WO2017000829A1 - 一种基于生物特征的安全校验方法及客户端、服务器 - Google Patents

一种基于生物特征的安全校验方法及客户端、服务器 Download PDF

Info

Publication number
WO2017000829A1
WO2017000829A1 PCT/CN2016/086868 CN2016086868W WO2017000829A1 WO 2017000829 A1 WO2017000829 A1 WO 2017000829A1 CN 2016086868 W CN2016086868 W CN 2016086868W WO 2017000829 A1 WO2017000829 A1 WO 2017000829A1
Authority
WO
WIPO (PCT)
Prior art keywords
response message
user
client
authentication
server
Prior art date
Application number
PCT/CN2016/086868
Other languages
English (en)
French (fr)
Inventor
林钧燧
Original Assignee
阿里巴巴集团控股有限公司
林钧燧
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 林钧燧 filed Critical 阿里巴巴集团控股有限公司
Priority to EP16817193.2A priority Critical patent/EP3319292B1/en
Priority to ES16817193T priority patent/ES2818199T3/es
Priority to KR1020187003347A priority patent/KR102493744B1/ko
Priority to PL16817193T priority patent/PL3319292T3/pl
Priority to JP2018500295A priority patent/JP6882254B2/ja
Priority to SG11201710590XA priority patent/SG11201710590XA/en
Publication of WO2017000829A1 publication Critical patent/WO2017000829A1/zh
Priority to US15/857,762 priority patent/US10659230B2/en
Priority to US16/876,584 priority patent/US10892896B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/12—Fingerprints or palmprints
    • G06V40/1365—Matching; Classification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response

Definitions

  • the invention belongs to the technical field of identity authentication, and particularly relates to a biometric-based security verification method and a client and a server in the identity authentication process.
  • the client sends the fingerprint data (fingerprint image or fingerprint feature data) of the user to the server, and compares the original fingerprint data with the user on the server side to complete the verification.
  • fingerprint data needs to be transmitted to the server, there is a risk of fingerprint data leakage during the uploading process.
  • the fingerprint data is personal privacy data, and the user does not necessarily agree to upload, and the leakage may cause reputational risk. Even if the user agrees to upload the fingerprint data, the network traffic is consumed during the fingerprint data uploading process, and the server side needs to compare the fingerprint data, which requires additional computing resources and storage resources.
  • the object of the present invention is to provide a biometric-based security verification method, a client, and a server, to avoid the above-mentioned technical problems such as the consumption of network traffic, the risk of personal fingerprint data leakage, and the like in the prior art verification process. safety.
  • a biometric-based security verification method is applied to a client in an identity authentication system, the identity authentication system further includes a server end, and the client saves an opening record, and the opening record includes an opening biometric school a biometric template ID for biometric verification obtained during the verification process, the security verification method comprising:
  • the opening biometric verification process includes:
  • Generating an activation response message including the biometric template ID and sending an activation response message to the server, so that the server receives the activation response message, and acquires the biometric template ID generated in the user record to be saved.
  • the server end signs the authentication request response message or the provisioning request response message by using the agreed first private key, and after receiving the authentication request response message, the client further includes:
  • the received authentication request response message is verified by the agreed first public key, and the subsequent response is performed if the verification is passed, otherwise an error is reported;
  • the client After receiving the opening request response message, the client further includes:
  • the received open request response message is verified by the agreed first public key, and the subsequent response is performed if the check is passed, otherwise an error is reported.
  • the security during the opening process can be further enhanced to prevent the forgery opening process.
  • the activation request response message carries a challenge value
  • the opening biometric verification process further includes:
  • the opening response message includes a user public key, so that the server receives the opening response message and performs verification using the agreed second public key, and saves the user public key on the server side.
  • the authentication request response message carries a challenge value
  • the security verification method further includes:
  • the security is enhanced and the replay attack of the forged message is prevented.
  • the activation request response message further includes a user ID
  • the client further includes:
  • the user ID is saved in the opening record, and the user ID is further included in the activation response message generated by the client, so that the server obtains the user ID after receiving the opening response message. And save it in the user record.
  • the activation response message further includes a client device ID, so that after receiving the activation request response message, the server acquires the device ID therein and saves it in the user record.
  • the authentication request response message further includes a user ID, and after receiving the biometric input by the user and acquiring the biometric template ID corresponding to the biometric, the method further includes:
  • the user ID is further included in the authentication response message generated by the client, so that the server obtains the user ID and receives the corresponding user record according to the user ID after receiving the authentication response message.
  • the authentication response message further includes a client device ID, so that the server obtains the device ID in the authentication response message after receiving the authentication response message, and searches for a corresponding user record according to the device ID.
  • the invention also provides a biometric-based security verification method, which is applied to a server end in an identity authentication system, the identity authentication system further includes a client, and the server end stores a user record, and the user record includes There is a biometric template ID for biometric verification obtained during the opening of the biometric verification process, and the security verification method includes:
  • the authentication response message including a biometric template ID
  • the biometric template ID in the authentication response message is compared with the biometric template ID in the saved user record, and if they are consistent, the verification is passed, otherwise an error is reported.
  • the opening biometric verification process includes:
  • Receiving a turn-on response message from the client acquiring a biometric template ID included in the activation response message, and generating a user record save.
  • the security verification method further includes:
  • the authentication request response message or the provisioning request response message is signed by the agreed first private key, so that the client checks the received authentication request response message with the agreed first public key, if the verification passes A subsequent response is made, otherwise an error is reported, or the received provisioning request response message is verified with the agreed first public key, and the subsequent response is performed if the verification is passed, otherwise an error is reported.
  • the security during the opening process can be further enhanced to prevent the forgery opening process.
  • the provisioning request response message carries a challenge value
  • the client generates a user public-private key pair including the user private key and the user public key, and saves the user private key
  • the opening biometric verification process further includes:
  • the receiving client selects a signature algorithm according to the challenge value in the activation request response message, and uses a selected signature algorithm and a prescribed second private key signature activation response message, the activation response message including a user public key, the signature algorithm is also selected according to the challenge value, and the second public key is used to verify the activation response message on the server side. Save the user's public key.
  • the security verification method further includes:
  • the receiving client selects a signature algorithm according to the challenge value in the authentication request response message, and uses the selected signature algorithm and the user private key to perform the authentication response message, and also selects the signature algorithm and the user public key verification authentication response message according to the challenge value. signature.
  • the security is enhanced and the replay attack of the forged message is prevented.
  • the provisioning request response message further includes a user ID, so that the client saves the user ID in the opening record after receiving the opening request response message, and the activation generated by the client is generated.
  • the response message further includes the user ID, and after receiving the activation response message, the server further includes:
  • a user ID is obtained from the activation response message, and the user ID is saved in the user record.
  • the opening response message further includes a client device ID
  • the server further includes:
  • the authentication request response message further includes a user ID, so that the client finds a corresponding opening record according to the user ID, and compares the obtained biometric template ID with the biometric template ID in the found opening record.
  • the user ID is further included in the authentication response message generated by the client, and after receiving the authentication response message, the server includes:
  • the authentication response message further includes a client device ID
  • the server further includes:
  • the invention also provides a client, which is applied to an identity authentication system.
  • the identity authentication system further includes a server end, and the client saves an opening record, where the opening record includes the obtained in the process of opening the biometric verification.
  • a biometric template ID for biometric verification, the client comprising:
  • a requesting module configured to send an authentication request to the server, and receive an authentication request response message returned by the server;
  • a response module configured to receive a biometric input by the user, obtain a biometric template ID corresponding to the biometric, and compare the acquired biometric template ID with a biometric template ID in the saved opening record, if the matching is An authentication response message including the acquired biometric template ID is generated, and an authentication response message is sent to the server, so that the server receives the authentication response message for verification.
  • the requesting module is further configured to send a turn-on request for opening the biometric check to the server, and receive a turn-on request response message returned by the server;
  • the response module is further configured to receive the user input for verification Feature, acquiring the biometric template ID corresponding to the biometric for verification, generating an opening record save, generating an activation response message including the biometric template ID, and sending an opening response message to the server, so that the server receives the The response message is opened, and the biometric template ID included in the generated user record is saved.
  • the server end signs the authentication request response message or the provisioning request response message by using the agreed first private key, and the requesting module is further used to make an agreement after receiving the authentication request response message.
  • the first public key verifies the received authentication request response message, and if the verification passes, the subsequent response is performed, otherwise the error is reported; after receiving the opening request response message, the requesting module is further used to agree
  • the first public key verifies the received provisioning request response message, and if the verification passes, the subsequent response is performed, otherwise an error is reported.
  • the activation request response message carries the challenge value
  • the response module is further configured to generate a public-private key pair of the user including the user private key and the user public key, and save the user private key; and the challenge value in the response message according to the provisioning request Selecting a signature algorithm, and using the selected signature algorithm and the agreed second private key to sign the generated activation response message and send it to the server, the opening response
  • the response message includes the user public key, so that the server receives the activation response message and performs verification using the agreed second public key, and saves the user public key on the server side.
  • the authentication request response message carries a challenge value
  • the response module is further configured to select a signature algorithm according to the challenge value, and use the selected signature algorithm and the user private key to sign the authentication response message, so that After receiving the authentication response message, the server end also checks the authentication response message according to the challenge value selection signature algorithm and the user public key.
  • the invention also provides a server, which is applied to an identity authentication system, the identity authentication system further includes a client, the server stores a user record, and the user record includes the acquired in the process of opening the biometric verification process.
  • Biometric template ID of the biometric check the server includes:
  • a response module configured to receive an authentication request from the client, and send an authentication request response message to the client;
  • a verification module configured to receive an authentication response message from the client, where the authentication response message includes a biometric template ID, and compare the biometric template ID in the authentication response message with the biometric template ID in the saved user record. For verification, if it is consistent, the verification is passed, otherwise an error is reported.
  • the response module is further configured to receive a provisioning request for opening the biometric verification from the client, and send a provisioning request response message to the client, so that the client obtains the biometric according to the user input for verification.
  • the biometric template ID corresponding to the biometric feature of the verification is generated, and the activation record is saved.
  • the verification module is further configured to receive an activation response message from the client, obtain a biometric template ID included in the activation response message, and generate a user record. save.
  • the response module is further configured to sign the authentication request response message or the provisioning request response message with the agreed first private key, so that the client responds to the received authentication request with the agreed first public key.
  • the message is checked. If the check is passed, the subsequent response is performed. Otherwise, an error is reported, or the received open request response message is verified by the agreed first public key. If the check is passed, the subsequent response is performed, otherwise an error is reported.
  • the activation request response message of the present invention carries a challenge value, and the client generates the The user private key and the user public key pair of the user public key are saved, and the user private key is saved.
  • the verification module is further configured to receive a signature algorithm selected by the client according to the challenge value in the activation request response message, and use the selected signature algorithm and convention.
  • the second private key signature opening response message, the opening response message includes a user public key, the signature algorithm is also selected according to the challenge value, and the second public key verification activation response message is used to save the user public key.
  • the verification module is further configured to receive an authentication response message that the client selects a signature algorithm according to the challenge value in the authentication request response message, and uses the selected signature algorithm and the user private key to perform the signature, and selects the signature according to the challenge value.
  • the algorithm and the user's public key verify the signature of the authentication response message.
  • the invention provides a biometric-based security verification method, a client and a server, and implements fingerprint verification, fingerprint template storage and verification process on the client side in a trusted execution environment (TEE), and is completely isolated from common hardware. No risk of privacy leakage.
  • TEE trusted execution environment
  • the network traffic in the process of transmitting fingerprint data is reduced, and at the same time, only the fingerprint template ID is compared on the server side, thereby reducing the computing overhead and storage overhead of the server.
  • the fingerprint verification is enabled, it is bound to the specific fingerprint template.
  • the new fingerprint template added after the opening is not used for verification, which increases security.
  • the security of the verification process is further enhanced by the selected signature algorithm to prevent network attacks of forged messages.
  • FIG. 1 is a flow chart of a biometrics verification process according to the present invention.
  • FIG. 2 is a flow chart of a biometric-based security verification method according to the present invention.
  • FIG. 3 is a schematic structural diagram of a client according to the present invention.
  • FIG. 4 is a schematic structural view of a server of the present invention.
  • biometric-based verification identity authentication by fingerprinting, speech recognition, face recognition, iris recognition and other technical means is becoming more and more common.
  • This biometric verification application has a wide range of applications, such as in access control systems, or in Internet payments.
  • This embodiment pays by internet
  • the fingerprint verification in the example is taken as an example to describe in detail a biometric-based security verification method of the present invention.
  • the fingerprint verification in the Internet payment in this embodiment completes the fingerprint comparison on the client side of the user, and further performs the result verification on the server side, and ensures the fingerprint verification through double protection. Effectiveness.
  • the client in this embodiment is generally an application program installed in a user's mobile terminal, a computer, or other smart device. Some clients directly use a webpage provided by a service provider in combination with a fingerprint scanning terminal.
  • the fingerprint verification method of this embodiment includes a fingerprint verification activation process and a verification process, which are respectively described below.
  • Embodiment 1 The opening process of fingerprint verification.
  • Fingerprint verification of Internet payment first needs to open the fingerprint verification function, as shown in Figure 1, including the following steps:
  • the client sends a provisioning request for opening the fingerprint verification to the server.
  • the user When the user activates the fingerprint verification function, the user first initiates a provisioning request to the server.
  • the server After receiving the opening request for opening the fingerprint verification, the server sends a provisioning request response message to the client.
  • the client After receiving the activation request response message, the client receives the fingerprint image input by the user for verification, and acquires the fingerprint template ID corresponding to the fingerprint image used for verification.
  • the user's client device Before the fingerprint verification is opened, the user's client device stores a plurality of fingerprint templates recorded by the user, and the fingerprint template is a fingerprint feature extracted from the fingerprint image.
  • the fingerprint verification function When the fingerprint verification function is enabled, the user inputs the fingerprint image of the finger used for fingerprint verification to the client, for example, placing the finger on the fingerprint scanning device, acquiring the fingerprint image, extracting the fingerprint feature, and thus the client The stored fingerprint templates are compared to obtain a corresponding fingerprint template ID.
  • the fingerprint image used by the user for fingerprint verification may be directly input, and the fingerprint template and the fingerprint template ID may be generated to obtain the fingerprint template. ID.
  • the client saves the opening record, and the opening record includes the fingerprint template ID.
  • the opening record is a record stored in the client device, and includes a fingerprint template ID used by the user for fingerprint verification when the user is turned on, and is used to compare the input fingerprint template ID in the fingerprint verification of the subsequent step, and look at the input. Whether the fingerprint template ID is the same as the fingerprint template ID when it was originally turned on. Consistent. That is, only the fingerprint template ID input at the time of opening can be applied in the subsequent verification, and the fingerprint template ID used for verification cannot be modified by cracking the user's power-on password, thereby ensuring that even if the user client device is lost, there is no need to worry about the password. It was cracked and used by criminals.
  • the client generates a turn-on response message including the fingerprint template ID in the opening record, and sends a turn-on response message to the server.
  • the fingerprint template ID in the opening record is carried in the opening response message and sent to the server end, so as to save the above information on the server side.
  • the server receives the opening response message, generates a user record, and the user record includes the fingerprint template ID of the user.
  • the server receives the opening response message sent by the client, and saves the user record in the server, and the user record includes the fingerprint template ID of the user.
  • the user record is saved on the server side for verification of the results during subsequent verification.
  • step 2 of the embodiment the following steps are further included in order to further increase the security during the opening process:
  • the server encrypts the provisioning request response message with the first private key.
  • the client After the client receives the activation request response message, it needs to verify the activation request response message.
  • the client and the server agree that there is a server public-private key pair, including the first public key and the first private key, the first public key is stored on the client, and the first private key is stored on the server.
  • the server sends the open request response message to the client by using the first private key, and then the client uses the first public key to decrypt and perform verification. If the verification passes, the subsequent steps are performed, otherwise an error is reported.
  • the encryption algorithm used here may be a symmetric algorithm, an asymmetric algorithm, a digest algorithm, or the like.
  • step 3 of the embodiment the method further includes the steps of:
  • the client uses the first public key to verify the provisioning request response message, and if the verification passes, the subsequent response is performed, otherwise an error is reported.
  • the client decrypts with the first public key to perform verification, and the verification passes to perform subsequent steps, otherwise, an error is reported.
  • the verification process of the provisioning request response message may be omitted, and the first public key and the first private key are always unchanged, and are the same for any client.
  • the embodiment includes the user ID in the activation request response message. Since the activation request response message is encrypted and signed, it can effectively prevent tampering during the transmission of the activation request response message. By including the user ID in the provisioning request response message and using the user ID to generate the opening record, the correct user ID and its corresponding fingerprint template ID can be effectively ensured in the opening record, thereby ensuring the verification in the subsequent steps. The correctness.
  • the provisioning request response message of the embodiment further includes a user ID, and includes a user ID and a fingerprint template ID in the opening record, and the user ID and the fingerprint template ID are also included in the opening response message, thereby receiving the opening response on the server end.
  • the user ID and the fingerprint template ID are obtained, and the user record is saved, and the user record includes the user ID and the fingerprint template ID.
  • the corresponding opening record is found according to the user ID, and the fingerprint template ID in the opening record can be matched according to the user ID, and the multi-user can support one client.
  • the user record is also searched according to the user ID, and the fingerprint template ID corresponding to it is verified.
  • the device ID is included in the activation response message, and the different devices of the user can be further distinguished.
  • the user record including the user ID, the device ID, and the fingerprint template ID is stored on the server side.
  • different user records are saved on the server side corresponding to different devices of the user, so that the verification can be identified.
  • different terminal devices of the user can be distinguished and verified. That is, in the comparison, the corresponding opening record and the user record are also found according to the device ID, and are respectively compared with the matching opening record and the fingerprint template ID in the user record.
  • the challenge response mode is further adopted to further enhance the security. That is, in step 2, the provisioning request response message also carries a challenge value.
  • the challenge response mode is one of the commonly used methods in identity authentication. Therefore, after receiving the provisioning request from the client, the server generates a challenge value, and sends a call request response message carrying the challenge value to the client, and the subsequent steps are performed by verifying the response value. Test.
  • the challenge value is generated by a random algorithm in the identity authentication process. In the prior art, there are a pseudo-random algorithm and a strong random algorithm. In this embodiment, a strong random algorithm is used, and the obtained random number distribution is more uniform.
  • the client After receiving the activation response message, the client also needs to generate a response value, and the response value is sent to the server in the activation response message, and the server needs to verify this.
  • the embodiment further includes the following steps:
  • the client selects a signature algorithm according to the challenge value included in the request response message, generates a public-private key pair, and includes the user private key in the saved provision record;
  • the activation response message is also verified according to the signature algorithm selected by the challenge value and the agreed second public key. After the verification is passed, the user record including the public key of the user is saved, and if the verification fails, an error is reported.
  • the signature algorithm is selected according to the received challenge value.
  • the selectable signature algorithm has 4, which are a signature algorithm 1, a signature algorithm 2, a signature algorithm 3, and a signature algorithm 4.
  • the algorithm can be selected in the manner of the challenge value remainder. If the challenge value is divided by 4 and the remainder is 0, the signature algorithm 1 is selected, the remainder is 1 to select the signature algorithm 2, and so on.
  • the specific signature algorithm includes a secure hash algorithm RAS-SHA1, RSA-SHA256, etc.
  • the signature algorithm corresponds to a unified user public-private key generation algorithm, and generates a pair of user public-private key pairs when activated, which is used as a subsequent fingerprint verification. Encryption and decryption, so that each user has his or her own public-private key pair, and the user's public-private key pair includes the user's private key and the user's public key.
  • the embodiment Before sending the opening response message, the embodiment uses the selected signature algorithm and the agreed second private key to sign the opening response message, where the second private key is determined by the client hardware, and correspondingly corresponds to the server end.
  • the second public key is determined by the client hardware, and correspondingly corresponds to the server end.
  • the algorithm is selected in the manner of the challenge value remainder, or may be directly selected by the single digit or the tens digit of the challenge value, or may be selected according to the value obtained by dividing the challenge value by 4.
  • the invention is not limited to a particular selection.
  • the challenge value is used in the same way as the client, and the corresponding signature is selected.
  • the name algorithm verifies the signed response message according to the agreed second public key.
  • the client After receiving the activation request response message, the client needs to respond and return a response message to the server.
  • the response message includes a response value, which is calculated according to a challenge value according to a fixed algorithm, so that the server side calculates the response value according to the same algorithm for comparison and verification.
  • the server saves the corresponding user record, and the user record saved by the server includes the user ID, the device ID, the user public key, and the fingerprint template ID, so as to perform the result verification in the subsequent verification process.
  • the provisioning request response message includes a user ID and a challenge value
  • the opening record includes a user private key, a user ID, and a fingerprint template ID
  • the activation response message includes a user public key, a user ID, a device ID, and a fingerprint template ID, in the server.
  • the user record saved at the end includes a user ID, a device ID, a fingerprint template ID, and a user public key.
  • Embodiment 2 The fingerprint authentication process of the user during use.
  • the client sends an authentication request to the server, and the server obtains an authentication request from the client.
  • the server After receiving the authentication request, the server sends an authentication request response message to the client.
  • the client After receiving the authentication request response message, the client receives the fingerprint image input by the user for verification, and obtains the fingerprint template ID corresponding to the fingerprint image used for verification, and the opening record saved by the client. The fingerprint template ID is compared. If it matches, the next step is entered, otherwise an error is reported.
  • the user only needs to place the finger used for payment on the fingerprint scanner according to the prompt interface, and input the fingerprint image for verification.
  • the client finds the corresponding fingerprint template from the stored fingerprint template, obtains the fingerprint template ID, finds the corresponding opening record according to the user ID, and compares with the fingerprint template in the opening record. If the fingerprint template ID is the same as that in the opening record, the notification is verified, otherwise the error is reported and the verification fails.
  • the fingerprint template ID of the “index finger” is saved in the opening record.
  • the fingerprint template ID corresponding to the fingerprint input by the user in the terminal is first identified.
  • the fingerprint template ID of the "index finger” that is, whether it is consistent with the fingerprint template ID saved in the opening record.
  • the fingerprint template ID is compared locally on the client, and the user's fingerprint is not transmitted in the network, thereby avoiding leakage of the user's biometrics.
  • the client generates an authentication response message including the obtained fingerprint template ID, and sends an authentication response message to the server.
  • the server receives the authentication response message and compares it with the fingerprint template ID in the corresponding user record saved locally. If it matches, the verification passes, otherwise an error is reported.
  • the client after performing fingerprint verification, the client only needs to send the fingerprint template ID instead of the fingerprint template to the server, and the server side compares again with the fingerprint template ID in the user record, and passes the image twice. It is safer to compare fingerprint authentication further.
  • the fingerprint template ID is transmitted, and the transmission traffic during the transmission process is also relatively small, and the calculation amount on the server side is also small.
  • the user ID is included in the authentication request response message, so that the corresponding opening record is found locally according to the user ID, and the fingerprint template ID is performed with the fingerprint template ID.
  • the authentication response message includes the device ID, the user ID, and the fingerprint template ID, and the server finds the corresponding user record accordingly, and compares the fingerprint template ID with the corresponding user record saved locally, and if the agreement is consistent, the verification is passed. The verification process ends, otherwise an error is reported and the verification fails.
  • the authentication response message may be encrypted by using the first private key, and then the client uses the first public key for decryption verification.
  • the embodiment still performs verification based on the challenge response mode.
  • the challenge response message is also included in the authentication response message.
  • the client selects a signature algorithm according to the challenge value.
  • the key used by the signature algorithm may be the second private key.
  • the server uses the second public key for verification.
  • the authentication response message is signed by using the user private key in the opening record, and on the server side, the signature algorithm is also selected according to the challenge value, according to the user public key pair according to the user record.
  • the authentication response message is verified.
  • the verification process is the same as the verification process of the pair of response messages in the embodiment, except that the used key is different, the first embodiment uses the second public key for verification, and the second embodiment uses the user public key for verification. Since the user's public-private key pair is unique to each user, the security during the verification process is further guaranteed.
  • the client selects a signature algorithm according to the challenge value, and uses the selected signature algorithm and the user private key to sign the authentication response message; after receiving the authentication response message, the server also selects the signature algorithm and the user according to the challenge value.
  • the public key verifies the authentication response message.
  • the authentication request response message in this step further includes service information, so that after the client receives the authentication response message, the service information is displayed on the client.
  • the user can determine whether it is the service corresponding to the fingerprint authentication according to the displayed service information, and if yes, select to continue the operation, otherwise the fingerprint authentication can be abandoned.
  • the present invention selects a signature algorithm according to a random number, and is not limited to selecting a signature algorithm to perform signature, and may also select a combination of multiple algorithms to perform a signature operation to improve the algorithm. For example, according to the single digit and the tens digit of the random number, two signature algorithms are selected, and the signature is performed twice to further enhance the security of the signature.
  • the signature verification of the response message is a random signature algorithm. Even if the user's private key is leaked, the attacker cannot forge the response message because the attacker does not know the signature algorithm.
  • the FIDO Alliance's verification scheme includes passwords, webpage plug-ins, and verification hardware, and the verification hardware is various, such as U disk (or U shield), NFC chip, TPM (trusted platform module). ) Chips, as well as biometric hardware such as fingerprint scanners, speech recognition, face recognition, and iris recognition.
  • the user's password will not be sent out, but processed by the internal software of the mobile phone, computer, etc.; after the verification is passed, the software sends the key to the login server without saving any login information; At the same time, the login server sends the key to the user device to inform it that it has "passed authentication.”
  • the enterprise wants to use the FIDO authentication method, it only needs to install the verification software on the server, and then install the corresponding plug-in or application on the customer and employee's equipment.
  • fingerprint verification as an example, FIDO's fingerprint verification can only be bound to the device. After the fingerprint is opened, the fingerprint template on all devices can complete the fingerprint verification.
  • the fingerprint template added after the fingerprint is opened can also Complete the verification, and generally add a fingerprint on the device, just enter a simple password (such as 4 is a digital password), become a security short board, there is security Full vulnerability.
  • a simple password such as 4 is a digital password
  • the message from the server side is not signed, and the device-side module can be attacked by forging the message.
  • the present invention stores the opening record and the user record in the opening process, and cannot subsequently change the fingerprint template ID for fingerprint verification, thereby preventing the fingerprint template from being added after the fingerprint is opened; and simultaneously selecting the signature algorithm by the challenge value, at school Adding a signature during the test can prevent forgery messages from being attacked.
  • the present invention further provides a client, which is applied to an identity authentication system, where the identity authentication system further includes a server end, the client saves a provisioning record, and the server side stores a user record.
  • the opening record and the user record include a biometric template ID for biometric verification obtained during the opening of the biometric verification process, and the client includes:
  • a requesting module configured to send an authentication request to the server, and receive an authentication request response message returned by the server;
  • a response module configured to receive a biometric input by the user, obtain a biometric template ID corresponding to the biometric, and compare the biometric template ID in the locally saved opening record, and if yes, generate a biometric template ID including the acquired
  • the authentication response message sends an authentication response message to the server, so that the server receives the authentication response message and compares it with the biometric template ID in the user record saved locally by the server, otherwise, an error is reported.
  • the requesting module is further configured to send a turn-on request for opening the biometric check to the server, and receive a turn-on request response message returned by the server;
  • the response module is further configured to receive the user input for verification Feature, acquiring the biometric template ID corresponding to the biometric for verification, generating an opening record save, generating an activation response message including the biometric template ID, and sending an opening response message to the server, so that the server receives the The response message is opened, and the biometric template ID included in the generated user record is saved.
  • the server end signs the authentication request response message or the provisioning request response message by using the agreed first private key, and the requesting module is further used to make an agreement after receiving the authentication request response message.
  • the first public key verifies the received authentication request response message, and if the verification passes, the subsequent response is performed, otherwise the error is reported; after receiving the opening request response message, the requesting module is further used to agree
  • the first public key verifies the received provisioning request response message, and if the verification passes, the subsequent response is performed, otherwise an error is reported.
  • the activation request response message of the present invention carries a challenge value, and the response module is further used for Generating a public-private key pair of the user including the user private key and the user public key, saving the user private key; selecting a signature algorithm according to the challenge value in the request response message, and using the selected signature algorithm and the agreed second private key pair to generate the activation
  • the response message is sent to the server, and the activation response message includes the user public key, so that the server receives the activation response message and uses the agreed second public key for verification, and saves the user public key on the server.
  • the authentication request response message carries a challenge value
  • the response module is further configured to select a signature algorithm according to the challenge value, and use the selected signature algorithm and the user private key to sign the authentication response message, so that After receiving the authentication response message, the server end also checks the authentication response message according to the challenge value selection signature algorithm and the user public key.
  • the provisioning request response message further includes a user ID
  • the response module further saves the user ID in the opening record, and further includes the user ID in the generated activation response message, so that After receiving the opening response message, the server acquires the user ID therein and saves it in the user record.
  • the activation response message further includes a client device ID, so that after receiving the activation request response message, the server acquires the device ID therein and saves the user ID in the user record.
  • the authentication request response message further includes a user ID, and after receiving the biometric input by the user, acquiring the biometric template ID corresponding to the biometric, the response module further finds a corresponding opening record according to the user ID, so as to Comparing the acquired biometric template ID with the biometric template ID in the found opening record;
  • the user ID is further included in the authentication response message generated by the response module, so that the server obtains the user ID and receives the corresponding user record according to the user ID after receiving the authentication response message. .
  • the authentication response message further includes a client device ID, so that the server obtains the device ID in the authentication response message after receiving the authentication response message, and searches for the corresponding device according to the device ID.
  • User record
  • the present invention also provides a server, which is applied to an identity authentication system corresponding to a previous server, and the identity authentication system further includes a client, and the client saves There is an opening record, the server stores a user record, and the opening record and the user record include a biometric template ID for biometric verification obtained during the opening of the biometric verification process, and the server side includes:
  • a response module configured to receive an authentication request from the client, and send an authentication request response message to the client;
  • a verification module configured to receive an authentication response message from the client, where the authentication response message includes a biometric template ID, and compare the biometric template ID in the authentication response message with the biometric template ID in the saved user record. For verification, if it is consistent, the verification is passed, otherwise an error is reported.
  • the response module is further configured to receive a provisioning request for opening the biometric verification from the client, and send a provisioning request response message to the client, so that the client obtains the biometric according to the user input for verification.
  • the biometric template ID corresponding to the biometric feature of the verification is generated, and the activation record is saved.
  • the verification module is further configured to receive an activation response message from the client, obtain a biometric template ID included in the activation response message, and generate a user record. save.
  • the response module is further configured to sign the authentication request response message or the provisioning request response message with the agreed first private key, so that the client responds to the received authentication request with the agreed first public key.
  • the message is checked. If the check is passed, the subsequent response is performed. Otherwise, an error is reported, or the received open request response message is verified by the agreed first public key. If the check is passed, the subsequent response is performed, otherwise an error is reported.
  • the activation request response message of the present invention carries a challenge value
  • the client generates a public-private key pair of the user including the user private key and the user public key, and saves the user private key
  • the verification module is further configured to receive the client according to the Opening a challenge value selection request signature message in the request response message, and using the selected signature algorithm and the agreed second private key signature activation response message, the activation response message including the user public key, and also selecting the signature algorithm according to the challenge value, and
  • the second public key is used to verify the open response message, and the user public key is saved on the server side.
  • the verification module is further configured to receive an authentication response message that the client selects a signature algorithm according to the challenge value in the authentication request response message, and uses the selected signature algorithm and the user private key to perform the signature, and selects the signature according to the challenge value.
  • Algorithm and user public key verification authentication response message Signature Algorithm and user public key verification authentication response message Signature.
  • the provisioning request response message further includes a user ID, so that the client saves the user ID in the opening record after receiving the opening request response message, and the activation generated by the client is generated.
  • the response message further includes the user ID, and after receiving the activation response message, the verification module further acquires a user ID from the activation response message, and saves the user ID in the user record. .
  • the activation response message further includes a client device ID
  • the verification module further acquires a device ID from the activation response message, and saves the device ID in the In the user record.
  • the authentication request response message further includes a user ID, so that the client finds a corresponding opening record according to the user ID, and the acquired biometric template ID and the biometric template in the found opening record. The ID is compared, and the user ID is further included in the authentication response message generated by the client.
  • the verification module After receiving the authentication response message, the verification module further acquires the user ID in the authentication response message, according to The user ID finds a corresponding user record.
  • the authentication response message further includes a client device ID
  • the verification module further acquires a device ID in the authentication response message, and finds a corresponding according to the device ID. User record.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Human Computer Interaction (AREA)
  • Multimedia (AREA)
  • Collating Specific Patterns (AREA)

Abstract

本发明公开了一种基于生物特征的安全校验方法及客户端、服务器，客户端发送给认证请求，服务器端接收到认证请求后，返回认证请求应答消息，客户端接收用户输入的用于校验的指纹图像，获取对应的生物特征模版ID，与本地保存的开通记录中的生物特征模版ID进行比对，生成包括获取的生物特征模版ID的认证响应消息，向服务器端发送认证响应消息，服务器端接收认证响应消息，与服务器端本地保存的对应用户记录中的生物特征模版ID进行比对，如果吻合则校验通过，否则报错。本发明还同时提出了对应于上述方法的客户端和服务器。本发明能够防止在网络上传送个人生物特征，可以防止泄露的风险，同时减少了网络传输的网络流量，具有更高的安全性。

Description

一种基于生物特征的安全校验方法及客户端、服务器 技术领域
本发明属于身份认证技术领域，尤其涉及在身份认证过程中的一种基于生物特征的安全校验方法及客户端、服务器。
背景技术
传统的密码校验过程中需要输入密码，每次输入密码的过程中，都存在泄漏风险，如键盘记录木马、物理窥视等。由于指纹具有稳定性强、个人唯一、算法准确性高等特点，近年来很多设备都开始采用指纹校验的功能，例如通过指纹校验实现在线支付，可以提高用户体验，增加支付安全性。
在现有技术中，在线指纹校验过程中客户端将用户的指纹数据(指纹图像或指纹特征数据)发送到服务器端，在服务器端和用户原来的指纹数据进行比较，完成校验。因为需要把指纹数据传输到服务器端，上传过程中存在指纹数据泄漏风险，指纹数据为个人隐私数据，用户不一定同意上传，同时泄漏会造成声誉风险。即使用户同意上传指纹数据，在指纹数据上传过程中还要耗费网络流量，服务器端也需要比对指纹数据，需耗费额外的计算资源及存储资源。
发明内容
本发明的目的是提供一种基于生物特征的安全校验方法及客户端、服务器，以避免现有技术校验过程中存在的上述耗费网络流量、存在个人指纹数据泄露风险等技术问题，并提高安全性。
为了实现上述目的，本发明技术方案如下：
一种基于生物特征的安全校验方法，应用于身份认证系统中的客户端，所述身份认证系统还包括服务器端，所述客户端保存有开通记录，所述开通记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述安全校验方法包括：
向服务器端发送认证请求，接收服务器端返回的认证请求应答消息；
接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID，将获取的所述生物特征模版ID与保存的开通记录中的生物特征模版ID进行比对，如果吻合则生成包括该获取的生物特征模版ID的认证响应消息，向服务器端发送认证响应消息，以便服务器端接收所述认证响应消息进行校验。
其中，所述开通生物特征校验过程包括：
向服务器端发送开通生物特征校验的开通请求，接收服务器端返回的开通请求应答消息；
接收用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存；
生成包括所述生物特征模版ID的开通响应消息，向服务器端发送开通响应消息，以便服务器端接收所述开通响应消息，获取其中包含的所述生物特征模版ID生成用户记录保存。
进一步地，所述服务器端以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，则客户端在接收到所述认证请求应答消息之后，还包括：
以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错；
则客户端在接收到所述开通请求应答消息之后，还包括：
以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
通过本步骤，可以进一步加强开通过程中的安全性，防止伪造开通过程。
进一步地，所述开通请求应答消息中携带有挑战值，所述开通生物特征校验过程还包括：
生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥；
根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥对生成的开通响应消息进行签名后发送给服务器 端，所述开通响应消息包括用户公钥，以便服务器端接收所述开通响应消息并使用约定第二公钥进行校验，在服务器端保存用户公钥。
进一步地，所述认证请求应答消息中携带有挑战值，所述安全校验方法还包括：
根据所述挑战值选择签名算法，用选择的签名算法和所述用户私钥对认证响应消息进行签名，以便所述服务器端在接收到所述认证响应消息后，同样根据所述挑战值选择签名算法和所述用户公钥对认证响应消息进行校验。
通过在开通生物特征校验过程中生成用户密钥对，并在认证过程中使用选择的签名算法和用户密钥对来进行校验，增强了安全性，防止伪造消息的重放攻击。
进一步地，所述开通请求应答消息还包括用户ID，所述客户端在接收到所述开通请求应答消息后，还包括：
将所述用户ID保存在所述开通记录中，并且在客户端生成的开通响应消息中还包括所述用户ID，以便所述服务器端在接收到所述开通响应消息后，获取其中的用户ID并将其保存在所述用户记录中。
所述开通响应消息还包括客户端设备ID，以便所述服务器端在接收到所述开通请求应答消息后，获取其中的设备ID并将其保存在所述用户记录中。
所述认证请求应答消息还包括用户ID，所述在接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID之后，还包括：
根据用户ID查找到对应的开通记录，以便将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对；
在客户端生成的认证响应消息中还包括所述用户ID，以便所述服务器端在接收到所述认证响应消息后，获取其中的用户ID并根据所述用户ID查找到对应的用户记录。
所述认证响应消息还包括客户端设备ID，以便所述服务器端在接收到所述认证响应消息后，获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
通过上述步骤，能支持一个终端设备支持多个用户，或一个用户具有多个终端设备的情况，根据用户ID或设备ID来找到对应的开通记录或者用户记录来进行对比校验。
本发明还提出了一种基于生物特征的安全校验方法，应用于身份认证系统中的服务器端，所述身份认证系统还包括客户端，所述服务器端保存有用户记录，所述用户记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述安全校验方法包括：
接收来自客户端的认证请求，向客户端发送认证请求应答消息；
接收来自客户端的认证响应消息，所述认证响应消息包括生物特征模版ID；
将所述认证响应消息中的生物特征模版ID与保存的用户记录中的生物特征模版ID进行比对校验，如果一致则校验通过，否则报错。
其中，所述开通生物特征校验过程包括：
接收来自客户端的开通生物特征校验的开通请求，向客户端发送开通请求应答消息，以便客户端根据用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存；
接收来自客户端的开通响应消息，获取所述开通响应消息包括的生物特征模版ID，生成用户记录保存。
进一步地，所述安全校验方法还包括：
以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，以便所述客户端以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错，或以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。通过本步骤，可以进一步加强开通过程中的安全性，防止伪造开通过程。
进一步地，所述开通请求应答消息中携带有挑战值，所述客户端生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥，所述开通生物特征校验过程还包括：
接收客户端根据开通请求应答消息中的挑战值选择签名算法，并使用 选择的签名算法和约定的第二私钥签名的开通响应消息，所述开通响应消息包括用户公钥，同样根据挑战值选择签名算法，并使用第二公钥校验开通响应消息，在服务器端保存用户公钥。
进一步地，所述安全校验方法还包括：
接收客户端根据认证请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和用户私钥进行签名的认证响应消息，同样根据挑战值选择签名算法和用户公钥校验认证响应消息的签名。
通过在开通生物特征校验过程中生成用户密钥对，并在认证过程中使用选择的签名算法和用户密钥对来进行校验，增强了安全性，防止伪造消息的重放攻击。
进一步地，所述开通请求应答消息还包括用户ID，以便所述客户端在接收到所述开通请求应答消息后，将所述用户ID保存在所述开通记录中，并且在客户端生成的开通响应消息中还包括所述用户ID，则所述服务器端在接收到所述开通响应消息后，还包括：
从所述开通响应消息中获取用户ID，将所述用户ID保存在所述用户记录中。
所述开通响应消息还包括客户端设备ID，所述服务器端在接收到所述开通响应消息后，还包括：
从所述开通响应消息中获取设备ID，将所述设备ID保存在所述用户记录中。
所述认证请求应答消息还包括用户ID，以便所述客户端根据用户ID查找到对应的开通记录，将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对，并在客户端生成的认证响应消息中还包括所述用户ID，所述服务器端在接收到所述认证响应消息后，还包括：
获取所述认证响应消息中的用户ID，根据所述用户ID查找到对应的用户记录。
所述认证响应消息还包括客户端设备ID，所述服务器端在接收到所述认证响应消息后，还包括：
获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
本发明还提出了一种客户端，应用于身份认证系统，所述身份认证系统还包括服务器端，所述客户端保存有开通记录，所述开通记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述客户端包括：
请求模块，用于向服务器端发送认证请求，接收服务器端返回的认证请求应答消息；
响应模块，用于接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID，将获取的所述生物特征模版ID与保存的开通记录中的生物特征模版ID进行比对，如果吻合则生成包括获取的生物特征模版ID的认证响应消息，向服务器端发送认证响应消息，以便服务器端接收所述认证响应消息进行校验。
进一步地，所述请求模块还用于向服务器端发送开通生物特征校验的开通请求，接收服务器端返回的开通请求应答消息；所述响应模块还用于接收用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存，生成包括所述生物特征模版ID的开通响应消息，向服务器端发送开通响应消息，以便服务器端接收所述开通响应消息，获取其中包含的所述生物特征模版ID生成用户记录保存。
进一步地，所述服务器端以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，则所述请求模块在接收到所述认证请求应答消息之后，还用于以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错；所述请求模块在接收到所述开通请求应答消息之后，还用于以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
本发明所述开通请求应答消息中携带有挑战值，所述响应模块还用于生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥；根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥对生成的开通响应消息进行签名后发送给服务器端，所述开通响 应消息包括用户公钥，以便服务器端接收所述开通响应消息并使用约定第二公钥进行校验，在服务器端保存用户公钥。
进一步地，所述认证请求应答消息中携带有挑战值，所述响应模块还用于根据所述挑战值选择签名算法，用选择的签名算法和所述用户私钥对认证响应消息进行签名，以便所述服务器端在接收到所述认证响应消息后，同样根据所述挑战值选择签名算法和所述用户公钥对认证响应消息进行校验。
本发明还提出了一种服务器，应用于身份认证系统，所述身份认证系统还包括客户端，所述服务器保存有用户记录，所述用户记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述服务器包括：
应答模块，用于接收来自客户端的认证请求，向客户端发送认证请求应答消息；
校验模块，用于接收来自客户端的认证响应消息，所述认证响应消息包括生物特征模版ID，将所述认证响应消息中的生物特征模版ID与保存的用户记录中的生物特征模版ID进行比对校验，如果一致则校验通过，否则报错。
进一步地，所述应答模块还用于接收来自客户端的开通生物特征校验的开通请求，向客户端发送开通请求应答消息，以便客户端根据用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存；所述校验模块还用于接收来自客户端的开通响应消息，获取所述开通响应消息包括的生物特征模版ID，生成用户记录保存。
进一步地，所述应答模块还用于以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，以便所述客户端以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错，或以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
本发明所述开通请求应答消息中携带有挑战值，所述客户端生成包括 用户私钥和用户公钥的用户公私钥对，保存用户私钥，所述校验模块还用于接收客户端根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥签名的开通响应消息，所述开通响应消息包括用户公钥，同样根据挑战值选择签名算法，并使用第二公钥校验开通响应消息，保存用户公钥。
进一步地，所述校验模块还用于接收客户端根据认证请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和用户私钥进行签名的认证响应消息，同样根据挑战值选择签名算法和用户公钥校验认证响应消息的签名。
本发明一种基于生物特征的安全校验方法及客户端、服务器，实现在客户端的指纹校验、指纹模版存储、校验过程在可信执行环境(TEE)中进行，和普通硬件完全隔离，无隐私泄漏风险。同时减少传输指纹数据过程中网络流量，同时在服务器端也只比较指纹模版ID，减少服务器端计算开销及存储开销。开通指纹校验时与具体指纹模版绑定，开通后添加的新指纹模版不能用于校验，增加安全性。通过选择的签名算法进一步增强验证过程的安全性，防止伪造消息的网络攻击。
附图说明
图1为本发明开通生物特征校验过程流程图；
图2为本发明基于生物特征的安全校验方法流程图；
图3为本发明客户端结构示意图；
图4为本发明服务器结构示意图。
具体实施方式
下面结合附图和实施例对本发明技术方案做进一步详细说明，以下实施例不构成对本发明的限定。
在基于生物特征的校验中，通过指纹识别、语音识别、脸部识别、虹膜识别等技术手段来进行身份认证越来越普遍。这种生物特征校验应用的范围很广，例如在门禁系统中，或互联网支付中。本实施例以互联网支付 中的指纹校验为例来详细描述本发明一种基于生物特征的安全校验方法。
有别于在线指纹校验，本实施例的互联网支付中的指纹校验，在用户的客户端完成指纹的比对，并在服务器端进一步进行结果校验，通过双重保护来保证指纹校验的有效性。本实施例的客户端一般为应用程序，安装在用户的移动终端、电脑或其他智能设备中，有些客户端直接是服务商提供的网页结合指纹扫描终端。
本实施例的指纹校验方法，包括指纹校验开通过程、校验过程，以下分别进行说明。
实施例一、指纹校验的开通过程。
互联网支付的指纹校验首先需要开通指纹校验功能，如图1所示，包括如下步骤：
①、客户端向服务器端发送开通指纹校验的开通请求。
当用户开通指纹校验功能时，首先向服务器端发起开通请求。
②、服务器端接收到开通指纹校验的开通请求后，向客户端发送开通请求应答消息。
③、客户端在收到开通请求应答消息后，接收用户输入的用于校验的指纹图像，获取该用于校验的指纹图像对应的指纹模版ID。
在开通指纹校验之前，用户的客户端设备上存储了用户录入的多个指纹模版，该指纹模版是从指纹图像提取的指纹特征。在开通指纹校验功能时，用户将用来进行指纹校验的手指的指纹图像输入到客户端，例如将该手指放在指纹扫描设备上，获取指纹图像，提取出指纹特征，从而与客户端已经存储的指纹模版进行对比，获取对应的指纹模版ID。
如果在开通指纹校验之前，用户的客户端设备上没有存储任何用户的指纹模版，这里也可以直接录入用户用来进行指纹校验的指纹图像，生成指纹模版及指纹模版ID，获取该指纹模版ID。
④、客户端保存开通记录，开通记录包括指纹模版ID。
开通记录是保存在客户端设备中的记录，包含开通时用户用来进行指纹校验的指纹模版ID，用于在后续步骤的指纹校验中，与输入的指纹模版ID进行对比，看输入的指纹模版ID是否与最初开通时的指纹模版ID 一致。即只有采用开通时输入的指纹模版ID才能在后续校验中应用，不能够通过破解用户的开机密码修改用于校验的指纹模版ID，从而保证了即使用户客户端设备丢失，也不必担心密码被破解而被不法分子冒用。
⑤、客户端生成包括开通记录中指纹模版ID的开通响应消息，向服务器端发送开通响应消息。
本实施例将开通记录中的指纹模版ID携带在开通响应消息中发送到服务器端，以便在服务器端保存上述信息。
⑥、服务器端接收开通响应消息，生成用户记录保存，用户记录中包括该用户的指纹模版ID。
从而在服务器端接收到客户端发来的开通响应消息，在服务器端用户记录保存，用户记录中包括该用户的指纹模版ID。在服务器端保存用户记录，以便在后续的校验过程中进行结果校验。
优选地，为了进一步地增加开通过程中的安全性，本实施例的步骤②中，还包括如下步骤：
服务器端采用第一私钥对开通请求应答消息进行加密。
从而在客户端接收到开通请求应答消息后，需要对开通请求应答消息进行校验。一般来说，在客户端与服务器端约定有服务器公私钥对，包括第一公钥和第一私钥，第一公钥保存在客户端，第一私钥保存在服务器端。服务器端在采用第一私钥对开通请求应答消息进行加密后发送到客户端，客户端用第一公钥解密进行校验，校验通过则进行后续的步骤，否则报错。这里用到的加密算法可以为对称算法、非对称算法、摘要算法等。
从而在本实施例的步骤③中，还包括步骤：
客户端采用第一公钥校验开通请求应答消息，如果校验通过才进行后续的响应，否则报错。
即客户端在接收到开通请求应答消息后，用第一公钥解密进行校验，校验通过则进行后续的步骤，否则报错。需要注意的是，在一般安全要求不高的情况下，也可以省略对开通请求应答消息的校验过程，第一公钥和第一私钥始终不变，对于任意的客户端都一样。
本实施例的客户端上如果开通了多个用户，例如多个用户共用一个客 户端，则开通记录中需要包含用户ID，以便区分不同用户的开通记录。然而由于客户端容易被黑客攻击篡改用户ID，因此本实施例在开通请求应答消息中包括用户ID，由于开通请求应答消息经过了加密签名，能有效防止在开通请求应答消息的传送过程中被篡改，通过在开通请求应答消息中包含用户ID，并采用该用户ID来生成开通记录，能有效保证开通记录中记录了正确的用户ID及其对应的指纹模版ID，从而保证了后续步骤中校验的正确性。
因此本实施例的开通请求应答消息中进一步包含用户ID，并在开通记录中包含用户ID和指纹模版ID，在开通响应消息中也包含用户ID和指纹模版ID，从而在服务器端接收到开通响应消息后，获取用户ID和指纹模版ID，并生成用户记录保存，用户记录中包括用户ID和指纹模版ID。
则当用户用用户ID登录后，根据用户ID来找对应的开通记录，能够根据用户ID来匹配其开通记录中的指纹模版ID，能够支持多用户共用一个客户端。同理在服务器端，也根据用户ID来查找用户记录，比对其对应的指纹模版ID进行校验。
进一步地，当用户有多个终端设备，为了区分不同的终端设备，在开通响应消息中还包含了设备ID，能够进一步区分用户的不同设备。从而在服务器端存储包括用户ID、设备ID和指纹模版ID的用户记录。当用户具有多个设备时，对应用户的不同设备，在服务器端保存不同的用户记录，从而能够识别校验。同理，当用户使用不同的终端设备，基于本发明的上述步骤，能够区分用户的不同终端设备，进行校验。即在比对时，还根据设备ID来找到对应的开通记录和用户记录，分别与匹配的开通记录和用户记录中的指纹模版ID进行比对校验。
优选地，为了进一步防止在校验过程中的重放攻击，在本实施例的开通过程中，还采用挑战应答方式来进一步增强安全性。即在步骤②中，开通请求应答消息还携带有挑战值。挑战应答方式是身份认证中常用的方法之一，因此服务器端接收来自客户端的开通请求后，生成挑战值，向客户端发送携带挑战值的开通请求应答消息，后续步骤通过验证应答值来进行校验。挑战值是在身份认证过程中通过随机算法生成的，关于随机数的生 成，现有技术中有伪随机算法和强随机算法，本实施例采用强随机算法，获得的随机数分布更加均匀。则客户端在接收到开通应答消息后，还需要生成应答值，在开通响应消息中携带应答值发送给服务器端，服务器端需要对此进行校验。
本实施例在步骤③之后，还包括步骤：
客户端根据开通请求应答消息中包含的挑战值选择签名算法，生成用户公私钥对，在保存的开通记录中包含用户私钥；
用选择的签名算法和约定的第二私钥对开通响应消息进行签名，在开通响应消息中包括生成的用户公钥；
同样根据所述挑战值选择的签名算法和约定的第二公钥对开通响应消息进行校验，在校验通过后，保存包括所述用户公钥的用户记录，如果校验失败则报错。
其中根据接收的挑战值来选择签名算法，例如可选择的签名算法有4中，分别为签名算法1、签名算法2、签名算法3、签名算法4。可以以挑战值求余的方式选择算法，如果挑战值除以4余数为0，则选择签名算法1，余数为1则选择签名算法2，依次类推。
具体的签名算法有安全哈希算法RAS-SHA1、RSA-SHA256等，上述签名算法对应有统一的用户公私钥生成算法，在开通时生成一对用户公私钥对，用来作为后续进行指纹验证时的加密和解密，从而每个用户拥有自己的用户公私钥对，用户公私钥匙对包括用户私钥和用户公钥。
在发送开通响应消息前，本实施例采用选择的签名算法和约定的第二私钥对开通响应消息进行签名，这里的第二私钥是客户端硬件所决定的，相应地在服务器端具有对应的第二公钥。
需要说明的是，本实施例以挑战值求余的方式选择算法，也可以直接以挑战值的个位数或十位数来进行选择，或根据挑战值除以4得到的值来进行选择，本发明不限于具体选择方式。
在服务器对开通响应消息的校验过程中，包括如下两个校验步骤：
1)、使用第二公钥和签名算法对签名进行校验。
在服务器端，根据与客户端相同的方法对挑战值求余，选择对应的签 名算法，同时根据约定的第二公钥对签名的响应消息进行校验。
2)、使用与客户端相同的算法计算得到应答值与响应消息中的应答值进行比较校验。
在指纹校验过程中，客户端在接收到开通请求应答消息后，需要进行响应，向服务器端返回响应消息。响应消息中包括应答值，该应答值是根据挑战值按照固定的算法计算得到的，以便服务器端根据同样的算法计算得到应答值进行比较校验。
从而在校验通过后，服务器端保存对应的用户记录，服务器端保存的用户记录包括用户ID、设备ID、用户公钥、指纹模版ID，以便在后续的校验过程中进行结果校验。
本实施例中开通请求应答消息包括用户ID和挑战值，开通记录包括用户私钥、用户ID和指纹模版ID，而开通响应消息包括用户公钥、用户ID、设备ID和指纹模版ID，在服务器端保存的用户记录包括用户ID、设备ID、指纹模版ID和用户公钥。
实施例二、用户在使用过程中的指纹认证过程。
用户在使用该互联网支付时，需要校验用户的指纹，如图2所示，执行如下步骤：
(1)、客户端向服务器端发送给认证请求，服务器端获取来自客户端的认证请求。
(2)、服务器端接收到认证请求后，向客户端发送认证请求应答消息。
(3)、客户端在收到认证请求应答消息后，接收用户输入的用于校验的指纹图像，获取该用于校验的指纹图像对应的指纹模版ID，与客户端保存的开通记录中的指纹模版ID进行比对，如果吻合则进入下一步，否则报错。
在支付过程中的指纹校验，用户只需根据提示界面，将用来支付的手指放在指纹扫描器上，输入用于校验的指纹图像。客户端从存储的指纹模版中找到对应的指纹模版，获取该指纹模版ID，根据用户ID找到对应的开通记录，与开通记录中的指纹模版进行比对。如果获得指纹模版ID与开通记录中的一致，则校验通知，否则报错，校验不通过。
例如，用户在开通指纹验证功能时使用的是食指，那么在开通记录中保存的就是“食指”的指纹模版ID，在验证时，先识别用户在终端中输入的指纹所对应的指纹模版ID是否为“食指”的指纹模版ID，即是否与开通记录中保存的指纹模版ID一致。
本实施例在客户端本地进行指纹模版ID的比对，不用在网络中传输用户的指纹，避免了用户生物特征的泄漏。
(4)、客户端生成包括获取的指纹模版ID的认证响应消息，向服务器端发送认证响应消息。
(5)服务器端接收认证响应消息，与本地保存的对应用户记录中的指纹模版ID进行比对，如果吻合则校验通过，否则报错。
本实施例的指纹认证过程，客户端在进行指纹校验后，仅需要将指纹模版ID而不是指纹模版发送到服务器端，由服务器端与用户记录中的指纹模版ID进行再次对比，通过两次对比进一步进行指纹认证，更加安全。同时传输的是指纹模版ID，传输过程中的传输流量也比较少，并且服务器端的计算量也小。
与实施例一相同的是，为了区分用户和用户的终端设备，在认证请求应答消息中包括用户ID，以便在客户端本地根据用户ID查找到对应的开通记录，并与其中的指纹模版ID进行对比。同时认证响应消息中包含设备ID、用户ID以及指纹模版ID，服务器端据此找到对应的用户记录，将该指纹模版ID与本地保存的对应用户记录进行比对，如果一致则认为校验通过，结束校验过程，否则报错，校验失败。
与实施例一相同的是，在实施例二中，也可以对认证应答消息采用第一私钥进行加密，然后在客户端用第一公钥进行解密验证。
值得注意的是，在校验指纹的认证过程，本实施例仍然基于挑战应答方式来进行校验。同样在认证应答消息中包括挑战值，客户端根据挑战值选择签名算法，签名算法所采用的密钥，可以是第二私钥，这时候在服务器端采用第二公钥进行校验。
优选地，使用开通记录中的用户私钥对认证响应消息进行签名，在服务器端，同样根据挑战值选择签名算法，用根据用户记录中的用户公钥对 认证响应消息进行校验。校验的过程同实施例一对响应消息的校验过程，只不过使用的密钥不同，实施例一使用第二公钥进行校验，而实施例二使用用户公钥进行校验。由于用户公私钥对对每个用户是唯一的，进一步保证校验过程中的安全性。
即：客户端根据所述挑战值选择签名算法，用选择的签名算法和所述用户私钥对认证响应消息进行签名；服务器端在接收到认证响应消息后，同样根据挑战值选择签名算法和用户公钥对认证响应消息进行校验。
与实施例一不同的是，本步骤的认证请求应答消息中还包括业务信息，以便在客户端接收到认证应答消息后，在客户端显示业务信息。用户可以根据显示的业务信息判断是否是自己正在进行指纹认证对应的业务，如果是则选择进行继续操作，否则可以放弃指纹认证。
无论在开通过程还是后面的校验过程，本发明根据随机数选择签名算法，不限于选择一种签名算法来进行签名，也可以选择多种算法的组合进行签名操作，提高算法的变化。例如根据随机数的个位数和十位数，选择两个签名算法，先后进行两次签名来进一步增强签名的安全性。本实施例对响应消息进行的签名校验，由于是随机的签名算法，即使用户私钥泄露，由于攻击者不知道签名算法，也无法伪造响应消息。
在现有技术中，FIDO联盟推出的校验方案包括了密码、网页插件以及校验硬件，而校验硬件多种多样，例如U盘(或U盾)、NFC芯片、TPM(可信赖平台模块)芯片，以及指纹扫描器、语音识别、脸部识别、虹膜识别等生物识别硬件。使用FIDO联盟的校验方法，用户的密码不会被发送出去，而是由手机、电脑等设备内部的软件进行处理；校验通过后，软件发送密钥到登录服务器，不保存任何登陆信息；与此同时，登陆服务器发送密钥到用户设备告知其“已经通过认证”。企业如果要使用FIDO的认证方式，只需要在服务器上安装校验软件，然后在客户和员工的设备上安装相应的插件或应用程序即可。然而以指纹校验为例，FIDO的指纹校验的开通仅能和设备绑定，即开通指纹后，所有设备上的指纹模版，都能完成指纹校验，指纹开通后添加的指纹模版也能完成校验，而一般在设备上添加指纹只需输入简单密码(如4为数字密码)，成为安全短板，存在安 全漏洞。同时从服务器端来的消息也没有签名，可以通过伪造消息对设备端模块进行攻击。而本发明在开通过程中存储开通记录和用户记录，在后续无法进行用于指纹校验的指纹模版ID的更改，防止了在指纹开通后添加指纹模版；同时通过挑战值选择签名算法，在校验过程中增加签名，可以防止伪造消息进行攻击。
如图3所示，本发明还提出了一种客户端，应用于身份认证系统，所述身份认证系统还包括服务器端，所述客户端保存有开通记录，所述服务器端保存有用户记录，所述开通记录和用户记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述客户端包括：
请求模块，用于向服务器端发送认证请求，接收服务器端返回的认证请求应答消息；
响应模块，用于接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID，与本地保存的开通记录中的生物特征模版ID进行比对，如果吻合则生成包括获取的生物特征模版ID的认证响应消息，向服务器端发送认证响应消息，以便服务器端接收所述认证响应消息，与服务器端本地保存的用户记录中的生物特征模版ID进行比对校验，否则报错。
进一步地，所述请求模块还用于向服务器端发送开通生物特征校验的开通请求，接收服务器端返回的开通请求应答消息；所述响应模块还用于接收用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存，生成包括所述生物特征模版ID的开通响应消息，向服务器端发送开通响应消息，以便服务器端接收所述开通响应消息，获取其中包含的所述生物特征模版ID生成用户记录保存。
进一步地，所述服务器端以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，则所述请求模块在接收到所述认证请求应答消息之后，还用于以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错；所述请求模块在接收到所述开通请求应答消息之后，还用于以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
本发明所述开通请求应答消息中携带有挑战值，所述响应模块还用于 生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥；根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥对生成的开通响应消息进行签名后发送给服务器端，所述开通响应消息包括用户公钥，以便服务器端接收开通响应消息并使用约定第二公钥进行校验，在服务器端保存用户公钥。
进一步地，所述认证请求应答消息中携带有挑战值，所述响应模块还用于根据所述挑战值选择签名算法，用选择的签名算法和所述用户私钥对认证响应消息进行签名，以便所述服务器端在接收到所述认证响应消息后，同样根据所述挑战值选择签名算法和所述用户公钥对认证响应消息进行校验。
进一步地，所述开通请求应答消息还包括用户ID，所述响应模块还将所述用户ID保存在所述开通记录中，并且在生成的开通响应消息中还包括所述用户ID，以便所述服务器端在接收到所述开通响应消息后，获取其中的用户ID并将其保存在所述用户记录中。
进一步地，所述开通响应消息还包括客户端设备ID，以便所述服务器端在接收到所述开通请求应答消息后，获取其中的设备ID并将其保存在所述用户记录中。
进一步地，所述认证请求应答消息还包括用户ID，所述响应模块在接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID之后，还根据用户ID查找到对应的开通记录，以便将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对；
在所述响应模块生成的认证响应消息中还包括所述用户ID，以便所述服务器端在接收到所述认证响应消息后，获取其中的用户ID并根据所述用户ID查找到对应的用户记录。
进一步地，所述认证响应消息还包括客户端设备ID，以便所述服务器端在接收到所述认证响应消息后，获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
如图4所示，本发明还提出了一种服务器，对应于前面的服务器端，应用于身份认证系统，所述身份认证系统还包括客户端，所述客户端保存 有开通记录，所述服务器保存有用户记录，所述开通记录和用户记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述服务器端包括：
应答模块，用于接收来自客户端的认证请求，向客户端发送认证请求应答消息；
校验模块，用于接收来自客户端的认证响应消息，所述认证响应消息包括生物特征模版ID，将所述认证响应消息中的生物特征模版ID与保存的用户记录中的生物特征模版ID进行比对校验，如果一致则校验通过，否则报错。
进一步地，所述应答模块还用于接收来自客户端的开通生物特征校验的开通请求，向客户端发送开通请求应答消息，以便客户端根据用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存；所述校验模块还用于接收来自客户端的开通响应消息，获取所述开通响应消息包括的生物特征模版ID，生成用户记录保存。
进一步地，所述应答模块还用于以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，以便所述客户端以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错，或以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
本发明所述开通请求应答消息中携带有挑战值，所述客户端生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥，所述校验模块还用于接收客户端根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥签名的开通响应消息，所述开通响应消息包括用户公钥，同样根据挑战值选择签名算法，并使用第二公钥校验开通响应消息，在服务器端保存用户公钥。
进一步地，所述校验模块还用于接收客户端根据认证请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和用户私钥进行签名的认证响应消息，同样根据挑战值选择签名算法和用户公钥校验认证响应消息 的签名。
进一步地，所述开通请求应答消息还包括用户ID，以便所述客户端在接收到所述开通请求应答消息后，将所述用户ID保存在所述开通记录中，并且在客户端生成的开通响应消息中还包括所述用户ID，则所述校验模块在接收到所述开通响应消息后，还从所述开通响应消息中获取用户ID，将所述用户ID保存在所述用户记录中。
进一步地，所述开通响应消息还包括客户端设备ID，所述校验模块在接收到所述开通响应消息后，还从所述开通响应消息中获取设备ID，将所述设备ID保存在所述用户记录中。
进一步地，所述认证请求应答消息还包括用户ID，以便所述客户端根据用户ID查找到对应的开通记录，将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对，并在客户端生成的认证响应消息中还包括所述用户ID，所述校验模块在接收到所述认证响应消息后，还获取所述认证响应消息中的用户ID，根据所述用户ID查找到对应的用户记录。
进一步地，所述认证响应消息还包括客户端设备ID，所述校验模块在接收到所述认证响应消息后，还获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
以上实施例仅用以说明本发明的技术方案而非对其进行限制，在不背离本发明精神及其实质的情况下，熟悉本领域的技术人员当可根据本发明作出各种相应的改变和变形，但这些相应的改变和变形都应属于本发明所附的权利要求的保护范围。

Claims (36)

  1. 一种基于生物特征的安全校验方法，应用于身份认证系统中的客户端，所述身份认证系统还包括服务器端，其特征在于，所述客户端保存有开通记录，所述开通记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述安全校验方法包括：
    向服务器端发送认证请求，接收服务器端返回的认证请求应答消息；
    接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID，将获取的所述生物特征模版ID与保存的开通记录中的生物特征模版ID进行比对，如果吻合则生成包括该获取的生物特征模版ID的认证响应消息，向服务器端发送认证响应消息，以便服务器端接收所述认证响应消息进行校验。
  2. 根据权利要求1所述的安全校验方法，其特征在于，所述开通生物特征校验过程包括：
    向服务器端发送开通生物特征校验的开通请求，接收服务器端返回的开通请求应答消息；
    接收用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存；
    生成包括所述生物特征模版ID的开通响应消息，向服务器端发送开通响应消息，以便服务器端接收所述开通响应消息，获取其中包含的所述生物特征模版ID生成用户记录保存。
  3. 根据权利要求2所述的安全校验方法，其特征在于，所述服务器端以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，则客户端在接收到所述认证请求应答消息之后，还包括：
    以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错；
    则客户端在接收到所述开通请求应答消息之后，还包括：
    以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
  4. 根据权利要求2所述的安全校验方法，其特征在于，所述开通请 求应答消息中携带有挑战值，所述开通生物特征校验过程还包括：
    生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥；
    根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥对生成的开通响应消息进行签名后发送给服务器端，所述开通响应消息包括用户公钥，以便服务器端接收所述开通响应消息并使用约定第二公钥进行校验，在服务器端保存用户公钥。
  5. 根据权利要求4所述的安全校验方法，其特征在于，所述认证请求应答消息中携带有挑战值，所述安全校验方法还包括：
    根据所述挑战值选择签名算法，用选择的签名算法和所述用户私钥对认证响应消息进行签名，以便所述服务器端在接收到所述认证响应消息后，同样根据所述挑战值选择签名算法和所述用户公钥对认证响应消息进行校验。
  6. 根据权利要求2所述的安全校验方法，其特征在于，所述开通请求应答消息还包括用户ID，所述客户端在接收到所述开通请求应答消息后，还包括：
    将所述用户ID保存在所述开通记录中，并且在客户端生成的开通响应消息中还包括所述用户ID，以便所述服务器端在接收到所述开通响应消息后，获取其中的用户ID并将其保存在所述用户记录中。
  7. 根据权利要求6所述的安全校验方法，其特征在于，所述开通响应消息还包括客户端设备ID，以便所述服务器端在接收到所述开通请求应答消息后，获取其中的设备ID并将其保存在所述用户记录中。
  8. 根据权利要求6所述的安全校验方法，其特征在于，所述认证请求应答消息还包括用户ID，所述在接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID之后，还包括：
    根据用户ID查找到对应的开通记录，以便将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对；
    在客户端生成的认证响应消息中还包括所述用户ID，以便所述服务器端在接收到所述认证响应消息后，获取其中的用户ID并根据所述用户ID查找到对应的用户记录。
  9. 根据权利要求7所述的安全校验方法，其特征在于，所述认证响应消息还包括客户端设备ID，以便所述服务器端在接收到所述认证响应消息后，获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
  10. 一种基于生物特征的安全校验方法，应用于身份认证系统中的服务器端，所述身份认证系统还包括客户端，其特征在于，所述服务器端保存有用户记录，所述用户记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述安全校验方法包括：
    接收来自客户端的认证请求，向客户端发送认证请求应答消息；
    接收来自客户端的认证响应消息，所述认证响应消息包括生物特征模版ID；
    将所述认证响应消息中的生物特征模版ID与保存的用户记录中的生物特征模版ID进行比对校验，如果一致则校验通过，否则报错。
  11. 根据权利要求10所述的安全校验方法，其特征在于，所述开通生物特征校验过程包括：
    接收来自客户端的开通生物特征校验的开通请求，向客户端发送开通请求应答消息，以便客户端根据用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存；
    接收来自客户端的开通响应消息，获取所述开通响应消息包括的生物特征模版ID，生成用户记录保存。
  12. 根据权利要求11所述的安全校验方法，其特征在于，所述安全校验方法还包括：
    以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，以便所述客户端以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错，或以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
  13. 根据权利要求11所述的安全校验方法，其特征在于，所述开通请求应答消息中携带有挑战值，所述客户端生成包括用户私钥和用户公钥 的用户公私钥对，保存用户私钥，所述开通生物特征校验过程还包括：
    接收客户端根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥签名的开通响应消息，所述开通响应消息包括用户公钥，同样根据挑战值选择签名算法，并使用第二公钥校验开通响应消息，在服务器端保存用户公钥。
  14. 根据权利要求13所述的安全校验方法，其特征在于，所述安全校验方法还包括：
    接收客户端根据认证请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和用户私钥进行签名的认证响应消息，同样根据挑战值选择签名算法和用户公钥校验认证响应消息的签名。
  15. 根据权利要求11所述的安全校验方法，其特征在于，所述开通请求应答消息还包括用户ID，以便所述客户端在接收到所述开通请求应答消息后，将所述用户ID保存在所述开通记录中，并且在客户端生成的开通响应消息中还包括所述用户ID，则所述服务器端在接收到所述开通响应消息后，还包括：
    从所述开通响应消息中获取用户ID，将所述用户ID保存在所述用户记录中。
  16. 根据权利要求15所述的安全校验方法，其特征在于，所述开通响应消息还包括客户端设备ID，所述服务器端在接收到所述开通响应消息后，还包括：
    从所述开通响应消息中获取设备ID，将所述设备ID保存在所述用户记录中。
  17. 根据权利要求15所述的安全校验方法，其特征在于，所述认证请求应答消息还包括用户ID，以便所述客户端根据用户ID查找到对应的开通记录，将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对，并在客户端生成的认证响应消息中还包括所述用户ID，所述服务器端在接收到所述认证响应消息后，还包括：
    获取所述认证响应消息中的用户ID，根据所述用户ID查找到对应的用户记录。
  18. 根据权利要求16所述的安全校验方法，其特征在于，所述认证响应消息还包括客户端设备ID，所述服务器端在接收到所述认证响应消息后，还包括：
    获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
  19. 一种客户端，应用于身份认证系统，所述身份认证系统还包括服务器端，其特征在于，所述客户端保存有开通记录，所述开通记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述客户端包括：
    请求模块，用于向服务器端发送认证请求，接收服务器端返回的认证请求应答消息；
    响应模块，用于接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID，将获取的所述生物特征模版ID与保存的开通记录中的生物特征模版ID进行比对，如果吻合则生成包括该生物特征模版ID的认证响应消息，向服务器端发送认证响应消息，以便服务器端接收所述认证响应消息进行校验。
  20. 根据权利要求19所述的客户端，其特征在于，所述请求模块还用于向服务器端发送开通生物特征校验的开通请求，接收服务器端返回的开通请求应答消息；所述响应模块还用于接收用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存，生成包括所述生物特征模版ID的开通响应消息，向服务器端发送开通响应消息，以便服务器端接收所述开通响应消息，获取其中包含的所述生物特征模版ID生成用户记录保存。
  21. 根据权利要求20所述的客户端，其特征在于，所述服务器端以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，则所述请求模块在接收到所述认证请求应答消息之后，还用于以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错；所述请求模块在接收到所述开通请求应答消息之后，还用于以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通 过才进行后续的响应，否则报错。
  22. 根据权利要求20所述的客户端，其特征在于，所述开通请求应答消息中携带有挑战值，所述响应模块还用于生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥；根据开通请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥对生成的开通响应消息进行签名后发送给服务器端，所述开通响应消息包括用户公钥，以便服务器端接收所述开通响应消息并使用约定第二公钥进行校验，在服务器端保存用户公钥。
  23. 根据权利要求22所述的客户端，其特征在于，所述认证请求应答消息中携带有挑战值，所述响应模块还用于根据所述挑战值选择签名算法，用选择的签名算法和所述用户私钥对认证响应消息进行签名，以便所述服务器端在接收到所述认证响应消息后，同样根据所述挑战值选择签名算法和所述用户公钥对认证响应消息进行校验。
  24. 根据权利要求20所述的客户端，其特征在于，所述开通请求应答消息还包括用户ID，所述响应模块还将所述用户ID保存在所述开通记录中，并且在生成的开通响应消息中还包括所述用户ID，以便所述服务器端在接收到所述开通响应消息后，获取其中的用户ID并将其保存在所述用户记录中。
  25. 根据权利要求24所述的客户端，其特征在于，所述开通响应消息还包括客户端设备ID，以便所述服务器端在接收到所述开通请求应答消息后，获取其中的设备ID并将其保存在所述用户记录中。
  26. 根据权利要求24所述的客户端，其特征在于，所述认证请求应答消息还包括用户ID，所述响应模块在接收用户输入的生物特征，获取该生物特征对应的生物特征模版ID之后，还根据用户ID查找到对应的开通记录，以便将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对；
    在所述响应模块生成的认证响应消息中还包括所述用户ID，以便所述服务器端在接收到所述认证响应消息后，获取其中的用户ID并根据所述用户ID查找到对应的用户记录。
  27. 根据权利要求26所述的客户端，其特征在于，所述认证响应消息还包括客户端设备ID，以便所述服务器端在接收到所述认证响应消息后，获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
  28. 一种服务器，应用于身份认证系统，所述身份认证系统还包括客户端，其特征在于，所述服务器保存有用户记录，所述用户记录包含有开通生物特征校验过程中获取的用于生物特征校验的生物特征模版ID，所述服务器包括：
    应答模块，用于接收来自客户端的认证请求，向客户端发送认证请求应答消息；
    校验模块，用于接收来自客户端的认证响应消息，所述认证响应消息包括生物特征模版ID，将所述认证响应消息中的生物特征模版ID与保存的用户记录中的生物特征模版ID进行比对校验，如果一致则校验通过，否则报错。
  29. 根据权利要求28所述的服务器，其特征在于，所述应答模块还用于接收来自客户端的开通生物特征校验的开通请求，向客户端发送开通请求应答消息，以便客户端根据用户输入的用于校验的生物特征，获取该用于校验的生物特征对应的生物特征模版ID，生成开通记录保存；所述校验模块还用于接收来自客户端的开通响应消息，获取所述开通响应消息包括的生物特征模版ID，生成用户记录保存。
  30. 根据权利要求29所述的服务器，其特征在于，所述应答模块还用于以约定的第一私钥对所述认证请求应答消息或开通请求应答消息进行签名，以便所述客户端以约定的第一公钥对接收的认证请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错，或以约定的第一公钥对接收的开通请求应答消息进行校验，如果校验通过才进行后续的响应，否则报错。
  31. 根据权利要求29所述的服务器，其特征在于，所述开通请求应答消息中携带有挑战值，所述客户端生成包括用户私钥和用户公钥的用户公私钥对，保存用户私钥，所述校验模块还用于接收客户端根据开通请求 应答消息中的挑战值选择签名算法，并使用选择的签名算法和约定的第二私钥签名的开通响应消息，所述开通响应消息包括用户公钥，同样根据挑战值选择签名算法，并使用第二公钥校验开通响应消息，保存用户公钥。
  32. 根据权利要求31所述的服务器，其特征在于，所述校验模块还用于接收客户端根据认证请求应答消息中的挑战值选择签名算法，并使用选择的签名算法和用户私钥进行签名的认证响应消息，同样根据挑战值选择签名算法和用户公钥校验认证响应消息的签名。
  33. 根据权利要求29所述的服务器，其特征在于，所述开通请求应答消息还包括用户ID，以便所述客户端在接收到所述开通请求应答消息后，将所述用户ID保存在所述开通记录中，并且在客户端生成的开通响应消息中还包括所述用户ID，则所述校验模块在接收到所述开通响应消息后，还从所述开通响应消息中获取用户ID，将所述用户ID保存在所述用户记录中。
  34. 根据权利要求33所述的服务器，其特征在于，所述开通响应消息还包括客户端设备ID，所述校验模块在接收到所述开通响应消息后，还从所述开通响应消息中获取设备ID，将所述设备ID保存在所述用户记录中。
  35. 根据权利要求33所述的服务器，其特征在于，所述认证请求应答消息还包括用户ID，以便所述客户端根据用户ID查找到对应的开通记录，将获取的所述生物特征模版ID与该查找到的开通记录中的生物特征模版ID进行比对，并在客户端生成的认证响应消息中还包括所述用户ID，所述校验模块在接收到所述认证响应消息后，还获取所述认证响应消息中的用户ID，根据所述用户ID查找到对应的用户记录。
  36. 根据权利要求35所述的服务器，其特征在于，所述认证响应消息还包括客户端设备ID，所述校验模块在接收到所述认证响应消息后，还获取所述认证响应消息中的设备ID，根据所述设备ID查找到对应的用户记录。
PCT/CN2016/086868 2015-07-02 2016-06-23 一种基于生物特征的安全校验方法及客户端、服务器 WO2017000829A1 (zh)

Priority Applications (8)

Application Number Priority Date Filing Date Title
EP16817193.2A EP3319292B1 (en) 2015-07-02 2016-06-23 Methods, client and server for checking security based on biometric features
ES16817193T ES2818199T3 (es) 2015-07-02 2016-06-23 Método de verificación de seguridad con base en una característica biométrica, un terminal de cliente y un servidor
KR1020187003347A KR102493744B1 (ko) 2015-07-02 2016-06-23 생체 특징에 기초한 보안 검증 방법, 클라이언트 단말, 및 서버
PL16817193T PL3319292T3 (pl) 2015-07-02 2016-06-23 Sposób weryfikacji bezpieczeństwa oparty na cechach biometrycznych, terminalu klienta i serwerze
JP2018500295A JP6882254B2 (ja) 2015-07-02 2016-06-23 生体特徴に基づく安全性検証方法、クライアント端末、及びサーバ
SG11201710590XA SG11201710590XA (en) 2015-07-02 2016-06-23 Security verification method based on biological feature, client terminal, and server
US15/857,762 US10659230B2 (en) 2015-07-02 2017-12-29 Using biometric features for user authentication
US16/876,584 US10892896B2 (en) 2015-07-02 2020-05-18 Using biometric features for user authentication

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510394393.3A CN106330850B (zh) 2015-07-02 2015-07-02 一种基于生物特征的安全校验方法及客户端、服务器
CN201510394393.3 2015-07-02

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/857,762 Continuation US10659230B2 (en) 2015-07-02 2017-12-29 Using biometric features for user authentication

Publications (1)

Publication Number Publication Date
WO2017000829A1 true WO2017000829A1 (zh) 2017-01-05

Family

ID=57607902

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/086868 WO2017000829A1 (zh) 2015-07-02 2016-06-23 一种基于生物特征的安全校验方法及客户端、服务器

Country Status (9)

Country Link
US (2) US10659230B2 (zh)
EP (1) EP3319292B1 (zh)
JP (1) JP6882254B2 (zh)
KR (1) KR102493744B1 (zh)
CN (1) CN106330850B (zh)
ES (1) ES2818199T3 (zh)
PL (1) PL3319292T3 (zh)
SG (2) SG10202000533XA (zh)
WO (1) WO2017000829A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107133603A (zh) * 2017-05-24 2017-09-05 努比亚技术有限公司 防止指纹泄漏的方法、移动终端及计算机可读存储介质
CN114641966A (zh) * 2019-09-12 2022-06-17 索尼集团公司 认证装置、认证方法、程序和信息处理装置

Families Citing this family (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106330850B (zh) 2015-07-02 2020-01-14 创新先进技术有限公司 一种基于生物特征的安全校验方法及客户端、服务器
CN107026836B (zh) * 2016-10-28 2020-03-06 阿里巴巴集团控股有限公司 一种业务实现方法和装置
CN107092819B (zh) * 2017-03-08 2020-04-14 Oppo广东移动通信有限公司 一种指纹录入检验方法及装置
CN107466454A (zh) * 2017-06-15 2017-12-12 深圳市汇顶科技股份有限公司 生物特征数据的安全处理方法、装置、传感器及终端设备
US20190349363A1 (en) * 2018-05-14 2019-11-14 GM Global Technology Operations LLC Biometric authentication with enhanced biometric data protection
US11005971B2 (en) * 2018-08-02 2021-05-11 Paul Swengler System and method for user device authentication or identity validation without passwords or matching tokens
CN109272287A (zh) * 2018-08-31 2019-01-25 业成科技（成都）有限公司 系统控制方法、电子签核系统、计算机及可读存储介质
CN110932858B (zh) * 2018-09-19 2023-05-02 阿里巴巴集团控股有限公司 认证方法和系统
CN109561074A (zh) * 2018-10-31 2019-04-02 北京中电华大电子设计有限责任公司 一种指纹认证的云安全系统和方法
WO2020091434A1 (ko) * 2018-11-02 2020-05-07 엘지전자 주식회사 무선 통신 시스템에서 생체정보를 이용하여 인증을 하기 위한 방법 및 장치
KR102210620B1 (ko) * 2018-12-20 2021-02-02 한국스마트인증 주식회사 서버에의 비밀 정보 저장 방법 및 복구 방법
US11075763B2 (en) * 2019-02-15 2021-07-27 International Business Machines Corporation Compute digital signature authentication sign with encrypted key instruction
US11108567B2 (en) 2019-02-15 2021-08-31 International Business Machines Corporation Compute digital signature authentication verify instruction
US11303456B2 (en) 2019-02-15 2022-04-12 International Business Machines Corporation Compute digital signature authentication sign instruction
KR20200100481A (ko) * 2019-02-18 2020-08-26 삼성전자주식회사 생체 정보를 인증하기 위한 전자 장치 및 그의 동작 방법
US10467398B1 (en) * 2019-03-14 2019-11-05 Alibaba Group Holding Limited Authentication by transmitting information through a human body
CN111988267B (zh) * 2019-05-24 2023-10-20 阿里巴巴集团控股有限公司 针对计算设备的认证方法及装置
CN110708326A (zh) * 2019-10-14 2020-01-17 北京明略软件系统有限公司 业务请求异常概率的确定方法和装置
US11496466B2 (en) * 2019-11-15 2022-11-08 Visa International Service Association Using an enrolled biometric dataset to detect adversarial examples in biometrics-based authentication system
TWI720738B (zh) * 2019-12-16 2021-03-01 臺灣網路認證股份有限公司 結合線上快速認證及公鑰基礎架構以識別身分之裝置及方法
JP7124979B2 (ja) * 2020-01-30 2022-08-24 日本電気株式会社 サーバ装置、認証システム、認証方法、プログラム及び方法
CN111489162A (zh) * 2020-04-07 2020-08-04 上海优扬新媒信息技术有限公司 一种基于生物特征的数据处理方法及装置
CN111782107A (zh) * 2020-06-30 2020-10-16 联想(北京)有限公司 信息处理方法、装置、计算机系统及可读存储介质
US20220044252A1 (en) * 2020-08-05 2022-02-10 Mastercard International Incorporated Systems and methods relating to tokenization
CN112104657B (zh) * 2020-09-17 2022-10-18 中国建设银行股份有限公司 信息校验方法和装置
US11977611B2 (en) 2020-10-20 2024-05-07 Mastercard International Incorporated Digital rights management platform
CN112968864A (zh) * 2021-01-26 2021-06-15 太原理工大学 一种可信的IPv6网络服务过程机制
CN113297552B (zh) * 2021-02-05 2023-11-17 中国银联股份有限公司 基于生物特征id链的验证方法及其验证系统、用户终端
WO2024116305A1 (ja) * 2022-11-30 2024-06-06 ファナック株式会社 制御装置及び制御システム

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101330386A (zh) * 2008-05-19 2008-12-24 刘洪利 基于生物特征的认证系统及其身份认证方法
CN101958792A (zh) * 2009-07-17 2011-01-26 华为技术有限公司 对用户进行指纹认证的方法和装置
US20110145904A1 (en) * 2009-12-14 2011-06-16 Erix Pizano Enterprise biometric authentication system for a windows biometric framework
CN102916968A (zh) * 2012-10-29 2013-02-06 北京天诚盛业科技有限公司 身份认证方法、身份认证服务器和身份认证装置
CN103368745A (zh) * 2013-07-19 2013-10-23 江南大学 一种教育信息资源保障的用户身份强认证方法
US20140337635A1 (en) * 2013-05-13 2014-11-13 Ira Konvalinka Biometric verification with improved privacy and network performance in client-server networks

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6535622B1 (en) * 1999-04-26 2003-03-18 Veridicom, Inc. Method for imaging fingerprints and concealing latent fingerprints
JP2001256191A (ja) * 2000-03-09 2001-09-21 Mitsubishi Electric Corp ネットワーク指紋認証システム
US20030105966A1 (en) * 2001-05-02 2003-06-05 Eric Pu Authentication server using multiple metrics for identity verification
US7702918B2 (en) * 2001-07-18 2010-04-20 Daon Holdings Limited Distributed network system using biometric authentication access
US7400749B2 (en) * 2002-07-08 2008-07-15 Activcard Ireland Limited Method and apparatus for supporting a biometric registration performed on an authentication server
US20070016777A1 (en) 2005-07-08 2007-01-18 Henderson James D Method of and system for biometric-based access to secure resources with dual authentication
JPWO2007094165A1 (ja) * 2006-02-15 2009-07-02 日本電気株式会社 本人確認システムおよびプログラム、並びに、本人確認方法
EP2012249A1 (en) * 2006-04-21 2009-01-07 Mitsubishi Denki Kabushiki Kaisha Authenticating server device, terminal device, authenticating system and authenticating method
JP2008176407A (ja) * 2007-01-16 2008-07-31 Toshiba Corp 生体認証システム、装置及びプログラム
JP5028194B2 (ja) * 2007-09-06 2012-09-19 株式会社日立製作所 認証サーバ、クライアント端末、生体認証システム、方法及びプログラム
JP5147673B2 (ja) * 2008-12-18 2013-02-20 株式会社日立製作所 生体認証システムおよびその方法
JP2010244365A (ja) * 2009-04-07 2010-10-28 Sony Corp サービス提供装置、サービス提供方法、生体情報認証サーバ、生体情報認証方法、プログラムおよびサービス提供システム
US8799666B2 (en) 2009-10-06 2014-08-05 Synaptics Incorporated Secure user authentication using biometric information
JP5309088B2 (ja) * 2010-06-21 2013-10-09 株式会社日立製作所 生体認証システムにおける、生体情報の登録方法、テンプレートの利用申請の方法、および、認証方法
EP2624160B1 (en) * 2010-09-30 2018-12-26 Panasonic Corporation Biometric authentication system, communication terminal device, biometric authentication device, and biometric authentication method
WO2012081126A1 (ja) * 2010-12-17 2012-06-21 富士通株式会社 生体認証装置、生体認証方法及び生体認証用コンピュータプログラム
CN102646190B (zh) * 2012-03-19 2018-05-08 深圳市腾讯计算机系统有限公司 一种基于生物特征的认证方法、装置及系统
WO2015041658A1 (en) * 2013-09-19 2015-03-26 Intel Corporation Technologies for synchronizing and restoring reference templates
CN104639517B (zh) * 2013-11-15 2019-09-17 阿里巴巴集团控股有限公司 利用人体生物特征进行身份验证的方法和装置
CN106330850B (zh) 2015-07-02 2020-01-14 创新先进技术有限公司 一种基于生物特征的安全校验方法及客户端、服务器

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101330386A (zh) * 2008-05-19 2008-12-24 刘洪利 基于生物特征的认证系统及其身份认证方法
CN101958792A (zh) * 2009-07-17 2011-01-26 华为技术有限公司 对用户进行指纹认证的方法和装置
US20110145904A1 (en) * 2009-12-14 2011-06-16 Erix Pizano Enterprise biometric authentication system for a windows biometric framework
CN102916968A (zh) * 2012-10-29 2013-02-06 北京天诚盛业科技有限公司 身份认证方法、身份认证服务器和身份认证装置
US20140337635A1 (en) * 2013-05-13 2014-11-13 Ira Konvalinka Biometric verification with improved privacy and network performance in client-server networks
CN103368745A (zh) * 2013-07-19 2013-10-23 江南大学 一种教育信息资源保障的用户身份强认证方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3319292A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107133603A (zh) * 2017-05-24 2017-09-05 努比亚技术有限公司 防止指纹泄漏的方法、移动终端及计算机可读存储介质
CN114641966A (zh) * 2019-09-12 2022-06-17 索尼集团公司 认证装置、认证方法、程序和信息处理装置

Also Published As

Publication number Publication date
PL3319292T3 (pl) 2020-12-28
CN106330850B (zh) 2020-01-14
KR102493744B1 (ko) 2023-01-30
US10659230B2 (en) 2020-05-19
SG10202000533XA (en) 2020-03-30
US20200280445A1 (en) 2020-09-03
JP2018521417A (ja) 2018-08-02
US10892896B2 (en) 2021-01-12
ES2818199T3 (es) 2021-04-09
KR20180026508A (ko) 2018-03-12
EP3319292B1 (en) 2020-08-26
JP6882254B2 (ja) 2021-06-02
SG11201710590XA (en) 2018-01-30
EP3319292A1 (en) 2018-05-09
US20180145833A1 (en) 2018-05-24
EP3319292A4 (en) 2018-06-27
CN106330850A (zh) 2017-01-11

Similar Documents

Publication Publication Date Title
WO2017000829A1 (zh) 一种基于生物特征的安全校验方法及客户端、服务器
US11336634B2 (en) Identity management via a centralized identity management server device
US10402797B2 (en) Secured authentication and transaction authorization for mobile and internet-of-things devices
US9887989B2 (en) Protecting passwords and biometrics against back-end security breaches
CN112425114B (zh) 受公钥-私钥对保护的密码管理器
US20170339138A1 (en) Multifactor privacy-enhanced remote identification using a rich credential
US20160125180A1 (en) Near Field Communication Authentication Mechanism
CN108989346A (zh) 基于账号隐匿的第三方有效身份托管敏捷认证访问模式
WO2015188424A1 (zh) 一种密钥存储设备及其使用方法
EP3206329B1 (en) Security check method, device, terminal and server
US10404689B2 (en) Password security
US10554652B2 (en) Partial one-time password
US20170279798A1 (en) Multi-factor authentication system and method
US20220014509A1 (en) Systems and methods for securing login access
US20180262471A1 (en) Identity verification and authentication method and system
US11930116B2 (en) Securely communicating service status in a distributed network environment
WO2019205389A1 (zh) 电子装置、基于区块链的身份验证方法、程序和计算机存储介质
CN111327629B (zh) 身份验证方法、客户端和服务端
TWM595792U (zh) 跨平台授權存取資源的授權存取系統
WO2022042745A1 (zh) 一种密钥管理方法及装置
SE540649C2 (en) Method and system for secure password storage
US9288060B1 (en) System and method for decentralized authentication of supplicant devices
TWM599939U (zh) 身分驗證系統
TWI778319B (zh) 跨平台授權存取資源方法及授權存取系統
TWI844338B (zh) 無密碼身分驗證方法與電腦程式產品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16817193

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11201710590X

Country of ref document: SG

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018500295

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 20187003347

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2016817193

Country of ref document: EP