WO2017076202A1

WO2017076202A1 - Smart card, mobile terminal, and method for using smart card to implement network identity authentication

Info

Publication number: WO2017076202A1
Application number: PCT/CN2016/103345
Authority: WO
Inventors: 肖德银; 梁洁
Original assignee: 国民技术股份有限公司
Priority date: 2015-11-03
Filing date: 2016-10-26
Publication date: 2017-05-11
Also published as: TW201717080A; CN107111707A

Abstract

A smart card, a mobile terminal, and a method for using the smart card to implement network identity authentication. The smart card is provided with a wireless interface, comprising: a secure master control chip, personal network identity information being stored therein; and a radio frequency chip, for implementing wireless communication transmission by means of the wireless interface, such that an application program of the terminal acquires the personal network identity information stored in the secure master control chip by means of the radio frequency chip. Network identity authentication can be implemented by merely replacing a smart card written with network identity information; the present invention is convenient and quick, and has prospects for wide application.

Description

Smart card, mobile terminal and method for network identity authentication using smart card

Technical field

The present invention relates to network security technologies, and more particularly to a smart card, a mobile terminal, and a method for performing network identity authentication using a smart card.

Background technique

At present, the real-name system of the network adopts the means of verifying the identity card information. However, only by virtue of the validity of the identity card information to judge whether the party is true or not, there is no unique means of verification, this method has great defects:

First of all, the privacy of network users is not well protected. At present, the method of checking the ID card information requires the user to provide real ID card information, so that the network service provider has a large amount of user identity information, and the user privacy has the risk of leaking.

Second, the security of the account of the network user is not guaranteed. Due to the lack of unique verification methods for current ID card information verification methods, if a personal account is cracked by a criminal, it will result in the individual not being able to prove the ownership of the account. This is because the individual's unique information (for example, ID card) is easy. Obtained by others.

Again, the authenticity of network users is hard to prove. In network applications such as e-commerce, both parties to the transaction have the requirement to verify the identity of the other party, thereby effectively determining the authenticity and validity of the network identity. Users are required to provide real ID information or biometric information (eg, fingerprints, photos, irises, etc.), but such information has a copyable feature that will be illegally transmitted and exploited by others once intercepted on the network. This makes it impossible to judge the authenticity of these information holders. In addition, because the current identity card does not have the ability to cancel, there is also the possibility that multiple copies of the same person's identity card may be used simultaneously in society.

The existing network ID card solution is in the form of eID (Electronic Identity) + bank card. eID is a network electronic identity that is issued to citizens by the “Public Network Identification System of the Ministry of Public Security” based on the cryptographic technology and using the smart security chip as the carrier. It can identify the identity remotely without revealing the identity information. In this solution, the eID information is written into the bank card, and the merchant reads the network ID card information in the bank card through the NFC (Near Field Communication) mobile phone to perform identification.

However, the existing technical solution has the following disadvantages: the cooperation of the NFC-enabled mobile smart device is required to complete the identification; and when the mobile APP (application) is used for identification, the bank card needs to be carried with you.

In view of the fact that NFC mobile phones are not popular, the program cannot be well promoted.

Summary of the invention

The invention provides a system and method for network identity authentication, the system comprising a smart card and a mobile terminal equipped with a smart card to provide a safe, convenient and fast network identity card service.

According to an aspect of the invention, the present invention provides a smart card having a wireless interface, comprising:

a security master chip that stores personal network identity information;

a radio frequency chip that implements wireless channel transmission through the wireless interface, so that an application of the terminal obtains the personal network identity information stored in the security master chip through the radio frequency chip.

According to an embodiment of the invention, the smart card comprises an application layer, a COS API interface, a CIOS and a card IO hardware module.

According to an embodiment of the invention, the smart card is a SIM card, and the wireless interface is a Bluetooth interface.

According to an embodiment of the invention, the SIM card also has a telecommunications function.

According to an embodiment of the invention, the smart card is an SD card, and the wireless interface is a Bluetooth interface or a contact SD card interface.

The present invention also provides a mobile terminal that is equipped with the smart card described above.

In accordance with an embodiment of the present invention, an application is also installed that invokes the personal network identity information in the smart card for network identification and security services.

According to an embodiment of the present invention, which is further installed with a network identity card application, the network identity card application has obtained the personal network identity information in the smart card, and can provide the personal network for another application. Identity Information.

The present invention also provides a method for network identity authentication using the above smart card, the method comprising the following steps:

Activate the application;

The application invokes personal network identity information in the smart card and requests the network identity service provider to verify the identity of the user;

The network identity service provider uses the network ID card identifier provided by the network ID card issuing authority to verify the user's network identity;

After the verification is passed, the application obtains a corresponding user network identity application identification code;

Thereby, the network identity authentication is completed.

According to an embodiment of the present invention, when the application is not installed in the same terminal as the smart card, the verification of the user identity may be completed by using a two-dimensional code login method, and the steps are as follows:

Logging in to the application, the application generates a two-dimensional code in real time;

Scanning the two-dimensional code using a network ID application;

Confirming login to the application in the network ID application;

The network identity card application is installed on the mobile terminal, is capable of scanning the two-dimensional code, and has obtained personal network identity information in the smart card.

By writing personal unique information (ie, personal network identity information) approved by the Ministry of Public Security into the smart card and the smart terminal obtains personal network identity information through the wireless interface of the smart card, NFC mobile phone support is not required, and no additional processing is required. A bank card that writes network identity information, and only a smart card that writes network identity information can implement network identity authentication, thereby providing a safe and convenient network identity management method.

DRAWINGS

1 is a hardware block diagram of a Bluetooth SIM card in accordance with an embodiment of the present invention.

2 is a software block diagram of a Bluetooth SIM card in accordance with an embodiment of the present invention.

3 is a block diagram of an implementation system of a network identity card in accordance with an embodiment of the present invention.

4 is a flow chart of a method of implementing a network identity card in accordance with an embodiment of the present invention.

detailed description

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First of all, it should be noted that the wireless interface mentioned in the present invention may be a Bluetooth interface, or may be other applicable wireless interfaces. In addition, the smart card mentioned in the present invention may be a SIM (Subscriber Identity Module) card or an SD (Secure Digital Memory) card. The SIM card and SD card have the same software architecture and hardware architecture, but the SD card's contact interface is an SD card interface (operating in SD card mode and SPI (Serial Peripheral Interface) mode), and SIM The card has a wireless interface (such as a Bluetooth interface).

FIG. 1 shows a hardware block diagram of a smart card of the present invention by taking a Bluetooth SIM card and a mobile phone terminal as an example. As described above, in the case of using an SD card, other wireless interface, or other smart device, there is a hardware framework similar to that of FIG.

As shown in FIG. 1 , the Bluetooth SIM card includes a security main control chip and a radio frequency chip, wherein the personal network identity information is stored in the security main control chip, which can ensure the secure storage of the identity information, and the radio frequency chip can implement the Bluetooth channel transmission. When the Bluetooth SIM card is installed in the mobile phone, the mobile APP can access the personal network identity information stored in the SIM card through the Bluetooth channel.

FIG. 2 shows a software block diagram of the smart card of the present invention by taking a Bluetooth SIM card and a mobile phone terminal as an example. Also, in the case of an SD card, other wireless interface, or other smart device, there is a software framework similar to that of FIG.

As shown in Figure 2, in the Bluetooth SIM card, CIOS (Card IO Management System) is responsible for ISO7816. Management of the (standard protocol) and Bluetooth interface, in addition to the API interface of the COS (Card Operating System) application. In addition, a COS space is reserved in the chip, so that the user can perform extended application development, which may be a traditional telecommunication application or other extended applications.

It can be seen that the user can implement the identity authentication of the mobile APP on the smart phone only by processing a Bluetooth SIM card with personal network identity information.

In addition, for the SD card, the network ID information in the card can be accessed not only through the Bluetooth interface but also through the contact SD card interface. For the terminal to perform network identity authentication, the SD card has a contact interface to access the network identity information, for example, the notebook has an SD card slot, so that the SD card can be directly put into the card slot, and the network ID card is read by the network ID assistant. Information for identity authentication login. Therefore, the authentication of the network ID card can be implemented for the device having the SD card interface. In addition, the network identity information in the SD card can also be accessed through the Bluetooth interface on a device that does not have an SD card interface.

The implementation system of the practice of the present invention is described in detail below. 3 is a system for implementing a network identity card in accordance with an embodiment of the present invention, wherein the present invention implements a network identity card carrier portion.

As shown in Figure 3, the network ID card issuing institution is connected to the official population system (such as the Ministry of Public Security) to assume the responsibility for the issuance and management of the network ID card, which is managed and controlled by the Ministry of Public Security.

The network ID card registration and distribution institution undertakes the registration and issuance functions of the network ID card. For example, the network ID registration and issuer is the issuer of China Mobile, China Unicom, China Telecom, etc. The network identity registration issuing institution may provide a carrier (ie, a smart card such as a SIM card or an SD card) that loads a network ID card for use in the issuance of a network identity card.

The network identity service provider connects to the network ID issuing authority and accesses the service organization of the network application, and undertakes the basic service for identifying the network ID card and related security value-added services.

Online applications are widely used network services and are applications that require network identification and security services.

The network ID issuing authority needs to go through the following process to issue a network ID card to the user (natural person): first, the user needs to provide a personal ID card to the network identity registration and issuing institution; then the network identity registration and issuing institution verifies the network ID card issuing institution; The ID issuing institution generates a network ID card uniquely representing the user according to the personal identification information provided by the user. Don't code and inform the network identity registration and issuing institution; finally, the network ID card registration and issuing institution verifies the issued network ID card identification code according to the user's identity information, and writes the network ID card identification code into the carrier (ie, SIM card, SD card, etc.) ) issued to the user.

In addition, after the network ID card issuing institution generates the user's network ID card identification code or after the user re-registers the network identity, the network ID card issuing institution needs to synchronously update the generated network identity to the network identity service provider. Certificate ID.

When the user uses the online application party that needs to be authenticated, the application first calls the terminal device (eg, mobile phone, laptop, etc.) to obtain the network identity information (ie, the network ID card) stored in the smart card, and then connects. Go to the network identity service provider to request verification to verify the authenticity and validity of the user's network identity. The network identity service provider authenticates the user's network identity by using the network identity code provided by the network identity issuing authority. Once the user's network identity is verified, the application will get a user network identity application identifier corresponding to the application. Therefore, although the user has a unique network ID number, only different network identity application identification codes can be obtained in different applications, thereby avoiding the behavior data of users in different network applications being aggregated, analyzed and tracked, to the greatest extent. Protect personal identity and privacy information.

A method of implementing the network identity card of the present invention will be described below with reference to FIG.

As shown in FIG. 4, the method for implementing the network ID card of the present invention includes the following steps: the user applies for a smart card to the network identity registration and issue authority; the network identity card issuing authority verifies the identity of the user and generates a network ID card identification code; and the network identity registration and issuer Deliver a network ID to the user; and the user binds the account in the application to the network ID.

Specifically, the process of generating and distributing a network ID card is as follows:

1) The user applies a valid ID card to the business hall of the network identity registration and distribution institution (telecom operators, such as China Mobile, China Unicom, China Telecom) to apply for a SIM card with a network ID function (also an SD card);

2) The staff of the business hall shall verify the identity of the user in accordance with the requirements of the official (such as the Public Security Bureau), and then submit the user identity information to the network ID issuing agency;

3) The network ID card issuing agency further submits the user identity information to the public security population database. Check to ensure the accuracy of identity information;

4) After the verification is passed, the network ID issuing agency generates a network identification code for the user, and then sends it to the business hall;

5) The business hall writes the network identification code to the SIM card applied by the user;

6) The user sets a personal identification number (Personal Identification Number);

7) The business hall staff will give the SIM card (or SD card) to the user.

After the user obtains the SIM card (or SD card), the network ID card needs to be bound to the account in the service application. After binding, the network ID card can be protected against the account. The basic process of binding is as follows:

1) The user opens his own app (application) and logs in with his or her original account;

2) Select “Network ID Authentication” for authentication on the “Authentication” interface;

3) The APP reads the network identity information in the SIM card (or SD card) and connects to the network identity service provider for online authentication;

4) After the authentication is successful, the APP completes the binding of the user account to the current network ID card.

In addition, the user can also select the network ID login when logging in to the APP, including the following steps: the user inputs the network ID PIN code; the APP and the network identity service provider automatically interact to complete the verification of the user identity; the network identity service provider will authenticate The result is notified to the APP; if authenticated, the user successfully logs in to the application.

In addition, for a PC (personal computer) application, a two-dimensional code can be used for registration, which specifically includes: when the user logs in to the Internet application, the application generates a QR code in real time; and the user uses the network ID application of the mobile terminal (may be A network ID assistant scans the QR code; confirms the login to the Internet application on the phone. Therefore, an application of a terminal other than the mobile terminal (such as a PC, etc.) can also use a network ID card.

In addition, if the Internet application cannot read the network identity information in the SIM card, the network identity assistant (APP provided by the issuing organization) can be called to perform the network authentication. The authentication process for identity.

For APPs that require personally identifiable information (such as the eID version), users no longer need to enter ID information to register, but simply bind the APP to the network ID and enter the PIN to log in.

In addition, in addition to the mobile terminal and the PC mentioned above, network identity authentication can also be implemented for a device that does not have a SIM card interface, as long as the device accesses the network identity information in the SIM card through the Bluetooth interface.

Those skilled in the art should understand that the technical solution of the present invention relates to an implementation framework of a network ID card, and how the network ID card issuing institution generates a network identity code according to the personal ID card information, and how the network identity service provider has personal identity information. It is not the invention of the present invention to perform verification, how the network identity card issuing authority performs synchronous update with the network identity service provider, and the like, and these processes may employ any suitable technique known in the art, and therefore, in order to avoid redundancy, This article does not describe in detail.

Those skilled in the art should understand that the SIM card and the SD card disclosed in the present invention may be a Micro card, a Nano card, or the like, but are not limited thereto. In addition, the SIM can also have basic telecommunications functions.

As described above, the network ID card implemented by the present invention does not require NFC mobile phone support, and does not need to additionally process a bank card for writing network identity information, and only needs to replace a smart card written with network identity information to implement the network. Authentication.

In addition, those skilled in the art should understand that the present invention can also download, install, and delete applications on a smart card through a wireless interface (such as a Bluetooth interface), so that various applications (such as various bank cards, cards, etc.) can be loaded. It makes identity authentication more convenient and faster, and has broad application prospects.

It should be noted that the various embodiments described above with reference to the accompanying drawings are only to illustrate the invention and not to limit the scope of the invention, and those of ordinary skill in the art should understand that without departing from the spirit and scope of the invention Modifications or equivalents to the invention are intended to be included within the scope of the invention. In addition, unless the context indicates otherwise, words in the singular include plural and vice versa. In addition, all or any of the embodiments are unless otherwise stated A portion may be used in conjunction with all or a portion of any other embodiment.

Claims

A smart card, wherein the smart card has a wireless interface, including:

a security master chip that stores personal network identity information;

a radio frequency chip that implements wireless channel transmission through the wireless interface, so that an application of the terminal obtains the personal network identity information stored in the security master chip through the radio frequency chip.
The smart card according to claim 1, wherein the smart card comprises an application layer, a COS API interface, a CIOS, and a card IO hardware module.
The smart card according to claim 1, wherein the smart card is a SIM card, and the wireless interface is a Bluetooth interface.
The smart card of claim 3 wherein said SIM card further has a telecommunications function.
The smart card according to claim 1, wherein the smart card is an SD card, and the wireless interface is a Bluetooth interface or a contact SD card interface.
A mobile terminal, characterized in that it is equipped with the smart card according to any one of claims 1-5.
The mobile terminal according to claim 6, further comprising an application program, wherein the application program invokes the personal network identity information in the smart card to perform network identity recognition and security services.
The mobile terminal according to claim 6, further comprising a network identity card application, wherein the network identity card application has obtained the personal network identity information in the smart card, and can be another application The program provides the personal network identity information.
A method for performing network identity authentication using the smart card according to any one of claims 1 to 5, characterized in that the method comprises the following steps:

Activate the application;

The application invokes personal network identity information in the smart card and requests the network identity service provider to verify the identity of the user;

The network identity service provider uses the network ID card identifier provided by the network ID card issuing authority to verify the user's network identity;

After the verification is passed, the application obtains a corresponding user network identity application identification code.
The method according to claim 9, wherein the application and the smart card are not installed in the same terminal, and the user identity verification can be completed by using a two-dimensional code login method, and the steps are as follows:

Logging in to the application, the application generates a two-dimensional code in real time;

Scanning the two-dimensional code using a network ID application;

Confirming login to the application in the network ID application;

The network identity card application is installed on the mobile terminal, is capable of scanning the two-dimensional code, and has obtained personal network identity information in the smart card.