WO2017152819A1 - 一种授权认证方法、装置和系统 - Google Patents

一种授权认证方法、装置和系统 Download PDF

Info

Publication number
WO2017152819A1
WO2017152819A1 PCT/CN2017/075745 CN2017075745W WO2017152819A1 WO 2017152819 A1 WO2017152819 A1 WO 2017152819A1 CN 2017075745 W CN2017075745 W CN 2017075745W WO 2017152819 A1 WO2017152819 A1 WO 2017152819A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
authentication
biometric
digital
biometric information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/075745
Other languages
English (en)
French (fr)
Inventor
李明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201610127334.4A external-priority patent/CN105939336A/zh
Priority claimed from CN201610127235.6A external-priority patent/CN105991654A/zh
Application filed by Individual filed Critical Individual
Priority to US16/083,469 priority Critical patent/US10785218B2/en
Priority to JP2018546887A priority patent/JP2019512786A/ja
Priority to EP17762505.0A priority patent/EP3429157A4/en
Publication of WO2017152819A1 publication Critical patent/WO2017152819A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/12—Fingerprints or palmprints
    • G06V40/1365—Matching; Classification
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/70—Multimodal biometrics, e.g. combining information from different biometric modalities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B13/00—Transmission systems characterised by the medium used for transmission, not provided for in groups H04B3/00 - H04B11/00
    • H04B13/005—Transmission systems in which the medium consists of the human body
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/14—Vascular patterns
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor

Definitions

  • the present invention relates to the field of electronic technologies, and in particular, to an authorization authentication method, apparatus, and system.
  • the electronic device When the user uses the electronic device to obtain authorization for certain specific places (eg, office areas, confidential areas, etc.), website login, personal items (cars, safes, etc.), dangerous goods, etc., the electronic devices are installed in these places, individuals The electronic system on the item or dangerous item establishes a communication connection, and then sends the stored key to the electronic system, which authenticates the key. It can be seen that in this prior art authorization mode, other people can use other people's electronic devices to obtain authorization, thereby performing illegal operations, resulting in loss of property, information, and the like of the user.
  • the present invention is directed to solving one of the above problems.
  • the main object of the present invention is to provide an authorization authentication method.
  • Another object of the present invention is to provide an authorization authentication apparatus.
  • An aspect of the present invention provides an authorization authentication method, including: after a biological limb enters a preset range of a first device, the first device establishes a communication connection with the second device through the biological limb; the first device Receiving, by the communication connection, the to-be-authorized information transmitted by the second device, where the to-be-authorized information includes: digital authentication information; the first time of the preset period of the biological limb entering the first device, the first The device collects biometric information of the biological limb; the first device acquires an authentication result of the digital authentication information and the biometric information authentication, and if the digital authentication information and the biometric information authentication are authenticated As a result, if the authentication is passed, the first device performs an authorization operation.
  • the biometric information includes: fingerprint information and/or vein information; and the collecting, by the first device, biometric information of the biological limb includes: in a case where the biological limb is in contact with the first device, A device collects the biometric information of a contact portion of the biological limb with the first device.
  • the first device acquires an authentication result package for authenticating the digital authentication information and the biometric information.
  • the first device authenticates the digital authentication information and the biometric information to obtain the authentication result.
  • the obtaining, by the first device, the authentication result of the digital authentication information and the biometric information includes: sending, by the first device, the biometric information and the digital authentication information to a background; the first device Receiving the authentication result sent by the background, wherein: the authentication result is an authentication result obtained by the background to authenticate the digital authentication information and the biometric information.
  • the to-be-authorized information further includes: identification information; the authenticating the digital authentication information and the biometric information comprises: authenticating the digital authentication information and the biometric information according to the identification information.
  • the authenticating the digital authentication information and the biometric information according to the identifier information includes: acquiring an authentication factor and biometric verification information corresponding to the identifier information, and using the authentication factor to the digital authentication information Performing digital authentication and detecting a matching rate of the biometrics verification information and the biometrics information, wherein the authenticating the authentication pass includes: digitally authenticating the digital authentication information by using the authentication factor When the matching rate between the biometric information and the biometrics verification information is greater than a preset value, the authentication result is the authentication pass.
  • the digitally authenticating the digital authentication information by using the authentication factor and detecting the matching rate of the biometric verification information and the biometric information includes:
  • the digital authentication information includes electronic signature information obtained by using a private key
  • the authentication factor includes a public key for verifying the electronic signature information
  • the digital authentication information is used by the authentication factor.
  • Performing the authentication includes: performing verification of the electronic signature information by using the public key; and/or the digital authentication information includes a MAC value calculated by using a symmetric key, where the authentication factor includes calculating a symmetry of the MAC value.
  • Decrypting the digital authentication information by using the authentication factor includes: calculating a MAC check value by using the symmetric key, verifying the MAC value and a MAC check value; and/or the digital authentication
  • the information includes a dynamic password generated by using a seed key, the authentication factor including the seed key for verifying the dynamic password, and the authenticating the digital authentication information by using the authentication factor comprises: using the seed secret The key verifies the dynamic password.
  • an authorization authentication apparatus comprising: a connection unit, configured to establish a communication connection with the identity recognition device by the biological limb after the biological limb enters a preset range of the authorization authentication device; Receiving, by the communication connection, the to-be-authorized information transmitted by the identity identification device, where the to-be-authorized information includes: digital authentication information; and an acquisition unit, in a duration of a preset range of the biological limb entering the authorized authentication device a biometric information for collecting the biological limb; an execution unit, configured to acquire an authentication result of the digital authentication information and the biometric information authentication, if the digital authentication information and the biometric information are authenticated The result of the certification is recognition If the certificate passes, the authorization operation is performed.
  • the biometric information includes: fingerprint information and/or vein information; the collecting unit is configured to collect the biological limb and the authorized authentication if the biological limb is in contact with the authorized authentication device The biometric information of the contact portion of the device.
  • the executing unit is specifically configured to perform authentication on the digital authentication information and the biometric information to obtain the authentication result.
  • the executing unit is specifically configured to send the biometric information and the digital authentication information to the background, and receive the authentication result sent by the background, where: the authentication result is the background to the The digital authentication information and the biometric information are authenticated and the obtained authentication result.
  • the to-be-authorized information further includes: identification information; the authenticating the digital authentication information and the biometric information comprises: authenticating the digital authentication information and the biometric information according to the identification information.
  • the authenticating the digital authentication information and the biometric information according to the identifier information includes: acquiring an authentication factor and biometric verification information corresponding to the identifier information, and using the authentication factor to the digital authentication information Performing digital authentication and detecting a matching rate of the biometrics verification information and the biometrics information, wherein the authenticating the authentication pass includes: digitally authenticating the digital authentication information by using the authentication factor When the matching rate between the biometric information and the biometrics verification information is greater than a preset value, the authentication result is the authentication pass.
  • the digitally authenticating the digital authentication information by using the authentication factor and detecting the matching rate of the biometric verification information and the biometric information comprises: authenticating the digital authentication information by using the authentication factor. And determining, when the digital authentication information is authenticated, whether a matching rate of the biometric information and the biometric verification information is greater than a preset value; or determining a matching between the biometric information and the biometric verification information Whether the rate is greater than a preset value, and when it is determined that the matching rate of the biometric information and the biometrics verification information is greater than a preset value, the digital authentication information is authenticated by using the authentication factor.
  • the digital authentication information includes electronic signature information obtained by using a private key
  • the authentication factor includes a public key for verifying the electronic signature information
  • the digital authentication information is used by the authentication factor.
  • Performing the authentication includes: performing verification of the electronic signature information by using the public key; and/or the digital authentication information includes a MAC value calculated by using a symmetric key, where the authentication factor includes calculating a symmetry of the MAC value.
  • Decrypting the digital authentication information by using the authentication factor includes: calculating a MAC check value by using the symmetric key, verifying the MAC value and a MAC check value; and/or the digital authentication
  • the information includes a dynamic password generated by using a seed key, the authentication factor including the seed key for verifying the dynamic password, and the authenticating the digital authentication information by using the authentication factor comprises: using the seed secret The key verifies the dynamic password.
  • Still another aspect of the present invention provides an authorization authentication system, comprising: an identity recognition device and the authorization authentication device according to claims 9-16; the identity recognition device configured to authenticate the authorization through the communication connection The device sends the to-be-authorized information.
  • system further includes: a background, configured to receive the biometric information and the digital authentication information sent by the authorization authentication device, and perform authentication on the digital authentication information and the biometric information to obtain an authentication result. And transmitting the authentication result to the authorized authentication device.
  • a background configured to receive the biometric information and the digital authentication information sent by the authorization authentication device, and perform authentication on the digital authentication information and the biometric information to obtain an authentication result. And transmitting the authentication result to the authorized authentication device.
  • the present invention provides an authorization authentication method, device and system, by which the digital authentication information of the electronic device such as a wristwatch and the biometric information of the human body can be verified and ensured.
  • the authorization authentication method of the present invention the verification of the digital authentication information and the verification of the biometric information of the human body are completed in one continuous operation, once Separating twice will lead to unsuccessful verification, which will prevent others from using electronic devices such as watches to pretend to be authorized by the user to ensure the safety of information and property.
  • the present invention can effectively prevent illegal molecules from using other people's electronic devices and biometric information to pass authorization by using the living body as a transmission conductor.
  • various digital authentication key information that the user needs to use may be stored in an electronic device carried by the wristwatch or the like, and the electronic device automatically sends the digital authentication information to the authentication end, and the user only needs to The biometric information can be collected to complete the authorized operation, which is convenient, fast and safe.
  • FIG. 1 is a flowchart of an authorization authentication method according to Embodiment 1 of the present invention.
  • FIG. 2 is a schematic structural diagram of an authorization authentication apparatus according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic structural diagram of an authorization authentication system according to Embodiment 1 of the present invention.
  • a biological limb is used for communication, that is, a biological limb is used to incorporate both devices of communication into the body area network.
  • the so-called Body Area Network (BAN) is a network element that is centered on the human body and is related to the human body (including personal terminals, distributed on the human body, on the clothes, and within a certain distance of the human body, such as within 3 to 5 meters. Even a communication network composed of sensors, networking devices, etc. inside the human body, therefore, only when the network element related to the human body enters the preset range of the communication device, the human body communication connection of the body area network can be established.
  • the present invention provides an authorization authentication method, as shown in FIG. 1, including:
  • Step S101 after the biological limb enters the preset range of the first device, the first device passes the biological limb and the second device A communication connection is established.
  • the first device is provided with a biometric collection function and is capable of communicating with the second device through the biological limb.
  • the first device can be used to manage the access or use rights of the place (office area, secret area), website login, personal items (cars, safes, etc.), dangerous goods, etc., and the first device can also be used to execute transactions.
  • it can be an access control card reader, a smart car lock, a safe lock, a dangerous goods manager, a computer with a biometric function, an ATM machine, and a POS machine.
  • the second device is placed outside the living body (including the human body, the animal body, etc.) (wearing in the living body or carried around the living body) or implanted in the living body, for example, the second device may be a wearable device (smart watch, smart glasses, etc.) , smart phones, sensor devices implanted in the body, etc.
  • the second device and the biological limb are in a communicable range (for example, worn on the wrist or the neck)
  • the second device establishes a human body communication channel with the living body, and the biological limb can be equivalent to the extended antenna of the second device, when the detecting party detects When the limb is biological, it is equivalent to detecting the second device.
  • the first device When the first device communicates by using the human body channel, it has a preset communication range. When the biological limb carrying the second device enters its communication range, the first device can detect the biological limb, and the second device passes the biological device. The first device can also be detected by the extended limb antenna.
  • the above first device and second device may also support other wired or wireless communication methods.
  • the first device and the second device establish a body area network (BAN) through the biological limb, and establish a living communication channel by using the biological limb, thereby realizing the first device and the second device to be transmitted through the biological limb.
  • the data between the devices enables communication using the living body.
  • the first device establishes a communication connection with the second device through the biological limb, and can be implemented in a wired manner and a wireless manner, and specifically, at least in one of two ways:
  • the first device and the second device are each provided with an electrode, and the first device is in contact with a biological limb implanted in the human body or a second device worn on the human body (for example, a user wearing the wristwatch contacts the POS device with a finger
  • the electrodes of the two sides are connected to form a passage in the human body, and the passage in the human body can be a simple line method or a current coupling method, thereby realizing wired communication.
  • the first device needs to be in contact with the biological limb wearing the second device, and transmits signals by level change or waveguide, thereby completing communication.
  • both the first device and the second device can detect whether the surrounding electric field transmits changes. If the communication partner enters the range allowed by the human body communication, the field strength change can be detected, and a communication connection is established with the other party. .
  • the second device may be detected by the first device in real time, and the communication may be initiated after the second device is detected.
  • the second device may also actively detect the first device, thereby actively initiating communication.
  • the human body is used as a transmission medium of an electrical signal to realize information interaction between the body surface, the body, and the device around the human body (3 to 5 meters).
  • traditional wireless communication technologies such as Bluetooth, WIFI, radio frequency and infrared
  • the signal is transmitted through the human body during human communication, so electromagnetic noise has little influence on it, and has low power consumption, high confidentiality and lower human damage. advantage.
  • the redundant connection problem of the wired communication method can be eliminated.
  • Step S102 The first device receives the to-be-authorized information transmitted by the second device by using the communication connection, where the information to be authorized includes: Digital authentication information.
  • the second device may be configured to send the to-be-authorized information to be transmitted to the first device, or may be sent by the second device to the first device after receiving the to-be-authorized information sent by the to-be-authorized information generating device.
  • the to-be-authorized information includes information for performing digital authentication.
  • the digital authentication information may be electronic signature information obtained by using a private key signature (when the electronic signature information is generated by the to-be-authorized information generating device,
  • the to-be-authorized information generating device may be an electronic signature device, a USBkey, or the like;
  • the digital authentication information may be a MAC value calculated using a symmetric key (when the MAC value is generated by the to-be-authorized information generating device, the authorization is to be authorized at this time)
  • the information generating device may be a device such as a cipher machine;
  • the digital authentication information may be a dynamic password generated by the seed key (when the dynamic password is generated by the to-be-authorized information generating device, the information to be authorized may be OTP, etc.) Device).
  • the to-be-authorized information may further include information representing the second device (such as product serial number, etc.), identity information of the holder, user account, and the like.
  • the second device may send the to-be-authorized information by means of a broadcast, or may send the to-be-authorized information to the second device after receiving the authorization request information of the first device.
  • Step S103 The first device collects biometric information of the biological limb during the duration of the preset range of the biological limb entering the first device.
  • the biometric information includes fingerprint information, iris information, face information, and Information such as vein information.
  • the first device is provided with a module for collecting biometric information, for example, a fingerprint collection module, configured to collect when a finger of the human body enters a preset communication range of the first device and contacts the fingerprint collection module of the first device.
  • the fingerprint of the finger is configured to collect the vein information in the wrist when the wrist of the human body enters the preset communication range of the first device and contacts the vein collection module, for example, iris collection a module, configured to collect iris information of the human eye when the human eye enters the preset communication range of the first device and is located in the iris collection area, and, for example, a face recognition module, configured to enter the first face When the device is within the preset communication range and is located in the face collection area, the face information of the face is collected.
  • the vein collection module for example, iris collection a module, configured to collect iris information of the human eye when the human eye enters the preset communication range of the first device and is located in the iris collection area
  • a face recognition module configured to enter the first face
  • the first device collecting biometric information of the biological limb includes: in case the biological limb is in contact with the first device, the first device Biometric information of the contact site of the biological limb with the first device is collected.
  • the first device needs to contact the biological limb of the user to collect corresponding biometric information, and the user actively contacts the first device to collect fingerprint or vein information, thereby avoiding
  • the mis-communication caused by the inadvertent passage of other users in crowded situations ensures the uniqueness and security of the communication, and at the same time expresses the user's true intention and true identity.
  • the action of the first device collecting the biometric information of the biological limb may be completed during the continuous process of establishing communication between the first device and the second device, or may be completed before the communication is established between the first device and the second device. As long as the biometric information and the authorized communication for collecting the biological limb are ensured to be completed in one continuous operation, the consistency of the transmitted authorization information and the biometric information is ensured.
  • step 103 there is no sequence in the execution of step 103 and step 101 and step 102, and step 103 can be performed. Executing before step 101 after step 101 may also be performed simultaneously with step 102, and may also be performed after step 102.
  • Step S104 The first device acquires the authentication result of the digital authentication information and the biometric information authentication. If the authentication result of the digital authentication information and the biometric information authentication is the authentication, the first device performs the authorization operation. Specifically, when the first device can authenticate the digital authentication information and the biometric information by using the pre-stored information, the digital authentication information and the biometric information can also be sent to the background connected thereto, and the digital authentication information and the creature are utilized by the background. Feature information is authenticated. When the result of the authentication pass is obtained, the first device performs a corresponding authorization operation, such as authorizing login to the website, authorizing opening of the access control, authorizing the opening of certain devices (cars, guns, etc.).
  • a corresponding authorization operation such as authorizing login to the website, authorizing opening of the access control, authorizing the opening of certain devices (cars, guns, etc.).
  • the first device acquiring the authentication result of the digital authentication information and the biometric information authentication may be completed by, but not limited to, the following manner:
  • the first device authenticates the digital authentication information and the biometric information, and obtains the authentication result.
  • the first device may store a key related to digital authentication and biometrics and other information, and have a function module for authenticating the digital authentication information and the biometric information, and may complete the entire authentication process by itself, thereby improving The efficiency of the authorization, and because the first device can complete the authorization independently, the security of the authorization is guaranteed.
  • the first device is a device such as an access card reader or a safe lock
  • the authentication function is completed by the access card reader, the safe lock, etc., so that the user holding the valid authorization information can be quickly, safely and conveniently. Turn these devices on easily.
  • the second device sends the biometric information and the digital authentication information to the background.
  • the first device receives the authentication result sent by the background, where: the authentication result is the background authentication of the digital authentication information and the biometric information, and the obtained authentication result.
  • the first device may only complete the collection of the biometric information and the communication with the second device, and the authentication process is completed by the background, and the background has a faster computing speed, and the complex operation can be completed quickly.
  • the separation of the acquisition part and the authentication part can also ensure the security of the system.
  • the digital authentication information of the electronic device such as a wristwatch and the biometric information of the human body can be verified, and the correlation and uniformity of the verified digital authentication information and the biometric information are ensured, and the authorization in the present invention is authorized.
  • the verification of the digital authentication information and the verification of the biometric information of the human body are completed in one continuous operation, and once separated, the verification is unsuccessful, thereby preventing others from using the electronic devices such as watches to impersonate. Users are authorized to ensure the security of information and property.
  • the present invention can effectively prevent illegal molecules from using other people's electronic devices and biometric information to pass authorization by using the living body as a transmission conductor.
  • various digital authentication key information that the user needs to use may be stored in an electronic device carried by the wristwatch or the like, and the electronic device automatically sends the digital authentication information to the authentication end, and the user only needs to The biometric information can be collected to complete the authorized operation, which is convenient, fast and safe.
  • the to-be-authorized information further includes: identification information; and the digital authentication information and the biometric information authentication comprise: authenticating the digital authentication information and the biometric information according to the identification information.
  • the to-be-authorized information further includes identifier information for indicating that the key information for authenticating the digital authentication information and the biometric information is obtained.
  • the identification information can be a serial number, Name, index number, etc.
  • the digital authentication information and the biometric information are authenticated according to the identification information, including: obtaining an authentication factor and biometric verification information corresponding to the identification information, and performing digital authentication and detection on the digital authentication information by using an authentication factor.
  • the certification result is certified.
  • the authentication factor corresponding to the digital authentication information and the biometric verification information corresponding to the biometric information may be indexed or quickly searched according to the identification information, for example, when the digital authentication information is an electronic signature information, the identification information
  • the indication may be to find a corresponding public key for verifying the signature, and the public key may be directly stored or stored in a digital certificate, and the identification information may identify the number of the public key or the number of the digital certificate, thereby causing the device to be verified.
  • the corresponding public key can be quickly found from the database; when the acquired biometric information is fingerprint information, the identification information may be the number of the fingerprint information or the number of the user holding the fingerprint information, so that the identification information can be quickly Accurately obtain corresponding authentication factors and biometric verification information.
  • the digital authentication information may be authenticated first, or the biometric information may be authenticated first, or at the same time, only when the authentication results for both are When passing, it is determined that the authentication result is the certification pass.
  • the verification method of the biometric information is mainly to determine the matching rate, and the collected biometric information is compared with the biometric verification information.
  • the matching rate is greater than a certain value, the verification is passed.
  • setting a high matching rate can ensure the authenticity of the results, but the high matching rate often causes the real user to be mistaken as the wrong user or the recognition fails, thereby deny authorization, resulting in inconvenient operation of the user.
  • a specific threshold eg, 99%, 90%, etc.
  • the feature information is the same biometric information, and the biometric authentication information is authenticated.
  • the specific threshold is a matching rate indicating that the two biometric information are the same biometric information.
  • the specific threshold in the prior art is usually set high, and the problem that the authentication fails due to the unidentifiable by the legitimate user is likely to occur.
  • the preset value is smaller than the specific threshold in the prior art, and the matching rate between the biometric verification information and the biometric information is detected to be greater than a preset value.
  • the final authentication result is determined by combining the results of digitally authenticating the information to be authenticated by using the digital authentication factor.
  • the digital authentication of the digital authentication information by using the authentication factor and the detection of the matching rate of the biometric verification information and the biometric information include: authenticating the digital authentication information by using the authentication factor, and authenticating the digital authentication information When passing, determining whether the matching rate of the biometric information and the biometric verification information is greater than a preset Whether the matching rate of the biometric information and the biometric verification information is greater than a preset value, and when the matching rate of the biometric information and the biometric verification information is greater than a preset value, the authentication factor is used to authenticate the digital authentication information. .
  • the digital authentication information is first authenticated, and the digital authentication guarantee by the strong authentication function can be used to reduce the probability that the real and legitimate users are recognized and failed.
  • the digital authentication fails, the biometric information is not required to be verified, which simplifies the process.
  • the biometric authentication information is first authenticated, the biometric information can be verified to identify the counterfeiter, so that no further follow-up is needed.
  • the digital certification process simplifies the process.
  • the authentication of the digital authentication information may include, but is not limited to, one or several of the following:
  • the digital authentication information includes electronic signature information obtained by using a private key signature
  • the authentication factor includes a public key for verifying the electronic signature information
  • the authentication of the digital authentication information by using the authentication factor includes: using the public key to the electronic signature information
  • the digital authentication in this mode is electronic signature authentication
  • the electronic signature information generation manner may use a private key to sign a preset value (such as a random number, etc.), obtain a signature value, and set a signature value and a preset. The value is used as electronic signature information.
  • the electronic signature authentication ensures that the digital authentication passes the user's real authorization and has the function of preventing the user from reversing and refusing the executed operation.
  • the digital authentication information includes a MAC value calculated by using a symmetric key
  • the authentication factor includes a symmetric key for calculating a MAC value
  • the authentication of the digital authentication information by using the authentication factor includes: calculating a MAC check value by using a symmetric key, and verifying MAC value and MAC check value; specifically, in this mode, the digital authentication uses the symmetric key to encrypt the information, and the authenticator decrypts the information by using the symmetric key, for example, using a symmetric algorithm (for example, MAC calculation) to utilize the symmetric
  • the key encrypts the preset value to obtain a ciphertext value (for example, a MAC value), and uses the ciphertext value and the preset value as the ciphertext information, thereby ensuring the security of the data transmission and improving the security of the communication.
  • the identity of the user is verified by a symmetric key pre-stored by both parties.
  • the digital authentication information includes a dynamic password generated by using a seed key
  • the authentication factor includes a seed key for verifying the dynamic password
  • the authentication of the digital authentication information by using the authentication factor includes: verifying the dynamic password by using the seed key.
  • the method uses a dynamic password to verify the identity, and can generate a dynamic password based on time or based on the challenge value, and the dynamic password can be used to verify the real identity of the user and ensure the security of the authorization.
  • This embodiment also provides an authorization authentication device 20, as shown in FIG.
  • the authorization authentication device 20 is a device corresponding to the authorization authentication method, and the authorization authentication device 20 is equivalent to the first device in the authorization authentication method, and the identity recognition device 30 is equivalent to the second device in the authorization authentication method.
  • the authorization authentication device 20 includes:
  • the connecting unit 201 is configured to establish a communication connection with the identity recognition device 30 through the biological limb after the biological limb enters the preset range of the authorization authentication device 20;
  • the receiving unit 202 is configured to receive the to-be-authorized information transmitted by the identity identification device 30 by using a communication connection, where the to-be-authorized information includes: digital authentication information;
  • the collecting unit 203 is configured to collect biometric information of the biological limb during the duration of the preset range of the biological limb entering the authorized authentication device 20;
  • the executing unit 204 is configured to obtain an authentication result of the digital authentication information and the biometric information authentication. If the authentication result of the digital authentication information and the biometric information authentication is the authentication pass, the authorization operation is performed.
  • the biometric information includes: fingerprint information and/or vein information;
  • the collecting unit 203 is configured to collect biometric information of the contact portion of the biological limb and the authorized authentication device 20 in the case where the biological limb is in contact with the authorized authentication device 20.
  • the execution result obtained by the execution unit 204 for the digital authentication information and the biometric information authentication may be completed by, but not limited to, the following two methods:
  • the first execution unit 204 is configured to perform authentication on the digital authentication information and the biometric information to obtain an authentication result.
  • the second execution unit 204 is configured to send the biometric information and the digital authentication information to the background 40, and receive the authentication result sent by the background, where the authentication result is the background 40 authenticating the digital authentication information and the biometric information. Certification results.
  • the to-be-authorized information further includes: identification information; and the digital authentication information and the biometric information authentication comprise: authenticating the digital authentication information and the biometric information according to the identification information.
  • the digital authentication information and the biometric information are authenticated according to the identification information, including: obtaining an authentication factor and biometric verification information corresponding to the identification information, and performing digital authentication and detection on the digital authentication information by using an authentication factor.
  • the certification result is certified.
  • the verification method of the biometric information is mainly to determine the matching rate, and the collected biometric information is compared with the biometric verification information.
  • the matching rate is greater than a certain value, the verification is passed.
  • setting a high matching rate can ensure the authenticity of the results, but the high matching rate often causes the real user to be mistaken as the wrong user or the recognition fails, thereby deny authorization, resulting in inconvenient operation of the user.
  • a specific threshold eg, 99%, 90%, etc.
  • the feature information is the same biometric information, and the biometric authentication information is authenticated.
  • the specific threshold is a matching rate indicating that the two biometric information are the same biometric information.
  • the specific threshold in the prior art is usually set high, and the problem that the authentication fails due to the unidentifiable by the legitimate user is likely to occur.
  • the preset value is smaller than the specific threshold in the prior art, and the matching rate between the biometric verification information and the biometric information is detected to be greater than a preset value.
  • the final authentication result is determined by combining the results of digitally authenticating the information to be authenticated by using the digital authentication factor.
  • the strong authentication function of digital authentication can set the matching rate of biometric authentication to be lower than the biometric authentication matching rate of the general device, thereby reducing the fact that the user carrying the real biometric is misjudged as the wrong user or the recognition fails. Probability.
  • the digital authentication of the digital authentication information by using the authentication factor and the detection of the matching rate of the biometric verification information and the biometric information include:
  • the authentication information is used to authenticate the digital authentication information, and when the digital authentication information is authenticated, it is determined whether the matching rate between the biometric information and the biometric verification information is greater than a preset value; or
  • the digital authentication information is authenticated by using the authentication factor.
  • authenticating the digital authentication information may be accomplished by, but not limited to, the following:
  • the digital authentication information includes electronic signature information obtained by using a private key signature, the authentication factor includes a public key for verifying the electronic signature information, and the authentication of the digital authentication information by using the authentication factor includes: using the public key to the electronic signature information Conduct a check; and/or
  • the digital authentication information includes a MAC value calculated by using a symmetric key
  • the authentication factor includes a symmetric key for calculating a MAC value
  • the authentication of the digital authentication information by using the authentication factor includes: calculating a MAC check value by using a symmetric key, and verifying MAC value and MAC check value;
  • the digital authentication information includes a dynamic password generated by using a seed key
  • the authentication factor includes a seed key for verifying the dynamic password
  • the authentication of the digital authentication information by using the authentication factor includes: verifying the dynamic password by using the seed key.
  • the embodiment further provides an authorization authentication system, as shown in FIG. 3, the authorization authentication system includes the foregoing identity recognition device 30 and the aforementioned authorization authentication device 20;
  • the identity identifying device 30 is configured to send the to-be-authorized information to the authorization authentication device 20 through the communication connection.
  • the authorization authentication system further includes: a background 40, configured to receive biometric information and digital authentication information sent by the authorization authentication device 20, and authenticate the digital authentication information and the biometric information to obtain an authentication result.
  • the authentication result is sent to the authorization authentication device 20.
  • Embodiments of the present invention provide a computer program that, when run on a processor, performs the above-described authorization authentication method.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • all combinations of the features disclosed in the specification, as well as any methods or devices disclosed herein may be employed in any combination, unless otherwise It is expressly stated that each feature disclosed in this specification can be replaced by an alternative feature that provides the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Health & Medical Sciences (AREA)
  • Power Engineering (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Human Computer Interaction (AREA)
  • Multimedia (AREA)
  • Collating Specific Patterns (AREA)
  • Measurement Of The Respiration, Hearing Ability, Form, And Blood Characteristics Of Living Organisms (AREA)

Abstract

本发明提供一种授权认证方法、装置和系统，该授权认证方法包括：在生物肢体进入第一设备的预设范围后，第一设备通过生物肢体与第二设备建立通信连接；第一设备通过通信连接接收第二设备传输的待授权信息，待授权信息包括：数字认证信息；在生物肢体进入第一设备的预设范围的持续时间内，第一设备采集生物肢体的生物特征信息；第一设备获取对数字认证信息以及生物特征信息认证的认证结果，如果对数字认证信息以及生物特征信息认证的认证结果为认证通过，则第一设备执行授权操作。通过该授权认证方法可以防止他人利用腕表等电子设备冒充用户通过授权，保证了信息和财产的安全。

Description

一种授权认证方法、装置和系统
相关申请的交叉引用
本申请基于申请号为201610127235.6，申请日为2016年3月7日的中国专利申请、申请号为提出201610127334.4，申请日为2016年3月7日的中国专利申请，并要求上述中国专利申请的优先权，上述中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明涉及一种电子技术领域，尤其涉及一种授权认证方法、装置和系统。
背景技术
在用户使用电子设备获取某些特定场所(例如，办公区域、保密区域等)、网站登录、个人物品(汽车、保险柜等)、危险物品等的授权时，电子设备与设置在这些场所、个人物品或危险物品上的电子系统建立通信连接，然后将存储的密钥发送给电子系统，电子系统对密钥进行认证。由此可见，现有技术中的这种授权方式，其它人可以使用别人的电子设备进而获得授权，进而执行非法操作，造成用户的财产、信息等损失。
发明内容
本发明旨在解决上述问题之一。
本发明的主要目的在于提供一种授权认证方法。
本发明的另一目的在于提供一种授权认证装置。
本发明的又一目的在于提供一种授权认证系统。
为达到上述目的，本发明的技术方案具体是这样实现的：
本发明一方面提供了一种授权认证方法，包括：在生物肢体进入第一设备的预设范围后，所述第一设备通过所述生物肢体与第二设备建立通信连接；所述第一设备通过所述通信连接接收所述第二设备传输的待授权信息，所述待授权信息包括：数字认证信息；在所述生物肢体进入第一设备的预设范围的持续时间内，所述第一设备采集所述生物肢体的生物特征信息；所述第一设备获取对所述数字认证信息以及所述生物特征信息认证的认证结果，如果对所述数字认证信息以及所述生物特征信息认证的认证结果为认证通过，则所述第一设备执行授权操作。
此外，所述生物特征信息包括：指纹信息和/或静脉信息；所述第一设备采集所述生物肢体的生物特征信息包括：在所述生物肢体与所述第一设备接触的情况下，第一设备采集所述生物肢体与所述第一设备的接触部位的所述生物特征信息。
此外，所述第一设备获取对所述数字认证信息以及所述生物特征信息认证的认证结果包 括：所述第一设备对所述数字认证信息以及所述生物特征信息进行认证，获得所述认证结果。
此外，所述第一设备获取对所述数字认证信息以及所述生物特征信息的认证结果包括：所述第一设备向后台发送所述生物特征信息以及所述数字认证信息；所述第一设备接收所述后台发送的所述认证结果，其中：所述认证结果为所述后台对所述数字认证信息以及所述生物特征信息进行认证，获得的认证结果。
此外，所述待授权信息还包括：标识信息；所述对所述数字认证信息以及所述生物特征信息认证包括：根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证。
此外，根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证包括：获取所述标识信息对应的认证因子和生物特征验证信息，并利用所述认证因子对所述数字认证信息进行数字认证以及检测所述生物特征验证信息与所述生物特征信息的匹配率，其中，所述认证结果为认证通过包括：在利用所述认证因子对所述数字认证信息进行数字认证通过且所述生物特征信息与所述生物特征验证信息的匹配率大于预设值时，所述认证结果为认证通过。
此外，所述利用所述认证因子对所述数字认证信息进行数字认证以及检测所述生物特征验证信息与所述生物特征信息的匹配率包括：
利用所述认证因子对所述数字认证信息进行认证，当对所述数字认证信息认证通过时，判断所述生物特征信息与所述生物特征验证信息的匹配率是否大于预设值；或
判断所述生物特征信息与所述生物特征验证信息的匹配率是否大于预设值，当判断出所述生物特征信息与所述生物特征验证信息的匹配率大于预设值时，利用所述认证因子对所述数字认证信息进行认证。
此外，所述数字认证信息包括利用私钥签名后获得的电子签名信息，所述认证因子包括对所述电子签名信息进行验签的公钥；所述利用所述认证因子对所述数字认证信息进行认证包括：利用所述公钥对所述电子签名信息进行验签；和/或所述数字认证信息包括利用对称密钥计算得到的MAC值，所述认证因子包括计算所述MAC值的对称密钥；所述利用所述认证因子对所述数字认证信息进行认证包括：利用所述对称密钥计算MAC校验值，验证所述MAC值和MAC校验值；和/或所述数字认证信息包括利用种子密钥生成的动态口令，所述认证因子包括所述验证所述动态口令的种子密钥；所述利用所述认证因子对所述数字认证信息进行认证包括：利用所述种子密钥对所述动态口令进行验证。
本发明另一方面还一种授权认证装置，包括：连接单元，在生物肢体进入授权认证装置的预设范围后，用于通过所述生物肢体与所述身份识别装置建立通信连接；接收单元，用于通过所述通信连接接收所述身份识别装置传输的待授权信息，所述待授权信息包括：数字认证信息；采集单元，在所述生物肢体进入授权认证装置的预设范围的持续时间内，用于采集所述生物肢体的生物特征信息；执行单元，用于获取对所述数字认证信息以及所述生物特征信息认证的认证结果，如果对所述数字认证信息以及所述生物特征信息认证的认证结果为认 证通过，则执行授权操作。
此外，所述生物特征信息包括：指纹信息和/或静脉信息；所述采集单元，在所述生物肢体与所述授权认证装置接触的情况下，用于采集所述生物肢体与所述授权认证装置的接触部位的所述生物特征信息。
此外，所述执行单元，具体用于对所述数字认证信息以及所述生物特征信息进行认证，获得所述认证结果。
此外，所述执行单元，具体用于向后台发送所述生物特征信息以及所述数字认证信息，并接收所述后台发送的所述认证结果，其中：所述认证结果为所述后台对所述数字认证信息以及所述生物特征信息进行认证，获得的认证结果。
此外，所述待授权信息还包括：标识信息；所述对所述数字认证信息以及所述生物特征信息认证包括：根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证。
此外，根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证包括：获取所述标识信息对应的认证因子和生物特征验证信息，并利用所述认证因子对所述数字认证信息进行数字认证以及检测所述生物特征验证信息与所述生物特征信息的匹配率，其中，所述认证结果为认证通过包括：在利用所述认证因子对所述数字认证信息进行数字认证通过且所述生物特征信息与所述生物特征验证信息的匹配率大于预设值时，所述认证结果为认证通过。
此外，所述利用所述认证因子对所述数字认证信息进行数字认证以及检测所述生物特征验证信息与所述生物特征信息的匹配率包括：利用所述认证因子对所述数字认证信息进行认证，当对所述数字认证信息认证通过时，判断所述生物特征信息与所述生物特征验证信息的匹配率是否大于预设值；或判断所述生物特征信息与所述生物特征验证信息的匹配率是否大于预设值，当判断出所述生物特征信息与所述生物特征验证信息的匹配率大于预设值时，利用所述认证因子对所述数字认证信息进行认证。
此外，所述数字认证信息包括利用私钥签名后获得的电子签名信息，所述认证因子包括对所述电子签名信息进行验签的公钥；所述利用所述认证因子对所述数字认证信息进行认证包括：利用所述公钥对所述电子签名信息进行验签；和/或所述数字认证信息包括利用对称密钥计算得到的MAC值，所述认证因子包括计算所述MAC值的对称密钥；所述利用所述认证因子对所述数字认证信息进行认证包括：利用所述对称密钥计算MAC校验值，验证所述MAC值和MAC校验值；和/或所述数字认证信息包括利用种子密钥生成的动态口令，所述认证因子包括所述验证所述动态口令的种子密钥；所述利用所述认证因子对所述数字认证信息进行认证包括：利用所述种子密钥对所述动态口令进行验证。
本发明又一方面还提供一种授权认证系统，包括：身份识别装置以及如权利要求9-16所述的授权认证装置；所述身份识别装置，用于通过所述通信连接向所述授权认证装置发送所述待授权信息。
此外，所述系统还包括：后台，用于接收所述授权认证装置发送的所述生物特征信息以及所述数字认证信息，对所述数字认证信息以及所述生物特征信息进行认证，获得认证结果，并将所述认证结果发送至所述授权认证装置。
由上述本发明提供的技术方案可以看出，本发明提供了一种授权认证方法、装置及系统，通过该授权认证方法可以验证腕表等电子设备的数字认证信息和人体的生物特征信息，保证了所验证的数字认证信息和生物特征信息的关联性和统一性，在本发明的授权认证方法中，对数字认证信息的验证和对人体生物特征信息的验证在一次连续的操作中完成，一旦分开两次进行则会导致验证的不成功，从而能够防止他人利用腕表等电子设备冒充用户通过授权，保证了信息和财产的安全。此外，本发明通过人体活体当作传输导体，可以有效地防止非法分子利用他人的电子设备和生物特征信息来通过授权。此外，使用本发明的授权认证方法，可以将用户需要使用的多种数字认证密钥信息均存储在腕表等随身携带的电子设备，电子设备自动将数字认证信息发送给认证端，用户只需采集生物特征信息即可完成被授权操作，方便快捷安全。
根据下文结合附图对本发明具体实施例的详细描述，本领域技术人员将会更加明了本发明的上述以及其他目的、优点和特征。
附图说明
后文将参照附图以示例性而非限制性的方式详细描述本发明的一些具体实施例。附图中相同的附图标记标示了相同或类似的部件或部分。本领域技术人员应该理解，这些附图未必是按比例绘制的。附图中：
图1为本发明实施例1提供的授权认证方法的流程图；
图2为本发明实施例1提供的授权认证装置的结构示意图；
图3为本发明实施例1提供的授权认证系统的结构示意图。
具体实施方式
在本发明中利用生物肢体来进行通信，即利用生物肢体将通信的双方设备纳入到体域网范围内。所谓体域网(Body Area Network，简称BAN)就是以人体为中心，由和人体相关的网络元素(包括个人终端，分布在人身体上、衣物上、人体周围一定距离范围如3～5米内、甚至人身体内部的传感器、组网设备)等组成的通信网络，因此，只有和人体相关的网络元素进入通信设备的这个预设范围内，才能建立体域网的人体通信连接。
实施例1
本发明提供一种授权认证方法，如图1所示，包括：
步骤S101，在生物肢体进入第一设备的预设范围后，第一设备通过生物肢体与第二设 备建立通信连接。
具体的实施方式中，第一设备具备生物特征采集功能，且能够与第二设备通过生物肢体进行通信的。第一设备可以用于对场所(办公区域、保密区域)、网站登录、个人物品(汽车、保险柜等)、危险物品等的进入或使用权限进行管理，第一设备也可以用于执行交易，例如可以是门禁读卡器、智能汽车锁、保险柜锁、危险物品管理器、带有生物识别功能的计算机、ATM机和POS机等。
第二设备放置于活体(包括人体、动物体等)外部(佩戴在活体或者携带在活体周边)或植入活体体内，例如，第二设备可以是可穿戴设备(智能腕表、智能眼镜等)、智能手机、植入活体内的传感设备等。当第二设备与生物肢体处于可通信范围内(例如佩戴在手腕、颈脖)时，第二设备与活体建立人体通信信道，生物肢体可以相当于第二设备的扩展天线，当检测方检测到生物肢体时，即相当于检测到该第二设备。
第一设备在利用人体信道进行通信时，其具有预设的通信范围，当携带有第二设备的生物肢体进入到其通信范围时，第一设备可以检测到生物肢体，第二设备通过该生物肢体扩展的天线，也可以检测到第一设备。当然，上述第一设备和第二设备可以还支持其他的有线或者无线通信方式。
在具体的实施方式中，第一设备与第二设备通过生物肢体建立体域网(Body Area Network，BAN)，利用生物肢体建立活体通信信道，从而实现通过生物肢体来传输第一设备和第二设备之间的数据，实现利用活体进行通信。第一设备通过生物肢体与第二设备建立通信连接可以通过有线方式和无线方式，具体地，至少可以通过以下两种方式之一实现：
有线方式：第一设备和第二设备均设有电极，第一设备与植入人体内或者佩戴在人体身上的第二设备的生物肢体接触(例如，佩戴有腕表的用户将手指接触POS机)时，将人体作为导体，双方的电极连通形成人体内的通路，该人体内的通路可以是简单线路方式，也可以电流耦合方式，从而实现有线方式的通信。此时第一设备需要与佩戴有第二设备的生物肢体接触，通过电平变化或者波导来传输信号，从而完成通信。
无线方式：在无线方式中，第一设备和第二设备均可以检测周围的电场是否发送变化，如果通信对方进入到人体通信允许的范围内，就能检测到场强变化，与对方建立通信连接。
此外，在通信的发起方面，可以由第一设备实时检测第二设备，在检测到第二设备后主动发起通信；也可以由第二设备来主动检测第一设备，从而主动发起通信。
上述方式利用人体作为电信号的传输介质，实现体表、体内及人体周围(3～5米)的设备的信息交互。与传统的蓝牙、WIFI、射频和红外等无线通信技术相比，人体通信过程中信号经过人体传输，因而电磁噪声对其影响很小，具有低功耗、高保密性以及更低的人体损害等优点。此外由于不存在多人通信时效率降低的问题，也可免除有线通讯方式冗余的连线困扰。
步骤S102，第一设备通过通信连接接收第二设备传输的待授权信息，待授权信息包括： 数字认证信息。
具体的实施方式中，第二设备可以是自己生成待传输的待授权信息后发送给第一设备，也可以由第二设备接收待授权信息生成装置发来的待授权信息后发送给第一设备。该待授权信息中包括有用于进行数字认证的信息，例如，该数字认证信息可以是利用私钥签名后获得的电子签名信息(当该电子签名信息由待授权信息生成装置生成时，此时该待授权信息生成装置可以是电子签名设备、USBkey等装置)；该数字认证信息可以是利用对称密钥计算得到的MAC值(当该MAC值由待授权信息生成装置生成时，此时该待授权信息生成装置可以是密码机等装置)；该数字认证信息可以是种子密钥生成的动态口令(当该动态口令由待授权信息生成装置生成时，此时该待授权信息生成装置可以是OTP等装置)。
该待授权信息还可以包括代表第二设备的信息(如产品序列号等)、持有者身份信息、用户帐号等信息。
当然，第二设备可以通过广播方式发送该待授权信息，也可以在接收到第一设备的授权请求信息后再向第二设备发送待授权信息。
步骤S103，在生物肢体进入第一设备的预设范围的持续时间内，第一设备采集生物肢体的生物特征信息；具体的实施方式中，生物特征信息包括指纹信息、虹膜信息、人脸信息和静脉信息等信息。该第一设备设置有用于采集生物特征信息的模块，例如，指纹采集模块，用于在人体的手指进入到第一设备的预设通信范围内并且接触到第一设备的指纹采集模块时，采集该手指的指纹，又如，静脉采集模块，用于在人体的手腕进入到第一设备的预设通信范围内并且接触到静脉采集模块时，采集该手腕中的静脉信息，还比如，虹膜采集模块，用于在人眼进入到第一设备的预设通信范围内并且位于虹膜采集区域时，采集该人眼的虹膜信息，还比如，人脸识别模块，用于在人脸进入到第一设备的预设通信范围内并且位于人脸采集区域时，采集该人脸的人脸信息。
在本发明的一个实施方式中，当生物特征信息为指纹信息和/或静脉信息时；第一设备采集生物肢体的生物特征信息包括：在生物肢体与第一设备接触的情况下，第一设备采集生物肢体与第一设备的接触部位的生物特征信息。
具体来说，当生物特征信息为指纹信息或静脉信息时，第一设备需要接触用户的生物肢体才能采集到相应的生物特征信息，用户通过主动接触第一设备采集指纹或者静脉信息，避免了在人多拥挤场合其他用户不经意通过时造成的误通信，保证了通信的唯一性和安全性，同时表达了用户的真实意图和真实身份。
第一设备采集生物肢体的生物特征信息这一动作可以在第一设备与第二设备建立通信的持续过程中完成，也可以在在第一设备和第二设备建立通信之前完成。只要保证采集生物肢体的生物特征信息与授权通信是在一次连续的操作中完成即可，从而保证发送的待授权信息和生物特征信息的一致性。
需要注意的是，步骤103与步骤101和步骤102的执行不存在先后顺序，步骤103可以 在步骤101之后步骤102之前执行，也可以与步骤102同时执行，还可以在步骤102之后执行。
步骤S104，第一设备获取对数字认证信息以及生物特征信息认证的认证结果，如果对数字认证信息以及生物特征信息认证的认证结果为认证通过，则第一设备执行授权操作。具体的，当第一设备可以利用自身预存的信息对数字认证信息以及生物特征信息进行认证，也可以将数字认证信息以及生物特征信息发送给与之连接的后台，利用后台对数字认证信息以及生物特征信息进行认证。当获得认证通过的结果时，则第一设备执行相应的授权操作，如授权登录网站、授权打开门禁、授权打开某些设备(汽车、枪支等)。
在本发明的具体实施方式中，第一设备获取对数字认证信息以及生物特征信息认证的认证结果可以通过但不限于以下方式完成：
方式一、第一设备对数字认证信息以及生物特征信息进行认证，获得认证结果。具体来说，第一设备可以存储有与数字认证和生物特征相关的密钥以及其他信息，同时具备对数字认证信息以及生物特征信息进行认证的功能模块，可以自行完成整个认证过程，从而可以提高授权的效率，且由于第一设备可以独立完成授权，保证了授权的安全性。例如，当该第一设备是门禁卡读卡器、保险柜锁等设备时，由门禁卡读卡器、保险柜锁等自行完成认证功能，可以让持有有效授权信息的用户快速、安全、便捷地打开这些设备。
方式二、第一设备向后台发送生物特征信息以及数字认证信息；第一设备接收后台发送的认证结果，其中：认证结果为后台对数字认证信息以及生物特征信息进行认证，获得的认证结果。具体来说，第一设备可以仅完成对生物特征信息的采集以及与第二设备的通信，而将认证的过程交由后台完成，后台具备更快的运算速度，可以快速完成复杂的运算。此外，将采集部分和认证部分分开放置，也可以保证系统的安全性。
通过本发明的授权认证方法，可以验证腕表等电子设备的数字认证信息和人体的生物特征信息，保证了所验证的数字认证信息和生物特征信息的关联性和统一性，在本发明的授权认证方法中，对数字认证信息的验证和对人体生物特征信息的验证在一次连续的操作中完成，一旦分开两次进行则会导致验证的不成功，从而能够防止他人利用腕表等电子设备冒充用户通过授权，保证了信息和财产的安全。此外，本发明通过人体活体当作传输导体，可以有效地防止非法分子利用他人的电子设备和生物特征信息来通过授权。此外，使用本发明的授权认证方法，可以将用户需要使用的多种数字认证密钥信息均存储在腕表等随身携带的电子设备，电子设备自动将数字认证信息发送给认证端，用户只需采集生物特征信息即可完成被授权操作，方便快捷安全。
在本发明的一个实施方式中，待授权信息还包括：标识信息；对数字认证信息以及生物特征信息认证包括：根据标识信息对数字认证信息以及生物特征信息进行认证。具体来说，第一设备在获取到第二设备发送来的待授权信息时，该待授权信息中还包括了用于指示获取对数字认证信息和生物特征信息进行认证的关键信息的标识信息，标识信息可以是序列号、 名称、索引号等方式。通过标识信息可以快速获取到用于数字认证信息和生物特征信息认证的关键信息，提高认证的速度和效率。
在本发明的一个实施方式中，根据标识信息对数字认证信息以及生物特征信息进行认证包括：获取标识信息对应的认证因子和生物特征验证信息，并利用认证因子对数字认证信息进行数字认证以及检测生物特征验证信息与生物特征信息的匹配率，其中，认证结果为认证通过包括：在利用认证因子对数字认证信息进行数字认证通过且生物特征信息与生物特征验证信息的匹配率大于预设值时，认证结果为认证通过。具体的，根据标识信息可以索引或者查快速地找出与数字认证信息对应的认证因子以及与生物特征信息对应的生物特征验证信息，例如，当数字认证信息为一个电子签名信息时，该标识信息可以是指示找到对应的用于验证签名的公钥，该公钥可以直接存放或者存放在数字证书中，该标识信息可以标识该公钥的编号或者数字证书的编号，从而使得要进行验证的设备可以从数据库中快速找到对应的公钥；当获取到的生物特征信息是指纹信息时，该标识信息可以是该指纹信息的编号或者持有该指纹信息的用户的编号，从而可以通过标识信息迅速准确地获取到对应的认证因子和生物特征验证信息。当对数字认证信息和生物特征信息进行认证的过程中，可以先对数字认证信息进行认证，也可以先对生物特征信息进行认证，也可以同时进行认证，只有当对两者的认证结果均为通过时，才确定认证结果为认证通过。
目前对生物特征信息的验证方式主要是通过设定匹配率，判断采集到的生物特征信息与生物特征验证信息进行比对，当匹配率大于一定值时，则判断为验证通过。而由于现在生物识别技术的限制，设置高匹配率虽然可以确保结果的真实性，但是高匹配率往往经常会使得误将真实的用户判定为错误用户或识别失败从而拒绝授权，造成用户的操作不便。例如，现有技术中，检测生物特征验证信息与接收到的生物特征信息的匹配率大于特定门限值(例如，99％、90％等)时，则认为生物特征验证信息与接收到的生物特征信息为同一生物特征信息，生物认证信息认证通过，即在本实施例中，特定门限值为指示两个生物特征信息为同一个生物特征信息的匹配率。为避免出现非法用户也通过认证的情况，现有技术中该特定门限值通常设置较高，此时容易出现合法用户无法识别而导致认证失败的问题。本申请为了降低合法用户认证失败的概率，所采取的预设值小于现有技术中的特定门限值，当检测所述生物特征验证信息与所述生物特征信息的匹配率大于预设值(例如，匹配率大于预设值但小于现有技术中的特定门限值)时，通过结合上述利用所述数字认证因子对所述待认证信息进行数字认证的结果来确定最终的认证结果。利用本发明的生物特征信息和数字认证信息双重验证，由于数字认证的强认证作用，可以将对生物特征认证的匹配率设置得比一般设备的生物特征认证匹配率低，从而降低了携带有真实生物特征的用户被误判为错误用户或识别失败的概率。
在本发明的一个实施方式中，利用认证因子对数字认证信息进行数字认证以及检测生物特征验证信息与生物特征信息的匹配率包括：利用认证因子对数字认证信息进行认证，当对数字认证信息认证通过时，判断生物特征信息与生物特征验证信息的匹配率是否大于预设 值；或判断生物特征信息与生物特征验证信息的匹配率是否大于预设值，当判断出生物特征信息与生物特征验证信息的匹配率大于预设值时，利用认证因子对数字认证信息进行认证。具体的，在对数字认证信息和生物特征信息进行认证的过程中，先对数字认证信息进行认证，可以通过强认证作用的数字认证的保证，来降低了真实合法的用户被识别失败的概率，且当数字认证没有通过时，无需再对生物特征信息进行验证，简化了流程；而当先对生物认证信息进行认证时，通过对生物特征信息验证，可以识别出假冒者，从而无需再进行后续的数字认证流程，简化了流程。
在本发明的具体实施方式中，对数字认证信息的认证可以包括但不限于以下的一种或几种方式：
方式一、数字认证信息包括利用私钥签名后获得的电子签名信息，认证因子包括对电子签名信息进行验签的公钥；利用认证因子对数字认证信息进行认证包括：利用公钥对电子签名信息进行验签；具体的，该方式中数字认证为电子签名认证，电子签名信息的生成方式可以采用私钥对预设值(如随机数等)进行签名，得到签名值，将签名值和预设值作为电子签名信息。通过电子签名认证可以确保该数字认证经过了用户的真实授权，且具有防止用户对执行过的操作反悔和抵赖的功能。
方式二、数字认证信息包括利用对称密钥计算得到的MAC值，认证因子包括计算MAC值的对称密钥；利用认证因子对数字认证信息进行认证包括：利用对称密钥计算MAC校验值，验证MAC值和MAC校验值；具体的，该方式中数字认证为利用对称密钥对信息进行加密后，由验证方利用对称密钥对信息进行解密，例如采用对称算法(例如MAC计算)利用对称密钥对预设值进行加密得到密文值(例如MAC值)，将密文值和预设值作为密文信息，通过该方式可以保证数据传输的安全性，提高通信的安全，同时还能通过双方预存的对称密钥来验证用户的身份。
方式三、数字认证信息包括利用种子密钥生成的动态口令，认证因子包括验证动态口令的种子密钥；利用认证因子对数字认证信息进行认证包括：利用种子密钥对动态口令进行验证。具体的，该方式中利用动态口令来验证身份，可以基于时间或者基于挑战值生成的动态口令，通过该动态口令可以验证用户的真实身份，保证授权的安全性。
本实施例还提供一种授权认证装置20，如图2所示。该授权认证装置20是授权认证方法对应的装置，该授权认证装置20相当于授权认证方法中的第一设备，而身份识别装置30相当于授权认证方法中的第二设备。在此仅对该授权认证装置20的结构进行简单说明，其余未尽之处参照对授权认证方法的描述。该授权认证装置20包括：
连接单元201，在生物肢体进入授权认证装置20的预设范围后，用于通过生物肢体与身份识别装置30建立通信连接；
接收单元202，用于通过通信连接接收身份识别装置30传输的待授权信息，待授权信息包括：数字认证信息；
采集单元203，在生物肢体进入授权认证装置20的预设范围的持续时间内，用于采集生物肢体的生物特征信息；
执行单元204，用于获取对数字认证信息以及生物特征信息认证的认证结果，如果对数字认证信息以及生物特征信息认证的认证结果为认证通过，则执行授权操作。
在本发明的一个实施方式中，生物特征信息包括：指纹信息和/或静脉信息；
采集单元203，在生物肢体与授权认证装置20接触的情况下，用于采集生物肢体与授权认证装置20的接触部位的生物特征信息。
在本发明的一个实施方式中，执行单元204获取对数字认证信息以及生物特征信息认证的认证结果可以通过但不限于以下两种方式完成：
方式一、执行单元204，具体用于对数字认证信息以及生物特征信息进行认证，获得认证结果。
方式二、执行单元204，具体用于向后台40发送生物特征信息以及数字认证信息，并接收后台发送的认证结果，其中：认证结果为后台40对数字认证信息以及生物特征信息进行认证，获得的认证结果。
在本发明的一个实施方式中，待授权信息还包括：标识信息；对数字认证信息以及生物特征信息认证包括：根据标识信息对数字认证信息以及生物特征信息进行认证。
在本发明的一个实施方式中，根据标识信息对数字认证信息以及生物特征信息进行认证包括：获取标识信息对应的认证因子和生物特征验证信息，并利用认证因子对数字认证信息进行数字认证以及检测生物特征验证信息与生物特征信息的匹配率，其中，认证结果为认证通过包括：在利用认证因子对数字认证信息进行数字认证通过且生物特征信息与生物特征验证信息的匹配率大于预设值时，认证结果为认证通过。
目前对生物特征信息的验证方式主要是通过设定匹配率，判断采集到的生物特征信息与生物特征验证信息进行比对，当匹配率大于一定值时，则判断为验证通过。而由于现在生物识别技术的限制，设置高匹配率虽然可以确保结果的真实性，但是高匹配率往往经常会使得误将真实的用户判定为错误用户或识别失败从而拒绝授权，造成用户的操作不便。例如，现有技术中，检测生物特征验证信息与接收到的生物特征信息的匹配率大于特定门限值(例如，99％、90％等)时，则认为生物特征验证信息与接收到的生物特征信息为同一生物特征信息，生物认证信息认证通过，即在本实施例中，特定门限值为指示两个生物特征信息为同一个生物特征信息的匹配率。为避免出现非法用户也通过认证的情况，现有技术中该特定门限值通常设置较高，此时容易出现合法用户无法识别而导致认证失败的问题。本申请为了降低合法用户认证失败的概率，所采取的预设值小于现有技术中的特定门限值，当检测所述生物特征验证信息与所述生物特征信息的匹配率大于预设值(例如，匹配率大于预设值但小于现有技术中的特定门限值)时，通过结合上述利用所述数字认证因子对所述待认证信息进行数字认证的结果来确定最终的认证结果。利用本发明的生物特征信息和数字认证信息双重验证，由 于数字认证的强认证作用，可以将对生物特征认证的匹配率设置得比一般设备的生物特征认证匹配率低，从而降低了携带有真实生物特征的用户被误判为错误用户或识别失败的概率。
在本发明的一个实施方式中，利用认证因子对数字认证信息进行数字认证以及检测生物特征验证信息与生物特征信息的匹配率包括：
利用认证因子对数字认证信息进行认证，当对数字认证信息认证通过时，判断生物特征信息与生物特征验证信息的匹配率是否大于预设值；或
判断生物特征信息与生物特征验证信息的匹配率是否大于预设值，当判断出生物特征信息与生物特征验证信息的匹配率大于预设值时，利用认证因子对数字认证信息进行认证。
在本发明的一个实施方式中，对数字认证信息进行认证可以通过但不限于以下方式完成：
方式一、数字认证信息包括利用私钥签名后获得的电子签名信息，认证因子包括对电子签名信息进行验签的公钥；利用认证因子对数字认证信息进行认证包括：利用公钥对电子签名信息进行验签；和/或
方式二、数字认证信息包括利用对称密钥计算得到的MAC值，认证因子包括计算MAC值的对称密钥；利用认证因子对数字认证信息进行认证包括：利用对称密钥计算MAC校验值，验证MAC值和MAC校验值；和/或
方式三、数字认证信息包括利用种子密钥生成的动态口令，认证因子包括验证动态口令的种子密钥；利用认证因子对数字认证信息进行认证包括：利用种子密钥对动态口令进行验证。
本实施例还提供一种授权认证系统，如图3所示，该授权认证系统包括前述的身份识别装置30以及前述的授权认证装置20；
身份识别装置30，用于通过通信连接向授权认证装置20发送待授权信息。
在本发明的一个实施方式中，授权认证系统还包括：后台40，用于接收授权认证装置20发送的生物特征信息以及数字认证信息，对数字认证信息以及生物特征信息进行认证，获得认证结果，并将认证结果发送至授权认证装置20。
本发明的实施例提供了一种计算机程序，当其在处理器上运行时，执行上述的授权认证方法。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要 求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。
至此，本领域技术人员应认识到，虽然本文已详尽示出和描述了本发明的多个示例性实施例，但是，在不脱离本发明精神和范围的情况下，仍可根据本发明公开的内容直接确定或推导出符合本发明原理的许多其他变型或修改。因此，本发明的范围应被理解和认定为覆盖了所有这些其他变型或修改。

Claims (17)

  1. 一种授权认证方法，其特征在于，包括：
    在生物肢体进入第一设备的预设范围后，所述第一设备通过所述生物肢体与第二设备建立通信连接；
    所述第一设备通过所述通信连接接收所述第二设备传输的待授权信息，所述待授权信息包括：数字认证信息；
    在所述生物肢体进入第一设备的预设范围的持续时间内，所述第一设备采集所述生物肢体的生物特征信息；
    所述第一设备获取对所述数字认证信息以及所述生物特征信息认证的认证结果，如果对所述数字认证信息以及所述生物特征信息认证的认证结果为认证通过，则所述第一设备执行授权操作。
  2. 根据权利要求1所述的方法，其特征在于，
    所述生物特征信息包括：指纹信息和/或静脉信息；
    所述第一设备采集所述生物肢体的生物特征信息包括：
    在所述生物肢体与所述第一设备接触的情况下，第一设备采集所述生物肢体与所述第一设备的接触部位的所述生物特征信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一设备获取对所述数字认证信息以及所述生物特征信息认证的认证结果包括：
    所述第一设备对所述数字认证信息以及所述生物特征信息进行认证，获得所述认证结果。
  4. 根据权利要求1或2所述的方法，其特征在于，所述第一设备获取对所述数字认证信息以及所述生物特征信息的认证结果包括：
    所述第一设备向后台发送所述生物特征信息以及所述数字认证信息；
    所述第一设备接收所述后台发送的所述认证结果，其中：所述认证结果为所述后台对所述数字认证信息以及所述生物特征信息进行认证，获得的认证结果。
  5. 根据权利要求3或4所述的方法，其特征在于，所述待授权信息还包括：标识信息；
    所述对所述数字认证信息以及所述生物特征信息认证包括：
    根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证。
  6. 根据权利要求5所述的方法，其特征在于，根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证包括：
    获取所述标识信息对应的认证因子和生物特征验证信息，并利用所述认证因子对所述数字认证信息进行数字认证以及检测所述生物特征验证信息与所述生物特征信息的匹配率，其中，所述认证结果为认证通过包括：在利用所述认证因子对所述数字认证信息进行数字认证通过且所述生物特征信息与所述生物特征验证信息的匹配率大于预设值时，所述认证结果为认证通过。
  7. 根据权利要求6所述的方法，其特征在于，所述预设值小于特定门限值，其中，所述特定门限值为指示两个生物特征信息为同一个生物特征信息的匹配率。
  8. 一种授权认证装置，其特征在于，包括：
    连接单元，在生物肢体进入授权认证装置的预设范围后，用于通过所述生物肢体与身份识别装置建立通信连接；
    接收单元，用于通过所述通信连接接收所述身份识别装置传输的待授权信息，所述待授权信息包括：数字认证信息；
    采集单元，在所述生物肢体进入授权认证装置的预设范围的持续时间内，用于采集所述生物肢体的生物特征信息；
    执行单元，用于获取对所述数字认证信息以及所述生物特征信息认证的认证结果，如果对所述数字认证信息以及所述生物特征信息认证的认证结果为认证通过，则执行授权操作。
  9. 根据权利要求8所述的装置，其特征在于，所述生物特征信息包括：指纹信息和/或静脉信息；
    所述采集单元，在所述生物肢体与所述授权认证装置接触的情况下，用于采集所述生物肢体与所述授权认证装置的接触部位的所述生物特征信息。
  10. 根据权利要求8或9所述的装置，其特征在于，
    所述执行单元，具体用于对所述数字认证信息以及所述生物特征信息进行认证，获得所述认证结果。
  11. 根据权利要求8或9所述的装置，其特征在于，
    所述执行单元，具体用于向后台发送所述生物特征信息以及所述数字认证信息，并接收所述后台发送的所述认证结果，其中：所述认证结果为所述后台对所述数字认证信息以及所述生物特征信息进行认证，获得的认证结果。
  12. 根据权利要求10或11所述的装置，其特征在于，所述待授权信息还包括：标识信息；
    所述对所述数字认证信息以及所述生物特征信息认证包括：
    根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证。
  13. 根据权利要求12所述的装置，其特征在于，根据所述标识信息对所述数字认证信息以及所述生物特征信息进行认证包括：
    获取所述标识信息对应的认证因子和生物特征验证信息，并利用所述认证因子对所述数字认证信息进行数字认证以及检测所述生物特征验证信息与所述生物特征信息的匹配率，其中，所述认证结果为认证通过包括：在利用所述认证因子对所述数字认证信息进行数字认证通过且所述生物特征信息与所述生物特征验证信息的匹配率大于预设值时，所述认证结果为认证通过。
  14. 根据权利要求13所述的装置，其特征在于，所述预设值小于特定门限值，其中，所述特定门限值为指示两个生物特征信息为同一个生物特征信息的匹配率。
  15. 一种授权认证系统，其特征在于，包括：身份识别装置以及如权利要求8-14所述的授权认证装置；
    所述身份识别装置，用于通过所述通信连接向所述授权认证装置发送所述待授权信息。
  16. 根据权利要求15所述的系统，其特征在于，所述系统还包括：
    后台，用于接收所述授权认证装置发送的所述生物特征信息以及所述数字认证信息，对所述数字认证信息以及所述生物特征信息进行认证，获得认证结果，并将所述认证结果发送至所述授权认证装置。
  17. 一种计算机程序，当其在处理器上运行时，执行如权利要求1-7中任一项所述的授权认证方法。
PCT/CN2017/075745 2016-03-07 2017-03-06 一种授权认证方法、装置和系统 Ceased WO2017152819A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US16/083,469 US10785218B2 (en) 2016-03-07 2017-03-06 Authorization authentication method, device and system
JP2018546887A JP2019512786A (ja) 2016-03-07 2017-03-06 権限付与認証方法、権限付与装置及び権限付与システム
EP17762505.0A EP3429157A4 (en) 2016-03-07 2017-03-06 AUTHORIZATION AUTHENTICATION METHOD, DEVICE AND SYSTEM

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201610127334.4 2016-03-07
CN201610127235.6 2016-03-07
CN201610127334.4A CN105939336A (zh) 2016-03-07 2016-03-07 一种身份认证方法及系统
CN201610127235.6A CN105991654A (zh) 2016-03-07 2016-03-07 一种授权认证方法、装置和系统

Publications (1)

Publication Number Publication Date
WO2017152819A1 true WO2017152819A1 (zh) 2017-09-14

Family

ID=59788979

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/075745 Ceased WO2017152819A1 (zh) 2016-03-07 2017-03-06 一种授权认证方法、装置和系统

Country Status (4)

Country Link
US (1) US10785218B2 (zh)
EP (1) EP3429157A4 (zh)
JP (1) JP2019512786A (zh)
WO (1) WO2017152819A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2019102902A (ja) * 2017-11-30 2019-06-24 ルネサスエレクトロニクス株式会社 通信システム
DE102019108095A1 (de) * 2019-03-28 2020-10-01 Infineon Technologies Ag Ausführen einer kryptografischen Operation
US11194897B2 (en) * 2019-04-10 2021-12-07 Mastercard International Incorporated System and methods for generating and authenticating dynamic usernames replication
CN113642050B (zh) * 2021-10-13 2022-02-08 联芸科技（杭州）有限公司 自配置加密硬盘及其配置方法、系统及系统的启动方法
CN118503946A (zh) * 2024-01-30 2024-08-16 中国银联股份有限公司 一种基于可信计算的生物特征验证方法及其系统

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103237030A (zh) * 2013-04-25 2013-08-07 深圳市中兴移动通信有限公司 基于生物识别的用户认证方法及系统
CN104202744A (zh) * 2014-08-14 2014-12-10 腾讯科技（深圳）有限公司 一种智能终端的操作认证方法、终端及系统
CN104767760A (zh) * 2015-04-23 2015-07-08 王晓军 具有指静脉身份认证的智能指环及用其控制终端的方法
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105939336A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN105989495A (zh) * 2016-03-07 2016-10-05 李明 一种支付方法及系统
CN105991654A (zh) * 2016-03-07 2016-10-05 李明 一种授权认证方法、装置和系统
CN105991652A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及系统
CN105991653A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及装置

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101061521B (zh) * 2004-11-16 2010-11-24 皇家飞利浦电子股份有限公司 识别系统和操作该系统的方法
JP2006268614A (ja) * 2005-03-25 2006-10-05 Sony Corp 情報処理システム、情報処理装置および方法、プログラム、並びに記録媒体
CN101213559B (zh) * 2005-08-05 2012-02-29 夏普株式会社 通信装置和通信系统
JP2010049490A (ja) * 2008-08-21 2010-03-04 Panasonic Electric Works Co Ltd 認証システム
JP2011076593A (ja) * 2009-09-03 2011-04-14 Seiko Instruments Inc 情報表示システム、管理装置、情報表示装置および電子棚札端末
JP2011123729A (ja) * 2009-12-11 2011-06-23 Hitachi Omron Terminal Solutions Corp 認証システム、人体通信端末装置、およびホスト装置
JP2012039370A (ja) * 2010-08-06 2012-02-23 Sony Corp 通信システム並びに通信装置
US20130006859A1 (en) * 2011-06-29 2013-01-03 Hyundai Motor Company Payment system and method using human body communication
US8994827B2 (en) * 2012-11-20 2015-03-31 Samsung Electronics Co., Ltd Wearable electronic device
KR20140119324A (ko) * 2013-03-28 2014-10-10 인텔렉추얼디스커버리 주식회사 의료 정보 모니터링 시스템 및 방법
JP2015055952A (ja) * 2013-09-11 2015-03-23 大日本印刷株式会社 決済システム、決済方法、認証サーバ、認証方法、及び、プログラム
EP3078135B1 (en) * 2013-12-05 2019-12-11 Sony Corporation Pairing consumer electronic devices using a cross-body communications protocol
US9510197B2 (en) * 2014-06-12 2016-11-29 Sony Mobile Communications Inc. Electronic equipment and method of authenticating a user
US10588005B2 (en) * 2014-09-26 2020-03-10 Mcafee, Llc Fuzzy fingerprinting of communicating wearables
KR20160072682A (ko) * 2014-12-15 2016-06-23 삼성전자주식회사 생체 정보를 이용한 인증 방법 및 이를 위한 전자 장치
KR102139795B1 (ko) * 2014-12-15 2020-07-31 삼성전자주식회사 생채 특징 패턴을 업데이트하는 방법 및 이를 위한 전자 장치
KR101675728B1 (ko) * 2015-01-05 2016-11-14 주식회사 슈프리마 정보처리기기를 이용한 사용자 인증 처리 방법 및 장치
CN105447437B (zh) * 2015-02-13 2017-05-03 比亚迪股份有限公司 指纹识别方法和装置
US9842329B2 (en) * 2015-02-13 2017-12-12 Sony Corporation Body area network for secure payment
KR20160136013A (ko) * 2015-05-19 2016-11-29 엘지전자 주식회사 이동 단말기 및 그 제어 방법
KR102027112B1 (ko) * 2016-07-05 2019-10-01 주식회사 슈프리마 지문 인증 방법 및 장치

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103237030A (zh) * 2013-04-25 2013-08-07 深圳市中兴移动通信有限公司 基于生物识别的用户认证方法及系统
CN104202744A (zh) * 2014-08-14 2014-12-10 腾讯科技（深圳）有限公司 一种智能终端的操作认证方法、终端及系统
CN104767760A (zh) * 2015-04-23 2015-07-08 王晓军 具有指静脉身份认证的智能指环及用其控制终端的方法
CN105245341A (zh) * 2015-09-07 2016-01-13 天地融科技股份有限公司 远程身份认证方法和系统以及远程开户方法和系统
CN105939336A (zh) * 2016-03-07 2016-09-14 李明 一种身份认证方法及系统
CN105989495A (zh) * 2016-03-07 2016-10-05 李明 一种支付方法及系统
CN105991654A (zh) * 2016-03-07 2016-10-05 李明 一种授权认证方法、装置和系统
CN105991652A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及系统
CN105991653A (zh) * 2016-03-07 2016-10-05 李明 一种身份认证方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3429157A4 *

Also Published As

Publication number Publication date
US10785218B2 (en) 2020-09-22
JP2019512786A (ja) 2019-05-16
US20190075103A1 (en) 2019-03-07
EP3429157A4 (en) 2019-10-16
EP3429157A1 (en) 2019-01-16

Similar Documents

Publication Publication Date Title
EP3428818B1 (en) Identity authentication method and system
US11012438B2 (en) Biometric device pairing
JP7467702B2 (ja) アクセス制御のためのシステム、方法及び装置
US8955069B1 (en) Event-based biometric authentication using mobile device
US20140380445A1 (en) Universal Authentication and Data Exchange Method, System and Service
CN106612259B (zh) 身份识别、业务处理以及生物特征信息的处理方法和设备
WO2017152818A1 (zh) 一种支付方法及系统
US20190174304A1 (en) Universal Authentication and Data Exchange Method, System and Service
CN105939336A (zh) 一种身份认证方法及系统
US20150026479A1 (en) Creation and authentication of biometric information
US20210105254A1 (en) System, method and computer-accessible medium for two-factor authentication during virtual private network sessions
CN105991652A (zh) 一种身份认证方法及系统
WO2017152819A1 (zh) 一种授权认证方法、装置和系统
US9030290B2 (en) Vicinity-based multi-factor authentication
CN105553926A (zh) 一种认证方法、服务器以及终端
CN105991654A (zh) 一种授权认证方法、装置和系统
CN105989488B (zh) 一种支付方法及系统
CN105989497A (zh) 一种支付方法及系统
CN105939195A (zh) 一种交易方法及系统
WO2017016038A1 (zh) 支付方法、支付装置、终端和支付系统
KR102339949B1 (ko) 인증 정보 처리 방법 및 장치와 인증 정보 처리 방법 장치를 포함한 사용자 단말
CN105989498A (zh) 一种支付方法及系统
CN109005158B (zh) 基于模糊保险箱的动态手势认证系统的认证方法
WO2026092841A1 (en) Preventing unauthorized use while charging
CN120048030A (zh) 一种智能设备控制系统、方法及相关产品

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018546887

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017762505

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017762505

Country of ref document: EP

Effective date: 20181008

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17762505

Country of ref document: EP

Kind code of ref document: A1