WO2017197974A1 - Biometric characteristic-based security authentication method, device and electronic equipment - Google Patents

Abstract

Disclosed in the present invention are a biometric characteristic-based security authentication method, device and electronic equipment, said method comprising: a terminal obtaining a first biometric characteristic according to a received biometric authentication request; the terminal matching said first biometric characteristic to a pre-set second biometric characteristic, generating a match result; the terminal using a private key of the security credentials of the terminal to encrypt the match result and obtain first ciphertext data, said security credentials uniquely corresponding to said terminal; the terminal sending to an authenticator the first ciphertext data and public key credentials of the security credentials, said authenticator being a server or the terminal. The present invention is used to solve the problem of security risks in current identity authentication.

Description

Biometric-based safety authentication method, device and electronic device

This application claims the priority of the Chinese patent application filed on May 20, 2016, the Intellectual Property Office of the People's Republic of China, the application number is 201610343447.8, and the invention name is "a biometric-based security authentication method and device". This is incorporated herein by reference.

Technical field

The present invention relates to the field of electronic communications, and in particular, to a biometric-based security authentication method, apparatus, and electronic device.

Background technique

With the continuous development and utilization of smart terminals such as smart phones, tablets, smart TVs, etc., people use smart terminal devices to conduct transactions and obtain services more and more, but inevitably involve the issue of identity authentication. For example, in the process of conducting an online transaction, the user needs to submit the payment information of the user to the server to implement the payment function. For example, when the user obtains a certain service on the Internet, the user account information needs to be submitted to the server to implement the login. And service acquisition.

The specific process of identity authentication uses the existing fingerprint authentication technology as an example: when the user needs to perform authentication, the client first collects the user fingerprint through the fingerprint sensor, and then extracts the fingerprint feature code and the fingerprint feature saved in the fingerprint database. Identifying samples for feature matching. The comparison process has two modes: one is to match locally on the device, and then the comparison result is uploaded to the server; the other is to upload the fingerprint feature to the server and perform on the server. match. Finally, if the match is successful, the certificate passes. Because the existing fingerprint authentication technology does not define the security of the underlying implementation of the device and the transmission process, it may cause the matching result to be stolen or tampered by the attacker such as third-party malware on the device, or attacked by the attacker during the transmission process. Stealing or tampering, once falsified, a transaction that should have been cancelled due to the failure of the authentication, but the transaction succeeded because of the authentication, so the user's account security has great security risks.

Considering the high security requirements of the financial field for payment transactions, the current identity authentication technology still has a large security risk. Therefore, an improved identity authentication method is needed to avoid existing security vulnerabilities.

Summary of the invention

The embodiments of the present invention provide a biometric-based security authentication method, device, and electronic device, which are used to solve the problem of existing security risks in identity authentication.

In a first aspect, an embodiment of the present invention provides a biometric-based security authentication method, the method comprising: acquiring, by a terminal, a first biometric according to a received biometric authentication request; the terminal, the first biometric and pre And the second biometric feature is matched to generate a matching result; the terminal encrypts the matching result by using a private key of the security certificate of the terminal to obtain first ciphertext data, where the security certificate uniquely corresponds to the terminal;

The terminal sends the first ciphertext data and the public key certificate of the security certificate to the authentication end, where the authentication end is a server or the terminal.

In a second aspect, an embodiment of the present invention further provides a biometric-based security authentication apparatus, the apparatus comprising: a transceiver unit, configured to receive a biometric authentication request; a sensor, configured to acquire a first biometric; and a matching unit, And matching the first biometric with a preset second biometric to generate a matching result;

a signature unit, configured to encrypt, by using a private key of the security certificate of the terminal, the first ciphertext data, where the security certificate uniquely corresponds to the terminal;

The transceiver unit is further configured to send the first ciphertext data and the public key certificate of the security certificate to the authentication end, where the authentication end is a server or the terminal.

In a third aspect, an embodiment of the present invention provides an electronic device, including:

At least one processor; and,

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor, the instructions being The at least one processor executes to enable the at least one processor to perform the biometric-based secure authentication method provided by any of the embodiments of the present application described above.

In a fourth aspect, an embodiment of the present invention provides a non-transitory computer readable storage medium, where the non-transitory computer readable storage medium stores computer instructions, where the computer instructions are used to cause the computer to execute any of the above The biometric-based security authentication method described.

In a fifth aspect, an embodiment of the present invention provides a computer program product, the computer program product comprising a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instruction is The computer, when executed, causes the computer to perform the biometric-based secure authentication method of any of the above.

The embodiment of the present invention obtains an authentication request for a biometric sent by a server, acquires a first authentication information set according to the authentication request, and matches the first authentication information set with a second authentication information set in the secure storage area. The first authentication information set includes at least the collected first biometric feature, and the second authentication information set includes at least a preset second biometric feature; on the other hand, the matching public key is used to encrypt the matching result, and The signed matching result is sent to the server, so that the server generates the authentication result according to the matching result after the verification. It can be seen that by the signature protection of the matching result, the matching result can be ensured that the matching result is not stolen or tampered by the attacker during the transmission process, thereby obtaining the correct authentication result and ensuring the security of the user account.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying for inventive labor.

FIG. 1 is a schematic flowchart of a biometric-based security authentication method according to an embodiment of the present invention;

2 is a schematic diagram of a security certificate distribution architecture according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a biometric-based security authentication system according to an embodiment of the present invention; FIG.

4 is a schematic flowchart of a method for online security authentication based on biometrics according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a method for offline security authentication based on biometrics according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a decryption process of an authentication end according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of a method for opening and binding a biometric-based pattern authentication according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a security authentication process for a fingerprint authentication alternative password based on biometrics according to an embodiment of the present invention; FIG.

FIG. 9 is a schematic diagram of a biometric-based security authentication apparatus according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of hardware of an electronic device according to an embodiment of the present invention.

detailed description

The present invention will be further described in detail with reference to the accompanying drawings, in which . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The present invention will be further described in detail with reference to the accompanying drawings, in which . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The terminal involved in the present invention may include a handheld device having a biometric authentication function, an in-vehicle device, a wearable device, a computing device, or other processing device connected to the wireless modem, and various forms of user equipment (User Equipment, UE for short) ), a mobile station (MS), a terminal, a terminal equipment, and the like. For convenience Description, the present invention is simply referred to as a terminal. Among them, the so-called biometrics refer to features such as fingerprints, irises, faces, and voice prints.

Embodiment 1

As shown in FIG. 1 , an embodiment of the present invention provides a schematic diagram of a biometric-based security authentication method.

Step S101: The terminal acquires the first biometric according to the received biometric authentication request.

Step S102: The terminal matches the first biometric with a preset second biometric to generate a matching result.

Step S103: The terminal encrypts the matching result by using a private key of the security certificate of the terminal to obtain first ciphertext data, where the security certificate uniquely corresponds to the terminal.

Step S104: The terminal sends the first ciphertext data and the public key certificate of the security certificate to the authentication end, where the authentication end is a server or the terminal.

The biometric to be authenticated included in the biometric authentication request is a feature such as a fingerprint, an iris, a voiceprint, or a face. Therefore, when the terminal receives the authentication request, the terminal sends a prompt information about the biometric collection to the user, and the user inputs After the biometric, the sensor collects the corresponding biometrics. Of course, the sensor can be integrated inside the terminal, or can be connected as a separate module to the terminal. The following content is further discussed in the context of the sensor inside the terminal.

In the embodiment of the present invention, the matching result is encrypted. The specific method is to digitally sign the matching result by using the security certificate of each terminal, where the security certificate of the terminal is It is distributed by the certificate system according to the setting rules. For example, as shown in FIG. 2, the certificate authority (CA) authorizes the fingerprint service certificate registration system (RA), and the RA issues a certificate to the terminal manufacturer. The terminal manufacturer is responsible for issuing and managing the terminal's public key certificate, and the RA is no longer involved in the issuance. Of course, if the terminal manufacturer does not have the capability of certificate management, the RA may replace the security certificate of the terminal for each terminal by means of a virtual manufacturer. In addition, the terminal manufacturer's public key certificate for the terminal issuing terminal may include three types in the figure: a matching unit certificate, a signature unit certificate, and a sensor certificate. Among them: the signature unit certificate is required, its role is to verify Subsequent verification of the matching result is true and the matching result is signed and sent to the authentication end; and the matching unit certificate and the sensor certificate are optional, and the main purpose is to establish the first secure channel and the second secure channel to ensure secure communication. Of course, other authentication methods that are not lower than the TLS2.0 security level can be adopted instead.

When the terminal has the security certificate issued by the certificate system, the first secure channel and the second secure channel are pre-established by using the matching unit certificate and the sensor certificate, and further, the terminal passes the first biometric collected by the sensor through the first secure channel. a matching unit sent to the terminal;

The matching unit matches the first biometric with the preset second biometric, generates a matching result, and sends the matching result to the signature unit of the terminal through the second secure channel, the matching unit Storing the second biometric in the middle;

The signature unit uses a hash function to generate a digest of the matching result by using the hash function, and then encrypts the digest using the security certificate of the terminal to obtain signature data, where the signature unit stores the terminal. Security certificate.

It can be seen that the sensor is used for collecting biometrics; the matching unit is configured to match the collected biometrics with the pre-stored biometrics to generate a matching result; the signature unit is used for digitally signing the matching result, and the matching unit and the signature unit are integrated. In the internal unit of the terminal, the purpose of adding a secure channel is to ensure that the transmission of biometrics such as fingerprints, or the matching success or the matching result of the failure are transmitted in the secure channel, ensuring that such sensitive data will not be transmitted during the transmission. Stealing or tampering to ensure communication security.

The first secure channel and the second secure channel are established when the terminal is started, and the sensor and the matching unit complete one-way or two-way identity authentication and session key exchange by using a handshake protocol, thereby establishing the first secure channel. ;

The matching unit and the signature unit complete one-way or two-way identity authentication and session key exchange through a handshake protocol, thereby establishing the second secure channel.

Specifically, the establishment protocol of the secure channel is composed of a handshake protocol and a recording protocol. The handshake protocol is used to complete the two-way identity authentication and the session key exchange process between the matching unit and the signature unit, and is also used to complete the two-way identity authentication and session key exchange between the matching unit and the sensor. process. The recording protocol is used to complete the encrypted transmission of application data. In addition, the establishment protocol of the secure channel complies with the requirements of the TLS 1.2 and above specifications, or adopts other authentication methods that are not lower than the TLS1.2 security level.

The purpose of this is to limit the terminal to use the signature unit to perform fingerprint signature verification, as well as to ensure the secure input and encryption processing of sensitive information such as the user identification code (PIN), and to support the sensor to encrypt and transmit the collected fingerprint data, and support the fingerprint template. The data is bound to the terminal and encrypted for storage. A terminal with biometric authentication can securely store keys, prohibit external direct access to keys, and prevent keys from being illegally injected, replaced, and used through effective security mechanisms, and ensure signature units and matching for secure authentication. The unit is not illegally attacked.

Because the authentication end can be either the server or the terminal itself, there are two scenarios: online authentication and offline authentication. When online authentication, the authentication end can be the server corresponding to the application APP; when offline authentication, the authentication end It can be an application APP inside the terminal, and the biometric authentication is an example of fingerprint authentication. FIG. 3 exemplarily shows an authentication system corresponding to online authentication and offline authentication, wherein the system includes: a fingerprint sensor and a fingerprint matching. Unit, fingerprint signature unit, terminal transceiver unit, application APP, application server, certificate authority, specifically:

The fingerprint sensor is responsible for fingerprint collection, and encrypts and transmits the collected fingerprint template information to the fingerprint service; the fingerprint matching unit is responsible for basic application functions such as fingerprint template information encryption storage, fingerprint operation, fingerprint comparison, etc.; the fingerprint signature unit is provided as a device security basis. The security authentication service is responsible for digitally signing key data such as the fingerprint comparison result; the terminal transceiver unit encapsulates the interface call related to the fingerprint authentication, and provides a unified interface for the upper layer application to call the underlying function; the application APP, such as the payment gateway of the PC end The APP of the page or the mobile terminal mainly provides a user interaction interface, and calls the fingerprint function of the device by calling the application interface of the fingerprint service. And the application APP can perform offline verification on the signed first ciphertext data, and authenticate the legality of the transaction and the user identity; the application server, for example, the payment application background business system, is responsible for the initiation and response of the payment request. Pre-storing sensitive data such as user bank account, terminal identification and binding relationship, and performing online verification on the signed first data, and authenticating the legality of the transaction and the user identity.

Based on the system architecture shown in FIG. 3, as shown in FIG. 4, an embodiment of the present invention provides an online connection. In the authentication scenario, the online authentication scenario, that is, the terminal networking, performs biometric authentication through the background service system server, taking fingerprint authentication as an example. The method is applicable to an online payment scenario, and accesses the Internet through communication of the terminal. The processing and interaction process of each unit in the system is as follows:

Step S201, the terminal starts the initialization work, that is, establishes the first secure channel and the second secure channel, that is, establishes a second secure channel between the signature list and the matching unit, and establishes a first secure channel between the matching unit and the sensor;

Step S202, when the user needs fingerprint authentication for the order transaction, the application corresponding to the transaction issues an authentication request;

Step S203, the sensor collects fingerprint information, and returns the fingerprint information to the matching unit through the first secure channel;

Step S204, the matching unit performs operations such as fingerprint comparison and fingerprint storage to obtain a result of fingerprint matching;

Step S205: The matching unit sends the result to the signature unit through the second secure channel, requests the signature unit to perform signature, and the signature unit signs the fingerprint matching result.

Step S206, the signature unit will send the first ciphertext data to the application;

Step S207, the application APP sends the first ciphertext data of the terminal to the background server of the application APP for verification;

Step S208: The background server of the application APP verifies the first ciphertext data to confirm whether the matching result is trusted.

Step S209, the background server of the application APP returns the authentication result to the application, and the application continues the subsequent transaction step according to the authentication result.

Of course, before performing security authentication, the identity authentication needs to be performed first, that is, the user pre-stores the fingerprint template in the terminal, and then operates the application APP to determine the “biometric type”, and if it is “fingerprint authentication”, it continues; the “security level” is determined. , to verify whether the financial application requirements (level 2 or 3) are met, and if so, continue; determine the "background business random factor", and verify whether it is consistent with the stored one. If yes, continue; if all the steps are successful, the authentication is passed, and the card number, device, and fingerprint are bound and stored in the background, and the activation is successful.

In addition, as shown in FIG. 5, the embodiment of the present invention provides a security authentication method in an offline authentication scenario, where offline authentication, that is, when the terminal is not in a network state, performs fingerprint authentication through the terminal's own application program. Applicable to the offline payment scenario, the non-contact near field communication of the terminal interacts with the POS terminal, and the processing and interaction process of each unit is as follows:

Steps S301 to S306 are the same as steps S201 to S206 of the online authentication, and are not described again.

Step S307, the application directly verifies the first ciphertext data to confirm whether the matching result is trusted, and performs subsequent operations according to the matching result.

In order to further ensure the reliability of the security authentication, the matching unit and the signature unit operate in a secure operating environment, wherein the secure operating environment comprises a trusted execution environment TEE or a security chip, wherein the secure operating environment There are security levels set to meet different transaction permissions. When the matching unit is in the TEE and the signature unit is in the security chip, the security level belongs to a higher level, meaning that the corresponding service range is a large transaction; when the comparison unit and the signature unit are both in the TEE, the security level belongs to The lower level means that the corresponding business scope is a small transaction.

Further, the terminal matches the first biometric with the preset second biometric to generate a matching result, and further includes:

Obtaining a right of the matched second biometric if the first biometric is matched with the preset second biometric; and generating whether the right to be authenticated and the second biometric corresponding to the authentication request match the result of.

For example, the mobile phone terminal internally stores a plurality of fingerprints, wherein only one fingerprint has the right to pay, and when the software is implemented, a set identifier is added for the fingerprint with the payment authority, so that when the fingerprint matching is completed, again Determine whether the fingerprint has the right to pay, that is, determine whether the fingerprint has a set identifier, and if so, continue with the following steps; otherwise, the prompt does not have permission, the transaction is terminated, or a mobile phone terminal internally stores a user Multiple fingerprints, each fingerprint is used differently, because in the software implementation, the corresponding permissions are set for the user's fingerprint, that is, an array is added, and each different enumeration value in the array represents the permissions of different fingerprints. After receiving the to-be-authenticated service corresponding to the authentication request, analyzing the enumeration value corresponding to the service, and then, when the fingerprint matching is completed, analyzing whether the enumeration value corresponding to the fingerprint is consistent with the enumeration value corresponding to the service, And determining whether the fingerprint has the right to handle the business, this can effectively avoid misoperations, such as children in the family members often use the parent's mobile phone, there is a risk of mis-transaction, so you can set for each fingerprint at this time Trading permissions, of course, can also be other permissions, such as login permissions.

Further, the private key of the security certificate of the terminal includes a private key of the terminal, and a public key certificate of the security certificate of the terminal includes a public key certificate of the terminal, and a public key certificate of the terminal manufacturer, where The public key certificate of the terminal is obtained by signing the public key of the terminal by using a private key of the terminal manufacturer, and the public key certificate of the terminal manufacturer is to sign the terminal manufacturer by using a private key of the authentication platform. The public key is obtained.

As shown in FIG. 6, in the signature authentication process, the server or application of the application APP verifies the public key certificate of the terminal using the public key verification technology, and verifies the first ciphertext data. The specific steps for the verification are as follows:

Step 1: Retrieve the CA root public key: the background determines which CA root public key to use according to the authority key identifier in the vendor public key certificate;

Step 2: Obtain the terminal manufacturer public key: use the CA root public key to verify the terminal manufacturer public key certificate in the background, and if the verification is correct, take out the terminal manufacturer public key in the certificate;

Step 3: Obtain a signature unit public key: the background manufacturer public key is used to verify the signature unit public key certificate in the background, and if the verification is correct, the signature unit public key in the certificate is retrieved;

Step 4: Verify the key data of the signature: the first ciphertext data of the signature is verified by the background using the signature unit public key.

Step 5. If all the steps are successful, the signature verification is passed.

The signature unit needs to digitally sign the fingerprint matching result provided by the matching unit, that is, first use the hash function to generate a summary of the key data, and then use the private key of the signature unit to encrypt the digest to generate a digital signature; the matching unit will sign The data is sent to the background together with the public key certificate; the backend service platform (online authentication mode) or the application (offline authentication mode) uses the public key technology to verify the legality of the signature data, thereby ensuring the signed first ciphertext The data is created by the signature unit on the terminal, that is, the signature unit cannot deny that the message was created, and the data has not been tampered with by the third party during the transmission.

Further, the terminal sends the public key certificate of the security certificate to the authentication end; after receiving the device authentication sent by the authentication end, the terminal sends the first ciphertext data to the authentication. end.

After the sending the first ciphertext data to the authentication end, the method includes:

The authentication end parses the ciphertext data in the following manner:

The authentication end obtains the public key of the terminal manufacturer according to the public key certificate of the terminal manufacturer and the public key of the pre-stored authentication platform;

The authentication end obtains the public key of the terminal according to the public key of the terminal manufacturer and the public key certificate of the terminal;

And if the authentication end obtains the public key of the terminal, determining that the device authentication of the terminal passes, and verifying the first ciphertext data by using the public key of the terminal, to obtain the matching result.

As shown in FIG. 6, the authentication end obtains the public key P _{MF of} the terminal manufacturer according to the public key certificate of the terminal manufacturer and the public key of the pre-stored authentication platform by using a public key verification technology, and then according to the terminal. The public key of the manufacturer and the public key certificate of the terminal obtain the public key P _{D of} the terminal, and when the public key of the terminal is obtained, the terminal can be regarded as a legal terminal, and the first ciphertext is further used by the public key of the terminal. The data is decrypted to obtain the matching result after decryption. If the matching is successful, the authentication end can follow the transaction step, otherwise the authentication end can prompt the transaction to fail and terminate the transaction.

Further, the terminal encrypts the key information by using the private key of the security certificate of the terminal to obtain second ciphertext data; the terminal sends the second ciphertext data to the authentication end. The key information includes at least one of a terminal identifier and a bank card account.

It should be noted that, in the foregoing step, the terminal uses the private key of the security certificate of the terminal to encrypt the key information, and the step S103 encrypts the matching result to obtain the first ciphertext data, and there is no strict execution order. That is to say, the two can be executed at the same time, that is, the matching result and the key information are encrypted together as a whole, and the ciphertext data obtained after the encryption is sent to the authentication end together, of course, step S103 may be performed first, and then the key information is encrypted. Or, the key information is encrypted first, and then step S103 is performed, and the specific execution sequence is determined according to actual needs.

Further, after the terminal sends the second ciphertext data to the authentication end, the terminal includes:

The authentication end parses the ciphertext data in the following manner:

The authentication end obtains the public key of the terminal manufacturer according to the public key certificate of the terminal manufacturer and the public key of the pre-stored authentication platform, according to the public key of the terminal manufacturer and the public key of the terminal The certificate obtains the public key of the terminal, and if the authentication end obtains the public key of the terminal, it determines that the device authentication of the terminal passes;

Verifying the first ciphertext data by using the public key of the terminal to obtain the matching result;

If the matching result is that the matching is successful, verifying the second ciphertext data by using the public key of the terminal to obtain the key information;

Determining whether the key information meets a preset authentication rule, and generating a biometric authentication result is sent to the terminal.

For example, the key information is the terminal identifier and the bank card account, and the private key of the terminal security certificate encrypts the terminal identifier and the bank card account to obtain the second ciphertext data, and then sends the second ciphertext data together with the first ciphertext data to the application. The server of the APP, after decrypting the first ciphertext data and the second ciphertext data by the application APP server, further determines whether the decrypted second ciphertext data is consistent with the pre-stored terminal identifier and the bank card account number, and if found to be inconsistent, the same is determined. The transaction is illegal and the transaction is considered to be unsuccessful. The reason for this is that the terminal's transaction is limited by the binding relationship between the terminal identifier and the bank account, because the binding relationship is a common transaction of the user, and if it is from another terminal, There may be a leakage of sensitive information of the user, which causes the illegal molecule to illegally use the sensitive data transaction at the remaining terminals, so it is further defined by the binding relationship.

In order to describe the above process of security authentication more systematically, the embodiment of the present invention still takes the fingerprint as an example, and elaborates the process through the interaction process shown in FIG. 7 and FIG. 8, wherein FIG. 7 illustrates the opening and binding of the fingerprint authentication. The process, the specific steps are as follows:

In step S401, the application invokes the interface to obtain key information of the terminal, including: the terminal identifier, the user name, whether the terminal supports the fingerprint authentication function, whether the terminal opens the fingerprint, whether the terminal has entered the fingerprint, and the security level of the terminal.

Step S402, the application passes the acquired terminal key information to the server of the application.

Step S403, the server of the application determines whether the opening condition is met, including: terminal support The fingerprint service, the device meets the security level, the current card/user support opens the fingerprint payment, and the current card/user does not open the fingerprint function on the terminal (ie, there is no corresponding binding relationship). If yes, proceed to the next step;

Step S404, the server of the application initiates a boot request;

Step S405, the application guides the user to open the fingerprint authentication. For example, after the user completes a transaction and determines that the device has the condition for opening the fingerprint authentication, the user may prompt the user to open the fingerprint authentication on the transaction success page;

Step S406, after the user selects to open the fingerprint payment and agrees to the agreement, if the terminal has not entered the fingerprint, the user is prompted to go to the system setting to enter the fingerprint, or directly jump to the system setting for input; if entered, the application will user information/card number Provided to the background (the card number can be automatically obtained according to the currently completed transaction, otherwise the cardholder is required to input);

Step S407, the background generates a service random factor, such as: a random number, a timestamp, and is saved in the database;

Step S408, the background initiates a fingerprint authentication request, where the request includes a service random factor;

Step S409, the application displays a fingerprint verification interface;

Step S410, the application calls the fingerprint service interface to perform fingerprint input and verification, and the interface parameter includes a service random factor;

In step S411, the fingerprint service verifies the fingerprint input by the user, that is, whether it matches the fingerprint that has been entered on the terminal. If the system does not enter the fingerprint, you can also jump to the system fingerprint entry interface, and then return and verify after the entry is successful (depending on whether the system provides this function and user experience evaluation);

Step S412, the fingerprint service returns key data such as the fingerprint verification result and the signature and certificate: if the verification fails, the application prompts the user to retry the fingerprint verification function, or cancels; if the verification is successful, the next step is continued;

Step S413, the application sends the returned data and the user information/card number to the background;

Step S414, the background verification is successful whether the signature data of the fingerprint verification result is correct. If the verification is successful, the data item is extracted and the identity legality is verified, including: determining whether the fingerprint verification result is successful, and the biological Whether the identification type is correct, whether the security level meets the requirements, whether the service random factor is consistent with the background storage, and the like. If the verification and certification are successful, the next step;

Step S415, binding the user information/card number with the fingerprint ID, the user ID, and the terminal identifier, and storing them in the background;

In step S416, the user is prompted to successfully open the fingerprint authentication and bind.

Further, after the server completes the fingerprint opening process, FIG. 8 shows a security authentication process of the fingerprint authentication replacement password, and the specific steps are as follows:

Step S501, the user operates the application, and initiates an order payment request in the application;

Step S502: The application invokes the interface of the fingerprint service to obtain the key information of the terminal, including: the terminal identifier, the user ID, whether the terminal supports the fingerprint (that is, whether the device has the fingerprint sensor), whether the terminal has the fingerprint enabled, whether the device has entered the fingerprint, and the security of the device. grade.

In step S503, the application passes the returned terminal key information to the application server.

Step S504: The server of the application determines, according to the key information of the device, whether the condition for using the fingerprint authentication to perform the payment/login is satisfied, including: the device supports, opens and inputs the fingerprint, the device meets the security level, and the corresponding user/card number of the device is opened for fingerprint authentication. (that is, there is a corresponding binding relationship), the order amount meets the limit condition, and the like. If yes, go to the next step;

Step S505, the server of the application generates a service random factor, such as a random number, a timestamp, and saves it in a database;

Step S506, the server of the application initiates a fingerprint authentication request, where the request includes a service random factor;

Step S507, the application displays a fingerprint verification interface;

Step S508, the application calls the fingerprint service interface to perform fingerprint input and verification, and the interface parameter includes a service random factor;

Step S509, the fingerprint service verifies the fingerprint input by the user, that is, whether it matches the fingerprint that has been entered on the device;

Step S510, the fingerprint service returns key data such as the fingerprint verification result, a signature, and a certificate: if the verification fails, the application prompts the user whether to retry the fingerprint verification function, or discards the fingerprint verification conversion. For the traditional payment/login method; if the verification is successful, continue to the next step;

Step S511, the application sends the returned data and user information (such as a card number) to the background;

Step S512, the server of the application verifies whether the signature data of the fingerprint verification result is correct. If the verification is successful, the data item is extracted and the identity and transaction legality are verified, including: determining whether the fingerprint verification result is successful, whether the biometric type is correct, and security Whether the level satisfies the current transaction amount, whether the service random factor is consistent with the background storage, and whether the fingerprint ID, the user ID and the device ID, and the card number/user information are consistent with the binding relationship of the background storage. If the verification and certification are successful, the next step;

Step S513, after the server authentication of the application succeeds, the transaction authorization is authorized to the application.

In step S514, the application completes operations such as fingerprint payment or fingerprint login.

The second embodiment of the present invention further provides a biometric-based security authentication device, which can execute the foregoing method embodiments. As shown in FIG. 9, the apparatus provided by the embodiment of the present invention includes: a transceiver unit 401, a sensor 402, a matching unit 403, and a signature unit 404, where:

The transceiver unit 401 is configured to receive a biometric authentication request.

a sensor 402, configured to acquire a first biometric feature;

The matching unit 403 is configured to match the first biometric with the preset second biometric to generate a matching result;

The signing unit 404 is configured to encrypt the matching result by using a private key of the security certificate of the terminal to obtain first ciphertext data, where the security certificate uniquely corresponds to the terminal;

The transceiver unit 401 is further configured to send the first ciphertext data and the public key certificate of the security certificate to the authentication end, where the authentication end is a server or the terminal.

Further, the sensor 402 is specifically configured to: send the collected first biometric feature to the matching unit 403 through the first secure channel;

The matching unit 403 is specifically configured to: match the first biometric with the preset second biometric, generate a matching result, and send the matching result to the signature unit 404 through the second secure channel, Storing the second biometric in the matching unit;

The signature unit 404 is specifically configured to: first generate a match to the matching result by using a hash function. And a summary of the result, wherein the digest is encrypted by using the security certificate of the terminal to obtain signature data, where the security certificate of the terminal is stored in the signature unit.

Further, the sensor 402 and the matching unit 403 perform one-way or two-way identity authentication and session key exchange through a handshake protocol, thereby establishing the first secure channel;

The matching unit 403 and the signature unit 404 complete one-way or two-way identity authentication and session key exchange through a handshake protocol, thereby establishing the second secure channel.

Further, the method further includes: the matching unit and the signature unit are operated in a secure operating environment, where the secure operating environment includes a trusted execution environment TEE or a security chip, wherein the secure operating environment is set to meet The security level of different trading permissions.

Further, the matching unit 403 is further configured to:

Obtaining a right of the matched second biometric if the first biometric is matched with the preset second biometric; and generating whether the right to be authenticated and the second biometric corresponding to the authentication request match the result of.

The method further includes: the private key of the security certificate of the terminal includes a private key of the terminal, and a public key certificate of the security certificate of the terminal includes a public key certificate of the terminal, and a public key certificate of the terminal manufacturer. Wherein the public key certificate of the terminal is obtained by signing the public key of the terminal by using the private key of the terminal manufacturer, and the public key certificate of the terminal manufacturer is the private key of the authentication platform, and the terminal is manufactured. The public key of the quotient is obtained.

Further, the transceiver unit 401 is specifically configured to: send, by the terminal, a public key certificate of the security certificate to the authentication end;

After receiving the device authentication sent by the authentication end, the terminal sends the first ciphertext data to the authentication end;

Or the terminal sends the public key certificate and the first ciphertext data of the security certificate to the authentication end, so that the authentication end authenticates whether the terminal is a legal terminal according to the public key certificate of the security certificate.

Further, the method further includes: an authentication end 405, configured to parse the ciphertext data in the following manner:

Obtaining the public key certificate according to the terminal manufacturer and the public key of the pre-stored authentication platform The public key of the terminal manufacturer;

Obtaining a public key of the terminal according to the public key of the terminal manufacturer and a public key certificate of the terminal;

And if the authentication end obtains the public key of the terminal, determining that the device authentication of the terminal passes, and verifying the first ciphertext data by using the public key of the terminal, to obtain the matching result.

Further, the signature unit 404 is further configured to:

The key information is digitally signed by using the private key of the security certificate of the terminal to obtain second ciphertext data; and the second ciphertext data is sent to the authentication end.

After the terminal sends the second ciphertext data to the authentication end, the authentication end 405 is further configured to:

Analyze ciphertext data in the following ways:

Obtaining, by the terminal manufacturer's public key certificate and the pre-stored public key of the authentication platform, the public key of the terminal manufacturer, obtaining the public key according to the terminal manufacturer's public key and the terminal's public key certificate a public key of the terminal, if the authentication end obtains the public key of the terminal, determining that the device authentication of the terminal passes;

Verifying the first ciphertext data by using the public key of the terminal to obtain the matching result;

If the matching result is that the matching is successful, verifying the second ciphertext data by using the public key of the terminal to obtain the key information;

Determining whether the key information meets a preset authentication rule, and generating a biometric authentication result is sent to the terminal.

The key information includes at least one of a terminal identifier and a bank card account.

In summary, the embodiment of the present invention obtains an authentication request for a biometric sent by a server, acquires a first authentication information set according to the authentication request, and sets a first authentication information set and a second authentication in the secure storage area. The information set is matched, the first authentication information set includes at least the collected first biometric feature, the second authentication information set includes at least a preset second biometric feature, and the second public key certificate is compared with the preset public key certificate. Resulting, the key information is digitally signed, and the signature data is sent to the server or the terminal, so that the server or the terminal After the verification, the authentication result is generated according to key information such as the matching result after decryption. It can be seen that the digital signature protection of the matching comparison result by the public key certificate can authenticate the legitimacy of the sender (terminal), ensure that the key information to be signed is created by the legal terminal, prevent the transaction from being rejected, and ensure the matching comparison. As a result, the integrity of the attacker is not stolen or falsified during the transmission process, and the correct and legitimate authentication result is obtained, thereby ensuring the security of the user account.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Embodiment 3

Based on the same concept, referring to FIG. 10, a hardware structure diagram of an electronic device 500 according to an embodiment of the present invention is shown in FIG.

One or more processors 510 and memory 520, one processor 510 is taken as an example in FIG.

The electronic device that performs the biometric-based secure authentication method may further include: an input device 530 and an output device 540.

The processor 510, the memory 520, the input device 530, and the output device 540 may be connected by a bus or other means, as exemplified by a bus connection in FIG.

The memory 520 is a non-transitory computer readable storage medium, and can be used for storing a non-transitory software program, a non-transitory computer executable program, and a module, such as a program instruction/module having a biometric authentication method in the embodiment of the present invention. (For example, the matching unit 403, the signature unit 404 shown in FIG. 9). The processor 510 executes various functional applications and data processing of the server by running non-transitory software programs, instructions, and modules stored in the memory 520, that is, implementing the biometric-based secure authentication method in the foregoing method embodiments.

The memory 520 may include a storage program area and an storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created by use of the processing device operated according to the list item, and the like. . Moreover, memory 520 can include high speed random access memory, and can also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, memory 520 can optionally include memory remotely located relative to processor 510 that can be connected to the processing device of the list item operation over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Input device 530 can receive input numeric or character information and generate key signal inputs related to user settings and function control of the electronic device. The output device 540 can include a display device such as a display screen.

The one or more modules are stored in the memory 520, and when executed by the one or more processors 510, perform a biometric-based secure authentication method in any of the above method embodiments.

The above product can perform the method provided by the embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details that are not described in detail in this embodiment, reference may be made to the method provided by the embodiments of the present invention.

The electronic device of the embodiment of the invention exists in various forms, including but not limited to:

(1) Mobile communication devices: These devices are characterized by mobile communication functions and are mainly aimed at providing voice and data communication. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

(2) Ultra-mobile personal computer equipment: This type of equipment belongs to the category of personal computers, has computing and processing functions, and generally has mobile Internet access. Such terminals include: PDAs, MIDs, and UMPC devices, such as the iPad.

(3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio, video players (such as iPod), handheld game consoles, e-books, and smart toys and portable car navigation devices.

(4) Server: A device that provides computing services. The server consists of a processor, a hard disk, a memory, a system bus, etc. The server is similar to a general-purpose computer architecture, but because of the need to provide highly reliable services, processing power and stability High reliability in terms of reliability, security, scalability, and manageability.

(5) Other electronic devices with data interaction functions.

Embodiment 4

An embodiment of the present invention provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the biological Feature security authentication method.

Embodiment 5

Embodiments of the present invention provide a computer program product, the computer program product comprising a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, Causing the computer to perform the Biometric-based security authentication method.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims (25)

1. A biometric-based security authentication method, the method comprising:

   The terminal acquires the first biometric according to the received biometric authentication request;

   The terminal matches the first biometric with a preset second biometric to generate a matching result;

   The terminal encrypts the matching result by using a private key of the security certificate of the terminal to obtain first ciphertext data, where the security certificate uniquely corresponds to the terminal;

   The terminal sends the first ciphertext data and the public key certificate of the security certificate to the authentication end, where the authentication end is a server or the terminal.
2. The method of claim 1 wherein said obtaining said first biometric comprises:

   Transmitting, by the terminal, the first biometric collected by the sensor to the matching unit of the terminal by using the first secure channel;

   The terminal matches the first biometric with a preset second biometric to generate a matching result, including

   The matching unit matches the first biometric with the preset second biometric, generates a matching result, and sends the matching result to the signature unit of the terminal through the second secure channel, the matching unit The second encryption is stored in the second biometric;

   The terminal encrypts the matching result to obtain the first ciphertext data by using the security certificate of the terminal, including:

   The signature unit first generates a digest of the matching result by using a hash function, and then encrypts the digest using the security certificate of the terminal to obtain signature data, where the signature unit stores the security of the terminal. certificate.
3. The method of claim 2, wherein before the acquiring the first biometric, the method further comprises:

   The sensor and the matching unit complete one-way or two-way identity authentication by using a handshake protocol and Separating a session key to establish the first secure channel;

   The matching unit and the signature unit complete one-way or two-way identity authentication and session key exchange through a handshake protocol, thereby establishing the second secure channel.
4. The method of claim 2, further comprising:

   The matching unit and the signature unit are operated in a secure operating environment, wherein the secure operating environment includes a trusted execution environment TEE or a security chip, wherein the security operating environment is provided with a security level that satisfies different transaction rights. .
5. The method of claim 1, wherein the terminal matches the first biometric with a preset second biometric to generate a matching result, further comprising:

   Obtaining a right of the matched second biometric if the first biometric matches the preset second biometric;

   A result of whether the right to be authenticated corresponding to the authentication request matches the authority of the second biometric is generated.
6. The method according to any one of claims 1 to 5, further comprising:

   The private key of the security certificate of the terminal includes a private key of the terminal, and a public key certificate of the security certificate of the terminal, including a public key certificate of the terminal, and a public key certificate of the terminal manufacturer, where the The public key certificate of the terminal is obtained by signing the public key of the terminal by using the private key of the terminal manufacturer, and the public key certificate of the terminal manufacturer is used to sign the public key of the terminal manufacturer by using the private key of the authentication platform. .
7. The method according to claim 6, wherein the terminal sends the first ciphertext data and the public key certificate of the security certificate, including:

   Sending, by the terminal, the public key certificate of the security certificate to the authentication end;

   After receiving the device authentication sent by the authentication end, the terminal sends the first ciphertext data to the authentication end;

   Or the terminal sends the public key certificate and the first ciphertext data of the security certificate to the authentication end, so that the authentication end authenticates whether the terminal is a legal terminal according to the public key certificate of the security certificate.
8. The method according to claim 6, wherein after the sending the first ciphertext data to the authentication end, the method further comprises:

   The authentication end parses the ciphertext data in the following manner:

   The authentication end obtains the public key of the terminal manufacturer according to the public key certificate of the terminal manufacturer and the public key of the pre-stored authentication platform;

   The authentication end obtains the public key of the terminal according to the public key of the terminal manufacturer and the public key certificate of the terminal;

   And if the authentication end obtains the public key of the terminal, determining that the device authentication of the terminal passes, and verifying the first ciphertext data by using the public key of the terminal, to obtain the matching result.
9. The method of claim 6 further comprising:

   The terminal encrypts the key information by using a private key of the security certificate of the terminal to obtain second ciphertext data;

   The terminal sends the second ciphertext data to the authentication end.
10. The method according to claim 9, wherein after the terminal sends the second ciphertext data to the authentication end, the method further includes:

    The authentication end parses the ciphertext data in the following manner:

    The authentication end obtains the public key of the terminal manufacturer according to the public key certificate of the terminal manufacturer and the public key of the pre-stored authentication platform, according to the public key of the terminal manufacturer and the public key of the terminal The certificate obtains the public key of the terminal, and if the authentication end obtains the public key of the terminal, it determines that the device authentication of the terminal passes;

    Verifying the first ciphertext data by using the public key of the terminal to obtain the matching result;

    If the matching result is that the matching is successful, verifying the second ciphertext data by using the public key of the terminal to obtain the key information;

    Determining whether the key information meets a preset authentication rule, and generating a biometric authentication result is sent to the terminal.
11. The method according to any one of claims 9 to 10, wherein the key information comprises at least one of a terminal identifier and a bank card account number.
12. A biometric-based safety authentication device, characterized in that the device comprises:

    a transceiver unit, configured to receive the biometric authentication request;

    a sensor for acquiring a first biometric feature;

    a matching unit, configured to match the first biometric with a preset second biometric to generate a matching result;

    a signature unit, configured to encrypt, by using a private key of the security certificate of the terminal, the first ciphertext data, where the security certificate uniquely corresponds to the terminal;

    The transceiver unit is further configured to send the first ciphertext data and the public key certificate of the security certificate to the authentication end, where the authentication end is a server or the terminal.
13. The device according to claim 12, wherein the sensor is specifically configured to: send the collected first biometric feature to the matching unit through a first secure channel;

    The matching unit is specifically configured to: match the first biometric with a preset second biometric, generate a matching result, and send the matching result to the signature unit by using a second secure channel, where Storing the second biometric in the matching unit;

    The signature unit is specifically configured to: first generate a digest of the matching result by using a hash function, and then encrypt the digest using the security certificate of the terminal to obtain signature data, where the signature unit stores The security certificate of the terminal.
14. The device according to claim 13, wherein the sensor and the matching unit complete one-way or two-way identity authentication and session key exchange through a handshake protocol, thereby establishing the first secure channel;

    The matching unit and the signature unit complete one-way or two-way identity authentication and session key exchange through a handshake protocol, thereby establishing the second secure channel.
15. The device of claim 13 further comprising:

    The matching unit and the signature unit are operated in a secure operating environment, wherein the secure operating environment includes a trusted execution environment TEE or a security chip, wherein the security operating environment is provided with a security level that satisfies different transaction rights. .
16. The device according to claim 12, wherein the matching unit is further configured to:

    Obtaining a right of the matched second biometric if the first biometric matches the preset second biometric;

    A result of whether the right to be authenticated corresponding to the authentication request matches the authority of the second biometric is generated.
17. The device according to any one of claims 12 to 16, further comprising:

    The private key of the security certificate of the terminal includes a private key of the terminal, and a public key certificate of the security certificate of the terminal, including a public key certificate of the terminal, and a public key certificate of the terminal manufacturer, where the The public key certificate of the terminal is obtained by signing the public key of the terminal by using the private key of the terminal manufacturer, and the public key certificate of the terminal manufacturer is used to sign the public key of the terminal manufacturer by using the private key of the authentication platform. .
18. The device according to claim 17, wherein the transceiver unit is specifically configured to:

    Sending, by the terminal, the public key certificate of the security certificate to the authentication end;

    After receiving the device authentication sent by the authentication end, the terminal sends the first ciphertext data to the authentication end;

    Or the terminal sends the public key certificate and the first ciphertext data of the security certificate to the authentication end, so that the authentication end authenticates whether the terminal is a legal terminal according to the public key certificate of the security certificate.
19. The device of claim 18, further comprising:

    The authentication end is used to parse the ciphertext data in the following manner:

    Obtaining, by the terminal manufacturer's public key certificate and the pre-stored public key of the authentication platform, the public key of the terminal manufacturer;

    Obtaining a public key of the terminal according to the public key of the terminal manufacturer and a public key certificate of the terminal;

    And if the authentication end obtains the public key of the terminal, determining that the device authentication of the terminal passes, and verifying the first ciphertext data by using the public key of the terminal, to obtain the matching result.
20. The device according to claim 18, wherein the signature unit is further configured to:

    Encrypting the key information by using the private key of the security certificate of the terminal to obtain the second ciphertext number And sending the second ciphertext data to the authentication end.
21. The device according to claim 20, wherein after the terminal sends the second ciphertext data to the authentication end, the authentication end is further configured to:

    Analyze ciphertext data in the following ways:

    Obtaining, by the terminal manufacturer's public key certificate and the pre-stored public key of the authentication platform, the public key of the terminal manufacturer, obtaining the public key according to the terminal manufacturer's public key and the terminal's public key certificate a public key of the terminal, if the authentication end obtains the public key of the terminal, determining that the device authentication of the terminal passes;

    Verifying the first ciphertext data by using the public key of the terminal to obtain the matching result;

    If the matching result is that the matching is successful, verifying the second ciphertext data by using the public key of the terminal to obtain the key information;

    Determining whether the key information meets a preset authentication rule, and generating a biometric authentication result is sent to the terminal.
22. The device according to any one of claims 20 to 21, wherein the key information comprises at least one of a terminal identifier and a bank card account number.
23. An electronic device, comprising:

    At least one processor; and,

    a memory communicatively coupled to the at least one processor; wherein

    The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 11. .
24. A non-transitory computer storage medium, characterized in that the non-transitory computer readable storage medium stores computer executable instructions for causing the computer to perform any of claims 1 to The method described in the item.
25. A computer program product, comprising: a computing program stored on a non-transitory computer readable storage medium, the computer program comprising the computing The machine is executable to cause the computer to perform the method of any one of claims 1 to 11 when the computer executable instructions are executed by a computer.

Images