WO2017071478A1 - 光子ca认证方法及系统 - Google Patents

光子ca认证方法及系统 Download PDF

Info

Publication number
WO2017071478A1
WO2017071478A1 PCT/CN2016/101972 CN2016101972W WO2017071478A1 WO 2017071478 A1 WO2017071478 A1 WO 2017071478A1 CN 2016101972 W CN2016101972 W CN 2016101972W WO 2017071478 A1 WO2017071478 A1 WO 2017071478A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
photonic
user
pin code
certificate
Prior art date
Application number
PCT/CN2016/101972
Other languages
English (en)
French (fr)
Inventor
刘若鹏
王旭东
Original Assignee
深圳光启智能光子技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳光启智能光子技术有限公司 filed Critical 深圳光启智能光子技术有限公司
Priority to EP16858914.1A priority Critical patent/EP3370383B1/en
Publication of WO2017071478A1 publication Critical patent/WO2017071478A1/zh
Priority to US15/956,773 priority patent/US10911247B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B10/00—Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
    • H04B10/80—Optical aspects relating to the use of optical transmission for specific applications, not provided for in groups H04B10/03 - H04B10/70, e.g. optical power feeding or optical transmission through water
    • H04B10/85—Protection from unauthorised access, e.g. eavesdrop protection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G06F21/35—User authentication involving the use of external additional devices, e.g. dongles or smart cards communicating wirelessly
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/12—Fingerprints or palmprints
    • G06V40/1365—Matching; Classification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B10/00—Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
    • H04B10/11—Arrangements specific to free-space transmission, i.e. transmission through air or vacuum
    • H04B10/114—Indoor or close-range type systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B10/00—Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
    • H04B10/70—Photonic quantum communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the present invention relates to a CA authentication, and more particularly to a photonic CA authentication method and an authentication system based on optical communication.
  • CA Certificate Authority
  • a digital certificate is issued by an authority authority that can be used to identify the identity of the other party.
  • a digital certificate is a file that contains a public key owner information and a public key, digitally signed by a certificate authority.
  • CA digital certificates can be safely and effectively authenticated, but there are also drawbacks to the abuse or misappropriation of digital certificates.
  • Visible light communication technology is a kind of LED
  • a new type of wireless optical communication technology developed in technology Communication is carried out by high-frequency flickering of the LED light source, and the transmission rate of visible light communication is up to gigabits per second.
  • a photonic CA authentication method includes:
  • a client certificate is provided to the client to perform CA certificate authentication.
  • the method further includes: fingerprinting the user fingerprint by the photonic terminal; and responding to the optical signal including the user ID by the fingerprint identification.
  • verifying the user ID included in the optical signal includes: including the optical signal The user ID is compared with the locally stored ID; if the two are consistent, the user ID is verified, otherwise the user ID verification fails.
  • the method further includes: sending an error message to the client in response to the user ID verification failure.
  • providing a user certificate to the client to perform CA certificate authentication comprises: performing PIN code verification by the photonic CA authentication terminal in response to verification by the user ID; In response to verification by the PIN code, the client is provided with the user certificate to perform CA certificate authentication.
  • the photonic CA authentication terminal includes a CA authentication module and a photonic processing module
  • the performing the authentication PIN code verification comprises: transmitting, by the photonic processing module, the PIN to the CA authentication module in response to the verification by the user ID
  • the code, and the PIN code received by the CA authentication module is compared with the locally stored PIN code to perform PIN code verification. If the two are consistent, the PIN code is verified, otherwise the PIN code verification fails.
  • the PIN code sent by the photon processing module is a PIN code encrypted by using a first key algorithm
  • the PIN code stored locally by the CA authentication module is a PIN code encrypted by using a second key algorithm.
  • Aligning the received PIN code with the locally stored PIN code by the CA authentication module includes: decrypting the received PIN code by using the first key algorithm; using the second key algorithm for local storage The PIN code is decrypted; and the decrypted two PIN codes are compared to perform PIN code verification.
  • the method further includes: transmitting an error message to the client in response to the PIN code verification failure.
  • the method further includes: submitting, by the client, the user certificate to the certificate authentication gateway to perform the CA certificate authentication.
  • the method further comprises: submitting, by the client, the user certificate to the certificate authentication gateway along with the certificate device password entered by the user to perform the CA certificate authentication.
  • a photonic CA authentication system comprising:
  • Photon CA authentication terminal the photonic CA authentication terminal includes:
  • a photon processing module configured to receive an optical signal from the photonic terminal and verify the user ID included in the optical signal
  • the photonic CA authentication terminal provides a user certificate to the client to perform C in response to verification by the user ID A certificate certification.
  • the system further includes: a photonic terminal configured to perform fingerprint identification on the user fingerprint, and in response to the fingerprint identification, transmitting the optical signal including the user ID to the photonic CA authentication terminal.
  • the photonic processing module includes: a storage unit storing a user ID; and a comparing unit configured to compare the user ID included in the optical signal with a user ID stored locally in the storage unit Yes, if the two are consistent, the user ID is verified, otherwise the user ID verification fails.
  • the photonic CA authentication terminal sends an error message to the client in response to the user ID verification failure.
  • the photonic CA authentication terminal further includes: a CA authentication module, configured to perform PIN code verification in response to the user ID verification, and provide the client with the PIN code verification User certificate to perform CA certificate authentication.
  • a CA authentication module configured to perform PIN code verification in response to the user ID verification, and provide the client with the PIN code verification User certificate to perform CA certificate authentication.
  • the storage unit of the photonic processing module further stores a PIN code, wherein the photonic processing module transmits a PIN code to the CA authentication module by using the user ID verification, and the CA authentication module includes: The storage unit stores a PIN code; and a comparing unit, configured to compare the received PIN code with the locally stored PIN code to perform PIN code verification, and if the two are consistent, the PIN code is verified, otherwise the PIN code verification fails.
  • the PIN code sent by the photonic processing module is a PIN code encrypted by a first key algorithm
  • the PIN code stored locally by the CA authentication module is an encrypted PIN using a second key algorithm
  • the CA authentication module further includes: a key unit, configured to decrypt the received PIN code by using the first key algorithm, and decrypt the locally stored PIN code by using the second key algorithm, where The comparing unit compares the decrypted two PIN codes to perform PIN code verification.
  • the photonic CA authentication terminal sends an error message to the client in response to the PIN code verification failure.
  • the system further includes: the client connecting to the photonic CA authentication terminal through a USB port, the client being configured to submit the user certificate to the certificate authentication gateway to perform the CA certificate authentication.
  • the client submits the user certificate to the certificate authentication gateway along with the certificate device password entered by the user to perform the CA certificate authentication.
  • Visible light communication has a very rich spectrum of resources, which is unmatched by general wireless communication including microwave communication.
  • visible light communication can be applied to any communication protocol, suitable for any environment, and the device for visible light communication is flexible and convenient to install, and is suitable for large-scale popular application. .
  • FIG. 1 shows a block diagram of an architecture of a photonic authentication system in accordance with an aspect of the present invention
  • FIG. 2 shows a block diagram of a photonic CA authentication terminal in accordance with an aspect of the present invention
  • FIG. 3 shows a flow chart of a photonic CA authentication method in accordance with an aspect of the present invention.
  • FIG. 1 is a block diagram showing the architecture of a photonic CA authentication system 1000 in accordance with an aspect of the present invention.
  • the photonic CA authentication terminal 100 is connected to the client 300 through a USB port.
  • the Certificate Authority Gateway 400 is deployed between the client 300 and the server 600 and is deployed in tandem. All information interaction between the client 300 and the server 600 passes through the authentication gateway 400.
  • the authentication gateway 400 is responsible for completing the complete certificate authentication process for the client 300 and the encrypted transmission of the data.
  • the client 300 can only authenticate to the authentication gateway, and the request can actually reach the server.
  • the photonic CA authentication system 1000 may further include a photonic terminal 200, and the user first performs preliminary photon verification to the photonic CA authentication terminal 100 using the photonic terminal 200, and performs subsequent CA authentication only after the verification.
  • the user transmits the optical signal including the user ID to the photonic CA authentication terminal 100 using the photonic terminal 200, and the photonic processing module 120 of the photonic CA authentication terminal 100 receives the optical signal, and executes the optical signal. Line photon verification.
  • the photonic terminal 200 includes a fingerprint identification module, which can perform fingerprint recognition on the user.
  • the photonic terminal 200 transmits the optical signal only after the user has identified by fingerprint.
  • the photonic terminal 200 can be in the form of a card such as a photon card.
  • FIG. 2 is a block diagram showing a photonic CA authentication terminal 100 in accordance with an aspect of the present invention.
  • the photonic CA authentication terminal 100 can include two parts, a CA authentication module 110 and a photonic processing module 120, which can communicate via the UART protocol.
  • Photon processing module 120 is primarily responsible for preliminary photon verification of the user.
  • the photonic CA authentication terminal 100 can be a packaged device, for example, an online banking U shield with photon reception.
  • the CA authentication module 110 and the photonic processing module 120 may also be a complete set of instruments packaged in different devices.
  • the CA authentication module 110 may be an existing USB-type electronic device with CA authentication function.
  • the password card, the photon processing module 120 is a photon receiving end for receiving only optical signals, and the two are respectively connected to the computer through a USB port to form a complete set of instruments.
  • the photonic processing module 120 may first include a light receiving unit 123, and accordingly, the photonic terminal 200 may include a light emitting unit (not shown) such that both are optically communicable.
  • the light emitting unit (eg, the encoding portion) of the photonic terminal 200 can encode the original communication data, such as the user ID, in any encoding manner.
  • Common encodings may include NRZ encoding, NRZI encoding, NRZI inversion counting encoding, and the like.
  • the NRZ code represents a high level and a low level represents 0.
  • the NRZI code is a signal flipping, that is, a high-low transition, representing a logic such as 1 (0), while the signal high and low remains unchanged, indicating another logic such as 0 (1).
  • the RZ pulse count coding is to set the original information in groups of n bits, and the inter-group interval between the two groups of signals is set, and the number of pulses in each group represents the information of n bits in the group of signals. .
  • the information bit 00 is represented by one pulse
  • the information 10 is represented by 3 pulses.
  • the NRZI inversion counting code also sets the original information in groups of n bits, and sets the inter-turn interval between the two groups of signals. Different from the RZ pulse count coding, NRZI is information indicating the n bits in the set of signals in the high-to-low level (or low-to-high level) in each group.
  • a light emitting unit may transmit the received encoded signal as visible light, for example, by indicating a high level signal with light and a low level with no light.
  • the light receiving unit 123 can be configured to receive the visible light signal emitted by the photo sub-terminal 200 and convert the visible light signal into a digital signal. For example, for high frequency flicker generated by an LED lamp, light may represent a high level, no light may represent a low level, or vice versa, thereby converting a received visible light signal into a digital signal.
  • the light receiving unit 123 (for example, a photoelectric conversion portion) forms an electric pulse signal by photoelectric conversion using the characteristics of the electric signal of the photodiode and the optical signal.
  • the electrical signal strength is also different. Therefore, it is necessary to perform rectification comparison of the formed current.
  • the photoelectric conversion circuit adjusts the output voltage level to a high level; when the current value through the photodiode is below a certain threshold, photoelectric conversion The circuit adjusts the output voltage level to a low level.
  • the threshold is set according to different environments through a mathematical model. If the distance is far away, the threshold may be lowered; the distance threshold may be relatively increased. Through the above process, the level can be adjusted to a certain range to ensure the correct pulse shape to ensure the accuracy of sampling as much as possible.
  • the light receiving unit 123 (for example, the decoding portion) further decodes the obtained digital signal to recover the original communication data, such as the user ID transmitted by the photo sub-terminal 200.
  • an optical signal including the user ID may be transmitted to the photon processing module 120, and the optical receiving unit 123 may receive the optical signal and process it to obtain a user ID.
  • the light receiving unit 123 can also perform A/D conversion and decryption processing (in the case where the user ID is encrypted).
  • the photonic processing module 120 may verify the user ID, and if the verification is passed, the photonic CA authentication terminal 100 may provide the user certificate to the client 300, for example, through a USB port.
  • the storage unit 111 of the CA authentication module 110 stores a user certificate, and at least through the photon verification, the CA authentication module 110 provides a user certificate for C A authentication.
  • the photonic processing module 120 functionally mainly includes two parts, namely, a light receiving portion such as the above-described light receiving unit 123, and a verification portion such as the comparing unit 122 detailed below.
  • the photonic CA authentication terminal 100 initially performs device initialization, and the client 300 will use The user ID is sent to the photonic CA authentication terminal 100 through the USB port.
  • the photonic processing module 120 is encrypted and stored in the storage unit 121, and this user ID is the same value as in the photo sub-terminal 200.
  • the comparison unit 122 may compare the user ID obtained by the light receiving unit 123 with the user ID in the storage unit 121, and if the two are consistent, the verification passes, otherwise the verification fails.
  • the photonic processing module 120 also needs to decrypt it first, and compares it with the user ID obtained by the light receiving unit 123.
  • the CA authentication module 110 can submit the user certificate to the client 300, and when the photon verification fails, the photonic CA authentication terminal 100 sends an error message to the client 300 through the USB port.
  • the CA authentication module 110 further needs to perform the PIN code verification, and only when the PIN code is verified, the client 300 is provided with the user certificate for CA authentication, and when After the PIN code verification is not completed, the photonic CA authentication terminal 100 transmits an error message to the client 300.
  • the client 300 sends the PIN code assigned by the certificate authentication gateway 400 to the photonic CA authentication terminal 100 through the USB port.
  • the CA authentication module 110 and the photonic processing module 120 each reserve one copy and are saved by different AES keys.
  • the PIN code in the storage unit 111 of the CA authentication module 110 is a first key algorithm, such as an AES1-encrypted PIN code
  • the PIN code in the storage unit 121 of the photon processing module 120 is A second key algorithm, such as a PIN code based on AES2 encryption.
  • the key unit 112 of the CA authentication module 110 may employ a second key algorithm, such as performing the received PIN code based on AES2. Decrypt, and use the second key algorithm, for example, to decrypt the locally stored PIN code based on AES1, and then compare the two, if the two are consistent, the PIN code is verified, otherwise the PIN code verification fails.
  • a second key algorithm such as performing the received PIN code based on AES2.
  • Decrypt and use the second key algorithm, for example, to decrypt the locally stored PIN code based on AES1, and then compare the two, if the two are consistent, the PIN code is verified, otherwise the PIN code verification fails.
  • the CA authentication terminal 110 may send the user certificate to the client 300, and when it fails, may send an error message to the client.
  • the client 300 may submit a user certificate to the certificate authentication gateway 400 to perform CA certificate authentication. Generally, the client 300 also needs to submit the certificate device password input by the user to the certificate authentication gateway 400 for CA certificate authentication.
  • the client 300 sends a connection request to the application server 600, requesting to first reach the authentication gateway 400, as indicated by the arrow of the numeral 1.
  • the certificate authentication gateway 400 requires the user to submit a user certificate, as indicated by the arrow of the number 2.
  • the client 300 prompts the user to enter the certificate device password and submits the user certificate to the server, as indicated by the arrow of the number 3.
  • the authentication gateway 400 verifies the obtained user certificate, including the certificate itself validity, the trust certificate chain, the blacklist verification or the OCSP verification, as indicated by the arrow of the number 4. After the verification is passed, the authentication gateway 400 can send the request to the real server 600 and append the user credential information to the request, as indicated by the arrow of the number 5.
  • the server 600 retrieves the identity of the user from the request, as indicated by the arrow numbered 6.
  • FIG. 3 is a flow chart showing a photonic CA authentication method 300 in accordance with an aspect of the present invention. As shown in FIG. 3, the method 300 can include the following steps:
  • Step 301 Prepare for authentication
  • the photonic CA authentication terminal 100 is connected to the client 300 via USB;
  • Step 302 terminal initialization
  • the photonic CA authentication terminal 100 can acquire the PIN code and the user ID;
  • Step 303 fingerprint identification
  • the fingerprint information needs to be input to perform fingerprint recognition
  • Step 304 If the fingerprint recognition is passed, the flow proceeds to step 305, otherwise proceeds to step 306;
  • Step 305 The photonic processing module 120 parses the received optical signal to obtain a user ID.
  • Step 306 Reporting an error to the client 300
  • Step 307 The photo sub-processing module 120 compares the received user ID with the locally stored user ID to perform photon verification. If the verification passes, the flow proceeds to step 308, otherwise proceeds to step 309;
  • Step 308 The photonic processing module 120 sends the PIN code to the CA authentication module 110;
  • the PIN code here may be a PIN code encrypted via AES2;
  • Step 310 The CA authentication module 110 decrypts the received PIN code.
  • the CA authentication module 110 can decrypt the PIN code using AES2;
  • Step 311 The CA authentication module 110 decrypts the locally stored PIN code.
  • CA authentication module 110 can decrypt the PIN code using, for example, AES1;
  • Step 312 Compare whether the two are consistent, if yes, the flow proceeds to step 313, otherwise proceeds to step 314;
  • Step 313 The CA authentication module 110 submits a user certificate to the client 300.
  • Step 314 Reporting an error to the client 300.
  • fingerprint recognition is first performed, followed by photon ID verification, and finally CA authentication.
  • the person, photon card and authentication terminal are fully bound, which can effectively prevent certificate abuse and improve the authentication security level.
  • Zhang San uses a device carrying a CA certificate, such as a USB memory, to legally access the authorized device.
  • a CA certificate such as a USB memory
  • the device of the CA certificate is not bound to Zhang San, if Zhang San lends the CA certificate device to Li Si, because the CA certificate device is not bound to the user, when Li Si uses ⁇ , It is still possible to legally start the A1111 device, posing a security risk.
  • Zhang San is mutually bound to the CA certificate by the photon ID verification method: first, fingerprint identification is performed, and after the fingerprint verification is passed, the current operator is confirmed to be Zhang San, and then photon verification is performed. If the photon ID is legal, start the CA authentication module to confirm that it has a valid CA certificate device, and finally perform CA authentication to confirm that it has the right to use the device.
  • the solution adopted in the present invention binds the CA certificate device to which the user is assigned by means of photon ID verification, so that others cannot replace the use, thereby increasing the The security of the device used.
  • This embodiment has undergone a triple verification method, and firstly carried out fingerprint recognition.
  • IJ, followed by photon ID verification, and finally CA certification effectively prevent certificate abuse and improve the authentication security level.
  • the various illustrative logic blocks, modules, and circuits described in connection with the embodiments disclosed herein may be general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays ( An FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform or perform the functions described herein.
  • a general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine.
  • the processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in cooperation with a DSP core, or any other such configuration.
  • the steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two.
  • the software modules may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read and write information from/to the storage medium.
  • the storage medium can be integrated into the processor.
  • the processor and storage medium can reside in an ASIC.
  • the ASIC can reside in the user terminal.
  • the processor and the storage medium may reside as discrete components in the user terminal.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • General Physics & Mathematics (AREA)
  • Optics & Photonics (AREA)
  • Software Systems (AREA)
  • Human Computer Interaction (AREA)
  • Multimedia (AREA)
  • Collating Specific Patterns (AREA)
  • Optical Communication System (AREA)
  • Storage Device Security (AREA)

Abstract

本发明提供了一种光子CA认证方法，包括：由光子CA认证终端接收来自光子终端的光信号，该光信号中包含用户ID；对该光信号中所包含的用户ID进行验证；以及响应于通过该用户ID验证，向客户端提供用户证书以执行CA证书认证

Description

说明书 发明名称：光子 CA认证方法及系统 技术领域
[0001] 本发明涉及一种 CA认证， 尤其涉及基于光通信的光子 CA认证方法及认证系统 背景技术
[0002] CA (Certificate Authority, 证书授权机构） 数字证书是由权威机构授权中心发 行的， 可以用它来识别对方的身份。 数字证书是一个经证书授权中心数字签名 的包含公幵密钥拥有者信息以及公幵密钥的文件。 CA数字证书可以安全有效进 行安全认证， 但是也有弊端就是数字证书滥用或盗用。
技术问题
[0003] 可见光通信技术是一种在 LED
技术上发展起来的新型无线光通信技术。 通过 LED光源的高频率闪烁来进行通信 ， 可见光通信的传输速率最高达每秒千兆。
问题的解决方案
技术解决方案
[0004] 以下给出一个或多个方面的简要概述以提供对这些方面的基本理解。 此概述不 是所有构想到的方面的详尽综览， 并且既非旨在指认出所有方面的关键性或决 定性要素亦非试图界定任何或所有方面的范围。 其唯一的目的是要以简化形式 给出一个或多个方面的一些概念以为稍后给出的更加详细的描述之序。
[0005] 根据本发明的一方面， 一种光子 CA认证方法， 包括：
[0006] 由光子 CA认证终端接收来自光子终端的光信号， 该光信号中包含用户 ID;
[0007] 对该光信号中所包含的用户 ID进行验证； 以及
[0008] 响应于通过该用户 ID验证， 向客户端提供用户证书以执行 CA证书认证。
[0009] 在一实例中， 该方法还包括： 由该光子终端对用户指纹进行指纹识别； 以及响 应于通过该指纹识别， 发送包含该用户 ID的该光信号。
[0010] 在一实例中， 对该光信号中所包含的用户 ID进行验证包括： 将该光信号中所含 的用户 ID与本地存储的 ID进行比对； 若两者一致则通过该用户 ID验证， 否则用 户 ID验证失败。
[0011] 在一实例中， 该方法还包括： 响应于该用户 ID验证失败， 向客户端发送报错消 息。
[0012] 在一实例中， 该响应于通过该用户 ID验证， 向客户端提供用户证书以执行 CA 证书认证包括： 响应于通过该用户 ID验证， 由该光子 CA认证终端执行 PIN码验 证； 以及响应于通过该 PIN码验证， 向该客户端提供该用户证书以执行 CA证书 认证。
[0013] 在一实例中， 该光子 CA认证终端包括 CA认证模块和光子处理模块， 该执行认 证 PIN码验证包括： 响应于通过该用户 ID验证， 由该光子处理模块向该 CA认证 模块传送 PIN码， 以及由该 CA认证模块将收到的 PIN码与本地存储的 PIN码进行 比对以执行 PIN码验证， 若两者一致则通过 PIN码验证， 否则 PIN码验证失败。
[0014] 在一实例中， 该光子处理模块发送的 PIN码是采用第一密钥算法经加密的 PIN码 ， 该 CA认证模块本地存储的 PIN码是采用第二密钥算法经加密的 PIN码， 其中由 该 CA认证模块将收到的 PIN码与本地存储的 PIN码进行比对包括： 采用该第一密 钥算法对收到的 PIN码进行解密； 采用该第二密钥算法对本地存储的 PIN码进行 解密； 以及将解密后的两个 PIN码进行比对以执行 PIN码验证。
[0015] 在一实例中， 该方法还包括： 响应于 PIN码验证失败， 向该客户端发送报错消 息。
[0016] 在一实例中， 该方法还包括： 由该客户端向证书认证网关提交该用户证书以执 行该 CA证书认证。
[0017] 在一实例中， 该方法还包括： 由该客户端将该用户证书连同用户输入的证书设 备密码一起提交至该证书认证网关以执行该 CA证书认证。
[0018] 根据本发明的另一方面， 提供了一种光子 CA认证系统， 包括：
[0019] 光子 CA认证终端， 该光子 CA认证终端包括：
[0020] 光子处理模块， 用于接收来自光子终端的光信号并对该光信号中包含的用户 ID 进行验证，
[0021] 该光子 CA认证终端响应于通过该用户 ID验证， 向客户端提供用户证书以执行 C A证书认证。
[0022] 在一实例中， 该系统还包括： 光子终端， 用于对用户指纹进行指纹识别， 以及 响应于通过该指纹识别， 向该光子 CA认证终端发送包含该用户 ID的该光信号。
[0023] 在一实例中， 该光子处理模块包括： 存储单元， 存储有用户 ID; 以及比较单元 ， 用于将该光信号中所含的用户 ID与该存储单元中本地存储的用户 ID进行比对 ， 若两者一致则通过该用户 ID验证， 否则用户 ID验证失败。
[0024] 在一实例中， 该光子 CA认证终端响应于该用户 ID验证失败， 向该客户端发送 报错消息。
[0025] 在一实例中， 该光子 CA认证终端还包括： CA认证模块， 用于响应于通过该用 户 ID验证来执行 PIN码验证， 以及响应于通过该 PIN码验证， 向该客户端提供该 用户证书以执行 CA证书认证。
[0026] 在一实例中， 该光子处理模块的存储单元还存储有 PIN码， 其中， 该光子处理 模块响应于通过该用户 ID验证向该 CA认证模块传送 PIN码， 以及该 CA认证模块 包括： 存储单元， 存储有 PIN码； 以及比较单元， 用于将收到的 PIN码与本地存 储的 PIN码进行比对以执行 PIN码验证， 若两者一致则通过 PIN码验证， 否则 PIN 码验证失败。
[0027] 在一实例中， 该光子处理模块所发送的 PIN码是采用第一密钥算法经加密的 PIN 码， 该 CA认证模块本地存储的 PIN码是采用第二密钥算法经加密的 PIN码， 该 C A认证模块还包括： 密钥单元， 用于采用该第一密钥算法对收到的 PIN码进行解 密， 以及采用该第二密钥算法对本地存储的 PIN码进行解密， 其中， 该比较单元 将解密后的两个 PIN码进行比对以执行 PIN码验证。
[0028] 在一实例中， 该光子 CA认证终端响应于该 PIN码验证失败， 向该客户端发送报 错消息。
[0029] 在一实例中， 该系统还包括： 该客户端， 通过 USB端口与该光子 CA认证终端 连接， 该客户端用于向证书认证网关提交该用户证书以执行该 CA证书认证。
[0030] 在一实例中， 该客户端将该用户证书连同用户输入的证书设备密码一起提交至 该证书认证网关以执行该 CA证书认证。
发明的有益效果 有益效果
[0031] 可见光通信有着相当丰富的频谱资源， 这是包括微波通信在内的一般无线通信 无法比拟的。 同吋， 可见光通信可以适用任何通信协议、 适用于任何环境， 并 且可见光通信的设备架设灵活便捷、 成本低廉， 适合大规模普及应用。 。
对附图的简要说明
附图说明
[0032] 在结合以下附图阅读本公幵的实施例的详细描述之后， 能够更好地理解本发明 的上述特征和优点。 在附图中， 各组件不一定是按比例绘制， 并且具有类似的 相关特性或特征的组件可能具有相同或相近的附图标记。
[0033] 图 1示出了根据本发明一方面的光子认证系统的架构的框图；
[0034] 图 2示出了根据本发明一方面光子 CA认证终端的框图； 以及
[0035] 图 3示出了根据本发明一方面光子 CA认证方法的流程图。
本发明的实施方式
[0036] 以下结合附图和具体实施例对本发明作详细描述。 注意， 以下结合附图和具体 实施例描述的诸方面仅是示例性的， 而不应被理解为对本发明的保护范围进行 任何限制。
[0037] 图 1是示出了根据本发明一方面的光子 CA认证系统 1000的架构的框图。 如图 1 所示， 光子 CA认证终端 100通过 USB端口与客户端 300连接。 证书认证网关 400部 署在客户端 300和服务端 600之间， 并采用串联部署。 客户端 300与服务端 600之 间的所有信息交互都经过认证网关 400。 认证网关 400负责完成对客户端 300的完 整证书认证过程以及数据的加密传输， 客户端 300只有通过认证网关的验证， 请 求才能真正到达服务器。
[0038] 光子 CA认证系统 1000还可包括光子终端 200， 用户使用光子终端 200向光子 CA 认证终端 100先进行初步的光子验证， 只有在经过该验证后才进行后续的 CA认证
[0039] 根据本发明的一方面， 用户使用光子终端 200向光子 CA认证终端 100发送包含 用户 ID的光信号， 光子 CA认证终端 100的光子处理模块 120接收该光信号， 并执 行光子验证。
[0040] 较优地， 光子终端 200包含有指纹识别模块， 可对用户进行指纹识别。 只有在 用户通过指纹识别之后， 光子终端 200才会发送该光信号。 光子终端 200可以是 例如光子一卡通的卡片形式。
[0041] 图 2是示出了根据本发明的一方面的光子 CA认证终端 100的框图。
[0042] 如图 2所示， 光子 CA认证终端 100可包括两部分， 即 CA认证模块 110和光子处 理模块 120， 这两者可通过 UART协议进行通信。 光子处理模块 120主要负责对用 户的初步的光子验证。 当上述两者通过 UART协议吋， 光子 CA认证终端 100可以 是封装成一体的设备， 例如是带有光子接收功能的网银 U盾。
[0043] 在其他的可实施方式中 CA认证模块 110和光子处理模块 120也可以为封装在不 同设备中的一整套仪器， 例如 CA认证模块 110可以为现有的具有 CA认证功能的 USB型电子口令卡， 光子处理模块 120为仅用于接收光信号的光子接收端， 上述 两者分别通过 U S B端口连接在电脑上， 形成一整套的仪器。
[0044] 光子处理模块 120首先可包括光接收单元 123， 相应地， 光子终端 200可包括光 发射单元 （未示出） ， 以使得两者可进行光通信。
[0045] 一般而言， 光子终端 200的光发射单元 （例如， 编码部分） 可以采用任何编码 方式来编码原始通信数据， 例如用户 ID。 常见的编码可包括 NRZ编码、 NRZI编 码、 NRZI反转计数编码等等。 NRZ编码是以高电平代表 1， 低电平代表 0。 NRZI 编码是以信号的翻转即高低电平的跳变为代表一个逻辑例如 1 (0) ， 而信号高 低电平保持不变表示另一逻辑例如 0 (1) 。 RZ脉冲计数编码是将原始信息以 n个 比特为一组， 相邻两组信号之间设有组间吋间间隔， 每组内以脉冲的个数表示 该组信号中的 n个比特的信息。 根据 RZ编码， 用一个脉冲表示信息位 00， 用 3个 脉冲表示信息 10。
[0046] NRZI反转计数编码也是将原始信息以 n个比特为一组， 相邻两组信号之间设有 组间吋间间隔。 区别于 RZ脉冲计数编码， NRZI是在每组内以高电平到低电平 ( 或低电平到高电平） 的反转次数分别表示该组信号中的 n个比特的信息。
[0047] 光发射单元 （例如， 发光部分， 诸如 LED) 可以例如通过以发光表示高电平信 号、 而以不发光表示低电平来将接收到的经编码信号以可见光的形式发送出去 [0048] 光接收单元 123可用于接收光子终端 200发射的可见光信号、 并将可见光信号转 换为数字信号。 例如， 对于 LED灯产生的高频率闪烁， 有光可代表高电平， 无光 可代表低电平， 或反之， 从而可将接收的可见光信号转换为数字信号。 光接收 单元 123 (例如， 光电转换部分） 利用光电二极管的电信号与光信号的特性， 通 过光电转换将形成电脉冲信号。 实践中由于光子终端 200与光子 CA认证终端 100 的相对位置不一样， 即每次光子终端 200发射到光接收单元 123的光信号强度是 不一样的， 所以其电信号强弱也是不一样的， 所以需要对所形成的电流进行整 流比较。 如当二极管通过的电流值高于某一定门限值吋， 光电转换电路将输出 的电压电平值调整为高电平； 当通过光电二极管的电流值低于某一门限值吋， 光电转换电路将输出的电压电平值调整为低电平。 该门限值的设定是通过一个 数学模型根据不同的环境来设定的， 如距离较远吋， 门限值可能会降低； 距离 近吋门限值可能会相对升高。 通过以上过程， 可以将电平调整到一定范围内， 以此保证正确的脉冲形状， 以尽可能保证采样的准确性。
[0049] 光接收单元 123 (例如， 解码部分） 进一步将得到的数字信号解码， 以恢复出 原始通信数据， 例如光子终端 200所发送的用户 ID。
[0050] 在用户通过光子终端 200的指纹识别后， 可向光子处理模块 120发送包含用户 ID 的光信号， 光接收单元 123可接收该光信号， 并对其进行处理， 以获得用户 ID。 除上述处理之外， 光接收单元 123还可执行 A/D转换、 解密处理 （在用户 ID经过 加密的情况下） 。
[0051] 在获得来自光子终端 200的用户 ID之后， 光子处理模块 120可对该用户 ID进行验 证， 若通过该验证， 则光子 CA认证终端 100可例如通过 USB口向客户端 300提供 用户证书， 以执行 CA证书认证。 例如， CA认证模块 110的存储单元 111中存储有 用户证书， 至少需要通过该光子验证， CA认证模块 110才会提供用户证书进行 C A认证。
[0052] 光子处理模块 120从功能上主要包括两个部分， 即光接收部分， 例如上述的光 接收单元 123， 以及验证部分， 例如下文详述的比较单元 122。
[0053] 在本案中， 光子 CA认证终端 100在最初会进行设备初始化， 客户端 300会将用 户 ID通过 USB口下发到光子 CA认证终端 100， 对于用户 ID， 光子处理模块 120加 密保存在存储单元 121中， 并且这个用户 ID是与光子终端 200中一样的数值。
[0054] 相应地， 在执行光子验证吋， 比较单元 122可将光接收单元 123得到的用户 ID与 存储单元 121中的用户 ID进行比较， 若两者一致， 则验证通过， 否则验证失败。 在存储单元 121中的用户 ID是经加密的用户 ID的情况下， 光子处理模块 120还需 首先对其进行解密， 在与光接收单元 123获得的用户 ID进行比较。
[0055] 如上所述， 当光子验证通过吋， CA认证模块 110可向客户端 300提交用户证书 ， 而当光子验证失败吋， 光子 CA认证终端 100会通过 USB端口向客户端 300发送 报错消息。
[0056] 在特定实施例中， 当通过光子验证后， CA认证模块 110还需进一步执行 PIN码 验证， 只有当通过 PIN码验证吋， 才会向客户端 300提供用户证书进行 CA认证， 而当未通过 PIN码验证吋， 光子 CA认证终端 100会向客户端 300发送报错消息。
[0057] 在此实施例中， 光子 CA认证终端 100在最初的设备初始化吋， 客户端 300会将 证书认证网关 400分配的 PIN码通过 USB口下发到光子 CA认证终端 100， 对于 PIN 码， CA认证模块 110和光子处理模块 120各保留一份， 通过不同的 AES密钥保存
[0058] 例如， 在 CA认证模块 110的存储单元 111中的 PIN码是以第一密钥算法， 例如基 于 AES1加密的 PIN码， 而在光子处理模块 120的存储单元 121中的 PIN码是以第二 密钥算法， 例如基于 AES2加密的 PIN码。
[0059] 在接收到光子处理模块 120经由 UART协议发送来的经加密的 PIN码后， CA认证 模块 110的密钥单元 112可采用第二密钥算法， 例如基于 AES2对收到的 PIN码进 行解密， 而采用第二密钥算法， 例如基于 AES1对本地存储的 PIN码进行解密， 然后两者进行比较， 若两者一致则通过 PIN码验证， 否则 PIN码验证失败。
[0060] 当通过 PIN码验证吋， CA认证终端 110可向客户端 300发送用户证书， 而当失败 吋， 可向客户端发送报错消息。
[0061] 客户端 300在接收到用户证书吋， 可向证书认证网关 400提交用户证书， 以执行 CA证书认证。 一般地， 客户端 300还需同吋将用户输入的证书设备密码一起提交 给证书认证网关 400进行 CA证书认证。 [0062] 在用户希望通过客户端进行服务请求吋， 如图 1中所示， 客户端 300向应用服务 端 600发送连接请求， 请求首先到达认证网关 400， 如标号 1的箭头所示。 证书认 证网关 400要求用户提交用户证书， 如标号 2的箭头所示。 客户端 300提示用户输 入证书设备密码， 向服务端提交用户证书， 如标号 3的箭头所示。 认证网关 400 对获取的用户证书进行验证， 包括证书自身有效性， 信任证书链， 黑名单验证 或者 OCSP验证， 如标号 4的箭头所示。 验证通过后， 认证网关 400可将请求发送 给真正服务器 600， 并将用户证书信息附加到请求中， 如标号 5的箭头所示。 服 务器 600从请求中获取用户的身份， 如标号 6的箭头所示。
[0063] 图 3是示出了根据本发明一方面光子 CA认证方法 300的流程图。 如图 3所示， 方 法 300可包括如下步骤：
[0064] 步骤 301 : 准备认证；
[0065] 此吋， 光子 CA认证终端 100与客户端 300通过 USB连接；
[0066] 步骤 302: 终端初始化；
[0067] 光子 CA认证终端 100可获取 PIN码和用户 ID;
[0068] 步骤 303: 指纹识别；
[0069] 用户若希望通过光子终端 200发送光信号执行光子验证， 则需要输入指纹信息 以执行指纹识别；
[0070] 步骤 304: 若指纹识别通过， 则流程行进至步骤 305， 否则行进至步骤 306;
[0071] 步骤 305: 光子处理模块 120对收到的光信号进行解析以获得用户 ID;
[0072] 步骤 306: 向客户端 300报错；
[0073] 步骤 307: 光子处理模块 120将收到的用户 ID与本地存储的用户 ID进行比较， 以 执行光子验证， 若验证通过则流程行进至步骤 308， 否则行进至步骤 309;
[0074] 步骤 308: 光子处理模块 120将 PIN码发送至 CA认证模块 110;
[0075] 这里的 PIN码可以是经由 AES2加密的 PIN码；
[0076] 步骤 310: CA认证模块 110对收到的 PIN码进行解密；
[0077] 相应地， CA认证模块 110可使用 AES2对该 PIN码进行解密；
[0078] 步骤 311 : CA认证模块 110对本地存储的 PIN码进行解密；
[0079] 这里 CA认证模块 110可使用例如 AES1对 PIN码进行解密； [0080] 步骤 312: 比较两者是否一致， 若一致则流程行进至步骤 313， 否则行进至步骤 314；
[0081] 步骤 313: CA认证模块 110向客户端 300提交用户证书；
[0082] 步骤 314: 向客户端 300报错。
[0083] 尽管为使解释简单化将上述方法图示并描述为一系列动作， 但是应理解并领会 ， 这些方法不受动作的次序所限， 因为根据一个或多个实施例， 一些动作可按 不同次序发生和 /或与来自本文中图示和描述或本文中未图示和描述但本领域技 术人员可以理解的其他动作并发地发生。
[0084] 在本发明中， 首先进行指纹识别， 接着是光子 ID验证， 最后是 CA认证。 人、 光子卡和认证终端完全绑定， 可以有效防止证书滥用现象， 提高认证安全级别
[0085] 为了更清楚的说明上述各个步骤， 以下以一个实际的例子来阐述说明：
[0086] 首先在服务器上建立以下的人员信息表格：
Figure imgf000010_0001
[0087] 即， 对于员工张三， 仅授权他使用电脑号为 A1111的设备。
[0088] 若采用现有技术中仅使用 CA认证的方式， 张三使用携带有 CA证书的设备， 例 如 USB存储器， 即可合法接入授权设备。 但是由于该 CA证书的设备并未与张三 绑定， 若张三将该 CA证书设备借出给李四使用， 由于 CA证书设备本申请并不与 使用者绑定， 当李四使用吋， 依然能合法的启动 A1111的设备， 造成安全隐患。
[0089] 若采用本发明实施例的方案， 张三通过光子 ID验证方式与其 CA证书相互绑定 ： 首先进行指纹识别， 指纹验证通过后， 确认当前的操作者为张三， 然后进行 光子验证， 若光子 ID为合法的， 则启动 CA认证模块， 以确认其具有合法的 CA证 书设备， 最后进行 CA认证， 以确认其具有使用设备的权限。
[0090] 相比于原先的 CA认证的方案， 本发明中所采用的方案将使用者与其分配到的 C A证书设备通过光子 ID验证的方式绑定在一起， 使得别人无法顶替使用， 从而增 加了设备使用的安全性。 本实施例经过了三重验证的方式， 首先进行了指纹识 另 IJ， 接着进行了光子 ID验证， 最后是 CA认证， 有效防止证书滥用现象， 提高认 证安全级别。
[0091] 本领域技术人员将进一步领会， 结合本文中所公幵的实施例来描述的各种解说 性逻辑板块、 模块、 电路、 和算法步骤可实现为电子硬件、 计算机软件、 或这 两者的组合。 为清楚地解说硬件与软件的这一可互换性， 各种解说性组件、 框 、 模块、 电路、 和步骤在上面是以其功能性的形式作一般化描述的。 此类功能 性是被实现为硬件还是软件取决于具体应用和施加于整体系统的设计约束。 技 术人员对于每种特定应用可用不同的方式来实现所描述的功能性， 但这样的实 现决策不应被解读成导致脱离了本发明的范围。
[0092] 结合本文所公幵的实施例描述的各种解说性逻辑板块、 模块、 和电路可用通用 处理器、 数字信号处理器 （DSP) 、 专用集成电路 （ASIC) 、 现场可编程门阵 列 （FPGA) 或其它可编程逻辑器件、 分立的门或晶体管逻辑、 分立的硬件组件 、 或其设计成执行本文所描述功能的任何组合来实现或执行。 通用处理器可以 是微处理器， 但在替换方案中， 该处理器可以是任何常规的处理器、 控制器、 微控制器、 或状态机。 处理器还可以被实现为计算设备的组合， 例如 DSP与微处 理器的组合、 多个微处理器、 与 DSP核心协作的一个或多个微处理器、 或任何其 他此类配置。
[0093] 结合本文中公幵的实施例描述的方法或算法的步骤可直接在硬件中、 在由处理 器执行的软件模块中、 或在这两者的组合中体现。 软件模块可驻留在 RAM存储 器、 闪存、 ROM存储器、 EPROM存储器、 EEPROM存储器、 寄存器、 硬盘、 可 移动盘、 CD-ROM、 或本领域中所知的任何其他形式的存储介质中。 示例性存 储介质耦合到处理器以使得该处理器能从 /向该存储介质读取和写入信息。 在替 换方案中， 存储介质可以被整合到处理器。 处理器和存储介质可驻留在 ASIC中 。 ASIC可驻留在用户终端中。 在替换方案中， 处理器和存储介质可作为分立组 件驻留在用户终端中。
[0094] 提供对本公幵的先前描述是为使得本领域任何技术人员皆能够制作或使用本公 幵。 对本公幵的各种修改对本领域技术人员来说都将是显而易见的， 且本文中 所定义的普适原理可被应用到其他变体而不会脱离本公幵的精神或范围。 由此 ， 本公幵并非旨在被限定于本文中所描述的示例和设计， 而是应被授予与本文 中所公幵的原理和新颖性特征相一致的最广范围。

Claims

权利要求书
一种光子 CA认证方法， 包括：
由光子 CA认证终端接收来自光子终端的光信号， 所述光信号中包含 用户 ID;
对所述光信号中所包含的用户 ID进行验证； 以及
响应于通过所述用户 ID验证， 向客户端提供用户证书以执行 CA证书 认证。
如权利要求 1所述的光子 CA认证方法， 其特征在于， 还包括： 由所述光子终端对用户指纹进行指纹识别； 以及
响应于通过所述指纹识别， 发送包含所述用户 ID的所述光信号。 如权利要求 1所述的光子 CA认证方法， 其特征在于， 对所述光信号中 所包含的用户 ID进行验证包括：
将所述光信号中所含的用户 ID与本地存储的 ID进行比对；
若两者一致则通过所述用户 ID验证， 否则用户 ID验证失败。
如权利要求 1所述的光子 CA认证方法， 其特征在于， 还包括： 响应于所述用户 ID验证失败， 向客户端发送报错消息。
如权利要求 1所述的光子 CA认证方法， 其特征在于， 所述响应于通过 所述用户 ID验证， 向客户端提供用户证书以执行 CA证书认证包括： 响应于通过所述用户 ID验证， 由所述光子 CA认证终端执行 PIN码验证
； 以及
响应于通过所述 PIN码验证， 向所述客户端提供所述用户证书以执行 CA证书认证。
如权利要求 5所述的光子 CA认证方法， 其特征在于， 所述光子 CA认 证终端包括 CA认证模块和光子处理模块， 所述执行认证 PIN码验证包 括：
响应于通过所述用户 ID验证， 由所述光子处理模块向所述 CA认证模 块传送 PIN码， 以及
由所述 CA认证模块将收到的 PIN码与本地存储的 PIN码进行比对以执 行 PIN码验证， 若两者一致则通过 PIN码验证， 否则 PIN码验证失败。 如权利要求 6所述的光子 CA认证方法， 其特征在于， 所述光子处理模 块发送的 PIN码是采用第一密钥算法经加密的 PIN码， 所述 CA认证模 块本地存储的 PIN码是采用第二密钥算法经加密的 PIN码， 其中由所 述 CA认证模块将收到的 PIN码与本地存储的 PIN码进行比对包括： 采用所述第一密钥算法对收到的 PIN码进行解密；
采用所述第二密钥算法对本地存储的 PIN码进行解密； 以及 将解密后的两个 PIN码进行比对以执行 PIN码验证。
如权利要求 5所述的光子 CA认证方法， 其特征在于， 还包括： 响应于 PIN码验证失败， 向所述客户端发送报错消息。
如权利要求 1所述的光子 CA认证方法， 其特征在于， 还包括： 由所述客户端向证书认证网关提交所述用户证书以执行所述 CA证书 认证。
如权利要求 9所述的光子 CA认证方法， 其特征在于， 还包括： 由所述客户端将所述用户证书连同用户输入的证书设备密码一起提交 至所述证书认证网关以执行所述 CA证书认证。
一种光子 CA认证系统， 包括：
光子 CA认证终端， 所述光子 CA认证终端包括：
光子处理模块， 用于接收来自光子终端的光信号并对所述光信号中包 含的用户 ID进行验证，
所述光子 CA认证终端响应于通过所述用户 ID验证， 向客户端提供用 户证书以执行 CA证书认证。
如权利要求 11所述的光子 CA认证系统， 其特征在于， 还包括： 光子终端， 用于对用户指纹进行指纹识别， 以及响应于通过所述指纹 识别， 向所述光子 CA认证终端发送包含所述用户 ID的所述光信号。 如权利要求 11所述的光子 CA认证系统， 其特征在于， 所述光子处理 模块包括：
存储单元， 存储有用户 ID; 以及 比较单元， 用于将所述光信号中所含的用户 ID与所述存储单元中本地 存储的用户 ID进行比对， 若两者一致则通过所述用户 ID验证， 否则 用户 ID验证失败。
如权利要求 11所述的光子 CA认证系统， 其特征在于， 所述光子 CA认 证终端响应于所述用户 ID验证失败， 向所述客户端发送报错消息。 如权利要求 11所述的光子 CA认证系统， 其特征在于， 所述光子 CA认 证终端还包括：
CA认证模块， 用于响应于通过所述用户 ID验证来执行 PIN码验证， 以 及响应于通过所述 PIN码验证， 向所述客户端提供所述用户证书以执 行 CA证书认证。
如权利要求 15所述的光子 CA认证系统， 其特征在于， 所述光子处理 模块的存储单元还存储有 PIN码， 其中， 所述光子处理模块响应于通 过所述用户 ID验证向所述 CA认证模块传送 PIN码， 以及
所述 CA认证模块包括：
存储单元， 存储有 PIN码； 以及
比较单元， 用于将收到的 PIN码与本地存储的 PIN码进行比对以执行 P IN码验证， 若两者一致则通过 PIN码验证， 否则 PIN码验证失败。 如权利要求 16所述的光子 CA认证系统， 其特征在于， 所述光子处理 模块所发送的 PIN码是采用第一密钥算法经加密的 PIN码， 所述 CA认 证模块本地存储的 PIN码是采用第二密钥算法经加密的 PIN码， 所述 C A认证模块还包括：
密钥单元， 用于采用所述第一密钥算法对收到的 PIN码进行解密， 以 及采用所述第二密钥算法对本地存储的 PIN码进行解密，
其中， 所述比较单元将解密后的两个 PIN码进行比对以执行 PIN码验 证。
如权利要求 15所述的光子 CA认证系统， 其特征在于， 所述光子 CA认 证终端响应于所述 PIN码验证失败， 向所述客户端发送报错消息。 如权利要求 11所述的光子 CA认证系统， 其特征在于， 还包括： 所述客户端， 通过 USB端口与所述光子 CA认证终端连接， 所述客户 端用于向证书认证网关提交所述用户证书以执行所述 CA证书认证。
[权利要求 20] 如权利要求 19所述的光子 CA认证系统， 其特征在于， 所述客户端将 所述用户证书连同用户输入的证书设备密码一起提交至所述证书认证 网关以执行所述 CA证书认证。
PCT/CN2016/101972 2015-10-28 2016-10-13 光子ca认证方法及系统 WO2017071478A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16858914.1A EP3370383B1 (en) 2015-10-28 2016-10-13 Photon-based ca authentication method and system
US15/956,773 US10911247B2 (en) 2015-10-28 2018-04-19 Photon-based CA authentication method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510716528.3 2015-10-28
CN201510716528.3A CN106656349B (zh) 2015-10-28 2015-10-28 光子ca认证方法及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/956,773 Continuation US10911247B2 (en) 2015-10-28 2018-04-19 Photon-based CA authentication method and system

Publications (1)

Publication Number Publication Date
WO2017071478A1 true WO2017071478A1 (zh) 2017-05-04

Family

ID=58629887

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101972 WO2017071478A1 (zh) 2015-10-28 2016-10-13 光子ca认证方法及系统

Country Status (4)

Country Link
US (1) US10911247B2 (zh)
EP (1) EP3370383B1 (zh)
CN (1) CN106656349B (zh)
WO (1) WO2017071478A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110958247A (zh) * 2019-12-01 2020-04-03 成都华迈通信技术有限公司 一种网关设备数据传输系统及数据传输方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108183794B (zh) * 2017-12-25 2020-08-28 中科稀土（长春）有限责任公司 一种基于光信息的认证方法
JP7199949B2 (ja) * 2018-12-12 2023-01-06 キヤノン株式会社 情報処理装置、システム、情報処理装置の制御方法、システムの制御方法及びプログラム

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0946022A2 (en) * 1998-03-26 1999-09-29 Nippon Telegraph and Telephone Corporation Email access control scheme for communication network using identification concealment mechanism
GB2360617A (en) * 2000-03-24 2001-09-26 Liu Kuo Shen Identifying the owner of a card or code, eg credit card
CN101504732A (zh) * 2009-03-13 2009-08-12 华中科技大学 基于标识密码技术的电子护照扩展访问控制系统及鉴权方法
CN101707594A (zh) * 2009-10-21 2010-05-12 南京邮电大学 基于单点登录的网格认证信任模型
CN102640449A (zh) * 2009-11-06 2012-08-15 瑞典爱立信有限公司 用于web应用通信的系统和方法

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100420183C (zh) * 2001-04-19 2008-09-17 株式会社Ntt都科摩 终端通信系统及方法
US20030065920A1 (en) * 2001-10-01 2003-04-03 International Business Machines Corporation Method and apparatus for using host authentication for automated public key certification
KR100559008B1 (ko) * 2003-04-02 2006-03-10 에스케이 텔레콤주식회사 이동통신 단말기의 적외선 통신을 이용한 사용자 인증시스템 및 그 방법
JP2006121524A (ja) * 2004-10-22 2006-05-11 Toshiba Solutions Corp 公開鍵暗号装置
CN1696967A (zh) * 2005-05-16 2005-11-16 刘小鹏 多层密码生物自主认证卡及认证话机
CN101427509A (zh) * 2006-04-18 2009-05-06 Magiq技术公司 用于量子密码网络的密钥管理和用户认证
JP5042109B2 (ja) * 2008-04-17 2012-10-03 株式会社リコー 電子証明書発行システム、電子証明書発行方法、及び電子証明書発行プログラム
US8464960B2 (en) * 2011-06-30 2013-06-18 Verisign, Inc. Trusted barcodes
US9509506B2 (en) * 2011-09-30 2016-11-29 Los Alamos National Security, Llc Quantum key management
CN102710611A (zh) * 2012-05-11 2012-10-03 福建联迪商用设备有限公司 网络安全身份认证方法和系统
US9887976B2 (en) * 2012-08-30 2018-02-06 Los Alamos National Security, Llc Multi-factor authentication using quantum communication
CN102916970B (zh) * 2012-10-30 2015-04-15 飞天诚信科技股份有限公司 一种基于网络的pin码缓存方法
CN203180938U (zh) * 2012-12-21 2013-09-04 国民技术股份有限公司 电子令牌和电子令牌认证系统
US9270651B2 (en) * 2013-04-05 2016-02-23 Futurewei Technologies, Inc. Authentication and initial key exchange in ethernet passive optical network over coaxial network
AU2013204989A1 (en) * 2013-04-13 2014-10-30 Digital (Id)Entity Limited A system, method, computer program and data signal for the provision of a profile of identification
KR101516881B1 (ko) * 2013-09-23 2015-05-04 숭실대학교산학협력단 사용자 인증 방법 및 장치
CN103929310A (zh) * 2014-04-25 2014-07-16 长沙市梦马软件有限公司 一种手机客户端口令统一认证方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0946022A2 (en) * 1998-03-26 1999-09-29 Nippon Telegraph and Telephone Corporation Email access control scheme for communication network using identification concealment mechanism
GB2360617A (en) * 2000-03-24 2001-09-26 Liu Kuo Shen Identifying the owner of a card or code, eg credit card
CN101504732A (zh) * 2009-03-13 2009-08-12 华中科技大学 基于标识密码技术的电子护照扩展访问控制系统及鉴权方法
CN101707594A (zh) * 2009-10-21 2010-05-12 南京邮电大学 基于单点登录的网格认证信任模型
CN102640449A (zh) * 2009-11-06 2012-08-15 瑞典爱立信有限公司 用于web应用通信的系统和方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3370383A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110958247A (zh) * 2019-12-01 2020-04-03 成都华迈通信技术有限公司 一种网关设备数据传输系统及数据传输方法
CN110958247B (zh) * 2019-12-01 2022-11-04 成都华迈通信技术有限公司 一种网关设备数据传输系统及数据传输方法

Also Published As

Publication number Publication date
CN106656349A (zh) 2017-05-10
CN106656349B (zh) 2019-10-25
EP3370383A1 (en) 2018-09-05
US20180241576A1 (en) 2018-08-23
EP3370383B1 (en) 2021-12-29
EP3370383A4 (en) 2019-06-26
US10911247B2 (en) 2021-02-02

Similar Documents

Publication Publication Date Title
US20210367795A1 (en) Identity-Linked Authentication Through A User Certificate System
CN109040067B (zh) 一种基于物理不可克隆技术puf的用户认证设备及认证方法
US7836306B2 (en) Establishing secure mutual trust using an insecure password
KR101104486B1 (ko) 보안 향상을 위한 안전 네트워크 연결 방법
US20190173873A1 (en) Identity verification document request handling utilizing a user certificate system and user identity document repository
US8386647B2 (en) Method for time source calibration and system thereof
JP2019213239A (ja) 量子鍵配信、プライバシー増幅、およびデータ送信のための方法、装置、およびシステム
CN103167491B (zh) 一种基于软件数字证书的移动终端唯一性认证方法
CN111435913B (zh) 一种物联网终端的身份认证方法、装置和存储介质
EP2634957A1 (en) Authentication Device and System
CN107395367B (zh) 一种基于量子密钥的群签名系统
TWI809292B (zh) 資料的加解密方法、裝置、存儲介質及加密文件
RU2012132318A (ru) Способы, предназначенные для того, чтобы давать возможность безопасной самостоятельной инициализации абонентских устройств в системе связи
TWI797738B (zh) 資料獲取方法、裝置、設備和介質
WO2014019526A1 (zh) 可见光的加密方法、解密方法、通信装置及通信系统
US10277406B1 (en) Authentication process for issuing sequence of short-lived digital certificates
JP6438901B2 (ja) 認証システム、鍵処理連携方法、および、鍵処理連携プログラム
US20210328799A1 (en) Automated authentication of a new network element
US10911247B2 (en) Photon-based CA authentication method and system
KR20220058845A (ko) 원격 검증에 관한 하드웨어 인증 토큰
US20140223528A1 (en) Certificate installation and delivery process, four factor authentication, and applications utilizing same
US11343078B2 (en) System and method for secure input at a remote service
CN110855714B (zh) 一种多租户设备的安全连接方法和系统
TWI694346B (zh) 多元身分認證憑據之系統與方法
CN116318748A (zh) 一种基于验证回路的可信时间认证方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16858914

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2016858914

Country of ref document: EP