TWI824239B - System, device and method for checking password incorrect times through server to complete corresponding operation - Google Patents

Abstract

A system, a device and a method for checking password incorrect times through a server to complete a corresponding operation are provided. By determining a password transmitted from a client passes validation by the server, generating an error message based on an incorrect times of inputting password when the password is not passed validation, and performing an operation in correspondence with the error message, the system and the method can manage re-try times of password effectively, and can achieve the effect of improving security of using certificate.

Description

System, device and method for checking the number of password errors through the server to complete the operation

A system, device and method for judging the number of password errors, specifically refers to a system, device and method that checks the number of password errors through a server to complete the operation.

Electronic vouchers, also known as digital vouchers, are an identification mechanism used in computer systems. An electronic certificate is a computer file or a set of computer files that records the owner's identity information and a set of public keys. The owner of an electronic voucher can authenticate his or her identity to the computer system to access or use a specific computer service.

The public key contained in the digital certificate corresponds to a private key. Generally speaking, digital certificates and corresponding private keys will be recorded in certificate files in a certain format, and certificate files containing digital certificates and private keys usually need to be encrypted before they can be stored in the computer system. . In other words, the certificate file must be decrypted using the certificate password before the digital certificate and/or private key can be obtained from the certificate file according to the format of the certificate file.

However, some current applications that use digital certificates may not have a set number of input times for the certificate password. In other words, after obtaining a certificate file containing someone else's digital certificate, an interested party can repeatedly try to open the certificate file with different strings. Until the credential password is guessed. In fact, although there are applications that limit the number of password input times, these applications only record the current number of incorrect times locally. Interested parties can back up the file recording the number of incorrect times before starting to try passwords, and then enter the password After the number of errors reaches a certain value, the backed-up file will be overwritten, so that the data recorded on the local side can be easily changed so that the application cannot accurately know the number of password attempts in the certificate file.

To sum up, it can be seen that there has been a problem in the previous technology that the credential password can be continuously tried for a long time. Therefore, it is necessary to propose improved technical means to solve this problem.

In view of the problem that the certificate password can be continuously tried in the previous technology, the present invention discloses a system, device and method for continuing the operation by checking the number of password errors on the server, wherein:

The system disclosed by the present invention that uses a server to check the number of password errors to complete operations at least includes: a client to obtain login information, which includes account information and certificate password; a service server to receive login information, And when it is judged that the certificate password has not passed the verification, the number of errors will be accumulated, and a corresponding error message will be generated based on the number of errors, and the error message will be sent to the client, so that the client can perform the operation corresponding to the error message and use it to determine the certificate password. When the verification is passed, a permission message is generated and sent to the client. After receiving the permission message, the client uses the certificate password to decrypt the certificate file to obtain the certificate data, and uses the certificate data to perform the target operation.

The device disclosed in the present invention that checks the number of password errors through the server to complete the operation at least includes: an input module to obtain login information including account information and certificate password; a communication module to send the login information to the service server , and is used to receive the error message or permission message returned by the service server; the certificate module is used to decrypt the certificate file using the certificate password to obtain the certificate information when the communication module receives the permission message; the execution module is used to When the communication module receives an error message, it executes the operation corresponding to the error message and uses the certificate data to execute the target operation.

The method disclosed in the present invention uses the server to check the number of password errors to complete the operation. The steps include at least: the client obtains the login information and sends the login information to the service server. The login information includes account information and certificate password; the service server When the server determines that the certificate password has not passed verification, it accumulates the number of errors, generates a corresponding error message based on the number of errors, and sends the error message to the client, so that the client performs the operation corresponding to the error message; the service server determines that the certificate password has passed During verification, a permission message is generated and sent to the client. After receiving the permission message, the client uses the certificate password to decrypt the certificate file to obtain the certificate data, and uses the certificate data to perform the target operation.

The system, device and method disclosed by the present invention are as above. The difference between the system, device and method disclosed by the present invention and the prior art is that the present invention transmits the certificate password to the service server through the client. The service server determines whether the certificate password passes the verification and can determine whether the certificate password has passed the verification. The number of errors generates a corresponding error message, allowing the client to perform corresponding operations based on the error message, thereby solving the problems existing in the previous technology and achieving the technical effect of improving the security of using digital certificates.

The features and implementations of the present invention will be described in detail below with reference to the drawings and examples. The content is sufficient to enable any person familiar with the relevant art to easily fully understand the technical means used to solve the technical problems of the present invention and implement them accordingly, thereby achieving The effect that the present invention can achieve.

This invention allows the service server to generate a corresponding permission message or error message based on whether the certificate password is correct after the user inputs the certificate password. The client can choose to use the certificate password to decrypt the certificate file when the service server returns the permission message. And when the service server returns an error message, the user can be prompted to enter the certificate password again or the user can be refused service.

The system operation of the present invention is first described below with reference to "Figure 1", a system architecture diagram of the system architecture of the present invention in which the server checks the number of password errors to complete the operation. As shown in "Figure 1", the system of the present invention includes a client 110, a service server 120, and an attachable certificate server 140. Among them, the client 110 and the service server 120 can be connected through a wired or wireless network to transmit data or signals to each other.

The client 110 is responsible for transmitting the login information to the service server 120 and performing corresponding operations based on the information returned by the service server. In some embodiments, the client 110 may further include an input module 111, a voucher module 112, a communication module 114, an execution module 115, and an additional computing module 113.

The input module 111 can select the digital certificate to be used, is also responsible for obtaining login information, and is responsible for transmitting the obtained login information to the service server 120 . Generally speaking, the input module 111 can display a user interface to provide input of login information. The login information obtained by input module 111 includes account information and certificate password. Among them, the account information includes but is not limited to the identity card number and/or the account registered on the service server 120 in advance.

The certificate module 112 can generate a key pair (in the present invention, the public key and the private key represent the two keys included in the key pair), and can generate a certificate signing request (Certificate Signing Request) including the public key. , CSR).

The certificate module 112 may also use a predetermined format to generate a certificate file including the digital certificate corresponding to the certificate signing request received by the communication module 114 and the generated private key. Generally speaking, when the certificate module 112 generates a certificate file, the content of the certificate file will be encrypted with the certificate password in the login information obtained by the input module 111. That is to say, the client 110 can combine the contents of the certificate file in a predetermined format. The digital certificate and private key data are encrypted to generate a certificate file. The above-mentioned predetermined format is a file format used to record digital certificates and private keys, such as PFX, PEM file format, etc., but the invention is not limited thereto.

The certificate module 112 is also responsible for decrypting the corresponding certificate file using the certificate password in the login information obtained by the input module 111 when the communication module 114 receives the permission message, and can obtain the certificate after decrypting the certificate file. material. It should be noted that the certificate file may include a digital certificate and a private key corresponding to the digital certificate (contained public key), and the certificate module 112 may obtain the certificate information from the digital certificate. Among them, the voucher information is usually one or more information included in the digital voucher, such as the identification information of the voucher owner (including but not limited to the ID number, passport number, etc.), the voucher serial number, the validity period of the voucher, etc., but the present invention does not With this limitation, for example, the voucher information can also be all the information contained in the digital voucher (that is, the voucher information can be a digital voucher).

The certificate module 112 can also perform a certificate deletion operation when the error message received by the communication module 114 indicates that the certificate is revoked. For example, the certificate module 112 can delete the certificate file selected by the input module 111, or it can delete the certificate by the error message. Obtain the deletion information from the deletion information, and delete the certificate file corresponding to the deletion information. The deletion information may include the storage path and file name of the certificate file, or may include the certificate serial number of the digital certificate contained in the certificate file, etc., which is sufficient to enable the execution of the module. Group 115 identifies the data in the certificate file that needs to be deleted, but the invention is not limited thereto.

In some embodiments, in addition to performing certificate deletion operations, the certificate module 112 can also perform certificate revocation operations. In more detail, the certificate module 112 can generate and send a certificate revocation request to the certificate server 140 through the communication module 114 , to complete the voucher cancellation operation. The certificate revocation request includes information sufficient for the certificate server 140 to identify the digital certificate that needs to be deleted, such as the certificate serial number of the digital certificate, but the present invention is not limited thereto.

The computing module 113 can generate verification data based on the certificate password in the login data obtained by the input module 111 . In more detail, the calculation module 113 can use the complete or partial certificate password as verification data, or can perform specific operations on the certificate password to generate verification data. Among them, the specific operation is an operation that can produce a one-to-one operation value with the certificate password and the certificate password cannot be deduced from the operation value, such as a hash operation, or an operation that rearranges the positions of the bits contained in the certificate password. , but the present invention is not limited to this.

The communication module 114 can transmit the certificate signing request generated by the certificate module 112 to the certificate server 140 to apply for a digital certificate from the certificate server 140. For example, the communication module 114 can directly transmit the certificate signing request to the certificate server. 140, the certificate signing request may also be sent to the service server 120, thereby indirectly sending the certificate signing request to the certificate server 140 through the service server 120.

The communication module 114 can also receive the digital certificate generated by the certificate server 140 . Generally speaking, the communication module 114 can receive the digital certificate in the same way as the certificate signing request is sent to the certificate server 140. For example, the communication module 114 can directly receive the digital certificate returned by the certificate server 140, or it can also receive it through The service server 120 receives the digital certificate returned by the certificate server 140, that is, receives the digital certificate forwarded by the service server 120.

The communication module 114 can also transmit the account information in the login information obtained by the input module 111 and the certificate information obtained by the certificate module 112 from the digital certificate received by the communication module 114 to the service server 120 . In some embodiments, the communication module 114 can also transmit the verification data generated by the computing module 113 together with the account information and certificate information to the service server 120 .

The communication module 114 is also responsible for receiving permission messages and error messages sent by the service server 120 . In some embodiments, the communication module 114 can also receive the security password sent by the service server 120 .

The communication module 114 can also transmit the account information obtained by the input module 111, the certificate information obtained by the certificate module 112, and the signature value generated by the execution module 115 to the service server 120.

The communication module 114 can also receive related data sent by the service server 120 . The associated information mentioned in the present invention is information that can represent the identity of the owner of the account information input by the input module 111, including but not limited to the identity identification information of the owner of the account information (including but not limited to identity card number, passport number etc.) or the certificate serial number of the digital certificate used by the owner of the account information for the service server 120, etc., but the present invention is not limited to this. Generally speaking, the associated information is provided by the owner of the account information when registering the account information on the service server 120 .

The execution module 115 is responsible for using the voucher data retrieved from the voucher file by the voucher module 112 to complete the corresponding target operation. The target operation executed by the execution module 115 usually includes a signature, such as logging into the service server 120 or transacting with the service server 120. More specifically, when the target operation is logging into the service server 120, the execution module 115 can use The certificate module 112 decrypts the private key obtained from the certificate file to generate a signature value, so that the communication module 114 can send the account information, certificate information and signature value to the service server 120 to log in to the service server 120 . Among them, the execution module 115 can use the private key obtained by the certificate module 112 to sign the account information and/or the certificate information to generate a signature value, or can also use the private key to sign the specific data contained in the permission message. to generate a signature value. When the target operation is a transaction with the service server 120, the client 110 can use the private key to sign the transaction data to generate a signature value, and can combine the transaction data, digital certificate (or certificate data), and signature value. Sent to the service server 120 to complete the transaction with the service server 120 .

The execution module 115 can also use the security password received by the communication module 114 to encrypt the certificate file generated by the certificate module 112 to generate a secondary encrypted certificate file (also represented as an "encrypted file" in the present invention), The encrypted file replaces the certificate file; the execution module 115 can also use the security password to decrypt the generated encrypted file when the communication module 114 receives the permission message to restore the encrypted file to a certificate file that can be decrypted using the certificate password. If the permission message contains an alternative password in addition to the security password, the execution module 115 can also use the alternative password as a new security password after the certificate module 112 decrypts the certificate file, and use the alternative password to encrypt the certificate file again. Generates an encrypted file that replaces the certificate file.

The execution module 115 is also responsible for executing operations corresponding to the error message when the communication module 114 receives the error message. For example, when the error message indicates that the password is incorrect, the execution module 115 can perform a prompt operation. In more detail, the execution module 115 can generate a prompt message and display the prompt message to prompt the user to re-enter the login information. However, the present invention does not This is the limit. The prompt message may correspond to the error message and/or may include all or part of the content contained in the error message. For example, the prompt message may include the number of password errors recorded in the error message, etc.

The execution module 115 can also determine whether the certificate information obtained by the certificate module 112 after decrypting the certificate file is consistent with the related information received by the communication module 114 . For example, when the associated information includes identification information and/or a certificate serial number, the execution module 115 can determine whether the owner's ID number/certificate serial number in the certificate information is consistent with the identity card number and/or certificate contained in the associated information. The serial numbers are the same.

The service server 120 is responsible for determining whether the certificate password obtained by the client 110 passes the verification, and is responsible for accumulating the number of errors when the certificate password fails the verification, and is responsible for generating corresponding result messages based on whether the certificate password passes the verification and the accumulated number of errors. . Among them, the service server 120 may further include a transmission module 121, a processing module 122, and a login module 123.

The transmission module 121 is responsible for receiving the login information obtained by the client 110, and is also responsible for receiving the account information, certificate information and/or verification information obtained by the client 110. The transmission module 121 is also responsible for transmitting error messages or permission messages generated by the processing module 122 to the client 110 .

The transmission module 121 can also receive the certificate signing request generated by the client 110, and can forward the received certificate signing request to the certificate server 140, and can receive the digital certificate returned by the certificate server 140, and can The received digital voucher is forwarded to the client 110 . The transmission module 121 may also transmit the certificate revocation request generated by the processing module 122 to the certificate server 140 to complete the certificate revocation operation.

The transmission module 121 may also transmit the security password generated by the processing module 122 to the client 110 . Generally speaking, the transmission module 121 can transmit the security password to the client 110 when transmitting the digital certificate received from the certificate server 140, but the present invention is not limited thereto.

The processing module 122 can store the account information, voucher information and verification information received by the transmission module 121 as a record, or can obtain the voucher information from the digital certificate received by the transmission module 121 and transfer it to the transmission module. 121 The received account information, verification information and obtained certificate information are stored as a record. In some embodiments, if the verification data received by the transmission module 121 is not generated by a specific operation performed by the client 110, but is a complete or partial certificate password, the processing module 122 can perform a specific operation on the verification data. And use the data generated by the operation as new verification data.

The processing module 122 is also responsible for determining whether the certificate password received by the transmission module 121 passes the verification. Generally speaking, the processing module 122 can read the corresponding verification data based on the account data received by the transmission module 121, and can perform specific operations on the certificate password to generate corresponding operation values, and can compare the generated The calculated value and the verification data read. When the calculated value is the same as the verification data, the processing module 122 can determine that the voucher password has passed the verification; and when the calculated value is different from the verification data, the processing module 122 can determine that the voucher password has not passed the verification.

The processing module 122 is also responsible for accumulating the number of errors corresponding to the account information received by the transmission module 121 when it is determined that the certificate password received by the transmission module 121 has not passed the verification, and is responsible for generating a message corresponding to the accumulated number of errors. error message. In more detail, the processing module 122 may determine whether the accumulated number of errors reaches a predetermined threshold. If the accumulated number of errors does not reach the threshold, the processing module 122 can generate an error message indicating that the password is incorrect. If the number of errors reaches the threshold, the processing module 122 can generate an error message indicating that the certificate is revoked, and can generate a certificate. Revocation request for credential revocation operation. In some embodiments, the error message may include the number of errors.

The processing module 122 is also responsible for generating a permission message when determining that the certificate password received by the transmission module 121 passes the verification. The processing module 122 can read the corresponding security password from the pre-stored record according to the account information received by the transmission module 121, and can generate a permission message including the read security password when generating the permission message. In some embodiments, the processing module 122 can generate a new security password (also referred to as a "substitute password" in the present invention) when reading the security password, and transmit the same in the pre-stored record. The security password corresponding to the account information received by the module 121 is updated to the substitute password, and a permission message including the read security password and the newly generated substitute password can also be generated.

The processing module 122 can also read the corresponding voucher information from the pre-stored records based on the account information in the login information received by the transmission module 121, and can use the read voucher information as associated data, and generate Contains permission messages for associated data. In some embodiments, the processing module 122 can add the associated data to the SESSION connected to the client 110, so that the transmission module 121 also transmits the associated data to the client when transmitting the permission message to the client 110. End 110.

The login module 123 can use the account information and credential information received by the transmission module 121 to select whether to allow login to the client 110 . For example, the login module 123 can allow the client 110 to log in to the service server 120 when it determines that the received account information and voucher information have been logged in, that is, when there is a piece of data containing the account information and voucher information; the login module 123 It is also possible to refuse (not allow) the client 110 to log in to the service server 120 when it is determined that the received account information and credential information have not been logged in or there is no corresponding account information and credential information.

The login module 123 can also select whether to allow the client 110 to log in to the service server 120 based on the account information, certificate information and signature value received by the transmission module 121 . In more detail, when the login module 123 determines that the account information and voucher information have been logged in, it can also obtain the public key contained in the corresponding digital certificate based on the voucher information, and use the public key to verify the signature value. If the signature If the signature value passes the verification, the login module 123 will allow the client 110 to log in to the service server 120; if the signature value does not pass the verification, the login module 123 will not allow the client 110 to log in to the service server 120.

The certificate server 140 may receive the certificate signing request transmitted by the client 110 or the service server 120, and may transmit the digital certificate corresponding to the received certificate signing request to the client 110 or the service server that issued the certificate signing request. 120.

The certificate server 140 may be a certificate signing server (CA). In this case, the certificate server 140 may generate a corresponding digital certificate based on the received certificate signing request; the certificate server 140 may also be a certificate registration server (RA). , in this way, the certificate server 140 can transmit the received certificate signing request to the certificate signing server and receive the digital certificate returned by the certificate signing server.

The certificate server 140 may also receive a certificate revocation request transmitted by the client 110 or the service server 120, and may cancel the digital certificate represented by the certificate revocation request.

Next, an embodiment will be used to explain the operating system and method of the present invention, and please refer to "Figure 2A" for the flow chart of the method of checking the number of password errors through the server to complete the operation proposed by the present invention. In this embodiment, it is assumed that the service server 120 is a financial service server, but the invention is not limited to this.

First, if the user does not have a digital certificate, the user can operate the client 110 to apply for the user's digital certificate from the certificate server 140 . In this embodiment, assuming the process shown in "Figure 2B", the user can operate the client 110 to connect to the service server 120, and can operate the client after the client 110 is connected to the service server 120. The client 110 applies for a digital certificate. In this way, the input module 111 of the client 110 can provide an input interface for the user to input account information and certificate password (login information). The computing module 113 of the client 110 can generate the input of the input module 111. Based on the hash value of the certificate password, the certificate module 112 of the client 110 can generate a key pair including a public key and a private key, and use the public key to generate a certificate signing request. The communication module 114 of the client 110 can The account information input by the input module 111, the hash value of the certificate password generated by the operation module 113, and the certificate signing request generated by the certificate module 112 are sent to the service server 120, thereby sending the request to the certificate server through the service server 120. 140 Apply for digital voucher (step 201).

After receiving the account information, the hash value of the certificate password and the certificate signing request sent by the client 110, the transmission module 121 of the service server 120 can forward the received certificate signing request to the certificate server 140, so that the certificate The server 140 issues a digital certificate based on the certificate signing request. The transmission module 121 can receive the digital certificate of the client 110 returned by the certificate server 140. Then, the processing module 122 of the service server 120 can receive the digital certificate from the transmission module 121. The voucher information, such as the voucher serial number, is retrieved from the received digital voucher (step 205).

Then, the processing module 122 of the service server 120 can store the account information, the hash value of the certificate password, and the retrieved certificate serial number received by the transmission module 121 of the service server 120 as a record. The service server The transmission module 121 of 120 may forward the digital certificate received from the certificate server 140 back to the client 110 (step 207).

After the communication module 114 of the client 110 receives the digital certificate sent by the service server 120, the certificate module 112 of the client 110 can match the digital certificate received by the communication module 114 with the generated key. The private key is encrypted with the certificate password input by the input module 111 of the client 110 to generate a certificate file including the digital certificate and the private key and store the generated certificate file.

Returning to "Figure 2A", when the user of the client 110 needs to log in to the service server 120 to use the services provided by the service server 120, the input module 111 of the client 110 can be obtained through the provided user interface. The user inputs the login information including the account information and certificate password. The communication module 114 of the client 110 can transmit the login information obtained by the input module 111 to the service server 120 (step 220).

After the transmission module 121 of the service server 120 receives the login information sent by the client 110, the processing module 122 of the service server 120 can determine whether the certificate password contained in the login information received by the transmission module 121 is passed. Verification (step 230). In this embodiment, it is assumed that the processing module 122 can read and transmit the account information received by the module 121 from the records stored in the process of the client 110 applying for a digital certificate to the certificate server 140 through the service server 120 The hash value (verification data) of the corresponding certificate password, and the certificate password can be hashed to generate the corresponding operation value, and the generated operation value can be compared with the read verification data, and the operation can be based on Whether the value is the same as the verification data determines whether the certificate password passes the verification.

If the processing module 122 of the service server 120 determines that the certificate password received by the transmission module 121 of the service server 120 has not passed the verification, then as shown in the process of "Figure 2C", the processing module 122 can accumulate and The number of errors corresponding to the account information received by the transmission module 121 (step 241), and can further determine whether the accumulated number of errors reaches the threshold (step 243). If not, the processing module 122 can generate a message indicating that the password is incorrect. error message, and the transmission module 121 can transmit the error message generated by the processing module 122 to the client 110 (step 245), so that after receiving the error message, the communication module 114 of the client 110 executes The module 115 can prompt the user to re-enter the login information according to the error message received by the communication module 114, and the communication module 114 can send the user's re-entered login information to the service server 120 (step 220); if so, That is, the number of errors corresponding to the account information received by the transmission module 121 of the service server 120 reaches the threshold, the processing module 122 of the service server 120 can generate an error message indicating that the certificate is revoked, and the transmission module 121 can The error message generated by the processing module 122 is sent to the client 110 (step 247). After the communication module 114 of the client 110 receives the error message indicating that the certificate is revoked, the certificate module 112 of the client 110 can communicate according to the error message. The relevant data contained in the error message received by the module 114 will be deleted from the certificate file containing the corresponding digital certificate (step 295). Among them, the processing module 122 of the service server 120 can read the certificate serial number (certificate data) corresponding to the account information received by the transmission module 121 from the pre-established record, and can generate a certificate containing the read certificate. The error message of the serial number allows the certificate module 112 of the client 110 to find the certificate file containing the digital certificate corresponding to the certificate serial number in the error message, and delete the found certificate file.

Returning to "Figure 2A" again, when the processing module 122 of the service server 120 determines whether the certificate password contained in the login information passes the verification (step 230), if the processing module 122 of the service server 120 determines whether the service server If the certificate password received by the transmission module 121 of the client 120 passes the verification, the processing module 122 can generate a permission message, and the transmission module 121 can transmit the permission message generated by the processing module 122 back to the client 110 (step 250).

After the communication module 114 of the client 110 receives the permission message sent by the service server 120, the certificate module 112 of the client 110 can obtain the certificate information using the certificate password in the obtained login information (step 270). In this embodiment, it is assumed that the certificate module 112 can use the certificate password to decrypt the certificate file, retrieve the digital certificate in the certificate file, and extract the certificate serial number from the digital certificate as the certificate data.

After the certificate module 112 of the client 110 obtains the certificate information, the communication module 114 of the client 110 can use the certificate information obtained by the certificate module 112 and the account number in the login information obtained by the input module 111 of the client 110 The data is sent to the service server 120 to log in to the service server 120 (step 290). In this embodiment, it is assumed that after the transmission module 121 of the service server 120 receives the account information and voucher information, the login module 123 of the service server 120 can use the account information and voucher information received by the transmission module 121 to Whether the client 110 is allowed to log in to the service server 120 is selected based on whether the client 110 has been logged in. For example, when there is a registration information including account information and certificate information, the login module 123 can allow the client 110 to log in to the service server 120; conversely, the login module 123 can deny (not allow) the client 110 to log in to the service server 120.

In this way, through the present invention, the service server 120 can determine whether the certificate password entered by the user of the client 110 is correct, and accumulate the number of errors when the certificate password is incorrect, so that it can choose whether to continue to use the certificate based on the number of errors accumulated by the service server. The user enters the certificate password.

In the above embodiment, as shown in the process of "Figure 2D", after the transmission module 121 of the service server 120 receives the digital certificate returned by the certificate server 140 (step 205), the service server 120 The processing module 122 can generate a security password. For example, the processing module 122 can use Advanced Encryption Standard (AES) to generate a security password. The transmission module 121 of the service server 120 can generate the security password generated by the processing module 122. The security password is transmitted to the client 110 together with the digital certificate received from the certificate server 140 (step 209).

After the communication module 114 of the client 110 receives the digital certificate and security password transmitted by the service server 120, the certificate module 112 of the client 110 can use the digital certificate and the private key in the generated key pair to The certificate password is encrypted using the Advanced Encryption Standard to generate a certificate file. Then, the execution module 115 of the client 110 can encrypt the certificate file using the security password received by the communication module 114 to generate an encrypted file (step 210). , the execution module 115 of the client 110 can also store the security password.

In this way, after the processing module 122 of the service server 120 determines that the certificate password in the login information received by the transmission module 121 of the service server 120 passes the verification (step 230), the processing module 122 of the service server 120 generates When sending the permission message to the client 110 (step 250), the processing module 122 may also read the security password corresponding to the account information in the login information from the pre-established record (step 253) and generate the security password containing the read The permission message containing the password, and the transmission module 121 of the service server 120 may also transmit the permission message including the security password to the client 110 (step 255).

After the communication module 114 of the client 110 receives the permission message sent by the service server 120, the execution module 115 of the client 110 can use the security password in the permission message received by the communication module 114 to decrypt the previously generated The encrypted file is used to restore the certificate file (step 260). Then, the certificate module 112 of the client 110 can use the certificate password to decrypt the certificate file restored by the execution module 115 to obtain the certificate information (step 270).

Furthermore, when the processing module 122 of the service server 120 generates the permission message to the client 110 (step 250), the processing module 122 can read the account information corresponding to the login information from the pre-established record. Security password (step 253) and generate a replacement password, and at the same time replace the security password corresponding to the account information in the login information in the pre-established record with the replacement password, so that the replacement password becomes a new security password. Then, the processing module 122 can A permission message containing the original security password and the newly generated replacement password is generated (step 255). In this way, after the transmission module 121 of the service server 120 sends the permission message including the permission message generated by the processing module 122 to the client 110, so that the communication module 114 of the client 110 receives the permission message sent by the service server 120 , the execution module 115 of the client 110 can use the original security password in the permission message received by the communication module 114 to decrypt the previously generated encrypted file to restore the certificate file (step 260). The certificate module of the client 110 112 can use the certificate password to decrypt the certificate file restored by the execution module 115 to obtain the certificate information (step 270). After the certificate module 112 obtains the certificate information, the execution module 115 can use the alternative password in the permission message to re-encrypt the certificate file to generate a new encrypted file. In this way, the client 110 can access the certificate file every time. Changing all security passwords to different ones can avoid the possibility of security passwords being stolen and further improve the security of the credential files.

In addition, in the above embodiment, after the processing module 122 of the service server 120 determines that the certificate password contained in the login information received by the transmission module 121 of the service server 120 passes the verification (step 230), the processing module 122 When generating and sending the permission message to the client 110 (step 250), as shown in the process of "Figure 2E", the processing module 122 can read from the pre-stored record corresponding to the account information in the login information. Credential data, such as the identity card number of the owner of the account data or the certificate serial number used by the owner of the account data, etc., and the read credential data can be used as associated data (step 251), and the transmission module 121 can The associated data is sent to the client 110 along with the permission message (step 259). Among them, the processing module 122 can add the related data to the SESSION connected to the client 110, so that the transmission module 121 transmits the related data together with the permission message to the client 110 in the form of SESSION when transmitting the permission message.

In this way, the communication module 114 of the client 110 receives the permission message and related information sent by the service server 120, and the certificate module 112 of the client 110 uses the login information obtained by the input module 111 of the client 110. After obtaining the certificate information with the certificate password (step 270), the execution module 115 of the client 110 can determine whether the certificate information obtained by the certificate module 112 is consistent with the associated information received by the communication module 114 (step 280), for example Determine whether the owner's ID number/voucher serial number in the certificate data is the same as the corresponding data in the related data. If not, the execution module 115 can generate and display an error message indicating that the identity verification failed (step 285) to prompt the user of the client 110. If the execution module 115 determines that the credential data matches the associated data, the client 110 Only then can the communication module 114 transmit the certificate information obtained by the certificate module 112 and the account information in the login information obtained by the input module 111 of the client 110 to the service server 120 to log in to the service server 120 (step 290 ).

In summary, it can be seen that the difference between the present invention and the prior art is that the certificate password is transmitted to the service server through the client. The service server determines whether the certificate password passes the verification and can generate a corresponding message based on the number of incorrect certificate passwords. Error messages are technical means that enable the client to perform corresponding operations based on the error messages. This technical means can solve the problem of the previous technology that the certificate password can be constantly tried, thereby achieving the technical effect of improving the security of using digital certificates. .

Furthermore, the method of checking the number of password errors through the server to complete the operation of the present invention can be implemented in hardware, software, or a combination of hardware and software. It can also be implemented in a centralized manner in a computer system or in different components. Implemented in a decentralized manner spread over several interconnected computer systems.

Although the embodiments of the present invention are disclosed above, the content described is not intended to directly limit the scope of patent protection of the present invention. Anyone with ordinary knowledge in the technical field to which the present invention belongs can make slight modifications and modifications to the form and details of the implementation of the present invention without departing from the spirit and scope disclosed by the present invention, which shall fall under the patent protection of the present invention. Scope. The scope of patent protection for this invention must still be defined by the scope of the attached patent application.

110:Client 111:Input module 112:Certificate module 113:Computational module 114: Communication module 115:Execute module 120:Service server 121:Transmission module 122: Processing module 123:Login module 140:Certificate Server Step 201: The client applies for a digital certificate from the certificate server Step 205: The service server receives the digital certificate generated by the certificate server and retrieves the certificate information from the digital certificate. Step 207: The service server sends the digital certificate to the client Step 209: The service server generates a security password and sends the security password to the client. Step 210: The client uses the security password to encrypt the certificate file to generate an encrypted file. Step 220: The client obtains and sends the account information and certificate password to the service server Step 230: The service server determines whether the certificate password passes the verification Step 240: The service server accumulates the number of errors, generates an error message based on the number of errors, and sends the error message to the client. Step 241: Accumulated number of errors on the service server Step 243: The service server determines whether the number of errors exceeds the threshold Step 245: The service server generates an error message indicating that the password is incorrect and sends the error message to the client. Step 247: The service server generates and sends an error message indicating that the certificate is revoked to the client. Step 250: The service server generates and sends the permission message to the client Step 251: The service server reads related data Step 253: Service server reads security password Step 255: The service server generates a permission message including the security password and sends the permission message to the client. Step 259: The service server sends the permission message and associated information to the client Step 260: The client uses the secure password to decrypt the encrypted file to restore the certificate file. Step 270: The client uses the certificate password to decrypt the certificate file to obtain the certificate information. Step 280: The client determines whether the certificate information matches the associated information. Step 285: The client generates and displays an error message indicating that the identity verification failed. Step 290: The client executes the target operation based on the credential information Step 295: The client deletes the certificate file containing the corresponding digital certificate based on the error message.

Figure 1 is an architectural diagram of the system according to the present invention that checks the number of password errors through the server to continue the operation. Figure 2A is a flow chart of the method of checking the number of password errors through the server to complete the operation proposed by the present invention. Figure 2B is a flow chart of the method for the service server to obtain digital certificate related information according to the present invention. Figure 2C is a flow chart of the password error handling process proposed by the present invention. Figure 2D is a flow chart of the method of using a secure password to encrypt and decrypt a certificate file according to the present invention. Figure 2E is a flow chart of the method of using relevant information to confirm the user's identity according to the present invention.

Step 220: The client obtains and sends the account information and certificate password to the service server

Step 230: The service server determines whether the certificate password passes the verification

Step 240: The service server accumulates the number of errors, generates an error message based on the number of errors, and sends the error message to the client.

Step 250: The service server generates and sends the permission message to the client

Step 270: The client uses the certificate password to decrypt the certificate file to obtain the certificate information.

Step 290: Client credentials execute target job

Claims (10)

A method of checking the number of password errors through the server to complete the operation. The method at least includes the following steps: a client generates a certificate file containing a digital certificate; a client obtains a login information and sends the login information to a Service server, the login information includes an account information and a certificate password; when the service server determines that the certificate password has not passed the verification based on a verification data stored in the application process of the digital certificate, it accumulates a number of errors, and based on The number of errors generates a corresponding error message, and sends the error message to the client, causing the client to perform the operation corresponding to the error message; and the service server determines that the certificate password passes the verification based on the verification data. , generate and send a permission message to the client. After receiving the permission message, the client uses the certificate password to decrypt the certificate file to obtain a certificate data, and uses the certificate data to perform the target operation, wherein the certificate The data is the digital certificate or one or more data contained in the digital certificate. The method of checking the number of password errors through the server to complete the operation as described in request item 1, wherein the step of the service server generating the corresponding error message based on the number of errors is that the service server reaches one when the number of errors reaches one. The error message indicating that the certificate is revoked is generated when the threshold value is reached, and the error message indicating that the password is incorrect is generated when the number of errors does not reach the threshold value, and the client executes the operation corresponding to the error message based on the representation of the client The error message of the revoked certificate deletes the certificate file containing the corresponding digital certificate, or displays an error message based on the error message indicating that the password is incorrect. The method of checking the number of password errors through the server to complete the operation as described in request item 1, wherein the method further includes receiving a security password generated by the service server before the client obtains the login information, And use the security password to encrypt the certificate file to generate an encrypted file, and the method further includes the client using the permission message before the step of using the certificate password to decode the certificate file to obtain the certificate information. Decrypt the encrypted file with the security password to restore the certificate file. The method of checking the number of password errors through the server to complete the operation as described in request item 1, wherein the client generates the certificate file containing the digital certificate, and further includes the client connecting to a certificate server to apply After the digital certificate is generated, the certificate file containing the digital certificate is generated and the relevant information of the digital certificate and the certificate password are sent to the service server, or the client is sent to the certificate server through the service server. The server applies for the digital certificate, so that the service server obtains the relevant information of the digital certificate and the certificate password, and sends the digital certificate to the client. The client generates the certificate file containing the digital certificate. The method of checking the number of password errors through the server to complete the operation as described in request item 1, wherein the service server generates and sends the permission message to the client, and further includes the step of the service server reading based on the account information. The step of obtaining an associated data and transmitting the associated data to the client, and the method further includes the step of the client determining the certificate before the client uses the certificate password to decrypt the certificate file to obtain the certificate information. Steps to determine whether the data matches the associated data. A system that checks the number of password errors on the server to complete the operation. The system at least includes: a client for generating a certificate file containing a digital certificate, and for obtaining a login information, the login information including an account number information and a certificate password; and A service server used to receive the login information and determine that the certificate password has not passed the verification based on the verification information stored in the application process of the digital certificate. Accumulate a number of errors and generate a corresponding error message based on the number of errors. An error message, and sending the error message to the client, causing the client to perform the operation corresponding to the error message, and to determine that the certificate password is verified based on the verification data, generate and send a permission message to the client The client, after receiving the permission message, uses the certificate password to decrypt a certificate file to obtain a certificate data, and uses the certificate data to perform a target operation, wherein the certificate data is the digital certificate or the digital One or more information contained in the certificate. A system for completing operations by checking the number of password errors on the server as described in request item 6, wherein the service server generates the error message indicating that the certificate is revoked when the number of errors reaches a threshold, and when the number of errors reaches a threshold, When the threshold is not reached, the error message indicating that the password is incorrect is generated. The client deletes the certificate file containing the corresponding digital certificate based on the error message indicating that the certificate is revoked, or displays an error prompt based on the error message indicating that the password is incorrect. As described in request item 6, the system uses the server to check the number of password errors to complete the operation, wherein the service server is further used to generate a security password, and transmits the security password to the client, and is used to generate a code containing the security password. The client is further used to encrypt the certificate file using the security password to generate the encrypted file, and when receiving the permission message, use the security password to decrypt the encrypted file to generate the certificate file. . As described in request item 6, the system uses the server to check the number of password errors to complete the operation, wherein the service server is further used to read an associated data based on the account information, and transmit the permission message and the associated information to the client, and the client is further configured to receive the permission message When the certificate information matches the associated information, it is determined that the certificate information matches the associated information, and when the certificate information matches the associated information, the certificate information and the account information are sent to the service server. A device that checks the number of password errors through a server to complete the operation. The device at least includes: an input module to obtain a login information, the login information includes an account information and a certificate password; a communication module to transmit The login information is sent to a service server, and is used to receive an error message or a permission message returned by the service server to verify the certificate password based on the verification information stored in the application process of the digital certificate, wherein the The error message is generated based on the number of errors that the certificate password has failed to pass verification; a certificate module is used to generate a certificate file containing a digital certificate, and is used to use the certificate when the communication module receives the permission message Password decrypt the certificate file to obtain a certificate information, wherein the certificate information is the digital certificate or one or more data contained in the digital certificate; and an execution module is used to receive the error when the communication module When receiving a message, execute the operation corresponding to the error message and use the certificate data to execute the target operation.

Images