CN106488452A - A kind of mobile terminal safety access authentication method of combination fingerprint - Google Patents

Abstract

The invention provides a mobile terminal safety access authentication method combined with fingerprints, which includes four steps of establishing an encrypted channel, user registration, user information review and user service access. The client collects terminal characteristic information, including USBKEY serial number, digital certificate serial number, mobile terminal serial number and user fingerprint characteristic information, uploads it to the secure access gateway through an encrypted channel, and the secure access gateway verifies the integrity and validity of the terminal information , and determine whether the terminal can access the protected server according to the verification result. By combining fingerprint identification technology with traditional identification methods, the media for identifying identities is directly related to the natural person itself, realizing the real correspondence between identification and the identified person, and effectively improving the security level of mobile terminal information access , It is more conducive to the role of convenient mobile technology in information application.

Description

A mobile terminal security access authentication method combined with fingerprint

technical field

The invention relates to a mobile terminal security access authentication method, in particular to a mobile terminal security access authentication method combined with fingerprints.

Background technique

At present, terminal security mainly adopts authentication methods such as passwords, USBKEYs, digital certificates, etc., which only verify whether the user knows the certain information, and these media for identifying identities are not related to the identified person itself, not only It is easy to be lost and leaked, and under the existing technical conditions, it is not difficult to forge, so the traditional identification method can no longer meet the various intelligence requirements of the rapidly developing society, especially in terms of security and management. A new, more accurate and reliable identification technology.

Fingerprint identification technology is currently the most mature and cheap biometric identification technology. At present, the fingerprint recognition technology is the most widely used. Not only can fingerprint recognition technology be seen in access control and attendance systems, but there are more fingerprint recognition applications on the market: such as laptops, mobile phones, cars, and bank payments. recognition technology.

With the popularization and use of wireless mobile terminals such as smartphones and tablet computers, mobile office and remote operations have become more mature, making mobile office and operations more convenient and effective, and greatly improving work efficiency and benefits. However, due to the characteristics of mobile networks and terminals, information security problems caused by various network viruses and hacker attacks are becoming more and more serious. To ensure that confidential data is not leaked, and to realize the authentication of mobile access objects has become the top priority of mobile security access solutions. .

Traditional identity authentication technology generally adopts security chip technology and PKI technology, and its process is: (1) call the security chip to generate a certificate request file; (2) submit the certificate request file to the CA system to issue a certificate and obtain the certificate file; The security chip, certificate file and CA certificate file are placed on the mobile terminal, and the security client software is run; (4) The security client software communicates with the server, exchanges certificates of both parties, and verifies the signature of the other party's certificate through the respective CA certificate files to realize interaction Two-way verification of the identities of both parties; (5) Through key negotiation protocols, such as IPSec VPN, SSL VPN or custom protocols, etc., negotiate the working key for data transmission between the two parties;

Traditional identification technology only verifies the device with security chip and digital certificate, but cannot verify the identity of the person using the device. If the device is obtained by an illegal person, it will be able to perform all the operations allowed by the device, which will inevitably lead to information disclosure and accountability for errors.

Contents of the invention

The technical problem to be solved by the present invention is that the existing identification technology only verifies the equipment with the safety chip and the digital certificate, but cannot verify the identity of the person using the equipment.

In order to solve the above-mentioned technical problems, the present invention provides a mobile terminal security access authentication method combined with fingerprints, comprising the following steps:

Step 1, establish an encrypted channel, the client calls the USBKEY and the digital certificate stored in the USBKEY, and completes the two-way identity verification based on the digital certificate and the encrypted channel negotiation based on the national secret SM1 algorithm according to the SSLVPN protocol;

Step 2, user registration, the specific steps are:

Step 2.1, the client terminal collects the terminal characteristic information, and prompts the user to enter the fingerprint to obtain the fingerprint characteristic information, and then uploads the terminal characteristic information and fingerprint characteristic information as user registration information to the secure access gateway through an encrypted channel;

In step 2.2, the secure access gateway receives the user registration information uploaded by the client, stores the user registration information in the database, and sets the initial audit result of the user registration information as "unverified", and unverified users do not have the access control information. Protect the authority of the server;

Step 3, user information review, the protected server will review the unreviewed user registration information in the database, check its validity and integrity, and focus on checking whether it is a legitimate user, and set up its review for illegal user registration information The result is "failed", and for legitimate user registration information, set the review result to "passed";

Step 4, user business access, the specific steps are:

Step 4.1, the client collects the user's fingerprint feature information, and uploads the fingerprint feature information together with the terminal feature information to the secure access gateway. The secure access gateway searches the database according to one item of terminal feature information. If the corresponding If there is no user registration information record, go to step 4.2, if no corresponding user registration information record is found, go to step 4.3;

In step 4.2, the security access gateway checks the audit status of the user's registration information. If the audit result is "not audited" or "failed", the security access gateway returns a failure result and terminates the user's client access to the protected server If the audit result is "Passed", compare the terminal feature information submitted by the user's client this time with the terminal feature information stored in the database. The ingress gateway returns a failure result and terminates the user's client to access the protected server. If they are completely consistent, the security access gateway returns the authentication success result to the user's client and allows the user's client to access the protected server;

In step 4.3, the secure access gateway adds a new user registration information record in the database, sets the initial verification result of the user registration information as "unverified", and waits for the protected server to verify.

Add user fingerprint feature information during user registration, so as to verify fingerprint feature information during user business access, effectively verify the identity of the person using the client, prevent the protected server from being accessed illegally, and enhance use security; Searching the database for a piece of data in the terminal feature information can ensure the timeliness of searching the database and improve the response speed of the system; using a secure access gateway to check the audit status of user registration information can further ensure access to protected servers behavioral security.

As a further limiting solution of the present invention, the terminal feature information in step 2.1 includes the serial number of the USBKEY, the serial number of the digital certificate and the serial number of the mobile terminal. Using terminal characteristic information can facilitate the registered verification of the legitimacy of the client by the protected server.

As a further limiting solution of the present invention, in step 4.1, the secure access gateway searches the database according to the serial number of the digital certificate in the terminal feature information. Using the digital certificate serial number to search the database can ensure the timeliness of searching the database and improve the response speed of the system.

As a further limiting solution of the present invention, the illegal user registration information in step 3 is classified into incomplete user registration information or wrong user registration information. The illegal definition of incomplete or wrong user registration information can further ensure the security of protected server access.

As a further limiting solution of the present invention, in step 3, for the user registration information whose audit result is "failed", if it is caused by a wrong operation of a legal user, the client will apply to the protected server to delete the original user registration information record, And resubmit the user registration information. This design can facilitate legal users to appeal and avoid accidental injury of legal users.

The beneficial effects of the present invention are as follows: (1) By adding user fingerprint feature information during the user registration process, the medium for identifying identity is directly related to the natural person itself, so that the fingerprint feature information can be verified during user service access, and identity recognition can be realized. It truly corresponds to the identified person itself, effectively verifies the identity of the person using the client, prevents the protected server from being accessed illegally, enhances the security of use, and solves the security defect that the traditional identity authentication technology only authenticates the device but does not authenticate the user of the device ; (2) Using one item of terminal characteristic information to search the database can ensure the timeliness of searching the database and improve the response speed of the system; (3) Use the secure access gateway to check the audit status of user registration information, It can further ensure the security of access to protected servers; (4) By binding user fingerprint feature information with digital certificate information, USBKEY information, and mobile terminal information, the identity of the user is verified on the basis of verifying the legitimacy of the device, realizing Double verification of the user and the device used; (5) The comparison of user characteristic information on the server side increases the difficulty for illegal users to bypass verification; (6) The transmission of user characteristic information through secure encryption technology ensures that the information is transmitted (7) Associating the identity verification result with the terminal access authority, the mobile terminal is isolated from the protected server through the security access gateway, and only the authenticated user is allowed by the security access gateway. Access to protected servers.

Description of drawings

Fig. 1 is a system block diagram of the present invention;

Fig. 2 establishes flow chart for the encryption channel of the present invention;

Fig. 3 is the flow chart of user registration of the present invention;

Fig. 4 is the audit flow chart of the present invention;

Fig. 5 is a flow chart of the present invention.

detailed description

As shown in Figures 1-5, the mobile terminal secure access authentication method combined with fingerprints disclosed by the present invention adopts the client/server mode, and the mobile terminal installs client software, and the software first uses USBKEY and digital certificate to negotiate with the secure access gateway Certificate-based identity authentication and encryption channel establishment based on national secret algorithm, and then collect terminal characteristic information, including USBKEY serial number, digital certificate serial number, mobile terminal serial number and user fingerprint characteristic information, and upload them to the secure access gateway through the encrypted channel . The secure access gateway verifies the integrity and validity of the terminal information, and determines whether the terminal can access the protected server according to the verification result. Specifically include the following steps:

Step 1, establish an encrypted channel, the user calls the USBKEY and the digital certificate stored in the USBKEY through the client, and completes the two-way identity verification based on the digital certificate and the encrypted channel negotiation based on the national secret SM1 algorithm according to the SSL VPN protocol. This process is different from the existing The encrypted channel establishment process is the same;

Step 2, user registration, the specific steps are:

Step 2.1, when the user runs the client for the first time, the client collects terminal feature information and prompts the user to enter the fingerprint to obtain the fingerprint feature information, and then uploads the terminal feature information and fingerprint feature information as user registration information to the secure interface through an encrypted channel. Incoming gateway, wherein, terminal characteristic information comprises USBKEY serial number, digital certificate serial number and mobile terminal serial number;

In step 2.2, the secure access gateway receives the user registration information uploaded by the client, stores the user registration information in the database, and sets the initial audit result of the user registration information as "unverified", and unverified users do not have the access control information. Protect the authority of the server;

Step 3, user information review, the system administrator of the protected server will review the unreviewed user registration information in the database, check its validity and integrity, and focus on checking whether it is a legitimate user, and for illegal user registration information , set the audit result to "failed", and set the audit result to "pass" for legal user registration information. Among them, illegal user registration information is divided into incomplete user registration information or wrong user registration information. For audit If the result is "failed" user registration information, if it is caused by a legitimate user's wrong operation, the user will apply to the system administrator of the protected server through the client to delete the original user registration information record, and resubmit the user registration information;

Step 4, user business access, the specific steps are:

Step 4.1, the user runs the client, and the client collects the user's fingerprint characteristic information, and uploads the fingerprint characteristic information together with the terminal characteristic information to the secure access gateway, and the secure access gateway uses the digital certificate serial number in the terminal characteristic information to Search the database, if the corresponding user registration information record is found, then enter step 4.2, if no corresponding user registration information record is found, then enter step 4.3;

In step 4.2, the security access gateway checks the audit status of the user's registration information. If the audit result is "not audited" or "failed", the security access gateway returns a failure result and terminates the user's client access to the protected server If the audit result is "passed", compare the terminal feature information submitted by the user's client with all the data content of the terminal feature information stored in the database (that is, the serial number of the USBKEY, the serial number of the digital certificate, and the mobile terminal sequence number) are completely consistent, if not completely consistent, the security access gateway will return a failure result and terminate the user's client access to the protected server, if completely consistent, the security access gateway will return to the user's client The result of authentication is successful, and the user's client is allowed to access the protected server;

In step 4.3, the secure access gateway adds a new user registration information record in the database, sets the initial verification result of the user registration information as "unverified", and waits for the protected server to verify.

The present invention uses the fingerprint-based identification technology to solve the problem of insufficient security of the traditional identification technology. By combining the fingerprint-based identification technology with the traditional identification method, the smart card, digital certificate, mobile terminal and user Biometrics are used as a whole for identity verification, and any lack or incompatibility of any item will lead to the failure of the verification, so that the identification medium is directly related to the user itself, and the true correspondence between the identity identification medium and the identified person itself is realized. , which effectively improves the security level of mobile terminal information access, and is more conducive to the role of convenient mobile technology in information applications.

Due to the diversity of existing biometric technologies, the main biometric technologies include face recognition, iris recognition, retinal recognition, fingerprint recognition, palmprint recognition, hand shape recognition, signature recognition, voice recognition, etc. Several kinds of feature information used to identify people replace the fingerprint feature information in the present invention to realize the combined authentication function.

Interpretation of relevant technical terms in the present invention:

SSL VPN: refers to a new type of VPN technology that uses the SSL (Security Socket Layer) protocol to achieve remote access.

IPSec VPN: refers to a VPN technology that uses the IPSec protocol to achieve remote access. Its full name is Internet Protocol Security, which is a security standard framework defined by the Internet Engineering Task Force (IETF) to provide end-to-end encryption for public and private networks. and authentication services.

National secret SM1 algorithm: a national commercial cipher block encryption algorithm, the block length of plaintext and ciphertext is 128 bits, and the effective key length is 128 bits.

Claims (5)

1. a kind of mobile terminal safety access authentication method of combination fingerprint is it is characterised in that comprise the steps：

Step 1, sets up encrypted tunnel, by client call USBKEY and be stored in digital certificate in USBKEY, according to SSL VPN agreement completes bidirectional identification checking and the negotiation of the encrypted tunnel based on state's close SM1 algorithm based on digital certificate；

Step 2, user's registration, concretely comprise the following steps：

Step 2.1, by client collection terminal characteristic information, and points out user input fingerprint obtaining fingerprint characteristic information, then Terminal characteristic information and fingerprint characteristic information are uploaded to safe access gateway as user's registration information by encrypted tunnel；

Step 2.2, safe access gateway receives the user's registration information of client upload, and registers customers as information Store in number It is " examination ＆ verification " according to the initial auditing result in storehouse, concurrently setting user's registration information；

Step 3, user profile is audited, and by protected server, the user's registration information do not audited in data base is audited, Detect its effectiveness and integrity, and whether high spot reviews is validated user, for illegal user's registration information, arranges it Auditing result is " not passing through ", and for legal user's registration information, arranging its auditing result is " passing through "；

Step 4, customer service accesses, and concretely comprises the following steps：

Step 4.1, client gathers the fingerprint characteristic information of user, and by fingerprint characteristic information together with terminal characteristic information It is uploaded to safe access gateway, safe access gateway searches for data base according to the item data in terminal characteristic information, if searching Rope to corresponding user's registration information record, then enters step 4.2, if not searching corresponding user's registration information record, Enter step 4.3；

Step 4.2, safe access gateway checks the examination ＆ verification state of this user's registration information, if auditing result be " examination ＆ verification " or " not passing through ", then the client returning failure result by safe access gateway and terminating this user accesses the row of protected server For；If auditing result is " passing through ", deposit in client this terminal characteristic information and data base of submitting to of comparing this user Whether the total data content of the terminal characteristic information of storage is completely the same, if not quite identical, is returned by safe access gateway Return failure result and terminate the client protected server of access of this user, if completely the same, by safe access gateway To the client return authentication successful result of this user, and the client of this user is allowed to access protected server；

Step 4.3, safe access gateway increases a user's registration information record newly in data base, sets this user's registration information Initial auditing result is " examination ＆ verification ", waits server examination ＆ verification to be protected.

2. the mobile terminal safety access authentication method of combination fingerprint according to claim 1 is it is characterised in that step Terminal characteristic information in 2.1 includes USBKEY serial number, digital certificate serial number and mobile terminal serial number.

3. the mobile terminal safety access authentication method of combination fingerprint according to claim 2 is it is characterised in that step In 4.1, safe access gateway searches for data base according to the digital certificate serial number in terminal characteristic information.

4. the mobile terminal safety access authentication method of combination fingerprint according to claim 1 and 2 is it is characterised in that walk Illegal user's registration information in rapid 3 is divided into user's registration information imperfect or user's registration information mistake.

5. the mobile terminal safety access authentication method of combination fingerprint according to claim 1 and 2 is it is characterised in that walk In rapid 3 for auditing result be " not passing through " user's registration information, if the faulty operation of validated user causes, then by client Hold and delete original user's registration information record to protected server application, and resubmit user's registration information.