WO2017005163A1

WO2017005163A1 - Wireless communication-based security authentication device

Info

Publication number: WO2017005163A1
Application number: PCT/CN2016/088549
Authority: WO
Inventors: 万四爽; 徐燕军; 何朔; 尹亚伟; 刘国宝
Original assignee: 中国银联股份有限公司
Priority date: 2015-07-09
Filing date: 2016-07-05
Publication date: 2017-01-12
Also published as: CN105592459B; CN105592459A

Abstract

Provided in the present invention is a wireless communication-based security authentication device, the device comprising: a wireless communication module for establishing a wireless communication link with a wireless router; a main controller for performing data communication with a user equipment in a wireless network to which the wireless router belongs through the wireless communication link, and performing a security authentication operation related to a security information exchange process on the basis of basic security data; and a security storage module for storing the basic security data. The wireless communication-based security authentication device disclosed in the present invention is convenient to operate and capable of comprehensive security protection.

Description

Security authentication device based on wireless communication

Technical field

The present invention relates to a secure authentication device, and more particularly to a secure authentication device based on wireless communication.

Background technique

At present, with the increasing popularity of computer and network applications and the growing variety of services in different fields, security for information interaction (ie, information interaction with high security requirements, such as transaction processing in the financial field) Authentication devices and methods are becoming more and more important.

In the existing technical solutions, a U shield (such as a USB Key) or an OTP (Dynamic Password) is generally used to implement a secure authentication process for security information interaction.

However, the above prior art solutions have the following problems: (1) For the U shield, since the U shield needs to be inserted into the computer, the operation is inconvenient and the usage scenario is limited; (1) for the OTP (dynamic) The way of the password), because it is necessary to carry the OTP device with it for use, it is also inconvenient to operate and the use scenario is limited; (3) the existing technical solution can only provide one-way security authentication (ie, user-side to server-side security) The protection is not able to provide security protection from the server side to the user side, so the security is low.

Therefore, there is a need to provide a secure authentication device that is easy to operate and has comprehensive security protection capabilities.

Summary of the invention

In order to solve the problems of the above prior art solutions, the present invention proposes a safety authentication device that is easy to operate and has comprehensive security protection capabilities.

The object of the invention can be achieved by the following technical solutions:

A security authentication device based on wireless communication, the wireless communication-based security authentication device includes:

a wireless communication module, the wireless communication module is configured to establish a wireless communication link with the wireless router;

a main controller, configured to perform data communication with a user equipment in a wireless network to which the wireless router belongs by using the wireless communication link to perform security information based on basic security data Security authentication operations related to the interaction process;

a secure storage module for storing the basic security data.

In the solution disclosed above, preferably, the basic security data includes at least a security key.

In the solution disclosed above, preferably, the wireless communication module is capable of automatically performing a networking operation after the secure authentication device is activated and initialized, the networking operation comprising: (1) determining whether the network is currently connected for the first time, and If it is the first time to network, go to step (2), otherwise go to step (3); (2) perform network automatic monitoring and networking operations; (3) directly connect to the network to which the last networking operation is connected, and if connected If it fails, go to step (2).

In the solution disclosed above, preferably, the network automatic monitoring and networking operation comprises: (1) starting a first listening program to listen to all network data packets from user equipments in the wireless network to which the wireless router belongs; (2) after listening to and receiving the network data packet, parsing configuration information of the wireless network to which the wireless router belongs from the network data packet, and then connecting to the wireless network based on the configuration information The configuration information is stored in the secure storage module, wherein the configuration information includes a wireless network identifier and/or a wireless network password.

In the solution disclosed above, preferably, after connecting to the wireless network, the main controller establishes a communication link with the user equipment in the following manner: (1) starting a second listening program to listen for from the a broadcast request of the user equipment for finding a secure authentication device; (2) after listening to and receiving the broadcast request, returning a response message to the user equipment to establish an IP protocol-based communication with the user equipment a link, wherein the response message includes an IP address of the secure authentication device.

In the solution disclosed above, preferably, after establishing a communication link with the user equipment, the main controller processes a secure authentication access request from the user equipment in a manner of: determining whether the user equipment is It has been added to the whitelist, and if it has been added to the whitelist, a response indicating that the secure authentication access operation is successful is returned to the user equipment. If the whitelist is not added, the access authentication operation is performed, and the access authentication operation is performed. After successful execution, a response indicating that the security authentication access operation is successful is returned, otherwise a response indicating that the security authentication access operation fails is returned.

In the solution disclosed above, preferably, the secure authentication access request includes device fingerprint information, where the device fingerprint information is a device serial number, or a device MAC address, or an operating system information of the device, or any of the foregoing information. combination.

In the solution disclosed above, preferably, the access identity authentication operation comprises: (1) parsing a secure authentication access request from the user equipment to extract device fingerprint information contained therein; (2) instructing a user to input a user access password via the user equipment; (3) determining whether the user access password is correct, And if it is correct, the access identity authentication operation is successful, and the device fingerprint information of the user equipment is subsequently written into the whitelist to indicate that the user equipment has successfully performed the access identity authentication operation; otherwise, the access identity The authentication operation failed.

In the solution disclosed above, preferably, the main controller performs a security authentication operation for the security information interaction request submitted by the user equipment in a manner based on a key pair stored in the secure storage module 3 The sensitive information in the security information interaction request is encrypted and then the entire security information interaction request is signed, and then the encrypted and signed security information interaction request is returned to the user equipment, so that the user equipment can The encrypted and signed security information interaction request is transmitted to the data processing server.

In the solution disclosed above, preferably, the main controller performs a secure authentication operation on the signed processing result returned by the data processing server transmitted via the user equipment in a manner of: checking based on a predetermined algorithm Whether the signature of the processing result is correct, and if correct, returning a response indicating that the security information interaction is successful to the user equipment, otherwise returning a response indicating that the security information interaction failed to the user equipment.

In the solution disclosed above, preferably, the security authentication device further includes an indication module, the indication module is configured to indicate a current state of the security authentication device, and includes three sets of indicator elements, the first group of indicator elements And indicating that the security authentication device is connected to the wireless network, the second group of indicating components is configured to indicate whether the security authentication device is in data communication with the user equipment, and the second group of indicating components is configured to indicate whether the security authentication device is A security authentication operation is being performed.

The wireless communication-based security authentication apparatus disclosed by the present invention has the following advantages: (1) convenient operation; (2) not only providing security protection from the user side to the server side, but also providing security protection from the server side to the user side.

DRAWINGS

The technical features and advantages of the present invention will be better understood by those skilled in the art, in which:

1 is a schematic structure of a wireless communication-based secure authentication apparatus according to an embodiment of the present invention Figure.

detailed description

1 is a schematic structural diagram of a wireless communication-based secure authentication apparatus according to an embodiment of the present invention. As shown in FIG. 1, the wireless communication-based security authentication apparatus disclosed by the present invention includes a main controller 1, a wireless communication module 2, and a secure storage module 3. The wireless communication module 2 is configured to establish a wireless communication link with a wireless router. The main controller 1 is configured to perform data communication with a user equipment in a wireless network to which the wireless router belongs through the wireless communication link to perform a security authentication operation related to a security information interaction process based on the basic security data. The secure storage module 3 is configured to store the basic security data.

Preferably, in the wireless communication-based secure authentication apparatus disclosed in the present invention, the basic security data includes at least a security key.

Preferably, in the wireless communication-based security authentication apparatus disclosed by the present invention, the wireless communication module 2 can automatically perform a networking operation after the security authentication apparatus is started and initialized, and the networking operation includes: (1) determining the current Whether it is the first time networking, and if it is the first time, enter step (2), otherwise enter step (3); (2) perform network automatic monitoring and networking operations; (3) directly connect to the last network operation Connect to the network, and if the connection fails, proceed to step (2).

Preferably, in the wireless communication-based secure authentication apparatus disclosed by the present invention, the network automatic monitoring and networking operation comprises: (1) starting a first listening program to listen to all wireless networks from the wireless router to which the wireless router belongs. a network data packet of the user equipment (for example, a UDP data packet); (2) after listening to and receiving the network data packet, parsing configuration information of the wireless network to which the wireless router belongs from the network data packet, and A connection is then made to the wireless network based on the configuration information and the configuration information is stored in the secure storage module 3, wherein the configuration information comprises a wireless network identifier and/or a wireless network password.

Preferably, in the wireless communication-based secure authentication apparatus disclosed by the present invention, after being connected to the wireless network, the main controller 1 establishes a communication link with the user equipment in the following manner: (1) a second listener is started to listen for a broadcast request from the user equipment for finding a secure authentication device; (2) after listening to and receiving the broadcast request, returning a response message to the user equipment to establish An IP protocol based communication link of the user equipment, wherein the response message includes The IP address of the secure authentication device.

Preferably, in the wireless communication-based secure authentication apparatus disclosed by the present invention, after establishing a communication link with the user equipment, the main controller 1 processes the secure authentication interface from the user equipment in the following manner. Incoming request: determining whether the user equipment has been added to the whitelist (that is, the user equipment that has successfully performed the access authentication operation before), and if the whitelist has been added, returns a security authentication access operation to the user equipment. The response is performed, and if the whitelist is not added, the access authentication operation is performed, and after the access authentication operation is successfully executed, a response indicating that the secure authentication access operation is successful is returned, otherwise, a response indicating that the secure authentication access operation fails is returned.

Preferably, in the wireless communication-based secure authentication apparatus disclosed by the present invention, the secure authentication access request includes device fingerprint information, where the device fingerprint information is a device serial number, or a device MAC address, or an operating system of the device. Information, or any combination of the above.

Preferably, in the wireless communication-based secure authentication apparatus disclosed by the present invention, the access identity authentication operation comprises: (1) parsing a secure authentication access request from the user equipment to extract a device included therein Fingerprint information; (2) instructing the user to input a user access password via the user equipment; (3) determining whether the user access password is correct, and if correct, the access identity authentication operation is successful, and the user equipment is subsequently The device fingerprint information is written in the whitelist to indicate that the user equipment has successfully performed the access identity authentication operation; otherwise, the access identity authentication operation fails.

Preferably, in the wireless communication-based secure authentication apparatus disclosed by the present invention, the main controller 1 requests a security information interaction (for example, a payment request) for the user equipment in a manner as follows, which includes, by way of example, Performing a secure authentication operation based on the transfer amount, the transferee account, the account password, etc.: encrypting the sensitive information in the security information interaction request based on the key stored in the secure storage module 3 and then The security information interaction request is signed, and then the encrypted and signed security information interaction request is returned to the user equipment such that the user equipment can transmit the encrypted and signed security information interaction request to the data processing server (eg Payment server).

Preferably, in the wireless communication-based secure authentication apparatus disclosed by the present invention, the main controller 1 performs security for the signed processing result returned by the data processing server transmitted via the user equipment in the following manner An authentication operation: verifying whether the signature of the processing result is correct based on a predetermined algorithm, and returning a response indicating that the security information interaction is successful to the user equipment if correct, otherwise returning to the user equipment indicating that the security information interaction fails the response to.

Preferably, in the wireless communication-based secure authentication apparatus disclosed in the present invention, the user equipment is a mobile phone, or a computer, or a television.

Preferably, the wireless communication-based security authentication apparatus disclosed by the present invention further includes an indication module 4 for indicating a current status of the security authentication apparatus, which includes three sets of indicating elements (for example, LED lights), The first set of indicator elements are used to indicate whether the secure authentication device has access to the wireless network, the second set of indicator elements are used to indicate whether the secure authentication device is in data communication with the user equipment, and the second set of indicator elements are used to indicate Whether the secure authentication device is performing a secure authentication operation.

It can be seen from the above that the wireless communication-based security authentication device disclosed in the present invention has the following advantages: (1) convenient operation; (2) not only providing user-to-server-side security protection, but also providing server-to-user-side safety protection.

Although the invention has been described in terms of the preferred embodiments described above, the implementation forms are not limited to the embodiments described above. It will be appreciated that various changes and modifications can be made in the present invention without departing from the spirit and scope of the invention.

Claims

A security authentication device based on wireless communication, the wireless communication-based security authentication device includes:

a wireless communication module, the wireless communication module is configured to establish a wireless communication link with the wireless router;

a main controller, configured to perform data communication with a user equipment in a wireless network to which the wireless router belongs by using the wireless communication link to perform a security authentication operation related to a security information interaction process based on the basic security data;

a secure storage module for storing the basic security data.
The wireless communication-based secure authentication apparatus according to claim 1, wherein the basic security data includes at least a security key.
The wireless communication-based security authentication apparatus according to claim 2, wherein the wireless communication module is capable of automatically performing a networking operation after the security authentication device is activated and initialized, and the networking operation comprises: (1) determining the current Whether it is the first time networking, and if it is the first time, enter step (2), otherwise enter step (3); (2) perform network automatic monitoring and networking operations; (3) directly connect to the last network operation Connect to the network, and if the connection fails, proceed to step (2).
The wireless communication-based security authentication apparatus according to claim 3, wherein the network automatic monitoring and networking operation comprises: (1) starting a first listening program to listen to all wireless networks from which the wireless router belongs Network packet of the user equipment; (2) after listening to and receiving the network data packet, parsing configuration information of the wireless network to which the wireless router belongs from the network data packet, and then based on the configuration Information is coupled to the wireless network and stores the configuration information into the secure storage module, wherein the configuration information includes a wireless network identifier and/or a wireless network password.
The wireless communication-based security authentication apparatus according to claim 4, wherein after being connected to the wireless network, the main controller establishes a communication link with the user equipment in the following manner: (1) a second listener is started to listen for a broadcast request from the user equipment for finding a secure authentication device; (2) after listening to and receiving the broadcast request, returning a response message to the user equipment to establish An IP protocol based communication link of the user equipment, wherein the response cancellation The information includes the IP address of the secure authentication device.
The wireless communication-based security authentication apparatus according to claim 5, wherein after establishing a communication link with the user equipment, the main controller processes the security authentication connection from the user equipment in the following manner Incoming request: determining whether the user equipment has been added to the whitelist, and if the whitelist has been added, returns a response indicating that the security authentication access operation is successful, and if the whitelist is not added, performing the access authentication operation. And returning a response indicating that the security authentication access operation succeeds after the access authentication operation is successfully executed, otherwise returning a response indicating that the security authentication access operation fails.
The wireless communication-based security authentication apparatus according to claim 6, wherein the secure authentication access request comprises device fingerprint information, and the device fingerprint information is a device serial number, or a device MAC address, or an operation of the device. System information, or any combination of the above.
The wireless communication-based secure authentication apparatus according to claim 7, wherein the access identity authentication operation comprises: (1) parsing a secure authentication access request from the user equipment to extract the included Device fingerprint information; (2) instructing the user to input a user access password via the user device; (3) determining whether the user access password is correct, and if correct, the access identity authentication operation is successful, and the user is subsequently The device fingerprint information of the device is written in the whitelist to indicate that the user equipment has successfully performed the access identity authentication operation; otherwise, the access identity authentication operation fails.
The wireless communication-based security authentication apparatus according to claim 8, wherein the main controller performs a security authentication operation for the security information interaction request submitted by the user equipment in a manner of: based on the security storage module The key stored in 3 encrypts the sensitive information in the security information interaction request and then signs the entire security information interaction request, and then returns the encrypted and signed security information interaction request to the user. The device such that the user device is capable of transmitting the encrypted and signed security information interaction request to the data processing server.
The wireless communication-based secure authentication apparatus according to claim 9, wherein said main controller performs security for a signed processing result returned by said data processing server transmitted via said user equipment in the following manner An authentication operation: verifying whether the signature of the processing result is correct based on a predetermined algorithm, and returning a response indicating that the security information interaction is successful to the user equipment if correct, otherwise returning to the user equipment indicating that the security information interaction fails the response to.
A wireless communication-based security authentication apparatus according to claim 10, wherein The security authentication device further includes an indication module, the indication module is configured to indicate a current state of the security authentication device, and includes three sets of indication elements, the first group of indication elements are used to indicate whether the security authentication device is connected A wireless network, a second set of indicating elements for indicating whether the secure authentication device is in data communication with a user equipment, and a second set of indicating elements for indicating whether the secure authentication device is performing a secure authentication operation.