WO2018098950A1

WO2018098950A1 - Method and device of using local authorization certificate in terminal

Info

Publication number: WO2018098950A1
Application number: PCT/CN2017/078605
Authority: WO
Inventors: 王思善; 常新苗
Original assignee: 华为技术有限公司
Priority date: 2016-12-02
Filing date: 2017-03-29
Publication date: 2018-06-07
Also published as: CN108604990A

Abstract

A method and device of using a local authorization certificate in a terminal. The method comprises: obtain, when a terminal receives a service request, a local authorization certificate in the terminal, the service request requiring providing a terminal validity proof, and the local authorization certificate being a certificate authorized by an authentication center, stored in the terminal and capable of providing the terminal validity proof; the terminal generates and sends a service response corresponding to the service request according to the local authorization certificate and the service request, the service response comprising the terminal validity proof. By implementing embodiments of the present invention, service request processing efficiency can be improved.

Description

Method and device for using local authorization credential in terminal

The present application claims priority to Chinese Patent Application No. 201611097424.X entitled "A Business Registration Method and Terminal" on December 2, 2016, the entire contents of which are incorporated herein by reference. in.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for using local authorization credentials in a terminal.

Background technique

In the unified identity authentication system, the authentication center is a third-party authority for authenticating the identity of the terminal and not related to the specific service. The server of the authentication center is usually placed in the public network for the authentication server to invoke. This way of cross-domain calling is for the bank. IT systems in the financial sector cannot be implemented. Therefore, in order to solve the dependency relationship between the authentication server and the authentication center, when the terminal receives the service registration request of the application, after the verification service registration request comes from the legal server, the terminal needs to go to the authentication center to apply for the validity check of the terminal. The server proves that the service registration response is from a legitimate terminal. When performing the validity check of the terminal, the terminal signs the service registration request by using the original equipment manufacturer (original equipment manufacturer, OEM) private key preset by the factory, and generates the service registration response through the authentication center public key encryption. The data packet is sent to the authentication center for the validity check of the terminal. The authentication center decrypts the service registration response data packet, verifies the legality of the terminal by verifying the signature data generated by the OEM manufacturer's private key, and encrypts the verification result, and sends the authentication result to the authentication server, and the authentication server decrypts the verification result. And perform subsequent business logic based on the verification results.

However, in the process of processing a service registration request, the existing terminal needs to detect the validity of the terminal that generates and registers the service public key. Since the different application services are independent of each other, the service key pair generated by the terminal does not have universality. When processing the service registration request of each application, the application provider needs to verify the legality of the terminal that generates the service key pair. When different applications in the same terminal perform service registration request processing, the legality detection has been performed. The terminal still needs to repeatedly go to the authentication center to check the validity of the terminal in response to each service registration request, thereby increasing the resource consumption of the terminal and prolonging the processing time of the service request, thereby reducing the efficiency of the service registration request processing. .

Summary of the invention

The embodiment of the invention discloses a method and a device for using a local authorization credential in a terminal, which are used for improving the efficiency of service request processing.

The first aspect discloses a method for using a local authorization credential in a terminal. When receiving a service request, the terminal acquires a local authorization credential in the terminal, where the service request requires providing a terminal legality certificate, where the local authorization credential is The certificate authority is authorized and stored in the terminal, and can provide the certificate of the terminal legality certificate; the terminal generates and sends a service response corresponding to the service request according to the local authorization certificate and the service request, and the service response includes the terminal legality certificate. It can be seen that the certificate center provides the certificate for providing the terminal legality certificate to the terminal, so that the terminal can provide the terminal legality certificate locally, and does not need to go to the authentication center to perform the terminal legality every time the service request for providing the terminal legality certificate is required. The detection of the characteristics can reduce the resource consumption of the terminal, shorten the operation time of the service, and improve the efficiency of the service request processing.

In one embodiment, the terminal legality certificate includes signature information generated using a local authorized private key, and the local authorized private key is generated by the terminal before sending the request information for obtaining the local authorization credential to the authentication center. If it is stored locally, the terminal can provide the terminal legality certificate locally, and prove to the authentication server that the service responds to the sender, that is, the identity of the terminal, thereby improving security.

In an embodiment, the service request is one of a service registration request and a service execution request. When the service request is a service registration request, the service response further includes a service public key, and when the service request is a service execution request, the service response is further The signature information generated by using the service private key is generated when the service public key and the service private key are received by the terminal, and the signature information generated by using the service private key is used to prove that the service execution response is sent by the service. The service response response is sent by the terminal of the service registration response, and the service execution response is a service response corresponding to the service execution request, and the service registration response is a service response corresponding to the service registration request, and the service key pair is generated in the service registration request phase, and can be used during the service execution phase. The business private key is signed to prove that the terminal licenses the current business execution, thereby improving the security of the business. The service server may choose to provide the terminal legality proof when the service is executed, and set the service type requirement, which can reduce the risk caused by the terminal legality certificate provided by the terminal during the registration phase, thereby improving the service execution. Security.

In an embodiment, if the first local authorization credential exists in the terminal, and the first local authorization credential is within the validity period, and the first local authorization credential meets the service type requirement of the service request, the first local authorization credential is used to construct the terminal legality. Proving that the service response corresponding to the service request is generated, the service response includes the terminal legality certificate, and the service response is sent. It can be seen that the service server can set the service type requirement according to the service to enhance the control of the service risk; After the locally saved local authorization certificate meets the service type requirements, the service response including the terminal legality certificate is generated, which can reduce the probability of occurrence of risks and improve the security of the service.

In one embodiment, the service request includes a service type requirement, the service type requirement includes a risk management requirement, the risk management requirement is generated by the service server for the first local authorization certificate, and the service request is sent by the service server.

In an embodiment, if the first local authorization credential does not exist in the terminal, or if the first local authorization credential in the terminal exceeds the validity period, or if the first local authorization credential does not satisfy the service type requirement of the service request, the terminal sends the authentication center to the authentication center. Sending request information for acquiring the second local authorization credential, so that the authentication center generates the second local authorization credential; the terminal receives and saves the second local authorization credential; the terminal constructs the service response corresponding to the service request by using the second local authorization credential, and Send a business response. The local authorization certificate can be used to construct a service response when it meets the validity period and service type requirements, so that the security of the service can be improved.

In one embodiment, the request information for acquiring the second local authorization credential includes at least one of device information or device identity information, using a signature generated by the original device manufacturer, and locally authorizing the public key, so that the authentication center according to the The device information or the device identity information is searched for the stored original device manufacturer public key to verify the original device manufacturer signature, and the second local authorization certificate is generated. The local authorized public key is a public key corresponding to the local authorized private key, and the device information is used. And the device identity information is information required by the terminal when the authentication center receives the request information of the second local authorization certificate, or the information that the authentication center negotiates with the terminal in advance.

In one embodiment, the first local authorization credential and the second local authorization credential include a validity period, a local authorization public key, and signature information generated using the authentication center private key, and the authentication center private key is generated and saved for the authentication center to generate a local authorization. When the certificate is authenticated, the authentication server verifies the local authorization certificate according to the saved certificate authority public key, and verifies the terminal legality certificate included in the service response according to the local authorization certificate, thereby improving service execution. Security.

In one embodiment, the first local authorization credential and the second local authorization credential further comprise a credential security level, wherein the credential security level is determined by the authentication center according to the device information, and the credential security level is A type of service type requirement, for different security levels of local authorization credentials, the service server sets corresponding service type requirements according to the security requirements of the service, so that the terminal provides the terminal legality certificate that meets the requirements of the service type, thereby improving Security of business execution.

In an embodiment, the local authorized public key is generated and saved locally by the terminal before sending the request information for acquiring the first local authorization credential to the authentication center, or the terminal is in the The authentication center generates and saves the request information for acquiring the second local authorization credential before being generated and saved locally.

In an embodiment, the validity period is determined by the authentication center according to the security level of the device, the security level of the device is determined by the device information, and the device information is sent by the terminal to the authentication center. For the first local authorization certificate or the second local authorization certificate request information, or the device information is found by the authentication center in the database according to the device identity information, the device The identity information is carried in the request information sent by the terminal to the authentication center for acquiring the first local authorization credential or the second local authorization credential. The service server can set a service type requirement for the validity period, so that the terminal can provide the legitimacy of the terminal locally, and the terminal can provide the terminal legality certificate satisfying the service type requirement according to the service server requirement, thereby improving the security of the service execution. .

In an embodiment, the terminal may detect whether the service request includes indication information for indicating the validity of the providing terminal, and if the service request includes the indication information for indicating the validity of the providing terminal, acquiring the local information in the terminal. Authorization certificate, after the inspection is passed, the terminal legality certificate is constructed. The triggering mechanism for providing the terminal legality proof established according to the indication information can also implement the control of the risk existing in the terminal during the service execution phase, instead of always trusting the legality proof provided by the terminal during the service registration phase, which can improve the service execution. safety.

In one embodiment, the indication information is determined based on at least one preset field or determined according to at least one of the service type requirements.

A second aspect discloses a device for using a local authorization credential, the device comprising means for performing a method of using a local authorization credential in a terminal provided by the first aspect or any of the possible implementations of the first aspect.

A third aspect discloses a computer readable storage medium comprising instructions, when executed on a computer, causing a computer to perform local authorization credentials in a terminal provided by the first aspect or any of the possible implementations of the first aspect Instructions.

The fourth aspect discloses a terminal, including: a processor, a memory, a communication interface, and a bus; a processor, a communication interface, and a memory communicate with each other through the bus; and the communication interface is configured to receive and send data; The memory is used to store an instruction, and the processor is configured to invoke an instruction in the memory to execute a method for using a local authorization credential in a terminal provided by the first aspect or any possible implementation manner of the first aspect. .

DRAWINGS

1 is a schematic structural diagram of a system disclosed in an embodiment of the present invention;

2 is a schematic flowchart of a method for using a local authorization credential in a terminal according to an embodiment of the present invention;

3 is a schematic flowchart of a method for generating a local authorization credential according to an embodiment of the present invention;

4 is a schematic flowchart of a method for using a local authorization credential in another terminal according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an apparatus for using local authorization credentials according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a terminal for running a method for using a local authorization credential in the terminal according to an embodiment of the present invention.

detailed description

The embodiment of the invention discloses a method and a device for using a local authorization credential in a terminal, which are used for reducing terminal resource consumption and improving the efficiency of service request processing. The details are described below separately.

In order to better understand the method and apparatus for using the local authorization credential in the terminal disclosed in the embodiment of the present invention, the system architecture used in the embodiment of the present invention is described below. The system architecture is a unified identity authentication system. Please refer to FIG. 1. FIG. 1 is a schematic diagram of a system architecture disclosed in an embodiment of the present invention. As shown in FIG. 1, the system can include a terminal 101, an application server 102, and a certificate authority 103. The application client 1011 and the unified identity authentication client 1012 and the unified identity authentication trusted application 1013 can be run in the terminal 101. The application client 1011 is the host of the user service on the terminal side, and the unified identity authentication client 1012 is implemented on the terminal side. The entity of the unified identity authentication function can provide services for multiple application clients compatible with the terminal, and is responsible for communicating with the authentication center 103. The unified identity authentication trusted application 1013 provides support for the unified identity authentication client 1012, and can access security. In the storage environment, a certificate revocation list (CRL) and a key that needs to be securely stored on the terminal side, the application server 102 may include a service server 1021 and an authentication server 1022 corresponding to the service server, and the authentication server 1022 is unified. The executor of the application authentication server on the application server can be deployed on the service server 1021 to cooperate with the service server 1021. The server can also independently deploy one server. The authentication center 103 can provide terminal legality detection as part of the unified identity authentication platform. The system Authentication Platform also includes a unified authentication platform root CA (certificate authority). The authentication center 103 pre-stores the authentication center private key and the original equipment manufacturer public key approved by the certification center, and the authentication server 1022 stores the authentication server certificate issued by the unified identity authentication platform root CA, the authentication server private key, and the authentication center in advance. The certificate authority public key is issued. The unified identity authentication trusted application 1013 pre-stores the original device manufacturer private key, the root certificate of the unified identity authentication platform root CA, and the certificate authority public key.

The terminal sends an application for the local authorization credential to the authentication center 103 through the unified identity authentication client 1012, and the authentication center 103 responds, generates a local authorization credential, and sends the local authorization credential to the terminal 101, so that the terminal 101 provides the locality. Terminal 101 legality certificate. The user can initiate a service to the service server 1021 through the application client 1011, which may be a registration service or an execution service. When the service server 1021 is configured to execute the service flow defined in the unified identity authentication protocol, the authentication server certificate and the signature information generated by using the authentication server private key are added to the corresponding service request, and sent to the application client 1011. The client 1011 performs corresponding service processing by calling the unified identity authentication client 1012. The unified authentication trusted application 1013, after the authentication of the identity of the authentication server 1022 is passed, if the service server 1021 requests the terminal 101 to provide the terminal 101 legality certificate in the service request, it is generated by the authentication center 103 and saved in the terminal 101. The local authorization credential constructs a service response corresponding to the legality certificate of the terminal 101 corresponding to the service request, and sends the service response to the authentication server 1022. The certificate server 1022 verifies the service response, obtains the verification result, and notifies the service server 1021 of the verification result, so that the service server 1021 executes the corresponding business logic according to the verification result.

The terminal 101 can be a mobile user equipment (English: User Equipment, UE), an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a wireless communication device, User agent or user device. The access terminal can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, and a personal digital processing (English: Personal Digital Assistant, PDA), a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, an in-vehicle device, a wearable device, a terminal in a future 5G network, or a terminal in a future evolved PLMN network, and the like. The application client 1011 can be used for various application clients, and the unified identity authentication client 1012 is responsible for interacting with the application client 1011 and the unified identity authentication trusted application 1013 running in the security environment.

Based on the system architecture shown in FIG. 1, please refer to FIG. 2. FIG. 2 is a schematic flowchart of a method for using a local authorization credential in a terminal according to an embodiment of the present invention, where a method for using a local authorization credential in the terminal is The terminal 101, the service server 1021, and the authentication server 1022 are described in terms of angles. As shown in FIG. 2, the method for using the local authorization credential in the terminal may include the following steps.

S201. The terminal receives the service request.

Specifically, the service request is sent by the service server, and the service request may include the service registration request and the service execution request. For example, in the fingerprint verification scenario, the service registration request requires the terminal to follow the specified process developed by the application server according to the unified identity authentication protocol. The document is referred to as the “designation process”. The request for the fingerprint verification function is activated. The service execution request corresponds to the process of requiring the terminal to perform fingerprint verification according to the specified process when the fingerprint verification service registration is completed.

The purpose of the service request is at least divided into two aspects. The first aspect requires the terminal to perform a service-related process, that is, to execute the use of the service private key to generate signature information and subsequent steps, and on the other hand, the terminal is required to provide the terminal legality certificate.

In an embodiment, if the service request includes indication information for indicating that the terminal legality certificate is provided, step S202 is performed.

Specifically, the indication information indicating that the terminal provides the legality certificate is generated by the service server, and the terminal determines, according to the indication information, that the service request requires providing the terminal legality certificate. When the service request is a service registration request, the service registration request includes the indication information because the registration service needs to perform terminal legality verification. The terminal determines, according to the indication information, that the terminal legality certificate needs to be provided, for example, one or more fields that are used by the terminal and the service server to indicate the validity of the terminal, or some or all information related to the service registration. For example, if the service request is a service registration request, it is determined that the terminal legality certificate needs to be provided, or the parameter for performing the risk management requirement exists in the service registration request, and it is determined that the terminal legality certificate needs to be provided, or may be legal according to other terminals. The field related to the proof of sex is determined, and the embodiment is not limited.

When the service request is a service execution request, the service server responds to the application client initiating the service execution request, and when the service execution request is generated by the authentication server, the service server may determine the service execution request according to the service itself, such as the sensitivity of the service and the security requirement of the service. Whether the terminal is required to provide proof of terminal legality. When required, the terminal is required to provide the terminal legality certificate in the service request sent to the terminal, that is, the indication information including the indication providing the terminal legality certificate. When determining, according to the indication information, that the terminal needs to provide the terminal legality certificate, the terminal acquires the local authorization certificate in the terminal, and constructs the terminal legality certificate.

The service request may further include authentication server challenge information, where the service request may be a service registration request or a service execution request, and the challenge information generates a random number internally for the authentication server, The service request is guaranteed to be real-time, and the replay attack is prevented. After the terminal returns to the authentication server service response, the challenge information in the service response is verified to confirm that the service is current.

S202. The terminal acquires a local authorization credential.

Specifically, the local authorization credential is a credential authorized by the authentication center and saved in the terminal to provide proof of terminal legality. When the service request is required to provide the terminal legality certificate, the terminal acquires the locally saved local authorization certificate, and is used to locally construct a service response including the terminal legality certificate.

As a public domain server shared by the Alliance, the Certification Authority is a third-party authority that authenticates terminal identity. In order to avoid the problem that the service server requires the terminal legality certificate, the terminal needs to go to the authentication center to perform the problem of low efficiency of the service execution. The authentication center responds to the request sent by the terminal for obtaining the local authorization certificate, and the verification center After the terminal is legal, the local authorization certificate corresponding to the terminal is generated to prove that the authentication center authorizes the terminal to locally generate the terminal legality certificate, and sends the local authorization certificate to the terminal, where the terminal localizes The authorization credentials are saved locally.

To ensure the security of the local authorization credentials, the local authorization credentials can be saved in the secure storage environment of the terminal, such as the trusted execution environment (TEE) or the security element (English). Or other possible secure storage environments.

In one embodiment, the terminal legality certificate includes signature information generated using a local authorized private key, and the local authorized private key is sent by the terminal to the authentication center for acquiring the local authorization credential The request information is generated and saved locally.

Specifically, the locally saved local authorization credential is used to prove that the terminal passes the terminal legality detection of the authentication center, and is authorized to locally generate the terminal legality certificate. Therefore, the terminal legality certificate includes the local authorization credential. When the terminal validity certificate is generated, the saved local authorization private key is used to generate signature information, and the local authorization certificate is used to authenticate the local authorization certificate according to the authentication center public key, and the terminal is determined to be The authority for generating the validity of the terminal is generated locally, and the signature information generated by the terminal using the local authorized private key is verified according to the local authorized public key in the local authorization credential to determine the legality of the terminal. On the other hand, before the terminal sends the request information for obtaining the local authorization credential to the authentication center, the terminal generates a local authorized asymmetric key pair, and saves the local authorized private key locally, and uses the local authorized public key as the local An element in the request information, configured to enable the authentication center to generate the local authorization credential.

To ensure the security of the local authorized private key, the local authorized private key may be stored in a secure storage environment of the terminal, such as TEE or SE, or other possible secure storage environments.

S203. The terminal generates a service response corresponding to the service request according to the local authorization credential and the service request.

Specifically, the service response includes the terminal legality certificate. The service response is sent to the authentication server, and the authentication server can verify the validity certificate of the terminal included in the response according to the received service response, and obtain the verification result.

In one embodiment, the service request is one of a service registration request and a service execution request, and when the service request is the service registration request, the service response further includes a service public key, when the service request is When the service performs the request, the service response further includes signature information generated by using a service private key, the service public key and the service The private key is generated when the terminal receives the service registration request corresponding to the service execution request, and the signature information generated by using the service private key is used to prove that the service execution response is sent by the terminal that sends the service registration response. The service execution response is a service response corresponding to the service execution request, and the service registration response is a service response corresponding to the service registration request.

Specifically, when the service request is to perform a service registration specifying process for the requesting terminal, such as a provisioning process of the fingerprint service or the digital certificate service, the service request is a service registration request, and after the terminal passes the identity verification of the authentication server, the corresponding service is generated. An asymmetric service key pair, and storing the service private key in a secure storage environment, and using the service public key as an element in the service registration response corresponding to the service registration request, when the service request is a request to perform a service, such as fingerprint verification or Digital signature, the business response also includes signature information generated using the business private key. After the service execution response is sent to the authentication server, the authentication server verifies the signature information generated by the service private key by using the service public key included in the previous service registration response or the service public key included in the service execution response to confirm that the terminal licenses the service. carried out.

In an embodiment, if the first local authorization certificate exists in the terminal, and the first local authorization certificate is within the validity period, and the first local authorization certificate satisfies the service type requirement of the service request, The first local authorization credential constructs the terminal legality certificate to generate a service response corresponding to the service request, and sends the service response.

Specifically, the service type requirement is generated by the service server according to its own business requirements.

For the terminal that obtains the local authorization certificate, it is necessary to determine whether the local authorization certificate can be used for the current service to construct the terminal legality certificate. The terminal first checks whether the obtained local authorization credential is within the validity period to determine whether the current local authorization credential is valid; and for the credential within the validity period, further determines the use of the current credential structure according to the service type requirement included in the service request. Determining whether the terminal legality certificate satisfies the service type requirement generated according to the service's own requirements, and if so, constructing the terminal legality certificate using the first local authorization credential, and including the terminal legality certificate in the service response in.

In one embodiment, the service request includes the service type requirement, the service type requirement includes a risk management requirement, and the risk management requirement is generated by the service server for the first local authorization certificate, and is used to ensure that the terminal is based on the The terminal legality certificate provided by the first local authorization certificate satisfies the security requirement of the service, and the service request is sent by the service server.

In this embodiment, the service type requirement is generated by the service server, and the service server may set different service type requirements according to the service requirements of the service itself, for example, according to the sensitivity of the service, the security requirement of the service, and the like, such as whether the money is involved. The transaction, the amount of the money transaction involved, etc. are divided into different levels. For example, the service server can classify different service execution requests according to the sensitivity of the service or the security level of the service, and assign different types of services to different categories. Business type requirements. On the other hand, the service type requirement may include risk management requirements, and may also include other requirements, such as application client version requirements, and the risk management requirements include risk management parameters and risk management thresholds, and the risk management requirements are for the local authorization. The parameter type generated in the voucher can be the validity period, the security level of the voucher, and the like.

For example, the local authorization credential may include at least one of a validity period, a security level of the credential, and the like. The security level of the credential may be determined by the authentication center according to the security level of the device corresponding to the device information, such as the type of the storage environment of the device. The higher the security level of the voucher, the higher the credibility of the currently saved local authorization voucher.

For example, as shown in Table 1, Table 1 is an example 1 of determining a service type requirement by a service server according to a service execution request type. The risk management requirement in the service type requirement is generated for the parameter of the validity period in the local authorization certificate. The service takes the fingerprint service execution request as an example, and the first column represents different service execution requests, and the security requirement of the service is determined by The security requirements may be increased according to at least one of factors such as whether the money transaction, the amount of money transactions involved, and the risk analysis result of the current transaction are analyzed by the business server risk management system. The server can detect whether the transaction amount is greater than a preset threshold, and divide the transaction into large and small payment, and the requirement for the business type is gradually increased from top to bottom, and the risk management requirement in the service type requirement is gradually increased from top to bottom, that is, The requirements are gradually strict. Specifically, the fingerprint login client does not involve the money transaction. Therefore, the service server may not set the risk management requirement, and only applies the client version requirement in the service type requirement according to the requirement; and the small fingerprint payment involves a small amount of money. For the transaction, the risk management requirement may be valid for the local authorization certificate generated within 3 months, or for the certificate within the validity period, the validity period of the certificate itself is valid for more than 3 months, and the service type requirement may further require the application client. The version may also include other business type requirements; for large-value fingerprint payment, the risk management requirement may be set to be valid for the local authorization certificate generated within one month, or for the certificate within the validity period, the validity period of the voucher is more than 6 months. The voucher is valid, and other business type requirements, such as the application client version, can also be performed. In addition, the risk management system of the server may be used to perform risk analysis on the current transaction to identify whether it is an abnormal transaction that does not meet the user's trading habits, and set corresponding risk management requirements according to the risk management result of the transaction. In addition, depending on the specific situation, the service type requirements other than the risk management requirements and the application client version requirements are set according to the service requirements, and other service execution request types may be set according to the specific conditions of the service execution request, which is not limited in this embodiment.

Table 1 Service server determines the service type requirement according to the type of service execution request.

For another example, as shown in Table 2, Table 2 is a second example of determining a service type requirement according to a service execution request type, and the risk management requirement in the service type requirement is a validity period and a credential security of the service server for the local authorization credential. Generated by the two parameters of the level, the local authorization credential also contains the security level of the credential, so on the basis of Table 1, the risk management requirements in Table 2 also correspondingly increase the risk management threshold established by the server for the security level of the credential. To generate the corresponding business type requirements and risk management requirements.

After receiving the service request, the terminal obtains the local authorization certificate locally saved by the terminal and confirms that the voucher is within the validity period, and then determines that the terminal legality certificate needs to be full according to the service type and/or the local authorization certificate in the service request. According to the local business authorization voucher, it can be judged whether the local authorization certificate can meet the business risk management requirements. For example, in the small fingerprint payment scenario of Table 2, if the level of the local authorization certificate currently stored in the terminal is level 2, according to the risk management requirement, the terminal needs to use the local authorization certificate generated within 3 days to meet the type requirement of the service; The terminal further detects whether the local authorization credential is generated within 3 days, and if yes, indicates that the local authorization credential meets the risk management requirement, and then determines whether the service type requirement other than the risk management requirement is met, if the local authorization credential is generated 5 days ago. The local authorization certificate does not meet the risk management requirements.

Table 2: The service server determines the service type requirement according to the type of service execution request.

The service type requirement may be delivered by the service server to the application client in advance, and when the service request is received, the saved service type requirement and the service request are forwarded to the unified identity authentication client for verification.

In one embodiment, if the first local authorization credential does not exist in the terminal, or if the first local authorization credential in the terminal exceeds a validity period, or if the first local authorization credential does not satisfy the service Requesting the service type request, the terminal sending, to the authentication center, request information for acquiring a second local authorization credential, so that the authentication center generates the second local authorization credential;

Receiving and saving the second local authorization credential by the terminal;

The terminal constructs a service response corresponding to the service request by using the second local authorization credential, and sends the service response.

Specifically, when there is no local authorization credential in the terminal, or the existing local authorization credential has expired, or the existing local authorization credential cannot meet the service type requirement required by the service server, it indicates that the local authorization credential does not exist locally or The existing local authorization credential cannot be used to construct a service response corresponding to the service request locally, and needs to re-apply the authentication center to apply for a new local authorization credential, that is, the second local authorization credential.

In an embodiment, the request information for acquiring the second local authorization credential includes at least one of signature information, device information or device identity information generated by using an original device manufacturer private key, and locally authorizing the public key to And causing the authentication center to search the stored original device manufacturer public key according to the device information or the device identity information to verify the signature information generated by using the original device manufacturer private key, to generate the second local authorization certificate. The local authorized public key is a public key corresponding to the local authorized private key, and the device information and the device identity information are required by the authentication center when receiving the request information of the second local authorization credential. Information provided by the terminal, or information that the authentication center negotiates with the terminal in advance.

Specifically, the private device of the original device manufacturer may be preset in the secure storage environment in the terminal, and the authentication center stores the public key of the trusted original device manufacturer, and the original local device includes the original device included in the request information of the second local authorization certificate. The signature information generated by the manufacturer's private key is used to enable the certificate authority to extract the saved original device manufacturer's public key to verify the signature information generated by using the original device manufacturer's private key to detect the legitimacy of the terminal and verify the identity of the terminal. The certificate authority will generate the local authorization credentials for the terminal. On the other hand, the authentication center extracts the saved original device manufacturer private key, which may be searched by the device identity information, and the device identity information may include at least one of a device ID, a vendor identifier, a device model, and the like of the terminal.

Before the authentication center requests the device information and the device identity information provided by the terminal, the key specification of the local authorized public-private key pair, such as the length and password algorithm, may be required.

In one embodiment, the first local authorization credential and the second local authorization credential include a validity period, the local authorization public key, and signature information generated using a certificate authority private key, the certificate authority private key being the certificate authority Generated and saved locally in the authentication center, the authentication center private key is used to generate the local authorization credential.

Specifically, the validity period of the local authorization credential in the judgment of the validity period is included in the local authorization credential, and the local authorized public key is the public key corresponding to the local authorized private key, and is used for the service response corresponding to the subsequent service request. The signature information generated by using the local authorization private key is used for verification; and the signature information generated by using the authentication center private key is used to prove that the local authorization certificate is issued by the authentication center, that is, the certification center recognizes that the terminal provides the terminal legality locally. prove.

Specifically, the device information may be carried in the request information that is sent by the terminal to the authentication center for obtaining the local authorization credential. On the other hand, if the request information of the local authorization credential is carried in the device identity information, if only If the device ID or other identification information, such as the manufacturer and model, you can also find the device information such as the device storage environment in the database preset by the authentication center through the device identity information, and determine the device security based on the device storage environment and other device information. A rating, which in turn determines the security level of the validity period and/or credentials. For example, the authentication center may set up a risk assessment system based on the terminal device information, and determine the security score of the terminal according to the terminal device information, mainly the storage environment of the terminal, and the security score may be used to determine the validity period of the local authorization certificate. .

In one embodiment, the first local authorization credential and the second local authorization credential further comprise a credential security level, wherein the credential security level is determined by the authentication center according to the device information, and the credential security level is A type of business type requirement.

For example, as shown in Table 3, Table 3 is an example of a device security level evaluation system generated by the certification center based on device information. The first column indicates the different storage environment types of the terminal, including REE (rich execution environment)/TEE/SE, etc. The credit score is determined according to the security level of different types of storage environments, and the credit score corresponds to the security of the corresponding device evaluated by the certification center. Level, the certification center determines the validity period of the generated local authorization certificate and the security level of the local authorization certificate based on the credit score. Further, the service server side can also be configured to set a risk management requirement for the parameters in the local authorization credential to ensure that the terminal uses the locally saved local authorization credential to prove that the terminal legality certificate meets its service management requirements.

The security level of the device may be classified according to the storage environment as REE/TEE/SE, or may be based on whether the SE meets professional level detection requirements (such as financial level, military level), or whether the SE and TEE have authority. Inspection agency certification, etc. to further subdivide. On the other hand, the authentication center can also perform the division of the credit score, the expiration date, and the security level of the voucher according to the cooperation relationship with each vendor, and the strength and credit of the manufacturer. This embodiment is not limited.

Table 3 Example of equipment security level evaluation system generated by the certification center based on equipment information

存储环境类型Storage environment type	信用分(总分5分)Credit score (5 points total)	有效期Validity period	凭证安全等级Credential security level	……......
REEREE	1分1 point	使用一次Use once	1(最低)1 (lowest)	……......
TEETEE	2分2 minutes	3个月3 months	2(中低)2 (low to medium)	……......
SESE	4分4 points	1年1 year	3(较高)3 (higher)	……......
……......	……......	……......	……......	……......

Specifically, when the local authorization credential update in the terminal is performed, that is, when the second local authorization credential is obtained from the authentication center, the local authorized public key may be generated when the original credential authorization credential is generated, or a new local may be generated. The re-generated local authorized public key is not limited in this embodiment.

In an embodiment, the validity period is determined by the authentication center according to the security level of the device, the security level of the device is determined by the device information, and the device information is sent by the terminal to the authentication center. For the first local authorization certificate or the second local authorization certificate request information, or the device information is found by the authentication center in the database according to the device identity information, the device The identity information is carried in the request information sent by the terminal to the authentication center for acquiring the first local authorization credential or the second local authorization credential.

S204. The terminal sends the service response.

Specifically, the terminal sends the service response corresponding to the service request to the authentication server, where the authentication server stores the public key of the authentication center, and verifies the signature information generated by using the private key of the authentication center in the local authorization certificate by using the public key of the authentication center. The local authorized public key in the local authorization certificate verifies the signature information generated by the local authorized private key in the service response, and obtains the verification result of the terminal legality certificate. When the verification is passed, the verification result and/or the service related data in the response are obtained, for example, The transaction order information at the time of fingerprint payment is sent to the service server. When a business request is for a business execution request, The service execution response corresponding to the execution request includes the signature information generated by using the service private key, and the signature information generated by the service private key saved by the service registration or the service public key attached to the service response is used to prove the service execution. The service registration response corresponding to the service registration request corresponding to the service execution response is from the same terminal.

In this embodiment, the trust mechanism is established in the service server trust authentication center, and then trusts the terminal authenticated by the authentication center to trust the local authorization credential in the terminal; therefore, the verification of the terminal legality verification requires a two-layer check: first according to The certificate authority public key verifies the local authorization certificate signed by the certificate authority, and then verifies the validity of the terminal by verifying the signature information generated by the terminal using the local authorized private key according to the local authorized public key in the certificate.

In the method for using the local authorization credential in the terminal shown in FIG. 2, the authentication center delivers a credential for providing the terminal legality certificate to the terminal, so that the terminal can provide the legality proof of the terminal locally, and does not need to provide the terminal every time. The proof of legality goes to the authentication center, which can reduce the resource consumption of the terminal, shorten the operation time of the service, and improve the efficiency of the service request processing.

Based on the system architecture shown in FIG. 1, please refer to FIG. 3. As shown in FIG. 3, FIG. 3 is a schematic flowchart of a method for generating a local authorization credential, wherein the local authorization credential is generated from a unified identity authentication client. As described in the perspective of the terminal 1012 (the unified authentication trusted application 1013) and the authentication center 103, as shown in FIG. 4, the method for generating the local authorization credential includes the following steps:

S301. The unified identity authentication client (the unified identity authentication trusted application) initiates a local authorization certificate application to the authentication center.

Specifically, the step may be performed in advance to obtain and save the local authorization credential in the terminal before the service registration request is received, or in the service registration or service execution process, when the terminal does not have the local authorization credential locally, or The local authorization certificate saved locally by the terminal exceeds the validity period, or the local authorization certificate saved locally by the terminal does not meet the service type requirement. The terminal needs to go to the authentication center to update the local authorization certificate, and then perform this step.

S302: A unified identity authentication client (Uniform Identity Authentication Trusted Application) collects device information.

Specifically, the device information may be provided by the unified identity authentication client (a unified identity authentication trusted application) when the authentication center receives the local authorization certificate application, or may be a certification center and a unified identity authentication. The client (Uniform Authentication Trusted Application) is pre-agreed. The device information may include a device ID, a vendor identifier, a device storage environment, and the like. The local authorization key pair specification may be a key length, an encryption algorithm, or the like. When the authentication center receives the local authorization credential application, the authentication center may simultaneously send the challenge information and the local authorization key specification for identifying the local authorization credential to the unified identity authentication client (the unified identity authentication may be Letter application).

S303. The unified identity authentication client (Uniform Authentication Trusted Application) generates a local authorization key pair.

Specifically, if the authentication center delivers the local authorization key pair specification requirement, the local authorization key pair generates the local authorization key pair according to the local authorization key pair specification requirement, and the The local authorized private key is securely stored and can be stored in a secure storage environment such as TEE or SE, or other possible secure storage environments. The terminal legality certificate can be constructed by the signature and the voucher generated by the private key.

S304. The unified identity authentication client (Uniform Identity Authentication Trusted Application) generates local authorization certificate application information.

Specifically, the local authorization credential application information may include: the local authorized public key, device information or device identity information, signature information generated using an original device manufacturer private key, and the generated by using an original device manufacturer private key The signature information is used to prove the validity of the terminal to the authentication center, wherein the original device manufacturer private key is a pre- Generated and stored in a secure storage environment. If the authentication center sends the challenge information to the unified identity authentication client (the unified identity authentication trusted application), the local authorization certificate application information may further include: the challenge information.

S305. The unified identity authentication client (the unified identity authentication trusted application) sends the local authorization certificate application information to the authentication center.

S306. The certification center generates a local authorization credential.

Specifically, the generating, by the certificate authority, the local authorization certificate may further include: verifying the local authorization voucher application information, where the specific process is: verifying the challenge information, and verifying the local authorization voucher application information by using the original device manufacturer public key prestored by the certification center. The terminal uses the signature information generated by the original device manufacturer private key to determine the legitimacy of the terminal.

After the local authorization credential application information is verified, the certification center may determine the validity period of the local authorization credential to be generated according to the device information. The specific process may be as follows: determining, by the device information, a corresponding device security level, and determining the validity period according to the device security level. The device information is carried in the request information for acquiring the first local authorization credential or the second local authorization credential request information sent by the terminal to the authentication center, or the device information is The authentication center searches for the device according to the device identity information, where the device identity information is request information sent by the terminal to the authentication center for acquiring the first local authorization credential or the second local authorization credential. It can be carried in the device ID, device model, and so on. If the local authorization certificate is not saved locally, the request information of the first local authorization credential sent to the authentication center or the second local authorization credential request information sent to the authentication center refers to the request information of the local authorization credential. If the local authorization credential saved locally by the terminal exceeds the expiration date, or the local authorization credential saved locally by the terminal does not meet the service type requirement, the first local authorization credential refers to the local authorization credential currently not satisfying the requirement in the terminal, and the second The authorization credential refers to the local authorization credential regenerated by the certificate authority based on the information of this application.

Further, the authentication center may also establish its own device security level evaluation system. According to the terminal device information, it may be a storage environment of the terminal, and determine a device security level of the terminal. The device security level may be used to determine a local authorization certificate. The expiration date also confirms the voucher security level of the local authorization voucher.

For example, refer to Table 3 and the corresponding description of Table 3 in step S203.

The local authorization credential may include a validity period, a local authorized public key, and signature information generated by using the authentication center private key, and may also include the device information, and may also include a security level of the credential.

S307. The authentication center sends the local authorization credential to the unified identity authentication client (Uniform Identity Authentication Trusted Application).

Specifically, the local authorization credential is stored in a secure storage environment of the terminal, such as in a TEE or SE, or in other possible secure storage environments.

Based on the system architecture shown in FIG. 1, please refer to FIG. 4. FIG. 4 is a schematic flowchart of a method for using a local authorization credential in a terminal according to an embodiment of the present invention, where a method for using a local authorization credential in the terminal is The application client 1011, the unified identity authentication client 1012 (the unified identity authentication trusted application 1013), the service server 1021, and the authentication server 1022 are described. The unified identity authentication client 1012 (the unified identity authentication trusted application 1013) The corresponding steps may be performed by the unified identity authentication client, or may be performed by the unified identity authentication trusted application. As shown in FIG. 3, the method for using the local authorization credential in the terminal may include the following steps.

S401. The application client initiates service registration with the service server.

Specifically, the user can initiate a service registration in the terminal by using the application client. The service registration can be a fingerprint service or a face service of an application. For example, the user can open a “fingerprint login” or “fingerprint payment” in an application client of the terminal. "Function, that is, the business registration that triggers the corresponding fingerprint service.

S402: The service server generates a service type requirement.

In an embodiment, when the service server determines that the service needs to provide the terminal legality certificate, the service type requirement includes a risk management requirement, where the risk management requirement is generated by the service server for the local authorization certificate, and is used for Ensure that the terminal's legality of the terminal provided by the local authorization certificate meets the needs of the service. The service server may be based on at least one factor such as the sensitivity of the service, the security requirement of the service, the risk analysis result of the business server risk management system, and the risk sensitivity of the current transaction, and may specifically relate to the money transaction and the involved The amount of money transactions, whether it is in line with trading habits, etc., is divided into different levels. In terms of the sensitivity of the business, the service server can classify different service requests according to the sensitivity of the service or the security level of the service, and allocate the services for different categories. Different risk management requirements. On the other hand, the service type requirement may include risk management requirements, and may also include other requirements, such as application client version requirements, and the risk management requirements include risk management parameters and risk management thresholds, and the risk management requirements are for the local authorization. The parameter type generated in the voucher, such as the validity period, the security level of the voucher, and so on.

S403. The service server sends a service registration notification including a service type requirement to the authentication server.

Specifically, the service server receives the service registration sent by the application client, and sends a service registration notification to the authentication server when receiving the service registration.

S404. The authentication server generates a service registration request and sends the service registration request to the service server.

Specifically, the service registration request includes the service type requirement, and when receiving the service registration notification, the authentication server generates a service registration request, and is used to request the terminal to complete registration of the corresponding service according to the specified process, where the specified process includes the terminal being registered. Proof of terminal legality is provided during the process. The authentication server stores a corresponding authentication server certificate, and the service registration request generated by the authentication server includes the authentication server certificate, which is used to prove the legality of the authentication server, and the service registration request further includes the identifier for identifying the registration. Challenge information and/or signature information generated using the authentication server private key. Among them, the business registration request is a kind of business request.

S405. The service server sends the service registration request to the unified identity authentication client (Uniform Identity Authentication Trusted Application).

Specifically, the authentication server sends the service registration request to the unified identity authentication client (the unified identity authentication trusted application) via the service server and the application client. At this time, if the service registration process needs to collect the user information, the terminal may pass the The application client notifies the user to input biological information, such as fingerprints, voices, images, etc., and the terminal receives and saves the information input by the user.

S406. The unified identity authentication client (Uniform Identity Authentication Trusted Application) detects the legality of the service registration request.

Specifically, the unified authentication trusted application can extract the CRL and the certificate authority root certificate preset in the secure storage environment, the authentication server certificate includes the authentication server public key, and the unified identity authentication client (the unified identity authentication trusted application) detects the service registration. The legality of the request is as follows: by checking whether the authentication server is in the CRL, it is confirmed whether the authentication server is revoked, and the server certificate is verified by the certificate authority root certificate, after the above two verifications are passed. Indicates that the service registration request is from a legitimate authentication server.

S407. The unified identity authentication client (Uniform Authentication Trusted Application) generates an asymmetric service key pair.

Specifically, the asymmetric service key pair is generated for the service registration request, and the service private key may be stored in a secure storage environment of the terminal, such as TEE or SE, or other possible secure storage environments.

S408. The unified identity authentication client (Uniform Authentication Trusted Application) detects whether there is a local authorization certificate locally, and detects whether the local authorization certificate is within a validity period.

Specifically, the service registration request is required to provide the terminal legality certificate, and the service registration request includes the indication information, and the terminal determines, according to the indication information, that the terminal legality certificate needs to be provided, the terminal first attempts to obtain the local authorization certificate stored in the terminal, and locally constructs the Proof of terminal legality. The local authorization credential may be generated and sent by the authentication center after the terminal initiates the service registration for the first time, and then the terminal applies to the authentication center before the service registration is performed. The embodiment is not limited. If the local authorization certificate has been saved in the current terminal, it is detected whether the local authorization certificate is within the validity period. The local authorization credential may include a validity period, a local authorized public key, and signature information generated by using the authentication center private key, and may also include device information or device identity information, where the validity period may be that the authentication center corresponds to the device information. The device security level is generated.

S409. The unified identity authentication client (Uniform Identity Authentication Trusted Application) detects whether the local authorization certificate meets the service type requirement.

Specifically, in this embodiment, when the terminal locally stores the local authorization credential, and the local authorization credential is within the validity period, the terminal can provide the terminal legality certificate locally. Then, the unified identity authentication client (the unified identity authentication trusted application) needs to determine whether the local authorization certificate currently obtained by the terminal satisfies the service requirement according to the service type requirement in the service registration request, and further determines whether the current usage can be used. The obtained local authorization credential is used to construct the terminal legality certificate.

When the local authorization certificate meets the service type requirement, indicating that the terminal authorization certificate can be constructed by using the local authorization certificate, step S410 is performed; when the terminal does not have a local authorization certificate locally, or the local authorization If the certificate exceeds the validity period, or if the local authorization certificate does not meet the service type requirement, it indicates that the terminal does not have a local authorization certificate locally or the current local local authorization certificate cannot be used to construct a service registration response corresponding to the service registration request, The authentication center needs to be re-applied to update the local authorization credential, that is, steps S301-S307 are performed to obtain the updated local authorization credential, and the service registration response corresponding to the service registration request is constructed by the updated local authorization credential.

S410. The unified identity authentication client (Uniform Identity Authentication Trusted Application) generates a service registration response.

Specifically, after determining that the terminal validity certificate can be constructed by using the local authorization credential, generating a service response including the terminal legality certificate: specifically including three parts, challenge information; including the service public key, the device ID, and other service data, such as biological information. Service data such as a hash value; a certificate of terminal validity including a local authorization credential and signature information generated using a local authorized private key. The service registration response formed by the above information may be sent to the authentication server by using the authentication server public key encryption in the authentication server certificate.

S411. The unified identity authentication client (the unified identity authentication trusted application) sends the service registration response to the authentication server.

Specifically, the service registration response is sent to the authentication server via the application client and the service server.

S412. The authentication server verifies the validity of the service registration response.

Specifically, the process of verifying the validity of the service registration response may be: decrypting the authentication server public key encryption information in the service registration response by using the authentication server private key, verifying the challenge information of the authentication server, and confirming the service registration request and the The service registration response is a business process; the certificate authority public key pre-stored by the authentication server is used to verify the signature of the authentication center private key in the local authorization certificate, and after the verification is passed, the local authorization public key in the local authorization certificate is obtained to verify the service registration response. The terminal uses the signature information generated by the local authorized private key to verify the validity certificate of the terminal through two verifications. The process indicates that the service registration response is from a legitimate terminal that has been verified by the certificate authority. Therefore, the registration process can continue. The authentication server saves the service public key and sends the verification result and the service related data to the service server to make the registration information. Landing, send a notification of successful registration to the terminal.

S413. The application client initiates service execution to the service server.

Specifically, after the service registration is successful, the execution process of the same service can be initiated in the terminal. If the service registration is not successful, the execution process of the service cannot be implemented. For example, after an application needs to register the fingerprint successfully, There are processes for implementing fingerprints. The user can initiate service execution through the application client in the terminal. The service execution can be fingerprint unlocking, face unlocking, and fingerprint payment of an application. For example, the user can click the “face unlock” button in an application client of the terminal, that is, Trigger business execution.

S414. The service server determines whether the current service needs to provide the terminal legality certificate.

Specifically, the service server may determine whether the terminal legality certificate is required according to the type of the service execution, or the application client determines whether the terminal legality certificate is required according to the preset rule of the service server, for example, if no sensitive service such as transfer is involved, The service server determines that the service does not need to provide the terminal legality certificate, or analyzes the service according to the risk control system of the service server to determine whether the legality certificate needs to be provided. Here, the service server can also be set up for different service execution types. List, classification manages the type of business execution that needs to provide proof of terminal legality. When receiving the service execution, the query is directly performed through the list to obtain whether the service execution needs to provide the terminal legality certificate of the terminal.

If the current service server determines that the service needs to provide the terminal legality certificate, it also needs to generate a corresponding service type requirement by referring to S402. In this embodiment, the service type requirement is generated by the service server, and is used to ensure that the terminal legality certificate constructed according to the local authorization credential in the service response can meet the risk management requirement of the current service.

For example, refer to Table 1 and Table 2 and the corresponding description of Table 1 and Table 2 in Step S203.

Optionally, the service type requirement may be preset by the service server in the application client, and when the application client detects that the service request is required to provide the terminal legality certificate, the service type requirement is added to the service request. Send to the unified identity authentication client (Uniform Identity Authentication Unified Authentication Trusted Application).

S415. The authentication server generates a service execution request and sends the service execution request to the service server.

Specifically, when the service execution needs to provide the terminal legality certificate, the authentication server generates a service execution request, and the service execution request may include a service type requirement, and may also include indication that the terminal legality certification indication information needs to be provided, where the indication information is Determined according to at least one preset field or determined according to at least one of the service type requirements. The service execution request may further include an authentication server certificate, signature information generated by using the authentication server private key, and challenge information for identifying the current service execution, and service related information, such as transaction order information when the fingerprint is paid, and may also include other Related information is not limited in this embodiment.

S416. The service server sends the service execution request to the unified identity authentication client (the unified identity authentication trusted application).

Specifically, the authentication server sends the service execution request to the unified identity authentication client (the unified identity authentication trusted application) via the service server and the application client. At this time, if the service execution needs to verify the user biometric information, the terminal may pass the application. The client notifies the user to input biological information, such as fingerprints, voices, images, etc., and compares with the information input by the user when the service is registered, and obtains the local biometric verification result. Further, the service type requirement and the indication information may be added by the application client, and then the service execution request for providing the terminal legality certificate is sent to the unified identity authentication client.

S417. The unified identity authentication client (Uniform Identity Authentication Trusted Application) detects the legality of the service execution request.

Specifically, detecting the validity of the service execution request includes: confirming whether the authentication server is revoked by searching for the authentication server in the CRL, and verifying the server certificate by using the root certificate of the certification authority, after the above two verifications are passed The business registration request comes from a legitimate server.

S418. The unified identity authentication client (Uniform Authentication Trusted Application) detects whether the local authorization certificate is saved locally, and if yes, detects whether the local authorization certificate is within the validity period.

Specifically, in the case that the terminal legality certificate is required to be provided, if the terminal does not locally save the local authorization credential, the steps S301-S307 may be performed to obtain the local authorization credential issued by the authentication center, and the subsequent steps are performed; If the local authorization certificate is saved, the validity period in the local authorization certificate is obtained, and it is determined whether the current local authorization certificate is within the validity period. If yes, step S419 is performed, and if the current local authorization certificate exceeds the validity period, step S301-S307 is performed. To re-acquire the local authorization credentials issued by the certificate authority, update the local authorization credentials, and perform the next steps.

For example, the validity period in the local authorization credential is valid within three months, and the unified authentication client (the unified authentication trusted application) detects that the local authorization credential is generated four months ago, indicating that the local authorization credential has exceeded Validity period, steps S301-S307 can be performed, the local authorization credential is updated and the subsequent steps are performed. If the local authorization credential is detected to be generated two months ago, it indicates that the local authorization credential is within the validity period, and the terminal can The terminal legality certificate is provided locally, and the subsequent steps are performed.

S419. The unified identity authentication client (Uniform Identity Trusted Application) detects whether the local authorization certificate meets the service type requirement.

Specifically, when the service type requirement includes the risk management requirement, the parameters in the local authorization credential may be obtained, such as obtaining the validity period in the local authorization credential and the security level of the credential, and comparing the risk management requirement with the parameter in the local authorization credential. Yes, to determine if the local authorization credentials meet the business type requirements. For example, taking Table 2 as an example, if the current local authorization credential is valid for 3 months, which is generated 2 months ago, the credential security level is 5 security, when the business execution request is fingerprint payment (small amount), this When the service type requirement corresponding to the voucher is "the local authorization voucher generated within 3 months is valid", the local authorization voucher can be judged to meet the risk management requirement in the service type requirement, and the current service can use the voucher to construct the terminal. Proof of legality; when the business execution request is a fingerprint payment (large amount), at this time, the service type requirement corresponding to the voucher is "the local authorization certificate generated within one month is valid", then it can be judged that the local authorization certificate does not satisfy the service. The risk management requirement in the type requirement, so the current service cannot use the voucher to construct the terminal legality certificate, so steps S301-S307 need to be performed, the local authorization credential is updated, and the new local authorization credential is used to construct the service type. Proof of terminal legality required.

S420: A unified identity authentication client (Uniform Identity Authentication Trusted Application) generates a service execution response.

Specifically, the service execution response may include: challenge information; including biometric comparison results, using the service The service related data and the service related data of the signature information generated by the private key may further include a biometric hash and a service public key; and the terminal legality certificate including the local authorization credential and the signature generated by using the local authorized private key. The biometric comparison result is obtained by comparing the biometric information collected by the application client and the biometric information locally saved in the service registration phase during the business execution phase. The service execution response may further include the current biometric hash. Further, the identifier information may be added, and the indication information is used to indicate that the service execution response includes the locally constructed terminal legality certificate. The service execution response is encrypted by the authentication server public key in the authentication server certificate.

S421. The unified identity authentication client (the unified identity authentication trusted application) sends the service execution response to the authentication server.

Specifically, the service execution response is sent to the authentication server via the application client and the service server.

S422. The authentication server verifies the validity of the service execution response.

Specifically, the process of verifying the validity of the service execution response is: decrypting the authentication server public key encryption information in the service execution response using the authentication server private key, verifying the challenge information of the authentication server, and confirming the service execution request and the service The execution response is a business process; the signature information generated by the authentication center private key in the local authorization certificate is verified by using the certificate authority public key pre-stored by the authentication server, and after the verification is passed, the local authorization public key in the local authorization certificate is obtained to verify the service execution. The signature information generated by the local authorized private key in the response is used to prove that the validity of the terminal is valid. Alternatively, the risk management requirement in the service type requirement and the proof of the terminal legality can be compared again. When the service registration is successful, the service public key stored in the service server or attached to the service execution response verifies the signature information generated by using the service private key, and the service execution response is legal, and the verification result is notified to the service server, and Execute the corresponding industry on the business server The follow-up process. For example, when the business execution is a fingerprint login, the signature generated by the private key of the service is verified, and after the verification result is valid in the response, the service server is notified to perform the login operation; for example, when the fingerprint is paid, the signature generated by the private key of the service is verified, and the response is determined. After the verification result and the order information are correct, the payment operation is performed.

The authentication server may further determine, according to the identifier information, whether the current service execution triggers the terminal legality proof, for example, the partial or all data segments of the terminal validity of the service response may be used as the identification information. The identification step may be generated by a unified identity authentication client or an application client.

In the method for using the local authorization credential in the terminal shown in FIG. 4, the authentication center delivers a credential for providing the terminal legality certificate to the terminal, so that the terminal can locally provide the legality certificate of the terminal, and the locally saved credential is It can be proved that the terminal is legal, and it is not necessary to go to the authentication center every time the service is executed, thereby reducing the resource consumption of the terminal, shortening the operation time of the service, and improving the efficiency of the service request processing.

Based on the system architecture shown in FIG. 1, please refer to FIG. 5. FIG. 5 is a schematic structural diagram of an apparatus for using local authorization credentials according to an embodiment of the present invention. As shown in FIG. 4, the apparatus may include:

The local authorization credential obtaining module 501 is configured to obtain a local authorization credential in the terminal when the service request is received, where the service request is required to provide the terminal legality certificate, and the local authorization credential is authorized by the authentication center. Preserving a voucher capable of providing the terminal legality certificate in the terminal;

The service response sending module 502 is configured to generate and send a service response corresponding to the service request according to the local authorization credential and the service request, where the service response includes the terminal legality certificate.

As a possible implementation manner, the terminal legality certificate includes signature information generated by using a local authorized private key, and the local authorized private key is sent by the terminal to the authentication center for Get the place The request information describing the local authorization credentials is generated and saved locally.

As a possible implementation manner, the service request is one of a service registration request and a service execution request, and when the service request is the service registration request, the service response further includes a service public key, where When the service request is a request for the service, the service response further includes signature information generated by using a service private key, where the service public key and the service private key are corresponding to the terminal receiving the service execution request. When the service registration request is generated, the signature information generated by using the service private key is used to prove that the service execution response is sent by the terminal that sends the service registration response, and the service execution response is the service corresponding to the service execution request. In response, the service registration response is a service response corresponding to the service registration request.

As a possible implementation manner, the service response sending module 502 is specifically configured to: if the first local authorization credential exists in the terminal, and the first local authorization credential is within a valid period, and the first local The authorization certificate satisfies the service type requirement of the service request, and the terminal validity certificate is constructed by using the first local authorization certificate to generate a service response corresponding to the service request, and the service response is sent.

As a possible implementation manner, the service request includes the service type requirement, where the service type requirement includes a risk management requirement, where the risk management requirement is generated by the service server for the first local authorization certificate, A service request is sent for the service server.

As a possible implementation manner, the service response sending module 502 is specifically configured to: if the first local authorization credential does not exist in the terminal, or if the first local authorization credential in the terminal exceeds a validity period, Or if the first local authorization credential does not satisfy the service type requirement of the service request, sending, to the authentication center, request information for acquiring the second local authorization credential, so that the authentication center generates the second local Authorization certificate;

Receiving and saving the second local authorization credential;

And using the second local authorization credential to construct a service response corresponding to the service request, and sending the service response.

As a possible implementation manner, the request information for acquiring the second local authorization credential includes at least one of device information or device identity information, an original device manufacturer signature, and a local authorization public key to enable the authentication. Determining, by the device information or the device identity information, the stored original device manufacturer public key to verify the original device manufacturer signature, and generating the second local authorization credential, where the local authorized public key is the local authorization a public key corresponding to the private key, the device information and the device identity information are information that the authentication center requests the terminal to provide when receiving the request information of the second local authorization certificate, or the authentication center Information that is negotiated in advance with the terminal.

As a possible implementation manner, the first local authorization credential and the second local authorization credential include a validity period, the local authorization public key, and signature information generated by using an authentication center private key, where the authentication center private key is The certificate authority generates and saves the generated local authorization credentials.

As a possible implementation manner, the first local authorization credential and the second local authorization credential further include a credential security level, where the credential security level is determined by the authentication center according to the device information, the credential The security level is one of the types of business types required.

As a possible implementation manner, the local authorized public key is generated and saved locally by the terminal before sending the request information for acquiring the first local authorization credential to the authentication center, or the terminal It is generated and saved locally before sending the request information for acquiring the second local authorization credential to the authentication center.

As a possible implementation manner, the validity period is determined by the authentication center according to a security level of the device, a security level of the device is determined by the device information, and the device information is the terminal location And the second local authorization credential request information sent by the authentication center for acquiring the first local authorization credential, or the device information is found by the authentication center in the database according to the device identity information. The device identity information is carried in the request information that is sent by the terminal to the authentication center for acquiring the first local authorization credential or the second local authorization credential.

As a possible implementation, the device further includes an indication information detecting module 503, configured to detect whether the service request includes indication information for indicating that the terminal validity certificate is provided, if the service request includes And the step of the local authorization credential obtaining module 501 performing the obtaining the local authorization credential in the terminal.

As a possible implementation manner, the indication information is determined according to at least one preset field or determined according to at least one of the service type requirements.

Based on the system architecture shown in FIG. 1, please refer to FIG. 6. As shown in FIG. 6, FIG. 6 is a schematic structural diagram of a terminal for using the method for using the local authorization credential disclosed in the embodiment of the present invention. As shown in FIG. 6, the terminal may include a processor 601, a memory 602, a communication interface 603, and a bus 604. among them:

a bus 604 for implementing a connection between these components;

A set of program codes is stored in the memory 602, and the processor 601 is configured to invoke the communication interface 603 to perform the following operations:

Obtaining a local authorization credential in the terminal when the service request is received, where the service request is required to provide the terminal legality certificate, and the local authorization credential is authorized by the authentication center and saved in the terminal to provide the a certificate describing the legality of the terminal;

The processor 601 is further configured to call the program code stored in the memory 602 to perform the following operations:

And generating, according to the local authorization credential and the service request, a service response corresponding to the service request, where the service response includes the terminal legality certificate;

The communication interface 603 is further configured to send the service response.

As a possible implementation manner, the terminal legality certificate includes signature information generated by using a local authorized private key, and the local authorized private key is sent by the terminal to the authentication center for The request information for obtaining the local authorization credential is generated and saved locally.

As a possible implementation manner, the processor 601, according to the local authorization credential and the service request, generating a service response corresponding to the service request, specifically includes:

Using the first local authorization credential if the first local authorization credential exists in the terminal, and the first local authorization credential is within a valid period, and the first local authorization credential satisfies the service type requirement of the service request Construction The validity of the terminal is verified to generate a service response corresponding to the service request.

As a possible implementation manner, if the first local authorization credential does not exist in the terminal, or if the first local authorization credential in the terminal exceeds a validity period, or if the first local authorization credential is not satisfied Determining, by the terminal, the request information for acquiring the second local authorization credential, so that the authentication center generates the second local authorization credential;

Receiving and saving the second local authorization credential by the terminal;

As a possible implementation manner, the request information for acquiring the second local authorization credential includes at least one of device information or device identity information, signature information generated by using an original device manufacturer private key, and a local authorized public key. And generating, by the authentication center, the signature information generated by using the original device manufacturer private key according to the device information or the device identity information to search the stored original device manufacturer public key, to generate the second local authorization certificate. The local authorized public key is a public key corresponding to the local authorized private key, and the device information and the device identity information are required by the authentication center when receiving the request information of the second local authorization credential. The information provided by the terminal or the information that the authentication center negotiates with the terminal in advance.

As a possible implementation manner, the validity period is determined by the authentication center according to the security level of the device, the security level of the device is determined by the device information, and the device information is that the terminal is authenticated to the terminal. The information sent by the center for obtaining the first local authorization credential or the second local authorization credential request information, or the device information is found by the authentication center in the database according to the device identity information. The device identity information is carried in the request information sent by the terminal to the authentication center for acquiring the first local authorization credential or the second local authorization credential.

As a possible implementation manner, the processor 601 is further configured to call the program code stored in the memory 602 to perform the following operations:

Detecting whether the service request includes indication information for indicating that the terminal legality certificate is provided, if And the step of performing the obtaining the local authorization credential in the terminal by using the indication information for indicating that the terminal validity certificate is provided.

The embodiment of the present invention also discloses a readable storage medium storing program code of a device and/or a terminal for executing a method of using the local authorization credential shown in FIGS. 2 and 3.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using a software program, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.). The computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media. The usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)) or the like.

A person of ordinary skill in the art may understand that all or part of the steps of the foregoing embodiments may be completed by a program instructing related hardware, and the program may be stored in a readable storage medium, and the storage medium may include: a flash drive , read-only memory (ROM), random access memory (RAM), disk or optical disk.

Claims

A method for using a local authorization credential in a terminal, comprising:

When the terminal receives the service request, acquiring a local authorization credential in the terminal, where the service request is required to provide a terminal legality certificate, and the local authorization credential is authorized by the authentication center and saved in the terminal to provide a certificate of the terminal legality certificate;

And the terminal generates and sends a service response corresponding to the service request according to the local authorization credential and the service request, where the service response includes the terminal legality certificate.
The method of claim 1, wherein the terminal validity certificate comprises signature information generated using a local authorized private key and the local authorization credential, the local authorized private key being the terminal being The certificate center generates and saves the request information for obtaining the local authorization credential before it is generated locally.
The method according to claim 1, wherein the service request is one of a service registration request and a service execution request, and when the service request is the service registration request, the service response further includes a service a public key, when the service request is a service execution request, the service response further includes signature information generated by using a service private key, where the service public key and the service private key are received by the terminal When the service execution request is corresponding to the service registration request, the signature information generated by using the service private key is used to prove that the service execution response is sent by the terminal that sends the service registration response, and the service execution response is the service. Performing a service response corresponding to the request, where the service registration response is a service response corresponding to the service registration request.
The method according to claim 1, wherein the terminal generates and sends a service response corresponding to the service request according to the local authorization credential and the service request, which specifically includes:

Using the first local authorization credential if the first local authorization credential exists in the terminal, and the first local authorization credential is within a valid period, and the first local authorization credential satisfies the service type requirement of the service request Constructing the terminal legality certificate to generate a service response corresponding to the service request, and sending the service response.
The method of claim 4, wherein the service request includes the service type requirement, the service type requirement includes a risk management requirement, and the risk management requirement is that the service server is for the first local authorization certificate The generated service request is sent by the service server.
The method according to claim 2, wherein the terminal generates and sends a service response corresponding to the service request according to the local authorization credential and the service request, and specifically includes:

If the first local authorization credential does not exist in the terminal, or if the first local authorization credential in the terminal exceeds a validity period, or if the first local authorization credential does not satisfy the service type requirement of the service request, Sending, by the terminal, request information for acquiring a second local authorization credential to the authentication center, so that the authentication center generates the second local authorization credential;

Receiving and saving the second local authorization credential by the terminal;

The terminal constructs a service response corresponding to the service request by using the second local authorization credential, and sends the service response.
The method according to claim 6, wherein the request information for acquiring the second local authorization credential comprises at least one of device information or device identity information, and signature information generated using an original device manufacturer private key Authorizing the public key locally, so that the authentication center searches for the stored original device manufacturer public key according to the device information or the device identity information to verify the signature information generated by using the original device manufacturer private key, and generates the Second a local authorization certificate, where the local authorization public key is a public key corresponding to the local authorization private key, and the device information and the device identity information are request information that the authentication center receives the second local authorization certificate At the time, the information provided by the terminal or the information that the authentication center negotiates with the terminal in advance is requested.
The method of claim 7, wherein the first local authorization credential and the second local authorization credential comprise a validity period, the local authorization public key, and signature information generated using a certificate authority private key, The authentication center private key is generated by the authentication center and stored in the authentication center, and the authentication center private key is used to generate the local authorization credential.
The method according to claim 8, wherein said first local authorization credential and said second local authorization credential further comprise a credential security level, said credential security level being determined by said authentication center based on said device information The credential security level is one of the types of service requirements.
The method according to claim 8, wherein said local authorized public key is generated and saved locally by said terminal before transmitting request information for obtaining said first local authorization credential to said authentication center Or the terminal generates and saves locally before sending the request information for acquiring the second local authorization credential to the authentication center.
The method according to any one of claims 4 to 10, wherein the expiration date is determined by the authentication center according to a security level of the device, and the security level of the device is determined by the device information. The device information is carried in the second local authorization credential request information sent by the terminal to the authentication center for acquiring the first local authorization credential, or the device information is the authentication. The device is located in the database according to the device identity information, and the device identity information is carried in the request information that is sent by the terminal to the authentication center for acquiring the first local authorization certificate or the second local authorization certificate. of.
The method according to any one of claims 4 to 10, wherein, when the service request is received, the method further includes:

Detecting whether the service request includes indication information for indicating that the terminal validity certificate is provided, and if the service request includes the indication information for indicating that the terminal legality certificate is provided, performing the obtaining The step of local authorization credentials in the terminal.
The method according to claim 12, wherein the indication information is determined according to at least one preset field or determined according to at least one of the service type requirements.
A device for using a local authorization credential, comprising:

a local authorization credential obtaining module, configured to acquire a local authorization credential in the terminal when the service request is received, where the service request is required to provide a terminal legality certificate, where the local authorization credential is authorized by the authentication center and saved in the terminal Providing a certificate of the terminal legality certificate;

And a service response sending module, configured to generate and send a service response corresponding to the service request according to the local authorization credential and the service request, where the service response includes the terminal legality certificate.
The apparatus according to claim 14, wherein said terminal validity certificate comprises signature information generated using a local authorized private key and said local authorization credential, said local authorized private key being said terminal being said to said terminal The certificate center generates and saves the request information for obtaining the local authorization credential before it is generated locally.
The apparatus according to claim 14, wherein said service request is a service registration request and a service execution One of the line requests, when the service request is the service registration request, the service response further includes a service public key, and when the service request is the service execution request, the service response further includes using The signature information generated by the service private key, where the service public key and the service private key are generated when the terminal receives the service registration request corresponding to the service execution request, and the signature information generated by using the service private key is used by The service execution response is sent by the terminal that sends the service registration response, and the service execution response is a service response corresponding to the service execution request, and the service registration response is a service response corresponding to the service registration request.
The device according to claim 14, wherein the service response sending module is configured to: if a first local authorization credential exists in the terminal, and the first local authorization credential is within a valid period, and The first local authorization certificate satisfies the service type requirement of the service request, and the terminal validity certificate is constructed by using the first local authorization certificate to generate a service response corresponding to the service request, and the service response is sent.
The apparatus according to claim 17, wherein said service request includes said service type requirement, said service type requirement includes a risk management requirement, and said risk management request is said service server for said first local authorization certificate The generated service request is sent by the service server.
The device according to claim 15, wherein the service response sending module is configured to: if the first local authorization credential does not exist in the terminal, or if the first local authorization in the terminal The voucher exceeds the validity period, or if the first local authorization voucher does not satisfy the service type requirement of the service request, the request information for acquiring the second local authorization voucher is sent to the authentication center, so that the authentication center generates the Describe the second local authorization credential;

Receiving and saving the second local authorization credential;

And using the second local authorization credential to construct a service response corresponding to the service request, and sending the service response.
The apparatus according to claim 19, wherein the request information for acquiring the second local authorization credential comprises at least one of device information or device identity information, a signature generated using an original device manufacturer private key, Authorizing the public key locally, so that the authentication center searches the stored original device manufacturer public key according to the device information or the device identity information to verify the original device manufacturer signature, and generates the second local authorization certificate. The local authorized public key is a public key corresponding to the local authorized private key, and the device information and the device identity information are required by the authentication center when receiving the request information of the second local authorization credential. Information provided by the terminal, or information that the authentication center negotiates with the terminal in advance.
The apparatus of claim 20, wherein the first local authorization credential and the second local authorization credential comprise a validity period, the local authorization public key, and signature information generated using a certificate authority private key, The authentication center private key is generated by the authentication center and stored in the authentication center, and the authentication center private key is used to generate the local authorization credential.
The apparatus according to claim 21, wherein said first local authorization credential and said second local authorization credential further comprise a credential security level, said credential security level being determined by said authentication center based on said device information The credential security level is one of the types of service requirements.
The apparatus according to claim 21, wherein said local authorized public key is generated and saved locally by said terminal before transmitting request information for obtaining said first local authorization credential to said authentication center Or the terminal generates and saves locally before sending the request information for acquiring the second local authorization credential to the authentication center.
The device according to any one of claims 17 to 23, wherein the expiration date is determined by the authentication center according to a security level of the device, and a security level of the device is determined by the device information, The device information is carried in the second local authorization credential request information sent by the terminal to the authentication center for acquiring the first local authorization credential, or the device information is the authentication. The device is located in the database according to the device identity information, and the device identity information is carried in the request information that is sent by the terminal to the authentication center for acquiring the first local authorization certificate or the second local authorization certificate. of.
The device according to any one of claims 17 to 23, wherein the device further comprises:

The indication information detecting module is configured to detect whether the service request includes indication information for indicating that the terminal validity certificate is provided, if the service request includes the indication for indicating that the terminal legality certificate is provided The information, the local authorization credential obtaining module performs the step of acquiring the local authorization credential in the terminal.
The apparatus according to claim 25, wherein the indication information is determined according to at least one preset field or determined according to at least one of the service type requirements.
A computer readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of claims 1-13.
A terminal, the terminal comprising: a processor, a memory, a communication interface, and a bus;

The processor, the communication interface, and the memory communicate with each other through the bus;

The communication interface is configured to receive and send data;

The memory is configured to store an instruction;

The processor is configured to invoke an instruction in the memory to perform the method of any one of claims 1-13.