CN104065487A - A method of IBC identity authentication based on digital fingerprint random secret value - Google Patents

Abstract

The invention discloses a random secret value IBC identity authentication method based on a digital fingerprint. The random secret value IBC identity authentication method based on the digital fingerprint comprises the steps that (1) a user private key is jointly generated according to a user ID, a password PW and a system main secret key generated by a PKG server, digital fingerprint information of the user is encrypted, and user identity mark information is generated; (2) the PKG server generates a user identity credential according to the user ID, the password PW, a fingerprint feature ciphertext and a user identity credential time limit and sends and stores the user identity credential to a user authentication server; (3) the user authentication server deduces the authenticity of the user identity mark information according to stored user identity credential information and a fingerprint feature threshold value. The random secret value IBC identity authentication method based on the digital fingerprint has good authentication, privacy and non-repudiation performance, and is suitable for identity authentication among entities in a monitoring system.

Description

A method of IBC identity authentication based on digital fingerprint random secret value

technical field

The invention relates to an authentication method, in particular to an IBC identity authentication method based on a digital fingerprint random secret value, and belongs to the technical fields of information system security and digital fingerprint identification.

Background technique

With the application of computer technology and network communication technology in the monitoring system, it is very convenient to monitor equipment or environments in different regions. Users can log in to the system anytime and anywhere to view various information. While informatization and networking bring convenience to users, threats such as cyber attacks, information tampering, and viruses and Trojan horses have also seriously affected the credibility of the system.

Illegal network intrusion and identity impersonation affect the trustworthiness of the subject's identity in the system platform. Identity authentication is an identification service that generates a relevant identity mark for the identity attribute of the authenticated party to determine the legitimacy of its identity.

Existing identity authentication technology relies on many factors, such as information set A ₁ known by the user = {password A ₁₁ , password A ₁₂ , ...}, set of things owned by the user A ₂ = {token A ₂₁ , smart card A ₂₂ , ...}, user's biometric feature set A ₃ = {fingerprint A ₃₁ , iris A ₃₂ , ...}, etc., these authenticated parties' security element sets AS = {A ₁ , A ₂ , A ₃ } produce their identity evidence, and The authentication result is obtained by comparing the expected value of the authentication party's identity evidence. From the perspective of identity authentication security and characteristics: (1) The identity authentication method based on information set _A1 is simple and easy to use, but the password has a recognized weak link, which is easy to be leaked and stolen; (2) The information set known to the user The composition of A ₁ and the collection of things owned by the user A ₂ is based on the two-factor authentication method, which can fundamentally improve the security risks caused by the leakage of passwords in information secret authentication methods, and the transmission of passwords (or their abstract values) in the network Replay attacks caused by eavesdropping; (3) Based on biometric identity authentication technology, because biometrics are universal, unique, and cannot be copied, lost and forgotten; they have the characteristics of high reliability and convenient application. In addition, there is a shortcoming in the existing biometric-based identity authentication technology. Storing biometric template information is easy to cause leakage, and the security of biometric templates is a key issue in a secure biometric system.

Contents of the invention

Aiming at the problem of biometric template security, the present invention combines biometric authentication technology and traditional cryptography technology, and proposes an IBC identity authentication method based on digital fingerprint random encryption value with good authentication, privacy and non-repudiation.

The digital fingerprint random secret value IBC identity authentication method based on the present invention is realized through the following technical solutions:

A kind of IBC identity authentication method based on digital fingerprint random secret value, concrete steps comprise: 1), generate user's private key jointly with the system master key that user ID, password PW, PKG server produce, meanwhile, PKG server carries out user's private key Digital signature; 2), collect user digital fingerprint information and encrypt it to generate user identity information; 3), PKG server generates user identity certificate according to user ID, password PW, user identity information, user identity certificate time limit and digital signature , send and save to the user authentication server, at the same time, the user authentication server writes the registration parameters into the user’s USBKey, and the registration is completed; 4) collect the digital fingerprint feature vector of the user to be authenticated, encrypt and send it to the user authentication server as ciphertext, and the user The authentication server calculates the random fusion encryption value according to the random number generator, and sends it to the user who needs to be authenticated; 5), the user who needs to be authenticated uses the user's private key to decrypt the random fusion encryption value, and the decryption result is sent back to the user authentication server, and then infers that the user The identity identification information is authentic, and the identity authentication process is completed.

Described step 1) specifically comprises:

1.1), the PKG server is initialized, the construction satisfies the Diffie-Hellman assumption of the elliptic curve E _p , and the base point G of the upper order of the elliptic curve E _p is n, so that the user ID satisfies the mapping function: F _ID : {0, 1} ^m → E _p , generate a large prime number k _m as the PKG system master key, and then obtain the PKG public key P _m =k _m ·G.

1.2), the PKG server uses the system master key k _m , PKG public key P _m , and the user provides ID and password value PW to generate user private key k _u , k _u satisfies ID||PW=U _ID =k _u ·G.

1.3), the PKG server uses the digital signature function Sig(k _m ,k _u ) to digitally sign the user's private key ku S _u ={k _u ,Sig(k _m ,k _u )}, and the user receives the digital signature S _u of the user's private key Finally, use the digital signature verification function Ver(P _m ,S _u ) to verify whether the user's private key matches the digital signature, and determine the legitimacy of the user's private key k _u .

Described step 2) specifically comprises:

2.1) Collect user fingerprints, extract user fingerprint feature vector group W _i : {W ₁ , W ₂ , W ₃ ,...}, generate fingerprint feature threshold τ according to user fingerprint feature vectors.

2.2), the user uses the RSA encryption algorithm to encrypt the fingerprint vector group vector W _i to obtain the fingerprint feature ciphertext E(W _i )=E(U _ID ,W _i ) as a template, the fingerprint feature ciphertext E(W _i ) and the fingerprint The feature threshold τ constitutes the identification information of the identity authentication user.

The step 3) specifically includes: the PKG server uses the user ID, password PW, fingerprint feature ciphertext E(W _i ), fingerprint feature threshold τ, user identity credential time limit T and digital signature Sig(k _m ,τ||T ||E(W _i )) Generate user identity credential C _u :

C _u ＝{U _ID ,PW,E(W _i ),τ,Sig(k _m ,τ||T||E(W _i ))}

At the same time, the user authentication server uses the digital signature verification function Ver(P _m ,C _u ) to verify the legitimacy of the user identity credential C _u , and sends the user ID, password PW, user fingerprint feature ciphertext E(W _i ), fingerprint feature threshold τ and the time limit T of the identity certificate are stored in the identity certificate database, and the PKG server notifies the user of successful registration, and writes the registration parameters {k _u ,G,Ver(P _m ,C _u )} into the user's USBKey.

Described step 4) specifically comprises:

4.1), use the fingerprint collector to collect the fingerprint of the user who needs to be authenticated, and extract the digital fingerprint feature vector X _u :{x ₁ ,x ₂ ,…,x _n }, use the user public key U _ID to encrypt X _u using the RSA algorithm, and the fingerprint Feature vector ciphertext E( _xi )=E(U _ID ,xi ₎ , and the fingerprint feature vector ciphertext E( _xi ) is sent to the user authentication server.

4.2), the random number generator of the user authentication server generates k random numbers ρ _j and kn random numbers r _ji , and ρ _j and r _ji meet the constraints:

4.3) Use the RSA algorithm to encrypt the random number r _ji to obtain the encrypted value of the random number E(r _ji )=E(U _ID ,r _ji ).

4.4), the user authentication server uses the fingerprint feature encryption value E(W _i ) of the user as a template, the fingerprint feature vector ciphertext E(xi ₎ and the random number encryption value E(r _ji ) to calculate the random fusion encryption value E(W _i x _i r _ji )=E(W _i )E(xi ₎ E(r _ji ), and send the random fusion encryption value E(W _i x _i r _ji ) to the user requiring authentication.

Described step 5) specifically comprises:

5.1), the user who needs to be authenticated uses the user's private key k _u to decrypt the random fusion encryption value E(W _i x _i r _ji ) to obtain the randomized fingerprint feature W _i x _i r _ji ; calculate the randomized fingerprint feature vector and And send R _j to the user authentication server.

5.2), the user authentication server calculates the fingerprint feature verification value R of the user to be authenticated according to R _j as:

$\mathrm{<span\; class="notranslate">\; R</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>{\mathrm{<span\; class="notranslate">\; R</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; the\; ji</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; the\; ji</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; the\; ji</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}$

If R>τ, the user identity authentication is passed; if R<τ, the user identity authentication fails, and the authentication result is returned to the user to be authenticated.

Compared with the prior art, the beneficial effects of the present invention include:

1. The IBC identity authentication method based on the digital fingerprint random secret value combines traditional cryptography and biometric identification technology, which provides good authentication, privacy and non-repudiation for the authentication process, and is widely used among entities in the monitoring system authentication.

2. Generate identity certificates and random secret value judgment methods through user identity information, so that the system does not need to directly store user fingerprint feature information, even if an attacker can enter the database, he cannot obtain user fingerprint feature information, and realizes high confidentiality of digital fingerprint templates.

3. The fingerprint is not directly used as the only authentication information, and the user does not need to provide the server with a fingerprint template.

4. The authentication method information of the authentication server is transparent to the user, so that the system can enjoy the good authentication of biometric features while ensuring the privacy of the user's fingerprint template and the resource of the authentication server.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the description, and are used together with the embodiments of the present invention to explain the present invention, and do not limit the present invention. in:

Fig. 1 is the schematic block diagram of the structure based on digital fingerprint random secret value IBC identity authentication user registration process in the method of the present invention;

Fig. 2 is a schematic structural block diagram of the user identity verification demonstration process based on the digital fingerprint random secret value IBC identity authentication in the method of the present invention.

Detailed ways

The IBC identity authentication method based on digital fingerprint random cipher value of the present invention is based on fingerprint feature vector and random cipher value analysis method for identity authentication, and its process is divided into two parts: user registration and user identity verification.

The user registration process based on digital fingerprint random secret value IBC identity authentication includes: 1. The user's private key is jointly generated with the user ID, password PW, and the system master key generated by the PKG server. At the same time, the PKG server digitally signs the user's private key; 2. ), collect user digital fingerprint information and encrypt to generate user identity information; 3), PKG server generates user identity certificate according to user ID, password PW, user identity information, user identity certificate time limit and digital signature, sends and saves At the same time, the user authentication server writes the registration parameters into the user USBKey, and the registration is completed.

Based on the digital fingerprint random secret value IBC identity authentication user identity verification process specifically includes: 1) Collect the digital fingerprint feature vector of the user to be authenticated, encrypt it to form a ciphertext and send it to the user authentication server, and the user authentication server performs random fusion encryption according to the random number generator. 2) The user who needs to be authenticated uses the user's private key to decrypt the random fusion encryption value, and the decryption result is sent back to the user authentication server, and then the authenticity of the user's identity information is deduced, and the identity authentication process is completed.

Below in conjunction with accompanying drawing 1, the IBC identity authentication user registration process based on digital fingerprint random secret value is described in further detail:

Step 1. Initialize the PKG server, construct the elliptic curve E _p that satisfies the Diffie-Hellman assumption, and select the base point G whose upper order is n on the elliptic curve E _p , so that the user ID satisfies the mapping function: F _ID : {0, 1} ^m → E _p , generate a large prime number k _m as the PKG system master key, and then obtain the PKG public key P _m =k _m ·G.

Step 2: The PKG server uses the system master key k _m , the PKG public key P _m , and the user provides ID and password value PW to generate the user's private key k _u , and k _u satisfies ID||PW=U _ID =k _u ·G.

Step 3: The PKG server uses the digital signature function Sig(k _m ,k _u ) to digitally sign the user's private key ku S _u ={k _u ,Sig(k _m ,k _u )} to improve the security of k _u transmission; when After receiving the digital signature _Su of the user's private key, the user uses the digital signature verification function Ver(P _m , Su ₎ to verify whether the user's private key matches the digital signature, thereby determining the legitimacy of the user's private key k _u .

Step 4: collect user fingerprints, extract user fingerprint feature vector group W _i : {W ₁ , W ₂ , W ₃ ,...}, and generate fingerprint feature threshold τ according to user fingerprint feature vectors.

Step 5. The user uses the RSA encryption algorithm to encrypt the fingerprint vector group vector W _i to obtain the fingerprint feature ciphertext E(W _i )=E(U _ID ,W _i ) as a template, the fingerprint feature ciphertext E(W _i ) and the fingerprint The feature threshold τ constitutes the identification information of the identity authentication user.

Step 6: The PKG server uses the user ID, password PW, fingerprint feature ciphertext E(W _i ), fingerprint feature threshold τ, user identity credential time limit T and digital signature Sig(k _m ,τ||T||E(W _i )) Generate user identity credential C _u :

C _u ＝{U _ID ,PW,E(W _i ),τ,Sig(k _m ,τ||T||E(W _i ))}

At the same time, the user authentication server uses the digital signature verification function Ver(P _m ,C _u ) to verify the legitimacy of the user identity credential C _u , and sends the user ID, password PW, user fingerprint feature ciphertext E(W _i ), fingerprint feature threshold τ and the time limit T of the identity certificate are stored in the identity certificate database, and the PKG server notifies the user of successful registration, and writes the registration parameters {k _u ,G,Ver(P _m ,C _u )} into the user's USBKey.

Below in conjunction with accompanying drawing 2, do further detailed description based on digital fingerprint random secret value IBC identity authentication user authentication process:

Step 1. Use the fingerprint collector to collect the fingerprint of the user who needs to be authenticated, and extract the digital fingerprint feature vector X _u :{x ₁ ,x ₂ ,…,x _n }, use the user public key U _ID to encrypt X _u using the RSA algorithm, and the fingerprint Feature vector ciphertext E( _xi )=E(U _ID ,xi ₎ , and the fingerprint feature vector ciphertext E( _xi ) is sent to the user authentication server.

Step 2. The random number generator of the user authentication server generates k random numbers ρ _j and kn random numbers r _ji , and ρ _j and r _ji satisfy the constraints:

Step 3: Use the RSA algorithm to encrypt the random number r _ji to obtain the random number encrypted value E(r _ji )=E(U _ID ,r _ji ).

Step 4: The user authentication server uses the fingerprint feature encryption value E(W _i ), fingerprint feature vector ciphertext E(xi ₎ and random number encryption value E(r _ji ) of the user as a template to calculate the random fusion encryption value E(W _i x _i r _ji )=E(W _i )E(xi ₎ E(r _ji ), and send the random fusion encryption value E(W _i x _i r _ji ) to the user requiring authentication.

Step 5. The user who needs to be authenticated uses the user private key ku to decrypt the random fusion encryption value E(W _i x _i r _ji ) to obtain the randomized fingerprint feature W _i x _i r _ji ; calculate the randomized fingerprint feature vector and And send R _j to the user authentication server.

Step 6. The user authentication server calculates the fingerprint feature verification value R of the user to be authenticated according to R _j as:

$\mathrm{<span\; class="notranslate">\; R</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>{\mathrm{<span\; class="notranslate">\; R</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; the\; ji</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; the\; ji</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; k</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; \&rho;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; the\; ji</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}$

If R>τ, the user identity authentication is passed; if R<τ, the user identity authentication fails, and the authentication result is returned to the user to be authenticated.

The IBC identity authentication method based on the digital fingerprint random encryption value described in the present invention is not limited to the description in the instructions and embodiments. All modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention are included within the scope of the claims of the present invention.

Claims (6)

1. Based on digital finger-print with a secret value IBC identity identifying method, it is characterized in that, concrete steps comprise:

   One, register with secret value IBC authentication user based on digital finger-print

   1), the system master key that produces with user ID, password PW, PKG server generates private key for user jointly, meanwhile, PKG server carries out digital signature to private key for user;

   2), gather number finger print information and be encrypted, generation User Identity information;

   3), PKG server generates user identity voucher according to user ID, password PW, User Identity information, user identity voucher time limit and digital signature, send and be saved in subscriber authentication server, simultaneously, subscriber authentication server will be registered parameter read-in in user USBKey, and registration completes;

   Two, based on digital finger-print with secret value IBC authentication subscriber authentication

   4) gather and need authenticated user digital finger-print characteristic vector, form ciphertext and send to subscriber authentication server after encrypting, subscriber authentication server carries out merging close value and calculating at random according to randomizer, and sends to and need authenticated user;

   5), need authenticated user user private key to the deciphering of the close value of random fusion, decrypted result is recycled to subscriber authentication server, and then infers User Identity information authenticity, authentication process completes.
2. According to claim 1 based on digital finger-print with secret value IBC identity identifying method, it is characterized in that described step 1) specifically comprise:

   1.1), the initialization of PKG server, structure meets Diffie-Hellman hypothesis elliptic curve E _p, choose elliptic curve E _pupper rank are the basic point G of n, make user ID meet mapping function: F _iD: { 0,1} ^m→ E _p, produce large prime number k _mas PKG system master key, then obtain PKG PKI P _m=k _mg;

   1.2), PKG server by utilizing system master key k _m, PKG PKI P _m, user provides ID, password value PW, produces private key for user k _u, k _umeet ID||PW=U _iD=k _ug;

   1.3), PKG server uses digital signature function Sig (k _m, k _u) to private key for user ku digital signature S _u={ k _u, Sig (k _m, k _u), user receives private key for user digital signature S _uafter, use digital signature authentication function Ver (P _m, S _u) whether authentication of users private key mate with digital signature, determines private key for user k _ulegitimacy.
3. According to claim 1 based on digital finger-print with secret value IBC identity identifying method, it is characterized in that described step 2) specifically comprise:

   2.1), gather user fingerprints, extraction user fingerprints characteristic vector group W _i: { W ₁, W ₂, W ₃..., generate fingerprint characteristic threshold tau according to user fingerprints characteristic vector;

   2.2), user uses RSA cryptographic algorithms to fingerprint vector group vector W _iencryption obtains the fingerprint characteristic ciphertext E (W as template _i)=E (U _iD, W _i), fingerprint characteristic ciphertext E (W _i) and fingerprint characteristic threshold tau formation authentication User Identity information.
4. According to claim 1 based on digital finger-print with secret value IBC identity identifying method, it is characterized in that described step 3) specifically comprise:

   PKG server by utilizing user ID, password PW, fingerprint characteristic ciphertext E (W _i), fingerprint characteristic threshold tau, user identity voucher time limit T and digital signature Sig (k _m, τ || T||E (W _i)) generation user identity voucher C _u:

   C _u＝{U _ID,PW,E(W _i),τ,Sig(k _m,τ||T||E(W _i))}

   Meanwhile, subscriber authentication server uses digital signature authentication function Ver (P _m, C _u), identifying user identity voucher C _ulegitimacy, and by user ID, password PW, user fingerprints feature ciphertext E (W _i), fingerprint characteristic threshold tau and identity documents time limit T be stored in identity documents database, PKG server notification user registration success, and will register parameter { k _u, G, Ver (P _m, C _u) write access customer USBKey.
5. According to claim 1 based on digital finger-print with secret value IBC identity identifying method, it is characterized in that described step 4) specifically comprise:

   4.1), utilize fingerprint acquisition instrument collection to need authenticated user fingerprint, and extract digital finger-print feature vector, X _u: { x ₁, x ₂..., x _n, user's PKI U _iDto X _uuse RSA Algorithm is encrypted, fingerprint characteristic vector ciphertext E (x _i)=E (U _iD, x _i), by fingerprint characteristic vector ciphertext E (x _i) be sent to subscriber authentication server;

   4.2), subscriber authentication server randomizer produces k random number ρ _j, a kn random number r _ji, and ρ _j, r _jimeet constraints:

   4.3), use RSA Algorithm to random number r _jiencryption obtains the close value E (r of random number _ji)=E (U _iD, r _ji);

   4.4), the close value of the fingerprint characteristic of subscriber authentication server using user as template E (W _i), fingerprint characteristic vector ciphertext E (x _i) and the close value of random number E (r _ji) calculate and merge at random close value E (W _ix _ir _ji)=E (W _i) E (x _i) E (r _ji), and will merge at random close value E (W _ix _ir _ji) send to and need authenticated user.
6. According to claim 1 based on digital finger-print with secret value IBC identity identifying method, it is characterized in that described step 5) specifically comprise:

   5.1), need authenticated user user private key k _uto the close value of random fusion E (W _ix _ir _ji) deciphering, obtain randomization fingerprint characteristic W _ix _ir _ji; Calculate randomization fingerprint characteristic vector sum and by R _jbe sent to subscriber authentication server;

   5.2), subscriber authentication server is according to R _jcalculate and need authenticated user fingerprint characteristic validation value R to be:

   $R=\underset{j=1}{\overset{k}{\mathrm{\&Sigma;}}}{\mathrm{\&rho;}}_j\&CenterDot;R_j=\underset{j=1}{\overset{k}{\mathrm{\&Sigma;}}}{\mathrm{\&rho;}}_j\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{W}_i{x}_i{r}_{\mathrm{ji}}=\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}\underset{j=1}{\overset{k}{\mathrm{\&Sigma;}}}{\mathrm{\&rho;}}_j{W}_i{r}_{\mathrm{ji}}=\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{W}_i{x}_i\underset{j=1}{\overset{k}{\mathrm{\&Sigma;}}}{\mathrm{\&rho;}}_j{r}_{\mathrm{ji}}=\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{W}_i{x}_i$

   If R > is τ, authenticating user identification passes through; If R < is τ, authenticating user identification failure, and authentication result is returned and needed authenticated user.