maintain the correspondence between the application identifier of the Internet application and the device identifier and the key of the corresponding key storage device to provide identity verification for different Internet applications.
  • the terminal device involved in the embodiment of the present invention may be a mobile terminal device such as a mobile phone, a tablet computer, a PDA (personal digital assistant), a smart watch, or a PC (personal computer), as long as it is installed.
  • the camera device or the scanning device can scan the terminal device that acquires the graphic code generated by the key storage device.
  • the Internet application involved in the embodiment of the present invention includes a website, an application client, and the like that can be accessed through the Internet/mobile Internet.
  • the authentication method provided by the embodiment of the present invention is more secure than the traditional authentication method, and implements a highly complex password and a one-time secret, thereby avoiding the risk of the password being stolen. Moreover, the authentication method provided by the embodiment of the present invention is more convenient and quick, and the user can quickly complete the identity verification process by directly scanning the graphic code without memorizing and inputting various different user names and passwords.
  • the password length and strength in the identity verification method provided by the embodiment of the present invention are much higher than the password set by the ordinary user and the 6-bit pure number used by the existing RSA SecurlD two-factor authentication token. Therefore, the password length can be directly used as the master password. Authentication.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the present invention can be embodied in the form of a computer program product embodied on one or more computer-usable storage interfaces (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.
  • computer-usable storage interfaces including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory operable in a particular manner by a computer or other programmable data processing device, such that instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the instruction means implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that the computer Or performing a series of operational steps on other programmable devices to produce computer-implemented processing such that instructions executed on a computer or other programmable device are provided for implementing a block in a flow or a flow and/or block diagram of the flowchart Or the steps of the function specified in multiple boxes.

Abstract

公开了一种密钥存储设备及其使用方法，用于提高密钥存储及使用的安全性，进而提高身份验证过程的安全性。密钥存储设备包括：安全模块（11），用于存储密钥，所述密钥用于验证用户身份；运算模块（12），用于在需要进行身份验证时生成身份验证信息，所述身份验证信息中至少包括利用所述安全模块存储的密钥对种子信息进行处理得到的处理后的种子信息，所述种子信息为计算机系统能够处理的任一信息；密钥交互模块（13），用于与外界设备交互所述身份验证信息。

Description

一种密钥存储设备及其使用方法
本申请要求在 2014年 06月 09 日提交中国专利局、 申请号分别为 201410254187.8和 201420304960.2、 发明名称分别为 "一种密钥存储设备及其使用方法"和 "一种密钥存储设备" 的中国专利申请的优先权， 其全部内容通过引用结合在本申请中。 技术领域
本发明涉及信息安全技术领域， 尤其涉及一种密钥存储设备及其使用方法。 背景技术
随着互联网技术尤其是移动互联网技术的飞速发展， 通过互联网提供的互联网应用越 来越多。 用户在访问这些互联网应用时， 如访问电子邮件、 访问即时通信应用、 访问网站 等， 为了保证用户访问的安全性， 各互联网应用的提供方通常需要在用户登录时对用户身 份进行验证。
目前， 最常用的身份验证方法包括密码、 密钥、 证书等， 密码通常由大小写字母、 数 字、 可输入的符号等组成， 密钥通常是按照特定算法生成的文件或字符串， 证书也是特定 机构发布的特殊文件， 以上方法本盾上都是相同的， 通过一个只有当事人知道或持有的唯 一数据来验证当事人的身份， 这个数据可以统称为密钥。 在对安全性要求更高的互联网应 用中， 如网上银行、 在线支付应用等， 通常还会使用其他辅助的身份验证手段， 常见的有 手机验证码、 RSA SecurlD双因素验证令牌和智能卡等。
在现有的身份验证技术中， 由于密码长度都有一定的限制， 密码设置太短、 太筒单的 话， 容易被破解， 太长太复杂用不便于记忆。 而且， 密码在通过键盘输入时， 容易被终端 设备中的恶意代码窃取， 从而降低了身份验证的安全性。
如果手机验证码作为辅助的身份验证手段， 由于智能手机很容易被植入恶意代码， 其 可以拦截网络侧下发的手机验证码 , 从而也无法保证身份验证的安全性。 而智能卡由于硬 件限制， 难以普及且通用性不强。 至于 RS A SecurlD双因素验证令牌， 其广泛应用于世界 各地的重要信息系统中， 但由于其是釆用 6位数字进行验证 , 只适合作为验证码使用， 而 不能作为验证身份的用户名和主要密码。 且该方法智能在独立的信息系统中使用， 无法通 用， 用户通常需要持有多个不同的 SecurlD令牌。
由此可见， 如何提高身份验证过程的安全性成为现有技术中亟待解决的技术问题之
发明内容
本发明实施例提供了一种密钥存储设备及其使用方法， 用于提高密钥存储及使用的安 全性， 进而提高身份验证过程的安全性。
本发明实施例提供一种密钥存储设备， 包括：
安全模块， 用于存储密钥， 所述密钥用于验证用户身份；
运算模块， 用于在需要进行身份验证时生成身份验证信息， 所述身份验证信息中至少 包括利用所述安全模块存储的密钥对种子信息进行处理得到的处理后的种子信息， 所述种 子信息为计算机系统能够处理的任一信息；
密钥交互模块， 用于与外界设备交互所述身份验证信息。
本发明实施例提供一种基于上述密钥存储设备的使用方法， 包括：
所述运算模块在需要进行身份验证时生成身份验证信息， 所述身份验证信息中至少包 括利用所述安全模块存储的密钥对种子信息进行处理得到的处理后的种子信息， 所述种子 信息为计算机系统能够处理的任一信息；
所述密钥交互模块在所述运算模块生成所述身份验证信息之后 , 与外界设备交互所述 身份验证信息。
本发明实施例提供的密钥存储设备及其使用方法， 当需要进行身份验证时生成身份验 证信息， 该身份验证信息至少包括运算模块利用安全模块存储的密钥对种子信息进行处理 后得到的处理后的种子信息， 并通过密钥交互模块将生成的身份验证信息提供给外界设备 用于进行身份验证。 本发明实施例提供的密钥存储装置及其使用方法， 由于使用密钥存储 设备利用存储的密钥对种子信息处理后， 实时生成身份验证信息， 并提供给用于身份验证 的外界设备， 因此， 无需用户记忆用户名和密码并通过键盘输入， 筒化了用户操作的同时， 避免了通过键盘输入密码时被窃取导致的密码使用的安全性问题， 另一方面， 身份验证信 息为根据处理后的种子信息生成的， 其复杂程度高于人类可以记忆的密码， 且其是唯一的 且不可重复的， 因此， 即使中途被监听也无法再次使用和伪造， 从而提高了密码存储及使 用的安全性， 进而能够提高身份验证的安全性。
本发明的其它特征和优点将在随后的说明书中阐述， 并且， 部分地从说明书中变得显 而易见， 或者通过实施本发明而了解。 本发明的目的和其他优点可通过在所写的说明书、 权利要求书、 以及附图中所特别指出的结构来实现和获得。 附图说明
此处所说明的附图用来提供对本发明的进一步理解， 构成本发明的一部分， 本发明的 示意性实施例及其说明用于解释本发明， 并不构成对本发明的不当限定。 在附图中：
图 la为本发明实施例中， 第一种密钥存储设备的结构示意图；
图 lb为本发明实施例中， 第二种密钥存储设备的结构示意图；
图 2为本发明实施例中， 密钥存储设备使用方法的流程示意图； 图 3为本发明实施例中， 密钥存储设备第一种应用系统的结构示意图； 图 4为本发明实施例中， 基于第一种应用系统的使用方法流程示意图；
图 5为本发明实施例中， 密钥存储设备第二种应用系统的结构示意图；
图 6为本发明实施例中， 基于第二种应用系统的使用方法流程示意图。 具体实施方式
为了提高密钥存储及使用的安全性， 进而提高身份验证过程的安全性， 本发明实施例 提供了一种密钥存储设备及其使用方法。
以下结合说明书附图对本发明的优选实施例进行说明， 应当理解， 此处所描述的优选 实施例仅用于说明和解释本发明， 并不用于限定本发明， 并且在不冲突的情况下， 本发明 中的实施例及实施例中的特征可以相互组合。
实施例一
如图 la所示， 为本发明实施例提供的密钥存储设备的结构示意图， 包括：
安全模块 11 , 用于存储密钥， 所述密钥用于验证用户身份。
运算模块 12, 用于在需要进行身份验证时生成身份验证信息。
其中， 运算模块 12生成的身份验证信息中至少包括利用安全模块 11存储的密钥对种子 信息进行处理得到的处理后的种子信息， 该种子信息为计算机系统能够处理的任一信息， 如已知的固定信息 （比如名字、 固定的数字等等）、 随机数、 时间、 累加计数器等等， 只 要是能够使用密钥进行处理的信息均可， 本发明对此不做限定。 较佳的， 具体实施时， 种 子信息可以为密钥存储设备的当前时间。
密钥交互模块 13 , 用于与外界设备交互身份验证信息。
具体实施时， 密钥交互模块 13可以包括显示子模块 131和 /或通信子模块 132, 其中： 显示子模块 131可以用于显示运算模块 12生成的身份验证信息， 外界设备可以通过获 取该显示的身份验证信息进行身份验证。 较佳的， 显示子模块 131显示的身份验证信息可 以为图形码， 该图形码可以为一维码（条形码）和二维码， 其中， 二维码包括标准二维码 和非标准二维码（即一些变形的二维码， 如圆形二维码、 彩色二维码等等）， 本发明对此 不做限定。 这样， 外界设备可以通过扫描显示子模块 131显示的身份验证信息来获取该身 份验证信息。
较佳的， 显示子模块 131可以但不限于为 LCD (液晶显示器）、 LED (发光二极管）显 示器、 OLED (有机发光二极管）显示器或者电子墨水展幕。
通信子模块 132, 可以用于与外界设备建立通信连接， 并通过建立的通信连接将运算 模块 12生成的身份验证信息传输给外界设备。 较佳的， 通信子模块 132, 可以但不限于用 于按照以下任一方式与所述外界设备建立通信连接： 耳机接口、 蓝牙、 红外、 FC (近场 通信）、 WIFI (无线保真）、 USB (通用串行接口）或者 OTG (数据传输接口）。
具体实施时， 运算模块 12可以但不限于按照以下方法利用安全模块 11存储的密钥对种 子信息进行处理： 利用安全模块 11存储的密钥对种子信息进行加密、 签名或者哈希运算得 到对应的哈希值。 具体的， 运算模块 12可以利用安全模块 11存储的密钥对种子信息进行加 密得到该种子信息对应的密文信息； 或者运算模块也可以利用安全模块 11存储的密钥对种 子信息进行签名得到签名后的种子信息， 还可以对种子信息进行哈希运算得到对应的哈希 值。
如图 lb所示， 为本发明实施例提供的密钥存储设备另外一种可能的结构示意图。 其还 可以包括确认按键 14, 其中， 确认按键 14与运算模块 12连接。 基于此， 当用户在访问互联 网需要进行身份验证时， 可以通过按压确认按键 14触发密钥存储设备的运算模块 12生成身 份验证信息。
较佳的， 为了提高密钥存储设备使用过程中的安全性， 具体实施时， 密钥存储设备还 可以包括物理防护模块 15 , 其中， 物理防护模块 15与运算模块 12连接。
其中， 物理防护模块 15可以为密码防护子模块 151和 /或生物特征防护子模块 152。 具体实现时， 密码防护子模块 151可以但不限于为物理密码键盘（至少包括数字键， 也可以为全键盘）和加密芯片， 生物特征防护子模块 152可以为以下任一种： 指紋釆集识 别模块、 声紋釆集识别模块或者虹膜釆集识别模块。
基于此， 密钥存储设备在生成身份验证信息可以先对用户身份进行验证， 如果身份验 证通过则生成身份验证信息。 具体的， 可以通过以下两种方式中的任一种对用户身份进行 验证：
方式一、 通过密码防护子模块进行身份验证
密码防护子模块 151预先存储合法用户设置的密码， 当用户触发密钥存储设备生成身 份验证信息时， 密钥存储设备提示用户输入设置的密码， 用户通过密码防护子模块 151输 入密码后， 密码防护子模块 151比对用户输入的密码与自身存储的密码一致时， 通知运算 模块 12生成身份验证信息， 否则通知用户操作失败。
方式二、 通过生物特征防护子模块进行身份验证
基于此， 生物特征防护子模块 152可以预先存储合法用户的生物特征信息， 例如指紋 信息、 虹膜信息或者声紋信息等。 当用户触发密钥存储设备生成身份验证信息时， 密钥存 储设备提示用户提供上述任一种生物特征信息， 生物特征防护子模块 152釆集到上述任一 种生物特征信息后， 比对釆集到的指紋信息与自身存储的指紋信息一致时， 通知运算模块 12生成身份验证信息， 否则通知用户操作失败。
基于同一发明构思， 本发明实施例中还提供了一种密钥存储设备的使用方法， 由于上 述方法解决问题的原理与密钥存储设备相似， 因此上述方法的实施可以参见密钥存储设备 的实施， 重复之处不再赘述。
实施例二
基于上述提供的密钥存储设备， 本发明实施例还提供了一种其对应的使用方法， 如图 2所示， 可以包括以下步骤：
S21、 运算模块在需要进行身份验证时生成身份验证信息。
其中， 身份验证信息中至少包括利用所述安全模块存储的密钥对种子信息进行处理得 到的处理后的种子信息， 该种子信息为计算机系统能够处理的任一信息。
S22、 密钥交互模块在所述运算模块生成所述身份验证信息之后， 与外界设备交互所 述身份验证信息。
具体实施时， 步骤 S22中， 密钥交互模块可以釆用以下任一方式与外界设备交互身份 验证信息：
方式一、 密钥交互模块包含的显示子模块显示运算模块生成的身份验证信息。
方式二、 密钥交互模块包含的通信子模块与外界设备建立通信连接， 并通过建立的通 信连接将运算模块生成的身份验证信息传输给外界设备。
具体实施时， 本发明实施例提供的密钥存储设备可以应用于以下三种需要进行身份验 证的应用场景， 其分别对应三种不同的实施方式， 以下分别进行说明。
实施例三
第一种实施方式、
如图 3所示， 为本发明实施例提供的密钥存储设备第一种应用系统的结构示意图， 包 括密钥存储设备和身份验证服务器， 其中：
密钥存储设备， 用于在需要进行身份验证时生成用户身份验证信息， 其中， 用户身份 验证信息至少包括利用存储的密钥对种子信息进行处理得到的处理后的种子信息；
身份验证服务器， 用于接收终端设备发送的身份验证请求， 身份验证请求中携带有处 理后的种子信息， 其中处理后的种子信息为终端设备从密钥存储设备获取的用户身份验证 信息中获得的； 从自身存储的密钥中， 查找密钥存储设备中存储的密钥对应的密钥； 利用 查找到的密钥还原和 /或验证处理后的种子信息；根据还原结果或者验证结果确定身份验证 是否通过。
为了便于说明， 以种子信息为密钥存储设备的当前时间为例。 这样， 身份验证服务器 可以用于在确定还原出的密钥存储设备的当前时间与自身的当前时间之间的间隔在预设 时间间隔范围之内时， 确定身份 -验证通过； 还可以用于确定对密钥存储设备的当前时间的 验证通过时， 确定身份验证通过。
较佳的， 密钥存储设备生成的身份验证信息可以但不限于为图形码， 在需要进行身份 验证时， 密钥存储设备可以按照以下方法生成该图形码： 运算模块利用安全模块预先存储 的密钥对种子信息进行处理得到处理后的种子信息。 运算模块利用处理后的种子信息（上 述得到的密文信息或者已签名的种子信息或者哈希值）生成一个图形码并通过显示子模块 显示。 这样， 终端设备可以通过扫描显示子模块显示的图形码从而得到该图形码中包含的 处理后的种子信息。 终端设备将得到的处理后的种子信息携带在身份-验证请求中发送给网 络侧的身份验证服务器， 身份验证服务器从自身存储的密钥中查找该密钥存储设备存储的 密钥所对应的密钥并使用查找到的密钥还原和 /或验证处理后的种子信息，根据还原结果或 者验证结果确定身份验证是否通过。
较佳的，具体实施时，本发明实施例提供的身份验证系统可以釆用对称密钥加密体系， 也可以釆用非对称密钥加密体系。 如果釆用对称密钥加密体系， 安全模块存储的密钥和身 份验证服务器存储的密钥相同。 如果釆用非对称密钥加密体系， 可以为每一个密钥存储设 备随机生成一组公钥和私钥， 密钥存储设备的安全模块存储私钥， 身份验证服务器存储公 钥。 相比于对称密钥加密机制， 非对称密钥加密机制能够进一步提高身份验证系统的安全 性， 这种情况下， 即使身份验证服务器被入侵， 攻击者也无法伪造用户登录。
具体的， 在使用非对称密钥加密技术时， 如果密钥存储设备使用私钥对种子信息进行 签名， 则身份验证服务器存储的公钥可以用于对已签名的种子信息进行验证； 如果密钥存 储设备使用私钥对种子信息进行加密， 则身份验证服务器存储的公钥可以用于对加密的种 子信息进行解密， 得到种子信息。 若使用对称密钥加密技术， 如果密钥存储设备使用存储 的密钥对种子信息进行签名， 则身份验证服务器存储的密钥可以用于对已签名的种子信息 进行验证； 如果密钥存储设备使用存储的密钥对种子信息进行加密， 则身份验证服务器存 储的密钥既可以用于对加密的种子信息进行解密得到种子信息后再验证， 也可以不还原直 接验证密文； 如果密钥存储设备使用哈希算法对种子信息进行哈希运算得到哈希值， 则身 份验证服务器可以用于对得到的哈希值进行验证。
以种子信息为密钥存储设备的当前时间为例， 如果还原得到的密钥存储设备的当前时 间与身份验证服务器的当前时间之间的时间间隔在预设时间间隔范围之内 （如可以设置为 极短的时间间隔）， 确定身份验证通过， 否则， 确定身份验证不通过； 或者确定对密钥存 储设备的当前时间的验证通过时， 确定身份验证通过， 否则确定身份验证不通过。
上述方法中， 身份验证服务器在接收到终端设备的身份验证请求之后， 需要从自身存 储的所有密钥中查找密钥存储设备中存储的密钥对应的密钥还原和 /或验证处理后的种子 信息。 具体的， 身份验证服务器可以依次尝试自身存储的每一密钥， 直至其能够还原和 / 或 -验证处理后的种子信息为止。
较佳的， 为了提高身份验证服务器还原和 /或验证处理后的种子信息的效率， 本发明实 施例中， 密钥存储设备生成的身份验证信息中还可以包含该密钥存储设备的设备标识， 这 样， 终端设备可以从身份验证信息中获取该设备标识， 并和处理后的种子信息一起携带在 身份验证请求中一并发送给身份验证服务器， 身份验证服务器可以根据设备标识从预先存 储的设备标识与密钥的对应关系中直接查找该设备标识对应的密钥， 将其作为密钥存储设 备中存储的密钥对应的密钥。
实施例四
为了更好的理解本发明实施例， 以下结合身份验证时的信息交互流程对本发明实施例 的具体实施过程进行说明， 为了便于说明， 本发明实施例以用户访问网上银行为例进行说 明， 用户登录网上银行的流程如图 4所示， 可以包括以下步骤：
S41、 密钥存储设备生成并显示用于对用户进行身份验证的二维码。
具体实施时， 用户可能通过以下两种方式访问网上 4艮行：
方式一、
用户使用获取用户身份验证信息的终端设备访问网上银行， 例如， 用户使用手机访问 网上银行， 同时使用该手机获取密钥存储设备生成的用户身份验证信息。 这种情况下， 用 户所访问的网上银行的登录页面需要提供使用本发明实施例提供的身份验证方法封装的 应用程序接口， 在用户需要登录网上银行时通过调用该应用程序接口触发对用户的身份验 证。
方式二、
用户使用获取用户身份验证信息的终端设备以外的其他终端设备访问网上银行， 例如 用户使用电脑访问网上银行， 使用自己的手机获取密钥存储设备生成的用户身份验证信 息。 这种情况下， 网上银行登录页面需要嵌入本发明实施例提供的身份验证方法封装的验 证程序， 并在登录页面以图形码（可以但不限于为二维码） 的形式显示， 当用户需要登录 网上银行时， 直接扫描该二维码便可以触发对用户的身份验证。
在触发对用户的身份验证之后， 用户通过触发自己拥有的密钥存储设备（该设备可以 为用户注册银行账户时由银行提供给用户）生成用户身份验证信息， 具体方法可以参见上 述实施例一中的描述， 这里不再赘述。
较佳的， 为了避免用户丢失密钥存储设备带来的风险， 本发明实施例中， 密钥存储设 备还可以在生成用户身份验证信息之前对用户身份进行识别， 例如， 可以通过指紋进行识 别， 也可以通过用户预先设置的密码对用户进行识别， 这里不做限定， 相应的， 密钥存储 设备还可以包括数字按键或者指紋釆集装置。
S42、 终端设备扫描密钥存储设备生成的二维码， 获得处理后的当前时间信息和密钥 存储设备的设备标识。
具体实施时， 对于方式一， 其可以直接调用根据本发明实施例提供的身份验证方法实 现的身份验证应用程序对密钥存储设备生成的用户身份验证信息进行扫描。 对于方式二， 用户自行启动终端设备中安装的根据本发明实施例提供的身份验证方法实现的身份验证 应用程序， 对密钥存储设备生成的用户身份验证信息进行扫描。
S43、 终端设备向网络侧的身份验证服务器发送身份验证请求。
其中， 身份验证请求中携带有得到的处理后的种子信息和密钥存储设备的设备标识。 另外， 终端设备还需要在身份验证请求中携带用户访问的互联网应用的应用标识或者应用 名称和该互联网应用在全局范围内的唯一标识， 该唯一标识是一个全局唯一的编码， 在不 同的互联网应用、 不同的终端设备、 不同时间上都不重复。 较佳的， 该唯一标识可以但不 限于为 UUID ( Universally Unique Identifier, 通用唯一识别码）或者 GUID ( Globally Unique Identifier, 全局唯一标识符）， 当然也可以是釆用类似技术实现的全局范围内的一个标识， 为了便于描述以下以 UUID为例进行说明。
如果用户通过上述第一种方式访问互联网应用， 则终端设备可以直接获取用户当前正 器； 如果用户通过上述第二种方式访问互联网应用， 则在生成登录页面显示的图形码中包 括互联网应用的应用标识或者应用名称和该互联网应用对应的 UUID, 这样， 终端设备通 过扫描该图形码便可以获取应用标识或者应用名称和该互联网应用对应的 UUID , 与从密 钥存储设备生成的二维码中获取的处理后的种子信息和密钥存储设备的设备标识一并发 送给身份验证服务器。
具体实施时， 终端设备可以通过有线网络、 无线网络和移动通信网络等向网络侧的身 份验证服务器发送身份验证请求。
544、 身份验证服务器根据身份验证请求中携带的设备标识查找对应的密钥。
545、 身份验证服务器利用查找到的密钥还原和 /或验证处理后的当前时间信息。
546、 身份验证服务器进行身份验证。
具体实施时， 以密钥存储设备对当前时间加密为例， 身份验证服务器比较还原出的密 钥存储设备的当前时间和自身的当前时间， 如果时间间隔不超过预设的时间间隔则确定验 证通过， 否则， 确定-验证不通过。
547、 身份验证服务器向提供互联网应用的应用服务器发送验证结果。
具体实施时， 身份验证服务器根据身份验证请求中携带的应用标识或者应用名称向该 应用标识或者应用名称对应的应用服务器提供验证结果， 并在发送的验证结果中携带用户 当前访问的互联网应用的 UUID。
548、 应用服务器向终端设备发送允许 /拒绝访问的响应消息。 并根据验证结果向该终端设备发送允许 /拒绝访问的响应消息。
由于现有的釆用加密机制的安全系统中， 非对称密钥加密技术的安全性已得到充分理 论证明， 并广泛使用。 但其最主要的缺点是密钥太长， 人类无法直接记忆和输入， 用户通 常需要将密钥存储在电脑文件或硬件设备中， 使用时进行导入， 这样， 便存在密钥泄露的 风险， 且使用极为不便。 而本发明实施例中， 由于图形码作为一种方便的机器自动识别技 术， 可以用来表示密文信息， 且容易被识别和传输进而解密。 这解决了现有的非对称密钥 加密机制中密钥太长， 不便于直接使用的问题。 此外， 本发明实施例中， 使用独立硬件生 成图形码， 可以避免私钥被窃取、 复制和篡改， 与用户使用的互联网应用物理隔离， 从根 本上避免了遭受黑客入侵的可能性， 具有极高的安全性。 同时， 本发明实施例中使用非对 称密钥加密机制时， 私钥存储在验证信息生成设备的安全模块中， 公钥存储在身份验证服 务器中， 即使身份验证服务器遭受黑客入侵， 公钥全部泄露， 攻击者也无法伪造任何用户 的身份进行验证， 从而不构成任何威胁。 最后， 由于密钥的长度和强度足够， 因此可以直 接使用验证信息生成设备的设备标识（可以为其唯一的编号）作为用户名， 每次对种子信 息加密生成的密文信息或已签名的信息作为密码进行身份-验证， 实现一次一密， 且密码复 杂度远远高于普通人类设置的密码， 安全性和便利性均大大提高。
第二种实施方式、
如图 5所示， 为本发明实施提供的密钥存储设备第二种应用系统的结构示意图， 包括 密钥存储设备、 身份验证服务器和终端设备， 其中：
终端设备， 用于在访问互联网应用需要进行身份验证时， 与验证信息生成设备建立通 信连接； 通过建立的通信连接与验证信息生成设备交互得到验证信息生成设备生成的身份 验证信息后，向身份验证服务器发送身份验证请求，身份验证请求中携带有身份验证信息； 验证信息生成设备， 用于生成身份验证信息， 并通过与终端设备建立的通信连接与终端设 备交互身份验证信息， 身份验证信息至少包括利用存储的第一密钥对种子信息进行处理后 得到的处理后的种子信息，种子信息为计算机系统能够处理的任一信息； 身份验证服务器， 用于在接收到身份验证请求之后，使用自身存储的第一密钥对应的第二密钥还原和 /或验证 身份验证信息中包含的处理后的种子信息； 根据还原结果或者验证结果确定身份验证是否 通过。
具体实施时， 当用户在访问互联网应用需要进行身份验证时， 可以触发建立终端设备 与验证信息生成设备之间的通信连接。 较佳的， 本发明实施例中终端设备与验证信息生成 设备之间可以但不限于釆用以下任一方式建立通信连接： 耳机接口、蓝牙、红外、 NFC (近 场通信）、 WIFI (无线保真）、 USB (通用串行接口）或者 OTG (数据传输接口）等。
具体实施时， 在建立通信连接之后， 验证信息生成设备可以通过建立的通信连接与终 端设备交互自身生成的身份验证信息。 具体实现时， 可以为终端设备主动从验证信息读取 验证信息生成设备生成的身份验证信息， 也可以为验证信息生成设备主动将自身生成的身 份验证信息发送给终端设备。 本发明实施例对此不做限定。 其中， 验证信息生成设备生成 的身份验证信息中至少包括验证信息生成设备利用存储的第一密钥对种子信息进行处理 后得到的处理后的种子信息。
为了便于说明， 以种子信息为验证信息生成设备的当前时间为例。 这样， 身份验证服 务器可以用于在确定还原出的验证信息生成设备的当前时间与自身的当前时间之间的间 隔在预设时间间隔范围之内时， 确定身份验证通过； 还可以用于确定对验证信息生成设备 的当前时间的验证通过时， 确定身份验证通过。
在需要进行身份验证时， 验证信 , 生成设备可以按照以下方法生成身份验证信 , ： 运算模块利用安全模块预先存储的密钥 （即第一密钥）对种子信息进行处理得到处理 后的种子信息。 具体实施时， 运算模块可以利用安全模块存储的密钥对种子信息进行加密 得到该种子信息对应的密文信息； 或者运算模块也可以利用安全模块存储的密钥对种子信 息进行签名得到签名后的种子信息， 还可以对种子信息进行哈希运算得到对应的哈希值。
通信子模块将运算模块得到的处理后的种子信息携带在身份验证信息中发送给终端 设备， 或者也可以由终端设备主动向通信子模块获取包含处理后的种子信息的身份验证信 息。 终端设备将得到的处理后的种子信息携带在身份验证请求中发送给网络侧的身份验证 服务器， 身份验证服务器从自身存储的密钥中查找该验证信息生成设备存储的密钥所对应 的密钥（即第二密钥）并使用查找到的密钥还原和 /或验证处理后的种子信息， 根据还原结 果或者验证结果确定身份验证是否通过。
较佳的， 具体实施时， 本发明实施例提供的交互式身份验证系统可以釆用对称密钥加 密体系， 也可以釆用非对称密钥加密体系。 如果釆用对称密钥加密体系， -验证信息生成设 备的安全模块存储的密钥和身份验证服务器存储的密钥相同。 如果釆用非对称密钥加密体 系， 可以为每一个验证信息生成设备随机生成一组公钥和私钥， 验证信息生成设备的安全 模块存储私钥， 身份验证服务器存储公钥。 相比于对称密钥加密机制， 非对称密钥加密机 制能够进一步提高身份验证系统的安全性， 这种情况下， 即使身份验证服务器被入侵， 攻 击者也无法伪造用户登录。
具体实施时， 在使用非对称密钥加密技术时， 如果验证信息生成设备使用私钥对种子 信息进行签名， 则身份验证服务器存储的公钥可以用于对已签名的种子信息进行验证； 如 果验证信息生成设备使用私钥对种子信息进行加密， 则身份验证服务器存储的公钥可以用 于对加密的种子信息进行解密， 得到种子信息。 若使用对称密钥加密技术， 如果验证信息 生成设备使用存储的密钥对种子信息进行签名， 则身份验证服务器存储的密钥可以用于对 已签名的种子信息进行验证； 如果验证信息生成设备使用存储的密钥对种子信息进行加 密， 则身份验证服务器存储的密钥既可以用于对加密的种子信息进行解密得到种子信息后 再验证， 也可以不还原直接验证密文； 如果验证信息生成设备使用哈希算法对种子信息进 行哈希运算得到哈希值， 则身份验证服务器可以用于对得到的哈希值进行验证。
以种子信息为验证信息生成设备的当前时间为例， 如果还原得到的验证信息生成设备 的当前时间与身份验证服务器的当前时间之间的时间间隔在预设时间间隔范围之内 （如可 以设置为极短的时间间隔）， 确定身份验证通过， 否则， 确定身份验证不通过； 或者确定 对验证信息生成设备的当前时间的验证通过时， 确定身份验证通过， 否则确定身份验证不 通过。
上述方法中， 身份验证服务器在接收到终端设备的身份验证请求之后， 需要从自身存 储的所有密钥中查找验证信息生成设备中存储的密钥对应的密钥还原和 /或验证处理后的 种子信息。 具体的， 身份验证服务器可以依次尝试自身存储的每一密钥， 直至其能够还原 和 /或验证处理后的种子信息为止。
较佳的， 为了提高身份验证服务器还原和 /或验证处理后的种子信息的效率， 本发明实 施例中， 验证信息生成设备在生成身份验证信息时， 还可以包含该验证信息生成设备的设 备标识， 这样， 终端设备可以从接收到的身份验证信息中获取该设备标识， 并和处理后的 种子信息一起携带在身份验证请求中一并发送给身份验证服务器， 身份验证服务器可以根 据设备标识从预先存储的设备标识与密钥的对应关系中直接查找该设备标识对应的密钥， 将其作为验证信息生成设备中存储的密钥对应的密钥。
具体实施时， 终端设备还可以用于在向身份验证服务器发送身份验证请求之前， 获取 用户所访问的互联网应用的应用标识， 并将获取的应用标识携带在身份验证请求中发送给 身份验证服务器。 以便身份验证服务器在得到身份验证结果之后 , 将得到的身份验证结果 通知给该应用标识对应的应用服务器。 具体的， 身份验证服务器可以从预先存储的应用标 识与应用服务器标识的对应关系中查找所述应用标识对应的应用服务器标识， 根据查找到 的应用服务器标识将身份验证结果发送给该应用服务器标识对应的应用服务器。
具体实施时， 由于用户可能使用进行身份验证的终端设备访问互联网应用， 也可能通 过其它终端设备访问互联网应用， 因此， 本发明实施例汇中， 终端设备可以按照以下两种 方式中的任一种获取用户所访问的互联网应用的应用标识：
方式一、 若用户使用进行身份验证的终端设备访问互联网应用时， 终端设备可以通过 调用互联网应用提供的接口获取该互联网应用的应用标识； 若用户使用其它终端设备访问 互联网应用时， 其可以使用终端设备扫描该互联网应用提供的图形码（可以但不限于为二 维码）获取该互联网应用的应用标识。
具体实施时， 为了提高互联网应用访问的安全性， 终端设备在建立与验证信息生成设 备之间的通信连接之后 , 终端设备还可以获取用户所访问的互联网应用的应用识别码， 并 将获取的应用识别码发送给验证信息生成设备， 验证信息生成设备利用自身存储的第一密 钥对该应用识别码进行处理之后 , 将其携带在身份验证信息中发送给终端设备， 终端设备 将接收到处理后的应用识别码携带在身份验证请求中发送给身份验证服务器。 具体实施 时， 终端设备获取应用识别码的方式与上述终端设备获取应用标识的方式相同， 这里不再 赘述。
较佳的，应用识别码是一个全局唯一的编码，在不同的互联网应用、 不同的终端设备、 不同时间上都不重复。 较佳的， 该应用识别码可以但不限于为 UUID ( Universally Unique Identifier, 通用唯一识别码）或者 GUID ( Globally Unique Identifier, 全局唯一标识符）， 当 然也可以是釆用类似技术实现的全局范围内的一个标识， 为了便于描述以下以 UUID为例 进行说明。
身份验证服务器在接收到处理后的应用识别码之后， 如果验证信息生成设备对该应用 识别码进行了加密处理， 则身份验证服务器需要利用自身存储的第二秘钥对其进行解密之 后与身份验证结果一并发送给对应的应用服务器， 应用服务器根据接收到的应用识别码可 以确定用户访问互联网应用的终端设备 , 并根据身份验证服务器发送的身份验证结果向该 终端设备发送允许 /拒绝访问的响应消息。
实施例六
为了更好的理解本发明实施例， 以下结合身份验证时的信息交互流程对本发明实施例 的具体实施过程进行说明， 为了便于说明， 本发明实施例以用户访问网上银行为例进行说 明， 用户登录网上银行的流程如图 6所示， 可以包括以下步骤：
S61、 用户访问互联网应用时， 建立终端设备与验证信息生成设备之间的通信连接。 具体实施时， 用户可能通过以下两种方式访问网上 4艮行：
方式一、
用户使用获取身份验证信息的终端设备访问网上银行， 例如， 用户使用手机访问网上 银行， 同时使用该手机获取验证信息生成设备生成的身份验证信息。 这种情况下， 用户所 访问的网上银行的登录页面需要提供使用本发明实施例提供的身份验证方法封装的应用 程序接口， 在用户需要登录网上银行时通过调用该应用程序接口触发对用户的身份验证。
方式二、
用户使用获取身份验证信息的终端设备以外的其他终端设备访问网上银行， 例如用户 使用电脑访问网上银行， 使用自己的手机获取验证信息生成设备生成的身份验证信息。 这 种情况下， 网上银行登录页面需要嵌入本发明实施例提供的身份验证方法封装的验证程 序， 并在登录页面以图形码（可以但不限于为二维码） 的形式显示， 当用户需要登录网上 银行时， 直接扫描该二维码便可以触发对用户的身份验证。
S62、 验证信息生成设备生成身份验证信息。
在触发对用户的身份验证之后， 用户通过触发自己拥有的验证信息生成设备（该设备 可以为用户注册银行账户时由银行提供给用户）生成身份验证信息， 例如， 用户通过验证 信息生成设备提供的按键触发验证信息生成设备生成身份验证信息， 验证信息生成设备生 成身份验证信息的具体方法可以参见上述实施例一中的描述， 这里不再赘述。 较佳的， 为了避免用户丢失验证信息生成设备带来的风险， 本发明实施例中， 验证信 息生成设备还可以在生成身份验证信息之前对用户身份进行识别， 例如， 可以通过指紋进 行识别， 也可以通过用户预先设置的密码对用户进行识别， 这里不做限定， 相应的， 验证 信息生成设备还可以包括数字按键或者指紋釆集装置。
具体实施时， 步骤 S62也可以先于步骤 S61执行， 即验证信息生成设备先生成身份验证 信息， 再与终端设备建立通信连接， 二者也可以同时执行， 本发明实施例对此不做限定。
563、 验证信息生成设备与终端设备交互自身生成的身份验证信息。
具体实施时， 验证信息生成设备利用自身存储的密钥对种子信息进行处理得到处理后 的种子信息， 将处理后的种子信息和自身的设备标识携带在身份验证信息中发送给终端设 备， 或者也可以由终端设备主动向通信子模块获取包含处理后的种子信息的身份验证信 息。
564、 终端设备向网络侧的身份验证服务器发送身份验证请求。
其中， 身份验证请求中携带有得到的处理后的种子信息和验证信息生成设备的设备标 识。
需要说明的是， 终端设备还可以获取用户所访问的互联网应用的应用识别码和应用标 识， 并将其携带在身份验证请求中一并发送给身份验证服务器。
具体实施时， 终端设备可以在与验证信息生成设备建立通信连接之前获取用户所访问 的互联网应用的应用标识， 也可以在与验证信息生成设备建立通信连接之后获取用户所访 问的互联网应用的应用标识， 也可以在接收到身份验证信息之后再获取用户所访问的互联 网应用的应用标识， 只要是在发送身份验证请求之前获取均可， 本发明对此不做限定。
例如， 如果用户通过上述第一种方式访问互联网应用， 则终端设备可以直接获取用户 证服务器； 如果用户通过上述第二种方式访问互联网应用， 则在生成登录页面显示的图形 码中包括互联网应用的应用标识或者应用名称和该互联网应用对应的 UUID, 这样， 终端 设备通过扫描该图形码便可以获取应用标识或者应用名称和该互联网应用对应的 UUID , 与从验证信息生成设备生成的二维码中获取的处理后的种子信息和验证信息生成设备的 设备标识一并发送给身份验证服务器。
较佳的， 为了提高数据传输的安全性， 终端设备可以将获取的 UUID发送给验证信息 生成设备进行处理之后， 再发送给身份验证服务器， 以防止其在传输过程中被篡改。 应当 理解， 如果终端设备将 UUID发送给验证信息生成设备进行处理时， 其需要在建立通信连 接之前获取 UUID和应用标识或者在建立连接通信之后接收到身份验证信息之前获取
UUID和应用标识。 以便验证信息生成设备将处理后的 UUID携带在身份验证信息中一并发 送给终端设备。 具体实施时， 终端设备可以通过有线网络、 无线网络和移动通信网络等向网络侧的身 份验证服务器发送身份验证请求。
565、 身份验证服务器根据身份验证请求中携带的设备标识查找对应的密钥。
566、 身份验证服务器利用查找到的密钥还原和 /或验证处理后的当前时间信息。
567、 身份验证服务器进行身份验证。
具体实施时， 以验证信息生成设备对当前时间加密为例， 身份验证服务器比较还原出 的-验证信息生成设备的当前时间和自身的当前时间， 如果时间间隔不超过预设的时间间隔 则确定验证通过， 否则， 确定验证不通过。
S68、 身份验证服务器向提供互联网应用的应用服务器发送验证结果。
具体实施时， 身份验证服务器根据身份验证请求中携带的应用标识或者应用名称向该 应用标识或者应用名称对应的应用服务器提供验证结果， 并在发送的验证结果中携带用户 当前访问的互联网应用的 UUID。
S69、 应用服务器向终端设备发送允许 /拒绝访问的响应消息。 并根据验证结果向该终端设备发送允许 /拒绝访问的响应消息。
由于现有的釆用加密机制的安全系统中， 非对称密钥加密技术的安全性已得到充分理 论证明， 并广泛使用。 但其最主要的缺点是密钥太长， 人类无法直接记忆和输入， 用户通 常需要将密钥存储在电脑文件或硬件设备中， 使用时进行导入， 这样， 便存在密钥泄露的 风险， 且使用极为不便。 而本发明实施例中， 由于图形码作为一种方便的机器自动识别技 术， 可以用来表示密文信息， 且容易被识别和传输进而解密。 这解决了现有的非对称密钥 加密机制中密钥太长， 不便于直接使用的问题。 此外， 本发明实施例中， 使用独立硬件生 成身份验证信息， 可以避免私钥被窃取、 复制和篡改， 具有极高的安全性。 同时， 本发明 实施例中使用非对称密钥加密机制时， 私钥存储在验证信息生成设备的安全模块中， 公钥 存储在身份验证服务器中， 即使身份验证服务器遭受黑客入侵， 公钥全部泄露， 攻击者也 无法伪造任何用户的身份进行验证， 从而不构成任何威胁。 最后， 由于密钥的长度和强度 足够， 因此可以直接使用验证信息生成设备的设备标识（可以为其唯一的编号）作为用户 名， 每次对种子信息加密生成的密文信息或已签名的信息作为密码进行身份验证， 实现一 次一密， 且密码复杂度远远高于普通人类设置的密码， 安全性和便利性均大大提高。
第三种实施方式、
本发明实施例提供的身份验证系统还可以用于企业门禁系统， 即企业只需要安装图形 码扫描装置 （例如可以为摄像头）， 并为每一员工配备一个密钥存储设备， 在进入时可以 通过扫描密钥存储设备生成的用户身份验证信息对其进行验证， 通过则允许进入， 同时， 还可以记录门开启时间等信息。 具体实施时， 本发明实施例提供的身份验证系统可以针对不同的互联网应用提供一个 密钥存储设备， 也可以针对安全要求高的互联网应用如网上银行、 在线支付等提供单独的 密钥存储设备， 此时， 身份验证服务器需要维护互联网应用的应用标识与其对应的密钥存 储设备的设备标识以及密钥之间的对应关系， 以对不同的互联网应用提供身份验证。
需要说明的是， 本发明实施例中涉及的终端设备可以为手机、 平板电脑、 PDA (个人 数字助理）、 智能手表等移动终端设备， 也可以是 PC (个人电脑）等设备， 只要是安装有 摄像装置或扫描装置， 能够扫描获取密钥存储设备生成的图形码的终端设备均可。
另夕卜，本发明实施例中涉及的互联网应用包括能够通过互联网 /移动互联网进行访问的 网站、 应用程序客户端等。
因此， 相对于传统的身份验证方法， 本发明实施例提供的身份验证方法安全性更高， 实现了高度复杂的密码和一次一密， 避免了密码被窃取的风险。 且本发明实施例提供的身 份验证方法， 更方便快捷， 用户无需记忆和输入各种不同的用户名和密码， 直接扫描图形 码即可快速完成身份验证过程。
由于本发明实施例提供的身份验证方法中的密码长度和强度比普通用户设置的密码 及现有的 RSA SecurlD双因素认证令牌使用的 6位纯数字高很多， 因此， 可以直接作为主密 码进行身份验证。
本领域内的技术人员应明白， 本发明的实施例可提供为方法、 系统、 或计算机程序产 品。 因此， 本发明可釆用完全硬件实施例、 完全软件实施例、 或结合软件和硬件方面的实 施例的形式。 而且， 本发明可釆用在一个或多个其中包含有计算机可用程序代码的计算机 可用存储介盾 （包括但不限于磁盘存储器、 CD-ROM、 光学存储器等）上实施的计算机程 序产品的形式。
本发明是参照根据本发明实施例的方法、 设备（系统）、 和计算机程序产品的流程图 和 /或方框图来描述的。 应理解可由计算机程序指令实现流程图和 /或方框图中的每一流 程和 /或方框、 以及流程图和 /或方框图中的流程和 /或方框的结合。 可提供这些计算机 程序指令到通用计算机、 专用计算机、 嵌入式处理机或其他可编程数据处理设备的处理器 以产生一个机器， 使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用 于实现在流程图一个流程或多个流程和 /或方框图一个方框或多个方框中指定的功能的 装置。
这些计算机程序指令也可存储在能弓 I导计算机或其他可编程数据处理设备以特定方 式工作的计算机可读存储器中， 使得存储在该计算机可读存储器中的指令产生包括指令装 置的制造品， 该指令装置实现在流程图一个流程或多个流程和 /或方框图一个方框或多个 方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上， 使得在计算机 或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理， 从而在计算机或其他 可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和 /或方框图一个 方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例， 但本领域内的技术人员一旦得知了基本创造性概 念， 则可对这些实施例做出另外的变更和修改。 所以， 所附权利要求意欲解释为包括优选 实施例以及落入本发明范围的所有变更和修改。
显然， 本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和 范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内， 则本发明也意图包含这些改动和变型在内。

Claims

权 利 要 求
1、 一种密钥存储设备， 其特征在于， 包括：
安全模块， 用于存储密钥， 所述密钥用于验证用户身份；
运算模块， 用于在需要进行身份验证时生成身份验证信息， 所述身份验证信息中至少 包括利用所述安全模块存储的密钥对种子信息进行处理得到的处理后的种子信息， 所述种 子信息为计算机系统能够处理的任一信息；
密钥交互模块， 用于与外界设备交互所述身份验证信息。
2、 如权利要求 1所述的设备， 其特征在于， 所述密钥交互模块为显示子模块； 所述显示子模块， 具体用于显示所述身份验证信息。
3、 如权利要求 2所述的设备， 其特征在于， 所述显示子模块为液晶显示子模块 LCD、 发光二极管 LED显示子模块、 有机发光二极管 OLED显示子模块或者电子墨水屏幕。
4、 如权利要求 1、 2或 3所述的设备， 其特征在于， 所述身份验证信息为图形码。
5、 如权利要求 1所述的设备， 其特征在于， 所述密钥交互模块包括通信子模块； 所述通信子模块， 具体用于与所述外界设备建立通信连接， 并通过建立的通信连接将 所述身份验证信息传输给所述外界设备。
6、 如权利要求 5所述的设备， 其特征在于，
所述通信子模块， 具体用于按照以下任一方式与所述外界设备建立通信连接： 耳机接 口、蓝牙、红夕卜、近场通信 FC、无线保真 WIFI、通用串行接口 USB或者数据传输接口 OTG。
7、 如权利要求 1~6任一权利要求所述的设备， 其特征在于， 所述种子信息包括所述设 备的当前时间。
8、 如权利要求 1任一权利要求所述的设备， 其特征在于，
所述运算模块， 具体用于按照以下方法利用所述安全模块存储的密钥对种子信息进行 处理： 利用所述安全模块存储的密钥对种子信息进行加密、 签名或者哈希运算。
9、 如权利要求 1所述的设备， 其特征在于， 还包括确认按键， 所述确认按键与所述运 算模块连接。
10、 如权利要求 1或 9所述的设备， 其特征在于， 还包括物理防护模块， 所述物理防护 模块与所述运算模块连接。
11、 如权利要求 10所述的设备， 其特征在于， 所述物理防护模块包括密码防护子模块 和 /或生物特征防护模块子模块。
12、 一种基于权利要求 1~11任一权利要求所述的密钥存储设备的使用方法， 其特征在 于， 包括：
所述运算模块在需要进行身份验证时生成身份验证信息， 所述身份验证信息中至少包 括利用所述安全模块存储的密钥对种子信息进行处理得到的处理后的种子信息， 所述种子 信息为计算机系统能够处理的任一信息；
所述密钥交互模块在所述运算模块生成所述身份验证信息之后， 与外界设备交互所述 身份验证信息。
13、 如权利要求 12所述的方法， 其特征在于， 所述密钥交互模块与外界设备交互所述 身份验证信息， 具体包括：
所述密钥交互模块包含的显示子模块显示所述身份验证信息。
14、 如权利要求 12所述的方法， 其特征在于， 所述密钥交互模块与外界设备交互所述 身份验证信息， 具体包括：
所述密钥交互模块包含的通信子模块与所述外界设备建立通信连接， 并通过建立的通 信连接将所述身份验证信息传输给所述外界设备。
PCT/CN2014/082518 2014-06-09 2014-07-18 一种密钥存储设备及其使用方法 WO2015188424A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US14/902,396 US20170085561A1 (en) 2014-06-09 2014-07-18 Key storage device and method for using same

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201420304960.2U CN204046622U (zh) 2014-06-09 2014-06-09 一种密钥存储设备
CN201420304960.2 2014-06-09
CN201410254187.8 2014-06-09
CN201410254187.8A CN104063650B (zh) 2014-06-09 2014-06-09 一种密钥存储设备及其使用方法

Publications (1)

Publication Number Publication Date
WO2015188424A1 true WO2015188424A1 (zh) 2015-12-17

Family

ID=54832762

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/082518 WO2015188424A1 (zh) 2014-06-09 2014-07-18 一种密钥存储设备及其使用方法

Country Status (2)

Country Link
US (1) US20170085561A1 (zh)
WO (1) WO2015188424A1 (zh)

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104243484B (zh) * 2014-09-25 2016-04-13 小米科技有限责任公司 信息交互方法及装置、电子设备
US10484172B2 (en) * 2015-06-05 2019-11-19 Apple Inc. Secure circuit for encryption key generation
AU2017362156A1 (en) * 2016-11-16 2019-07-04 Meir GOLAN System, methods and software for user authentication
CN107528842A (zh) * 2017-08-21 2017-12-29 合肥丹朋科技有限公司 网站密码生成方法及装置
CN108011876A (zh) * 2017-11-29 2018-05-08 中国银行股份有限公司 一种实名认证方法、装置及系统
US10812337B2 (en) 2018-06-15 2020-10-20 Vmware, Inc. Hierarchical API for a SDDC
US10942788B2 (en) 2018-06-15 2021-03-09 Vmware, Inc. Policy constraint framework for an sddc
US11086700B2 (en) 2018-08-24 2021-08-10 Vmware, Inc. Template driven approach to deploy a multi-segmented application in an SDDC
CN115380514B (zh) 2020-04-01 2024-03-01 威睿有限责任公司 为异构计算元件自动部署网络元件
CN111695097A (zh) * 2020-05-29 2020-09-22 平安科技（深圳）有限公司 登录检验方法、装置及计算机可读存储介质
US11803408B2 (en) 2020-07-29 2023-10-31 Vmware, Inc. Distributed network plugin agents for container networking
US11863352B2 (en) 2020-07-30 2024-01-02 Vmware, Inc. Hierarchical networking for nested container clusters
US20220217136A1 (en) * 2021-01-04 2022-07-07 Bank Of America Corporation Identity verification through multisystem cooperation
US11606254B2 (en) 2021-06-11 2023-03-14 Vmware, Inc. Automatic configuring of VLAN and overlay logical switches for container secondary interfaces
US20230231741A1 (en) 2022-01-14 2023-07-20 Vmware, Inc. Per-namespace ip address management method for container networks
CN114915458B (zh) * 2022-04-27 2023-08-29 安徽超清科技股份有限公司 一种城市轨道交通用综合监测防护装置
US11848910B1 (en) 2022-11-11 2023-12-19 Vmware, Inc. Assigning stateful pods fixed IP addresses depending on unique pod identity
US11831511B1 (en) 2023-01-17 2023-11-28 Vmware, Inc. Enforcing network policies in heterogeneous systems

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102186169A (zh) * 2010-04-30 2011-09-14 北京华大智宝电子系统有限公司 一种身份认证方法、装置及系统
CN103312519A (zh) * 2013-07-05 2013-09-18 飞天诚信科技股份有限公司 一种动态口令设备及其工作方法
CN103366111A (zh) * 2013-07-10 2013-10-23 公安部第三研究所 移动设备上基于二维码实现智能卡扩展认证控制的方法
CN104065653A (zh) * 2014-06-09 2014-09-24 韩晟 一种交互式身份验证方法、装置、系统和相关设备
CN104065652A (zh) * 2014-06-09 2014-09-24 韩晟 一种身份验证方法、装置、系统及相关设备

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6199055B1 (en) * 1997-11-05 2001-03-06 E-Stamp Corporation System and method for providing fault tolerant transcriptions over an unsecured communication channel
US6985583B1 (en) * 1999-05-04 2006-01-10 Rsa Security Inc. System and method for authentication seed distribution
FI20050562A0 (fi) * 2005-05-26 2005-05-26 Nokia Corp Menetelmä avainmateriaalin tuottamiseksi
JP2008098696A (ja) * 2006-10-05 2008-04-24 Toshiba Corp 暗号鍵管理装置及び暗号鍵管理方法
KR101490687B1 (ko) * 2007-08-20 2015-02-06 삼성전자주식회사 홈 네트워크에서 디바이스들이 비밀 정보를 공유하는 방법및 이를 위한 장치
US8856901B2 (en) * 2010-05-26 2014-10-07 Marcel Van Os Digital handshake for authentication of devices
US8429407B2 (en) * 2010-05-26 2013-04-23 Apple Inc. Digital handshake between devices

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102186169A (zh) * 2010-04-30 2011-09-14 北京华大智宝电子系统有限公司 一种身份认证方法、装置及系统
CN103312519A (zh) * 2013-07-05 2013-09-18 飞天诚信科技股份有限公司 一种动态口令设备及其工作方法
CN103366111A (zh) * 2013-07-10 2013-10-23 公安部第三研究所 移动设备上基于二维码实现智能卡扩展认证控制的方法
CN104065653A (zh) * 2014-06-09 2014-09-24 韩晟 一种交互式身份验证方法、装置、系统和相关设备
CN104065652A (zh) * 2014-06-09 2014-09-24 韩晟 一种身份验证方法、装置、系统及相关设备

Also Published As

Publication number Publication date
US20170085561A1 (en) 2017-03-23

Similar Documents

Publication Publication Date Title
CN109951489B (zh) 一种数字身份认证方法、设备、装置、系统及存储介质
WO2015188424A1 (zh) 一种密钥存储设备及其使用方法
US20210264010A1 (en) Method and system for user authentication with improved security
EP3319292B1 (en) Methods, client and server for checking security based on biometric features
US20220191016A1 (en) Methods, apparatuses, and computer program products for frictionless electronic signature management
WO2015188426A1 (zh) 一种身份验证方法、装置、系统及相关设备
US10592651B2 (en) Visual image authentication
CN106575326B (zh) 利用非对称加密实施一次性密码的系统和方法
KR101878149B1 (ko) 패스워드의 보안 입력 및 처리 장치, 시스템 및 방법
CN104065653B (zh) 一种交互式身份验证方法、装置、系统和相关设备
US8661254B1 (en) Authentication of a client using a mobile device and an optical link
US10848304B2 (en) Public-private key pair protected password manager
CN108989346A (zh) 基于账号隐匿的第三方有效身份托管敏捷认证访问模式
EP3206329B1 (en) Security check method, device, terminal and server
WO2019226115A1 (en) Method and apparatus for user authentication
US20180262471A1 (en) Identity verification and authentication method and system
WO2021190197A1 (zh) 生物支付设备的认证方法、装置、计算机设备和存储介质
TWM599939U (zh) 身分驗證系統
TWI640887B (zh) 配合一行動裝置實現的使用者身分驗證系統及方法
US11968202B2 (en) Secure authentication in adverse environments
TWI644227B (zh) 配合一行動裝置實現的交互驗證系統及方法
US20200374277A1 (en) Secure authentication in adverse environments
TW202134915A (zh) 身分驗證方法以及使用其之系統
Guangming et al. A New Dynamic Authentication Captcha Based on Negotiation Between Host and Mobile Terminal for Electronic Commerce
TWM549918U (zh) 配合一行動裝置實現的交互驗證系統

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 14902396

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14894228

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14894228

Country of ref document: EP

Kind code of ref document: A1