[go: up one dir, main page]

WO2019137193A1 - 硬件登录windows10以上系统的实现方法及装置 - Google Patents

硬件登录windows10以上系统的实现方法及装置 Download PDF

Info

Publication number
WO2019137193A1
WO2019137193A1 PCT/CN2018/123211 CN2018123211W WO2019137193A1 WO 2019137193 A1 WO2019137193 A1 WO 2019137193A1 CN 2018123211 W CN2018123211 W CN 2018123211W WO 2019137193 A1 WO2019137193 A1 WO 2019137193A1
Authority
WO
WIPO (PCT)
Prior art keywords
module
key
encryption
computer
registration
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2018/123211
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Feitian Technologies Co Ltd
Original Assignee
Feitian Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Feitian Technologies Co Ltd filed Critical Feitian Technologies Co Ltd
Priority to US16/770,569 priority Critical patent/US11314853B2/en
Publication of WO2019137193A1 publication Critical patent/WO2019137193A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/54—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by adding security routines or objects to programs
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/58—Random or pseudo-random number generators
    • G06F7/588—Random number generators, i.e. based on natural stochastic processes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/107—License processing; Key processing

Definitions

  • the present disclosure relates to the field of information security, and in particular, to a method and an apparatus for implementing hardware login to a Windows 10 or higher system.
  • the existing operating system is mainly based on the Windows operating system. Entering password login or pin code login is the most common way, but because of the need to output a series of numbers, it is easy to leak a large security risk. Prior to Windows 10, the Windows local hardware login method only supported biometric login. Biometrics are too demanding on both hardware and software, making it difficult to implement.
  • the purpose of the disclosure is to overcome the deficiencies of the prior art, and provide a method and an apparatus for implementing hardware login to a Windows 10 or higher system.
  • the present disclosure provides an implementation method for hardware login to a system above Windows 10, including an authentication process, where the authentication process includes:
  • Step S1 When the computer monitors the insertion of the hardware device, the device identifier of the hardware device is obtained, and the first data packet is obtained according to the registration index corresponding to the device identifier, where the first data packet includes: a first random number a second random number, a first session random number, and a first encrypted value;
  • Step S2 The computer encrypts the first data packet by using the saved first encryption key to obtain a first encryption result, and sends the first encryption result and the registration index to the hardware device;
  • Step S3 The hardware device decrypts the received first encryption result by using the saved second encryption key to obtain a first decryption result, and uses the saved second supporting service corresponding to the received registration index. And verifying, by the frame key and the third random number, the fourth random number, and the second session random number in the first decryption result, the second encrypted value in the first decryption result, if the verification is successful, executing step S4 Returning an error message to the computer if the verification fails, and the computer refuses to log in after receiving the error message;
  • Step S4 The hardware device generates a third encryption value and a fourth encryption according to the saved second device key corresponding to the registration index, the third random number in the first decryption result, and the second session random number. And encrypting the third encrypted value and the fourth encrypted value by using the second encryption key to obtain a second encryption result, and transmitting the second encryption result to the computer;
  • Step S5 the computer decrypts the received second encryption result by using the first encryption key to obtain a second decryption result, and uses the saved first device key corresponding to the registration index, the first The second decryption result is verified by the random number and the first session random number, and if the verification is successful, the login is allowed, and if the verification fails, the login is refused.
  • the obtaining the device identifier of the hardware device and the acquiring the first data packet according to the registration index corresponding to the device identifier includes: the computer determining whether the hardware device is registered, and The registration index corresponding to the device identifier acquires the first data packet, otherwise the login is rejected.
  • the computer determines whether the hardware device is registered, including:
  • the computer obtains a registration list; and determines whether the acquired device identifier matches the device identifier in the registration list, and the hardware device is already registered, otherwise the hardware device is not registered.
  • the method before the acquiring the device identifier of the hardware device, the method further includes:
  • the computer sends an acquisition application instruction to the hardware device; after receiving the acquisition application instruction, the hardware device returns data to the computer; the computer receives data returned by the hardware device and determines whether the application is acquired according to the received data If it succeeds, the device identifier of the hardware device is obtained, otherwise the login is refused.
  • the acquiring the device identifier of the hardware device in the step S1 includes: the computer sending an acquiring device identification instruction to the hardware device; the hardware device receiving the acquiring device identification instruction and returning the device identifier of the device to the device a computer; the computer receives the device identifier returned by the hardware device and saves it.
  • the method before the acquiring the first data packet according to the registration index corresponding to the device identifier, the method includes: the computer splicing the second random number, the first random number, and the first session random number Obtaining the first splicing result, and using the saved first matching service framework key corresponding to the registration index to encrypt the first splicing result according to a preset algorithm to obtain the first ciphering value;
  • the second supporting service frame key corresponding to the received registration index and the third random number, the fourth random number, and the second session random number in the first decryption result saved in the step S3 Verifying the second encrypted value in the first decrypted result, the hardware device splicing the third random number, the fourth random number, and the second session random number in the first decrypted result to obtain the second stitching
  • the second splicing result is encrypted according to the preset algorithm using the saved second matching service framework key corresponding to the received registration index to obtain a first encryption result; and the first encryption result is determined. Whether the second encrypted value in the first decrypted result is the same, if the verification is successful, otherwise the verification fails.
  • the hardware device in step S4 generates a third according to the saved second device key corresponding to the registration index, the third random number in the first decrypted result, and the second session random number.
  • the encrypted value and the fourth encrypted value including: the hardware device encrypts the third random number in the first decryption result according to a preset algorithm by using a second device key corresponding to the registration index to obtain a third encryption And encrypting, by using the second device key, the second session random number in the first decryption result according to a preset algorithm to obtain a fourth encrypted value;
  • the second decryption result including: The computer encrypts the saved first random number by using the saved first device key corresponding to the registration index according to a preset algorithm to obtain a fifth encrypted value; and using the first device key pair according to the preset algorithm.
  • the saved first session random number is encrypted to obtain a sixth encrypted value; determining whether the fifth encrypted value and the sixth encrypted value match the second decrypted result, if the verification is successful, the login is allowed, otherwise the verification fails. , refused to log in.
  • the method further includes a logout process, and the logout process includes:
  • Step P1 Obtain a registration list when the computer receives the deletion information selected by the user;
  • Step P2 The computer determines whether the received deletion information matches the information in the registration list, if yes, step P3 is performed, otherwise the logout is refused;
  • Step P3 The computer prompts the user to confirm the deletion operation.
  • the information corresponding to the deletion information selected by the user is deleted from the registration list, and the logout process ends.
  • the method further includes a registration process, the registration process including:
  • Step A1 when the computer receives the registration trigger information, initializes and starts monitoring the hardware device;
  • Step A2 When the computer monitors the insertion of the hardware device, acquires the device identifier of the hardware device; and obtains a registration list;
  • Step A3 The computer determines whether the obtained device identifier matches the device identifier in the registration list, if yes, the current hardware device is registered, and the registration process ends; otherwise, step A4 is performed;
  • Step A4 The computer negotiates an encryption key with the hardware device and saves it;
  • Step A5 The computer sends a registration command to the hardware device.
  • Step A6 The hardware device receives the registration command, and updates the registration index, generates a second device key and a second supporting service framework key, and saves the corresponding registration index, and uses the saved second encryption key pair. Encrypting the second device key and the second supporting service framework key to obtain a third encryption result;
  • Step A7 The hardware device sends the third encryption result and the registration index to the computer;
  • Step A8 The computer saves the received registration index, and decrypts the received third encryption result by using the saved first encryption key.
  • Step A9 The computer saves the device identifier, the first device key decrypted from the third encryption result, and the first accessory service framework key in the registration list corresponding to the registration index.
  • the method further includes:
  • the computer sends an acquisition application instruction to the hardware device; the hardware device returns data to the computer after receiving the acquisition application instruction; the computer receives the data returned by the hardware device and determines according to the received data If the application is successful, the device identifier of the hardware device is obtained, otherwise the registration fails.
  • the acquiring the device identifier of the hardware device in the step A2 includes: the computer sending an acquiring device identification instruction to the hardware device; the hardware device receiving the acquiring device identification instruction and returning the device identifier of the device to the a computer; the computer receives the device identifier returned by the hardware device and saves it.
  • the computer further includes: the computer prompting the user to input a user registration name; and saving the user registration name when the computer receives the user registration name input by the user.
  • step A4 includes:
  • Step A41 The computer generates a first key and saves it, and uses the first key to encrypt the first preset data according to a preset algorithm to obtain a fifth encryption result, and the first key and the Sending a fifth encryption result to the hardware device;
  • Step A42 The hardware device receives the first key and the fifth encryption result sent by the computer, decrypts the fifth encryption result by using the first key, and determines whether the decryption result is the a preset data, if yes, step A43 is performed, otherwise the registration error message is returned to the computer, and the process ends;
  • Step A43 The hardware device generates a second key, generates a second encryption key according to the first key and the second key, and saves the second key according to a preset algorithm. Decrypting the result to perform encryption to obtain a sixth encryption result, and transmitting the second key and the sixth encryption result to the computer;
  • Step A44 The computer receives the second key and the sixth encryption result sent by the hardware device, decrypts the sixth encryption result by using the second key, and determines whether the decryption result is the If the data is preset, step A45 is performed; otherwise, the registration fails and ends;
  • Step A45 The computer generates a first encryption key according to the saved first key and the acquired second key, and saves the first encryption key.
  • the generating the second encryption key according to the first key and the second key comprises: encoding the first 8 bytes of the first key and the last 8 of the second key Byte data is spliced to obtain a second encryption key;
  • the step A45 includes: the computer splicing the saved first 8 bytes of the first key and the obtained last 8 bytes of the second key to obtain a first encryption key and saving.
  • step A9 the method includes:
  • Step B1 The computer pops up a verification PIN code box, prompting the user to input a PIN code
  • Step B2 When the computer receives the PIN code input by the user, it is determined whether the PIN code input by the user is the same as the saved PIN code, if yes, step A9 is performed, otherwise the registration failure is prompted.
  • the present disclosure further provides an implementation device for hardware login to a Windows 10 or higher system, including a computer and a hardware device; the computer includes:
  • a first obtaining module configured to acquire a device identifier of the hardware device when the computer monitors the insertion of the hardware device in the authentication process
  • a second acquiring module configured to acquire a first data packet according to a registration index corresponding to the device identifier acquired by the first acquiring module, where the first data packet includes: a first random number, a second random number, and a first session a random number and a first encrypted value;
  • a first encryption module configured to encrypt, by using the saved first encryption key, the first data packet obtained by the second acquiring module to obtain a first encryption result
  • a first sending module configured to send the registration index and the first encryption result obtained by the first encryption module to the hardware device
  • a first receiving module configured to receive a second encryption result or error information sent by the hardware device in an authentication process
  • a first decryption module configured to decrypt the second encryption result received by the first receiving module by using the saved first encryption key to obtain a second decryption result
  • a first verification module configured to use the saved first device key corresponding to the registration index, the first random number, and the first session random number to obtain a second decryption result obtained by the first decryption module authenticating;
  • Rejecting the login module for rejecting the login after the first receiving module receives the error information or when the first verification module fails to verify
  • the hardware device includes:
  • a second receiving module configured to receive the first encryption result and the registration index sent by the computer during the authentication process
  • a second decrypting module configured to decrypt the first encryption result received by the second receiving module by using the saved second encryption key to obtain a first decryption result
  • a second verification module configured to use the saved second serving service framework key corresponding to the registration index received by the second receiving module and the third decrypted result obtained by the second decryption module
  • the random number, the fourth random number, and the second session random number verify the second encrypted value in the first decrypted result received by the second receiving module
  • a first generating module configured to: when the second verification module is successfully verified, according to the saved second device key corresponding to the registration index received by the second receiving module, and the second decryption module The third random number and the second session random number in the first decryption result generate a third encrypted value and a fourth encrypted value;
  • a second encryption module configured to encrypt the third encryption value and the fourth encryption value generated by the first generation module by using the second encryption key to obtain a second encryption result
  • the second sending module is configured to return an error message to the computer when the second verification module fails to verify, and is further configured to send the second encryption result obtained by the second encryption module to the computer.
  • the computer further includes:
  • a first determining module configured to determine, in the authentication process, whether the hardware device is registered, and triggering the second acquiring module, otherwise triggering the rejecting login module;
  • the rejecting the login module is further configured to refuse to log in when the first determining module determines to be no.
  • the first determining module includes:
  • a first obtaining unit configured to acquire a registration list
  • a first determining unit configured to determine whether the device identifier acquired by the first acquiring module matches the device identifier in the registration list acquired by the first acquiring unit, and the hardware device is already registered, otherwise The hardware device is not registered.
  • the computer further includes a second determining module
  • the first sending module is further configured to send an acquiring application instruction to the hardware device
  • the second receiving module is further configured to receive an acquiring application instruction sent by the computer;
  • the second sending module is further configured to return data to the computer
  • the first receiving module is further configured to receive data returned by the hardware device
  • the second determining module is configured to determine, according to the data received by the first receiving module, whether the acquiring application is successful, and if yes, triggering the first acquiring module, otherwise triggering the rejecting login module;
  • the rejecting the login module is further configured to reject the login when the second determining module determines to be no.
  • the first acquiring module is specifically configured to send an acquiring device identification instruction to the hardware device, and receive the device identifier returned by the hardware device and save the device identifier;
  • the second receiving module is further configured to receive an acquiring device identification instruction
  • the second sending module is further configured to return the device identifier of the device to the computer after the second receiving module receives the acquiring device identification instruction.
  • the computer further includes:
  • a splicing encryption module configured to splicing the second random number, the first random number, and the first session random number to obtain a first splicing result, and using the saved corresponding to the registration index according to a preset algorithm
  • the first supporting service framework key encrypts the first splicing result to obtain the first encrypted value
  • the second verification module is configured to splicing a third random number, a fourth random number, and a second session random number in the first decrypted result obtained by the second decryption module to obtain a second splicing result, according to the preset
  • the algorithm encrypts the second splicing result by using the saved second supporting service framework key corresponding to the registration index received by the second receiving module to obtain a first encryption result; determining the first encryption result and Whether the second encrypted value in the first decryption result received by the second receiving module is the same, if the verification is successful, otherwise the verification fails.
  • the first generating module is specifically configured to: when the second verification module is successfully verified, use a second device key corresponding to the registration index received by the second receiving module according to a preset algorithm
  • the third random number in the first decryption result obtained by the second decryption module is encrypted to obtain a third encrypted value
  • the first decryption obtained by the second decryption module is performed according to a preset algorithm by using the second device key.
  • the second session random number in the result is encrypted to obtain a fourth encrypted value
  • the first verification module is configured to encrypt the saved first random number by using the saved first device key corresponding to the registration index according to a preset algorithm to obtain a fifth encrypted value; and use the preset algorithm according to the preset algorithm.
  • the first device key encrypts the saved first session random number to obtain a sixth encrypted value; and determines whether the fifth encrypted value and the sixth encrypted value match the second decrypted result, and then verifies Successful, login is allowed, otherwise the verification fails and the login is denied.
  • the computer further includes a third obtaining module, a third determining module, and a confirming deleting module:
  • the first receiving module is further configured to receive deletion information selected by the user during the logout process
  • the third obtaining module is configured to obtain a registration list after the first receiving module receives the deletion information
  • the third determining module is configured to determine whether the deletion information received by the first receiving module matches the information in the registration list acquired by the third obtaining module, and if the matching does not match, the cancellation is cancelled;
  • the confirmation deletion module is configured to prompt the user to confirm the deletion operation when the third determination module determines to be YES, and when the confirmation deletion information of the user is received, the information corresponding to the deletion information selected by the user is from the registration list. delete.
  • the computer further includes a first initialization module, a fourth acquisition module, a fifth acquisition module, a fourth determination module, a negotiation storage module, a third decryption module, and a first saving module;
  • the first receiving module is further configured to receive registration trigger information in the registration process, and further configured to receive a registration index and a third encryption result sent by the hardware device;
  • the first initialization module is configured to initialize and start monitoring the hardware device when the first receiving module receives the registration trigger information
  • the fourth obtaining module is configured to acquire, when the first initialization module monitors the insertion of the hardware device, the device identifier of the hardware device;
  • the fifth obtaining module is configured to obtain a registration list during the registration process
  • the fourth determining module is configured to determine whether the device identifier acquired by the fourth acquiring module matches the device identifier in the registration list acquired by the fifth acquiring module, and if yes, the current hardware device is registered;
  • the negotiation saving module is configured to negotiate an encryption key with the hardware device and save when the fourth determining module determines to be no;
  • the first sending module is further configured to send a registration command to the hardware device during a registration process
  • the first saving module is configured to save the registration index received by the first receiving module during a registration process
  • the third decryption module is configured to decrypt the third encryption result received by the first receiving module by using the saved first encryption key
  • the first saving module is further configured to: use the device identifier acquired by the fourth acquiring module, the first device key obtained by decrypting the third decryption module from the third encryption result, and the first supporting service framework The key is saved in the registration list acquired by the fifth obtaining module, corresponding to the registration index;
  • the hardware device further includes: an update module, a generation save module, and a third encryption module;
  • the second receiving module is further configured to receive a registration command sent by the computer during a registration process
  • the update module is configured to update the registration index after the second receiving module receives the registration command
  • the generating and saving module is configured to generate a second device key and a second supporting service framework key, and save the same with the registration index.
  • the third encryption module is configured to encrypt, by using the saved second encryption key, the second device key generated by the generation and saving module and the second supporting service frame key to obtain a third encryption result;
  • the second sending module is further configured to send the third encryption result obtained by the third encryption module and the updated registration index of the update module to the computer.
  • the computer further includes a fifth determining module
  • the first sending module is further configured to send an acquiring application instruction to the hardware device during a registration process
  • the second receiving module is further configured to receive an acquiring application instruction sent by the computer during a registration process
  • the second sending module is further configured to: return data to the computer after the second receiving module receives the acquiring application instruction;
  • the first receiving module is further configured to receive data returned by the hardware device during a registration process
  • the fifth determining module is configured to determine, according to the data received by the first receiving module, whether the acquiring application is successful, and if yes, triggering the fourth acquiring module, otherwise the registration failure is prompted.
  • the fourth acquiring module is specifically configured to send an acquiring device identification instruction to the hardware device during the registration process, and receive the device identifier returned by the hardware device and save the device identifier;
  • the second receiving module is further configured to receive an acquiring device identification instruction during the registration process
  • the second sending module is further configured to return the device identifier of the device to the computer after the second receiving module receives the acquiring device identification instruction.
  • the computer further includes: a prompt receiving module and a second saving module;
  • the prompt receiving module is configured to prompt a user to input a user registration name and receive the user registration name during the registration process;
  • the second saving module is configured to save the user registration name received by the prompt receiving module.
  • the negotiation save module includes:
  • a first generation saving unit configured to generate a first key and save the same
  • a first encryption unit configured to encrypt the first preset data according to a preset algorithm by using a first key in the first generation and holding unit to obtain a fifth encryption result
  • a first sending unit configured to send the first key in the first generation holding unit and the fifth encryption result obtained by the first encryption unit to the hardware device;
  • a first receiving unit configured to receive data sent by the hardware device
  • a second acquiring unit configured to obtain a second key and a sixth encryption result from the data received by the first receiving unit
  • a decryption determining unit configured to decrypt, by using the second key acquired by the second acquiring unit, the sixth encryption result obtained by the second acquiring unit, to determine whether the decryption result is the first preset data, if the determination is otherwise Prompt registration failed;
  • a second generation and holding unit configured to generate, according to the first key saved by the first generation storage unit and the second key acquired by the second acquisition unit, when the decryption determination unit determines to be YES
  • the first encryption key is saved and saved
  • the hardware device further includes: an acquisition determination module and a generation encryption module;
  • the second receiving module is further configured to receive data sent by the computer during a negotiation key process
  • the obtaining determining module is configured to obtain the first key and the fifth encryption result from the data received by the second receiving module, and decrypt the fifth encryption result by using the first key, and determine Whether the decrypted result is the first preset data;
  • Generating an encryption module configured to generate a second key when the acquisition determination module determines to be YES, generate a second encryption key according to the first key and the second key, and save; use the second Encrypting the decrypted result obtained by the obtaining and determining module according to a preset algorithm to obtain a sixth encryption result;
  • the second sending module is further configured to send the second key generated by the generating encryption module and the encrypted second encryption result to the computer, and is further configured to determine, in the obtaining determining module, that If not, return a registration error message to the computer.
  • the generating and encrypting module is specifically configured to generate a second key when the obtaining determining module determines to be yes, and the first 8 bytes of the first key and the last 8 of the second key Byte data is spliced to obtain a second encryption key and saved; using the second key to encrypt the decryption result according to a preset algorithm to obtain a sixth encryption result;
  • the second generation and holding unit is specifically configured to: the first 8 bytes of data of the first key and the second key acquired by the second acquiring unit to be saved when the decryption determining unit determines to be YES
  • the last 8 bytes of data are spliced to obtain the first encryption key and saved.
  • the computer further includes:
  • a prompting module is popped up for popping up the verification PIN code box during the registration process, prompting the user to input the PIN code and receiving;
  • the sixth judging module is configured to determine whether the PIN code input by the user received by the pop-up prompting module is the same as the saved PIN code, and the first saving module is triggered, otherwise the registration failure is prompted.
  • the present disclosure has the following advantages:
  • the technical solution of the present disclosure can achieve the purpose of using the registered hardware device to log in to the Windows 10 or higher system through the Windows system service application in the computer, and improve the security of the login process; and the type of the hardware device in the solution is not limited, any Devices that can do secure computing can be used to log in for user convenience.
  • FIG. 1 is a flowchart of a method for implementing hardware login to a Windows 10 or higher system according to Embodiment 1 of the present disclosure
  • FIG. 2 is a flowchart of a registration process in a method for implementing hardware login to a Windows 10 or higher system according to Embodiment 2 of the present disclosure
  • FIG. 3 is a flowchart of an authentication process in a method for implementing hardware login to a Windows 10 or higher system according to Embodiment 2 of the present disclosure
  • FIG. 4 is a flowchart of a logout process in a method for implementing hardware login to a Windows 10 or higher system according to Embodiment 2 of the present disclosure
  • FIG. 5 is a schematic block diagram of an apparatus for implementing hardware login to a Windows 10 or higher system according to Embodiment 3 of the present disclosure.
  • the first embodiment of the present disclosure provides a method for implementing a hardware login to a system of windows 10 or higher.
  • the system of the computer is a windows 10 or higher system (including a windows 10 system).
  • the method in this embodiment includes an authentication process. As shown in FIG. 1 , the authentication process includes:
  • Step S1 When the computer monitors the insertion of the hardware device, acquires the device identifier of the hardware device, and acquires the first data packet according to the registration index corresponding to the device identifier;
  • the first data packet in this embodiment includes: a first random number, a second random number, a first session random number, and a first encrypted value;
  • the obtaining the device identifier of the hardware device and obtaining the first data packet according to the registration index corresponding to the device identifier includes: determining, by the computer, whether the hardware device is registered, and according to the registration corresponding to the device identifier The index gets the first packet, otherwise it refuses to log in.
  • the computer determines whether the hardware device is registered, including: the computer obtains the registration list, and determines whether the obtained device identifier matches the device identifier in the registration list, and the hardware device is already registered, otherwise the hardware device is not registered;
  • the computer acquiring the registration list includes: the computer calling the first interface to obtain the registration list.
  • the method further includes: the computer sending the acquisition application instruction to the hardware device; after receiving the acquisition application instruction, the hardware device returns the data to the computer; the computer receiving the data returned by the hardware device according to the receiving The data obtained determines whether the application is successful, and the device identifier of the hardware device is obtained, otherwise an error is reported.
  • the obtaining the device identifier of the hardware device in the step S1 includes: the computer sending the acquiring device identification instruction to the hardware device; the hardware device receiving the acquiring device identification instruction and returning the device identifier of the device to the computer; and the computer receiving the device identifier returned by the hardware device And save;
  • acquiring the first data packet according to the registration index corresponding to the device identifier includes: the computer calling the fourth interface to acquire the first data packet according to the registration index corresponding to the device identifier;
  • the method Before acquiring the first data packet according to the registration index corresponding to the device identifier, the method includes: the computer splicing the second random number, the first random number, and the first session random number to obtain the first splicing result, and using the saved according to the preset algorithm. Encrypting the first splicing result with the first supporting service framework key corresponding to the registration index to obtain a first encrypted value;
  • Step S2 The computer encrypts the first data packet by using the saved first encryption key to obtain a first encryption result, and sends the first encryption result and the registration index to the hardware device;
  • Step S3 The hardware device decrypts the received first encryption result by using the saved second encryption key to obtain a first decryption result, and uses the saved second supporting service framework key corresponding to the received registration index and the first The third random number, the fourth random number, and the second session random number in the decrypted result are used to verify the second encrypted value in the first decrypted result. If the verification is successful, step S4 is performed, and if the verification fails, the computer returns an error message. ;
  • the second supporting service frame key corresponding to the received registration index and the third random number, the fourth random number, and the second session random number in the first decryption result saved in step S3 are used. And verifying, by the hardware device, the third random number, the fourth random number, and the second session random number in the first decryption result to obtain a second stitching result, according to the pre-preparation
  • the algorithm uses the saved second matching service framework key corresponding to the received registration index to encrypt the second splicing result to obtain a first encryption result; and determines whether the second encryption result in the first encryption result and the first decryption result is The same, if the verification is successful, otherwise the verification fails;
  • the computer refuses to log in after receiving the error information returned by the hardware device
  • Step S4 The hardware device generates a third encrypted value and a fourth encrypted value according to the saved second device key corresponding to the registration index, the third random number in the first decrypted result, and the second session random number; using the second encryption The key encrypts the third encrypted value and the fourth encrypted value to obtain a second encrypted result, and sends the second encrypted result to the computer;
  • the hardware device generates a third encryption value and a fourth encryption according to the saved second device key corresponding to the registration index, the third random number in the first decryption result, and the second session random number.
  • the value includes: the hardware device uses the second device key corresponding to the registration index to encrypt the third random number in the first decryption result according to a preset algorithm to obtain a third encrypted value; and uses the second device key according to the preset algorithm. Encrypting the second session random number in the first decryption result to obtain a fourth encrypted value;
  • Step S5 The computer decrypts the received second encryption result by using the first encryption key to obtain a second decryption result, and uses the saved first device key, the first random number, and the first session random number corresponding to the registration index.
  • the second decryption result is verified. If the verification is successful, the login is allowed. If the verification fails, the login is refused.
  • the second decryption result is verified by using the saved first device key, the first random number, and the first session random number corresponding to the registration index, including: the computer is saved according to a preset algorithm. Encrypting the saved first random number with the first device key corresponding to the registration index to obtain a fifth encrypted value; and encrypting the saved first session random number using the first device key according to a preset algorithm to obtain a sixth encryption a value; determining whether the fifth encrypted value and the sixth encrypted value match the second decrypted result, if the verification is successful, the login is allowed, otherwise the verification fails, and the login is refused.
  • the method in this embodiment may further include a logout process.
  • the logout process includes:
  • Step P1 Obtain a registration list when the computer receives the deletion information selected by the user;
  • Step P2 The computer determines whether the received deletion information matches the information in the registration list, if yes, step P3 is performed, otherwise the logout is refused;
  • Step P3 The computer prompts the user to confirm the deletion operation.
  • the information corresponding to the deletion information selected by the user is deleted from the registration list, and the logout process ends.
  • the method in this embodiment may further include a registration process.
  • the registration process includes:
  • Step A1 When the computer receives the registration trigger information, initializes and starts monitoring the hardware device;
  • performing initialization includes: the computer creates monitoring of the searching device according to the hardware device information; for example, the hardware device information may be a PID (ie, a product identification code) or a VID (ie, a vendor ID);
  • the hardware device information may be a PID (ie, a product identification code) or a VID (ie, a vendor ID);
  • step A1 the method includes:
  • Step P1 When an application in the computer is started, the computer calls the first interface to obtain a registration list;
  • Step P2 the computer displays the obtained registration list
  • Step A2 When the computer monitors the insertion of the hardware device, acquires the device identifier of the hardware device; and obtains a registration list;
  • the method before the acquiring the device identifier of the hardware device in step A2, the method further includes: the computer sending the acquisition application instruction to the hardware device; the hardware device receiving the application instruction and returning the data to the computer; and the computer receiving the data returned by the hardware device and According to the received data, it is judged whether the acquisition application is successful, and the device identifier of the hardware device is obtained, otherwise an error is reported.
  • the acquiring the device identifier of the hardware device in step A2 includes: the computer sending the acquiring device identification instruction to the hardware device; the hardware device receiving the acquiring device identification instruction and returning the device identifier of the device to the computer; and the computer receiving the device identifier returned by the hardware device And save.
  • the obtaining the registration list in step A2 includes: the computer calling the first interface to obtain the registration list;
  • Step A3 The computer determines whether the obtained device identifier matches the device identifier in the registration list, and indicates that the current hardware device has been registered, and the registration process ends; otherwise, step A4 is performed;
  • the method further includes: the computer prompting the user to input the user registration name; and saving the user registration name when the computer receives the user registration name input by the user;
  • Step A4 The computer negotiates the encryption key with the hardware device and saves it;
  • step A4 includes:
  • Step A41 The computer generates a first key and saves it, encrypts the first preset data according to a preset algorithm by using the first key to obtain a fifth encryption result, and sends the first key and the fifth encryption result to the hardware device. ;
  • Step A42 The hardware device receives the first key and the fifth encryption result sent by the computer, decrypts the fifth encryption result by using the first key, and determines whether the decryption result is the first preset data, if yes, step A43 is performed, otherwise, the computer Return registration error message, end;
  • Step A43 The hardware device generates a second key, generates a second encryption key according to the first key and the second key, and saves the second encryption result by using the second key to encrypt the decryption result according to a preset algorithm. Sending the second key and the sixth encryption result to the computer;
  • generating the second encryption key according to the first key and the second key comprises: splicing the first 8 bytes of data of the first key and the last 8 bytes of data of the second key to obtain a second encryption key key;
  • Step A44 The computer receives the second key and the sixth encryption result sent by the hardware device, decrypts the sixth encryption result by using the second key, and determines whether the decryption result is the first preset data. If yes, step A45 is performed, otherwise the registration is prompted. Failed to end
  • Step A45 The computer generates a first encryption key according to the saved first key and the obtained second key, and saves the first encryption key;
  • the step A45 includes: the computer splicing the first 8 bytes of the saved first key and the obtained last 8 bytes of the second key to obtain the first encryption key and saving;
  • Step A5 The computer sends a registration command to the hardware device.
  • Step A6 The hardware device receives the registration command, and updates the registration index, generates a second device key and a second supporting service framework key, and saves the corresponding information with the registration index, and uses the saved second encryption key to the second device key and The second supporting service framework key is encrypted to obtain a third encryption result;
  • Step A7 The hardware device sends the third encryption result and the registration index to the computer;
  • Step A8 The computer saves the received registration index, and decrypts the received third encryption result by using the saved first encryption key
  • Step A9 The computer saves the device identifier, the first device key decrypted from the third encryption result, and the first supporting service framework key in a registration list corresponding to the registration index;
  • the method before step A9, the method includes:
  • Step B1 The computer pops up a verification PIN code box, prompting the user to input a PIN code
  • Step B2 When the computer receives the PIN code input by the user, it is determined whether the PIN code input by the user is the same as the saved PIN code, if yes, step A9 is performed, otherwise an error is reported.
  • the second embodiment of the present disclosure provides a method for implementing a hardware login to a system of windows 10 or higher.
  • the system of the computer is a windows 10 or higher system (including a windows 10 system).
  • the method in this embodiment includes a registration process and an authentication process. As shown in FIG. 2, the registration process includes :
  • Step 101 When the computer receives the registration trigger information, initialize and start monitoring the hardware device;
  • performing initialization includes: the computer creates a monitoring of the searching device according to the hardware device information;
  • the method further includes:
  • Step a1 when an application in the computer is started, calling the first interface to obtain a registration list;
  • the first interface is FindAllRegisteredDeviceInfoAsync;
  • the registration list includes the device identifier, the first device key, and the first supporting service framework key and the registration index;
  • Step a2 The computer displays the obtained registration list
  • Step 102 The computer monitors and determines whether there is a hardware device inserted, if yes, step 103 is performed; otherwise, the user is prompted to insert the hardware device, and returns to step 102;
  • Step 103 The computer sends an acquisition application instruction to the hardware device.
  • the acquisition application instruction in this embodiment is 00 a4 04 00 0e d1 56 00 01 32 52 68 65 6c 6c 6f 01 01 00;
  • Step 104 The hardware device receives the acquisition application instruction and returns data to the computer.
  • Step 105 The computer receives the data returned by the hardware device, and determines whether the application is successfully obtained according to the data, if yes, step 106 is performed; otherwise, an error is reported;
  • determining whether the application is successfully obtained according to the data in step 105 includes: the computer determining whether the received data is the first preset value, and the acquiring the application succeeds, otherwise the acquiring the application fails; for example, in the embodiment.
  • the first preset value is 9000;
  • the error in the embodiment is specifically: the computer displays a failure interface
  • Step 106 The computer sends an acquisition device identification instruction to the hardware device.
  • the device identification instruction is: 00 27 00 00 00;
  • Step 107 The hardware device receives the acquiring device identification instruction and returns its own device identifier to the computer.
  • the device identification in this embodiment is: 5a e8 51 1b 83 90 2a 34 48 ce d1 75 c6 1a 30 b9 9d b1 51 c7 c5 e2 b7 78 14 f7 0d 96 7f 6f e6 8c;
  • Step 108 The computer receives the device identifier of the hardware device and saves it;
  • Step 109 The computer calls the first interface to obtain a registration list.
  • the first interface is FindAllRegisteredDeviceInfoAsync
  • Step 110 The computer determines whether the saved hardware identifier matches the device identifier in the acquired registration list, and indicates that the current hardware device has been registered, otherwise step 111 is performed;
  • Step 111 The computer prompts the user to input a user registration name
  • Step 112 Save the user registration name when the computer receives the user registration name input by the user;
  • the user registration name in this embodiment is: A_EPASS_key;
  • Step 113 The computer generates the first key and saves, encrypts the first preset data according to the preset algorithm by using the first key to obtain a fifth encryption result, and sends the first key and the fifth encryption result to the hardware device. ;
  • the first key in this embodiment is a random number, the length is 16 bytes, and the length of the fifth encryption result is also 16 bytes; for example, the first key is: 1e e1 86 9a 87 0c 1d d0 1b 80 9b bd d8 d6 83 be; the first preset data is: EnterSafe--Hello; the fifth encryption result is: f9 12 16 0c db 71 94 a3 c8 dd 10 bd ad ff 51 ec;
  • Step 114 The hardware device receives the data sent by the computer and obtains the first key and the fifth encryption result therefrom, decrypts the fifth encryption result by using the first key, and determines whether the decryption result is the first preset data. If yes, step 115 is performed. Otherwise, return a registration error message to the computer;
  • the computer after receiving the registration error message, the computer prompts that the registration fails;
  • Step 115 The hardware device generates a second key, generates a second encryption key according to the first key and the second key, and saves the second encryption result by using a second key to encrypt the decryption result according to a preset algorithm. Sending the second key and the sixth encryption result to the computer;
  • generating the second encryption key according to the first key and the second key comprises: performing the first 8 bytes of data of the first key and the last 8 bytes of data of the second key Splicing to obtain a second encryption key; for example, the second key is: 0a c8 6e 9c 30 b5 e5 d5 c1 32 86 fb 30 41 bf e4; the sixth encryption result is: 48 57 d9 96 6c d2 74 46 43 f7 a2 90 Fa 91 b6 26;
  • Step 116 The computer receives the data sent by the hardware device, and obtains the second key and the sixth encryption result therefrom, and uses the second key to decrypt the sixth encryption result, and determines whether the decryption result is the first preset data. If yes, step 117 is performed. Otherwise, the registration fails.
  • Step 117 The computer generates a first encryption key according to the first key and the second key and saves the first encryption key;
  • the implementation process in this embodiment is the same as the method in the step 115, and details are not described herein again.
  • Step 118 The computer sends a registration command to the hardware device.
  • the registration command in this embodiment is: 00 20 00 00 00;
  • Step 119 The hardware device receives the registration command, and updates the registration index, generates a second device key and a second supporting service framework key, and saves the corresponding information with the registration index, and uses the saved second encryption key to the second device key and The second supporting service framework key is encrypted to obtain a third encryption result;
  • the update registration data is: the registration index is incremented by 1; for example, the device key is: 24 49 94 23 06 8e b2 00 80 27 22 33 12 49 35 6b 9c 00 26 59 95 26 e3 D3 fe c0 63 a8 22 c0 65 0a; server key is: d2 06 28 ad bb ab 27 22 d1 e6 3c 04 a4 39 68 ca 57 12 e3 3f e0 b6 44 59 d7 a8 50 0b 0a 0a 3d 2d;
  • the result of the encryption is: cc 01 a8 8b 01 a9 fa ec 44 51 9f fc c5 44 be 4d e5 02 d1 f9 31 3d fa 35 69 3f 2c 2a be a1 ec a3 13 db 39 8c b6 02 d6 00 59 46 18 4
  • Step 120 The hardware device sends the third encryption result and the registration index to the computer.
  • Step 121 The computer saves the received registration index, and decrypts the received third encryption result by using the saved first encryption key. If the decryption is successful, step 122 is performed. If the decryption fails, the registration fails.
  • Step 122 The computer pops up a verification PIN code box, prompting the user to input a PIN code
  • Step 123 When the computer receives the PIN code input by the user, it is determined whether the PIN code input by the user is the same as the saved PIN code, if yes, step 124 is performed; otherwise, the registration failure is prompted;
  • the PIN code in this embodiment is: ABC123456;
  • Step 124 The computer saves the device identifier, the decrypted first device key, and the first accessory service framework key in the registration list corresponding to the registration index.
  • Step 125 When the computer receives the background task registration information, it is determined whether the background task is registered, and then the registration completion information is prompted, otherwise a background task is registered, and the screen is locked;
  • the computer registers the background task through the BackgroundExecutionManager and the BackgroundTaskBuilder; and creates a background trigger event, that is, triggers the background task through an event, mainly implemented by the SecondaryAuthenticationFactorAuthenticationTrigger class, in this embodiment, when the user The background task is triggered when the screen is locked, and the authentication process begins.
  • the authentication process in the method includes:
  • Step 201 When the background task of the computer is started, the computer initializes and starts monitoring the hardware device;
  • the initializing the computer includes: the computer creating a monitoring of the searching device according to the hardware device information;
  • Step 202 When the computer monitors the insertion of the hardware device, sending an acquisition application instruction to the hardware device;
  • Step 203 The hardware device returns data to the computer after receiving the application instruction.
  • Step 204 The computer receives the data returned by the hardware device and determines whether the application is successfully obtained according to the data, if yes, step 205 is performed; otherwise, an error is reported;
  • the step 204 includes: the computer determines whether the received data is the first preset value, and the application is successful, otherwise the application fails; for example, the first preset value in the embodiment is 9000;
  • Step 205 The computer sends an acquisition device identification instruction to the hardware device.
  • Step 206 The hardware device receives the acquiring device identification instruction and returns its own device identifier to the computer.
  • Step 207 The computer receives the device identifier of the hardware device and saves it.
  • Step 208 The computer calls the first interface to obtain a registration list.
  • the first interface is FindAllRegisteredDeviceInfoAsync;
  • the registration list includes the device identifier, the first device key, the first supporting service framework key, and the registration index;
  • Step 209 The computer determines whether the saved device identifier matches the device identifier in the registration list, if yes, step 210 is performed; otherwise, the current hardware device is not registered, and an error is reported;
  • Step 210 The computer invokes the fourth interface to obtain the first data packet according to the registration index corresponding to the device identifier.
  • the fourth interface in this embodiment is a StartAuthenticationAsync function, where the first data includes: a second random number, a first random number, a first session random number, and a first encrypted value; and before step 210, the computer includes Two random numbers, a first random number, and a first session random number are spliced to obtain a first splicing result, and the first splicing result is encrypted according to a preset algorithm using the saved first matching service framework key corresponding to the registration index. An encrypted value;
  • the second random number in this embodiment is: 95 c1 6d 5b 1c f6 80 40 ac 49 31 52 92 cf 7d cc 94 11 2d 0e 59 74 31 a6 ea 81 e1 c0 82 5a d7 26; first random number For: bb 17 71 28 25 9f 77 fb c0 5c 29 99 fd 15 2d 20 4d ee ee 7a 0d ed 96 6c 8b b8 63 e7 c8 cc d1 92; first session random number: 9d 26 5b 0c 69 7c 3b b3 B5 f5 96 5e 3f 19 bf 6d 66 ff c9 50 51 d8 11 59 8a 8c 76 28 27 c7 1c dc; first encryption value: e0 b1 88 c1 e2 91 40 68 45 76 0
  • Step 211 The computer encrypts the first data packet by using the saved first encryption key to obtain a first encryption result, and sends the first encryption result and the registration index corresponding to the device identifier to the hardware device.
  • the computer and the first encryption key may be generated in advance and saved; the first encryption key and the second key in the registration phase may be the same key or different keys;
  • Step 212 The hardware device decrypts the received first encryption result by using the saved second encryption key to obtain a first decryption result.
  • the 213 the hardware device splices the third random number, the fourth random number, and the second session random number in the first decrypted result to obtain a second splicing result, and uses the saved corresponding to the received registration index according to the preset algorithm.
  • the second supporting service framework key encrypts the second splicing result to obtain the first encryption result;
  • Step 214 The hardware device determines whether the first encryption result is the same as the second encryption value in the first decryption result, if yes, step 215 is performed; otherwise, the computer rejects the login information;
  • Step 215 The hardware device generates a third encrypted value and a fourth encrypted value according to the saved second device key corresponding to the received registration index, the third random number in the first decrypted result, and the second session random number.
  • step 215 includes: the hardware device encrypts the third random number in the first decryption result according to a preset algorithm to obtain a third encrypted value, and uses the second device key. Encrypting the second session random number in the first decryption result according to a preset algorithm to obtain a fourth encrypted value;
  • the third encryption value in this embodiment is: 83 00 42 2c 5c 4a 95 3e 8c 21 fe 42 0f Ed f0 ac 23 9c ac 72 82 d9 2e d3 27 b6 59 e3 64 35 7b ea; fourth encryption value: bb 55 73 b3 fd 9b 08 7e 1f b4 84 b7 c7 0e 32 20 86 ce 4e ea 15 5c 27 62 5e 5e 1c b6 00 f6 35 1c e6 2c 1c 13;
  • Step 216 The hardware device encrypts the third encrypted value and the fourth encrypted value by using the second encryption key to obtain a second encryption result, and sends the second encryption result to the computer.
  • Step 217 The computer decrypts the received second encryption result by using the first encryption key to obtain a second decryption result.
  • Step 218 The computer verifies the second decryption result by using the saved first device key, the first random number, and the first session random number corresponding to the registration index. If the verification succeeds, the login is allowed, and if the verification fails, the login is refused;
  • the step 219 includes: the computer encrypts the saved first random number according to the preset algorithm using the saved first device key corresponding to the registration index to obtain a fifth encrypted value; and uses the first algorithm according to a preset algorithm.
  • a device key encrypts the saved first session random number to obtain a sixth encrypted value; determines whether the fifth encrypted value and the sixth encrypted value match the second decrypted result, if the verification succeeds, the login is allowed; otherwise, the verification fails. Refuse to log in.
  • the logout process may also be included, as shown in FIG. 4, including:
  • Step 301 When the computer receives the deletion information selected by the user, the first interface is invoked to obtain the registration list.
  • the first interface is FindAllRegisteredDeviceInfoAsync
  • Step 302 The computer determines whether the received deletion information matches the information in the registration list. If yes, step 303 is performed; otherwise, the logout is refused;
  • Step 303 The computer pops up a delete message box, prompting the user to confirm the deletion operation;
  • Step 304 The computer determines whether the user confirms the deletion information, if yes, step 305 is performed; otherwise, the logout process ends;
  • Step 305 The computer deletes the information corresponding to the deletion information selected by the user from the registration list, and the logout process ends.
  • Embodiment 3 of the present disclosure provides an apparatus for implementing hardware login to a system of windows 10 or higher, as shown in FIG. 5, including a computer 1 and a hardware device 2; wherein, the system of the computer 1 is a windows 10 or higher system (including a windows 10 system), and the computer 1 includes :
  • the first obtaining module 11 is configured to acquire the device identifier of the hardware device when the computer 1 monitors the insertion of the hardware device during the authentication process;
  • the second obtaining module 12 is configured to acquire the first data packet according to the registration index corresponding to the device identifier acquired by the first obtaining module 11;
  • the first data packet in this embodiment includes: a first random number, a second random number, a first session random number, and a first encrypted value;
  • the second obtaining module 12 is specifically configured to invoke the fourth interface to acquire the first data packet according to the registration index corresponding to the device identifier acquired by the first acquiring module 11;
  • the first encryption module 13 is configured to encrypt the first data packet acquired by the second obtaining module 12 by using the saved first encryption key to obtain a first encryption result;
  • the first sending module 14 is configured to send the registration index and the first encryption result obtained by the first encryption module 13 to the hardware device 2;
  • the first receiving module 15 is configured to receive the second encryption result or the error information sent by the second sending module 26 of the hardware device 2 during the authentication process;
  • the first decryption module 16 is configured to decrypt the second encryption result received by the first receiving module by using the saved first encryption key to obtain a second decryption result;
  • the first verification module 17 is configured to verify the second decrypted result obtained by the first decryption module 16 by using the saved first device key, the first random number, and the first session random number corresponding to the registration index;
  • the login module 18 is configured to allow login when the first verification module 17 succeeds in verification
  • the hardware device 2 includes:
  • the second receiving module 21 is configured to receive the first encryption result and the registration index sent by the first sending module 14 of the computer 1 during the authentication process;
  • the second decryption module 22 is configured to decrypt the first encryption result received by the second receiving module 21 by using the saved second encryption key to obtain a first decryption result;
  • the second verification module 23 is configured to use the saved second storage service framework key corresponding to the registration index received by the second receiving module 21 and the third random number in the first decryption result obtained by the second decryption module 22, The fourth random number and the second session random number verify the second encrypted value in the first decrypted result received by the second receiving module;
  • the first generation module 24 is configured to: when the second verification module 23 succeeds in verifying, according to the saved second device key corresponding to the registration index received by the second receiving module 21, and the first decryption result obtained by the second decryption module 22 The third random number and the second session random number generate a third encrypted value and a fourth encrypted value;
  • the second encryption module 25 is configured to encrypt the third encryption value and the fourth encryption value generated by the first generation module 24 by using the second encryption key to obtain a second encryption result;
  • the second sending module 26 is configured to return an error message to the computer 1 when the second verification module 23 fails to verify, and is also used to send the second encryption result obtained by the second encryption module 25 to the computer 1.
  • the computer 1 in this embodiment further includes:
  • the first judging module is configured to determine whether the hardware device is registered in the authentication process, and trigger the second obtaining module 12; otherwise, the rejecting the login module 19 is triggered;
  • the first determining module includes:
  • a first obtaining unit configured to acquire a registration list
  • the first obtaining unit is specifically configured to invoke the first interface to obtain a registration list.
  • the first determining unit is configured to determine whether the device identifier acquired by the first obtaining module 11 matches the device identifier in the registration list acquired by the first acquiring unit, and the hardware device is already registered, otherwise the hardware device is not registered.
  • the login module 19 is rejected, and is also used to reject the login when the first determination module determines to be no.
  • the computer 1 in this embodiment further includes a second determining module
  • the first sending module 14 is further configured to send the acquiring application instruction to the hardware device 2;
  • the second receiving module 21 is further configured to receive an acquiring application instruction sent by the computer 1;
  • the second sending module 26 is further configured to return data to the computer 1;
  • the first receiving module 15 is further configured to receive data returned by the hardware device 2;
  • a second determining module configured to determine, according to the data received by the first receiving module 15, whether the acquiring application is successful, if yes, triggering the first obtaining module 11, otherwise triggering the rejecting the login module 19;
  • the login module 19 is rejected, and is also used to reject the login when the second determination module determines to be no.
  • the first obtaining module 11 is specifically configured to send the acquiring device identification instruction to the hardware device 2; and receive the device identifier returned by the hardware device 2 and save the device identifier;
  • the second receiving module 21 is further configured to receive an acquiring device identification instruction.
  • the second sending module 26 is further configured to return the device identifier of the device to the computer 1 after the second receiving module 21 receives the acquiring device identification instruction.
  • the computer 1 further includes: a splicing encryption module, configured to splicing the second random number, the first random number, and the first session random number to obtain a first splicing result, and using the saved corresponding to the registration index according to the preset algorithm
  • the first supporting service framework key encrypts the first splicing result to obtain a first encrypted value
  • the second verification module 23 is configured to splicing the third random number, the fourth random number, and the second session random number in the first decrypted result obtained by the second decryption module 22 to obtain a second splicing result, according to the pre-pre
  • the algorithm uses the saved second matching service framework key corresponding to the registration index received by the second receiving module 21 to encrypt the second splicing result to obtain a first encryption result; and determines that the first encryption result is received by the second receiving module 21 Whether the second encrypted value in the first decrypted result is the same, if the verification is successful, otherwise the verification fails.
  • the first generating module 24 is specifically configured to use the second device key corresponding to the registration index received by the second receiving module 21 to use the second device key according to the preset algorithm to the second when the second verification module 23 is successfully verified.
  • the third random number in the first decrypted result obtained by the decryption module 22 is encrypted to obtain a third encrypted value;
  • the second session in the first decrypted result obtained by the second decrypting module 22 according to the preset algorithm using the second device key Random number is encrypted to obtain a fourth encrypted value;
  • the first verification module 17 is configured to: according to the preset algorithm, encrypt the saved first random number by using the saved first device key corresponding to the registration index to obtain a fifth encrypted value; use the first according to the preset algorithm.
  • the device key encrypts the saved first session random number to obtain a sixth encrypted value; determines whether the fifth encrypted value and the sixth encrypted value match the second decrypted result, if the verification is successful, the login is allowed, otherwise the verification fails, and the rejection log in.
  • the computer 1 of this embodiment further includes a third obtaining module, a third determining module, and a confirming deleting module:
  • the first receiving module 15 is further configured to receive deletion information selected by the user during the logout process
  • the third obtaining module is configured to obtain the registration list after the first receiving module 15 receives the deletion information
  • the third determining module is configured to determine whether the deletion information received by the first receiving module 15 matches the information in the registration list acquired by the third obtaining module, and if the matching does not match, the logout is refused;
  • the confirmation deletion module is configured to prompt the user to confirm the deletion operation when the third determination module determines that the message is YES.
  • the confirmation deletion information of the user is received, the information corresponding to the deletion information selected by the user is deleted from the registration list.
  • the computer 1 in this embodiment further includes a first initialization module, a fourth acquisition module, a fifth acquisition module, a fourth determination module, a negotiation storage module, a third decryption module, and a first save module.
  • the first receiving module 15 is further configured to receive the registration triggering information during the registration process, and further configured to receive the registration index and the third encryption result sent by the hardware device;
  • a first initialization module configured to initialize and start monitoring the hardware device when the first receiving module 15 receives the registration trigger information
  • a fourth obtaining module configured to acquire a device identifier of the hardware device when the first initialization module monitors the insertion of the hardware device
  • a fifth obtaining module configured to obtain a registration list during the registration process
  • the fifth obtaining module is specifically configured to invoke the first interface to obtain a registration list during the registration process
  • the fourth determining module is configured to determine whether the device identifier acquired by the fourth acquiring module matches the device identifier in the registration list acquired by the fifth obtaining module, and if yes, the current hardware device is registered;
  • the negotiation save module is configured to negotiate an encryption key with the hardware device and save the fourth determination module when the determination is negative;
  • the first sending module 14 is further configured to send a registration command to the hardware device during the registration process
  • a first saving module configured to save the registration index received by the first receiving module during the registration process
  • the third decryption module is configured to decrypt the third encryption result received by the first receiving module by using the saved first encryption key
  • the first saving module is further configured to save the device identifier acquired by the fourth obtaining module, the first device key decrypted by the third decrypting module from the third encryption result, and the first supporting service framework key and the registration index.
  • the hardware device 2 further includes: an update module, a generation save module, and a third encryption module;
  • the second receiving module 21 is further configured to receive the registration command sent by the computer 1 during the registration process;
  • the update module is configured to update the registration index after the second receiving module 21 receives the registration command.
  • the generating save module is configured to generate a second device key and a second supporting service framework key and save the corresponding information with the registration index.
  • the third encryption module is configured to encrypt the second device key and the second supporting service frame key generated by the generating and saving module by using the saved second encryption key to obtain a third encryption result;
  • the second sending module 26 is further configured to send the third encryption result obtained by the third encryption module and the updated registration index of the update module to the computer.
  • the first initialization module is specifically configured to: when the first receiving module receives the registration trigger information, create a monitoring of the searching device according to the hardware device information, and start monitoring the hardware device.
  • the computer 1 in this embodiment further includes a fifth determining module
  • the first sending module 14 is further configured to send the acquiring application instruction to the hardware device 2 during the registration process;
  • the second receiving module 21 is further configured to receive the acquiring application instruction sent by the computer 1 during the registration process;
  • the second sending module 26 is further configured to return data to the computer 1 after the second receiving module 21 receives the acquiring application instruction;
  • the first receiving module 15 is further configured to receive data returned by the hardware device 2 during the registration process;
  • the fifth determining module is configured to determine, according to the data received by the first receiving module, whether the acquiring application is successful, and triggering the fourth acquiring module, otherwise the registration fails.
  • the fourth obtaining module is specifically configured to send the acquiring device identification instruction to the hardware device 2 during the registration process, and receive the device identifier returned by the hardware device 2 and save the device identifier;
  • the second receiving module 21 is further configured to receive an acquiring device identification instruction during the registration process
  • the second sending module 26 is further configured to return the device identifier of the device to the computer 1 after the second receiving module 21 receives the acquiring device identification instruction.
  • the computer in this embodiment further includes: a prompt receiving module and a second saving module;
  • a prompt receiving module configured to prompt a user to input a user registration name during the registration process, and receive a user registration name input by the user;
  • the second saving module is configured to save the user registration name received by the prompt receiving module.
  • the negotiation save module includes:
  • a first generation saving unit configured to generate a first key and save the same
  • a first encryption unit configured to encrypt, by using a first key in the first generation and holding unit, the first preset data according to a preset algorithm to obtain a fifth encryption result
  • a first sending unit configured to send the first key in the first generation holding unit and the fifth encryption result obtained by the first encryption unit to the hardware device 2;
  • a first receiving unit configured to receive data sent by the hardware device 2
  • a second acquiring unit configured to obtain a second key and a sixth encryption result from the data received by the first receiving unit
  • the decryption determining unit is configured to decrypt the sixth encryption result obtained by the second obtaining unit by using the second key acquired by the second acquiring unit, and determine whether the decrypted result is the first preset data, and if it is determined otherwise, the registration fails;
  • a second generation and holding unit configured to generate a first encryption key according to the first key saved by the first generation storage unit and the second key acquired by the second acquisition unit when the decryption determination unit determines to be YES;
  • the hardware device 2 further includes: an acquisition determination module and a generation encryption module;
  • the second receiving module 21 is further configured to receive data sent by the computer 1 during the negotiation of the key;
  • the obtaining determining module is configured to obtain the first key and the fifth encryption result from the data received by the second receiving module 21, decrypt the fifth encryption result by using the first key, and determine whether the decrypted result is the first preset data;
  • Generating an encryption module configured to generate a second key when the acquisition determination module determines to be YES, generate a second encryption key according to the first key and the second key, and save the second encryption key according to a preset algorithm
  • the result is encrypted to obtain a sixth encryption result
  • the second sending module 26 is further configured to send the second key generated by the generating encryption module and the encrypted sixth encryption result to the computer 1, and is further configured to return the registration error information to the computer 1 when the acquisition determining module determines to be no.
  • the generating encryption module is specifically configured to generate a second key when the obtaining determining module determines to be yes, and splicing the first 8 bytes of the first key and the last 8 bytes of the second key to obtain the second encryption. Key is saved; the second encryption result is obtained by encrypting the decryption result according to a preset algorithm by using the second key;
  • the second generation and holding unit is configured to: when the decryption determination unit determines to be YES, perform the first 8 bytes of data of the saved first key and the last 8 bytes of data of the second key acquired by the second acquiring unit.
  • the first encryption key is obtained by splicing and saved.
  • the computer 1 in this embodiment further includes:
  • a prompting module is popped up for popping up the verification PIN code box during the registration process, prompting the user to input the PIN code and receiving;
  • the sixth judging module is configured to determine whether the PIN code input by the user received by the pop-up prompting module is the same as the saved PIN code, and the first saving module is triggered, otherwise the registration failure is prompted.
  • the technical solution of the present disclosure can achieve the purpose of using the registered hardware device to log in to the Windows 10 or higher system through the Windows system service application + hardware device in the computer, and improve the security of the login process; and the type of the hardware device in the solution is not limited, any Devices that can do secure computing can be used to log in for user convenience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computational Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种硬件登录windows10以上系统的实现方法及装置，该方法包括：当计算机（1）监控到硬件设备（2）插入时，根据与该硬件设备（2）的设备标识对应的注册索引获取第一数据包；使用保存的第一加密密钥对第一数据包进行加密得到第一加密结果，将第一加密结果和注册索引发送给硬件设备（2）进行验证；如验证成功则根据保存的与注册索引对应的第二设备密钥、第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；使用第二加密密钥对第三加密值和第四加密值进行加密得到第二加密结果，并将第二加密结果发送给计算机（1）进行验证，如验证成功则允许登录，如验证失败则拒绝登录。该方法提高了登录过程的安全性，方便用户使用。

Description

硬件登录windows10以上系统的实现方法及装置 技术领域
本公开涉及信息安全领域，尤其涉及一种硬件登录windows10以上系统的实现方法及装置。
背景技术
随着计算机及网络技术与应用的不断发展，伴随而来的计算机系统安全问题越来越被大家所重视。计算机系统一旦遭受破坏，将给用户带来重大损失。伴随着云计算、大数据等新型技术的发展，对操作系统用户的安全性要求越来越高，尤其是承载用户重要数据和业务程序的服务器操作系统，而用户的密码安全更是重中之重。当前各种密码嗅探该工具、键盘输入监听程序及操作系统关键进程的注入程序都成为了黑客们的最爱。黑客通过上述工具可以方便的获取或分析出用户的操作系统登录密码，例如：网络上流程的mimikatz工具，可方便的获取已登录用户的密码。
现有的操作系统主要以windows操作系统为主，输入密码登录或pin码登录是最常用的一种方式，但是由于需要输出一串数字，容易泄露存在很大安全隐患。在windows10之前，windows本地硬件登录方式仅支持生物识别登录方式。生物识别对硬件和软件都要求过高，实现起来比较困难。
发明内容
本公开的目的是为了克服现有技术的不足，提供一种硬件登录windows10以上系统的实现方法及装置。
本公开提供了一种硬件登录windows10以上系统的实现方法，包括认证过程，所述认证过程包括：
步骤S1：当计算机监控到硬件设备插入时，获取所述硬件设备的设备标识，并根据与所述设备标识对应的注册索引获取第一数据包，所述第一 数据包包括：第一随机数、第二随机数、第一会话随机数和第一加密值；
步骤S2：所述计算机使用保存的第一加密密钥对所述第一数据包进行加密得到第一加密结果，并将所述第一加密结果和所述注册索引发送给所述硬件设备；
步骤S3：所述硬件设备使用保存的第二加密密钥对接收到的所述第一加密结果进行解密得到第一解密结果，使用保存的与接收到的所述注册索引对应的第二配套服务框架密钥和所述第一解密结果中的第三随机数、第四随机数、第二会话随机数对所述第一解密结果中的第二加密值进行验证，如验证成功则执行步骤S4，如验证失败则给所述计算机返回错误信息，所述计算机接收到所述错误信息后拒绝登录；
步骤S4：所述硬件设备根据保存的与所述注册索引对应的第二设备密钥、所述第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；使用所述第二加密密钥对所述第三加密值和第四加密值进行加密得到第二加密结果，并将所述第二加密结果发送给所述计算机；
步骤S5：所述计算机使用所述第一加密密钥对接收到的第二加密结果进行解密得到第二解密结果，使用保存的与所述注册索引对应的第一设备密钥、所述第一随机数和所述第一会话随机数对所述第二解密结果进行验证，如验证成功则允许登录，如验证失败则拒绝登录。
进一步地，所述获取所述硬件设备的设备标识与所述根据与所述设备标识对应的注册索引获取第一数据包之间包括：所述计算机判断所述硬件设备是否已注册，是则根据与所述设备标识对应的注册索引获取第一数据包，否则拒绝登录。
进一步地，所述计算机判断所述硬件设备是否已注册，包括：
所述计算机获取注册列表；并判断获取到的设备标识与所述注册列表中的设备标识是否匹配，是则所述硬件设备已注册，否则所述硬件设备未注册。
进一步地，在所述步骤S1中，所述获取所述硬件设备的设备标识之前还包括：
所述计算机向所述硬件设备发送获取应用指令；所述硬件设备接收到获取应用指令后，给所述计算机返回数据；所述计算机接收硬件设备 返回的数据并根据接收到的数据判断获取应用是否成功，是则获取所述硬件设备的设备标识，否则拒绝登录。
进一步地，所述步骤S1中的获取所述硬件设备的设备标识，包括：所述计算机向硬件设备发送获取设备标识指令；所述硬件设备接收获取设备标识指令并将自身的设备标识返回给所述计算机；所述计算机接收所述硬件设备返回的所述设备标识并保存。
进一步地，所述根据与所述设备标识对应的注册索引获取第一数据包之前包括：所述计算机将所述第二随机数、所述第一随机数、所述第一会话随机数进行拼接得到第一拼接结果，根据预设算法使用保存的与所述注册索引对应的第一配套服务框架密钥对所述第一拼接结果进行加密得到所述第一加密值；
所述步骤S3中的使用保存的与接收到的所述注册索引对应的第二配套服务框架密钥和所述第一解密结果中的第三随机数、第四随机数、第二会话随机数对所述第一解密结果中的第二加密值进行验证，包括：所述硬件设备将第一解密结果中的第三随机数、第四随机数、第二会话随机数进行拼接得到第二拼接结果，根据预设算法使用保存的与接收到的所述注册索引对应的第二配套服务框架密钥对所述第二拼接结果进行加密得到第一加密结果；判断所述第一加密结果与所述第一解密结果中的第二加密值是否相同，是则验证成功，否则验证失败。
进一步地，所述步骤S4中的所述硬件设备根据保存的与所述注册索引对应的第二设备密钥、所述第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值，包括：所述硬件设备使用与所述注册索引对应的第二设备密钥根据预设算法对所述第一解密结果中的第三随机数进行加密得到第三加密值；使用所述第二设备密钥根据预设算法对所述第一解密结果中的第二会话随机数进行加密得到第四加密值；
所述步骤S5中的使用保存的与所述注册索引对应的第一设备密钥、所述第一随机数和所述第一会话随机数对所述第二解密结果进行验证，包括：所述计算机根据预设算法使用保存的与所述注册索引对应的第一设备密钥对保存的第一随机数进行加密得到第五加密值；根据所述预设算法使用所述第一设备密钥对保存的第一会话随机数进行加密得到第六加密值； 判断所述第五加密值和所述第六加密值是否与所述第二解密结果匹配，是则验证成功，允许登录，否则验证失败，拒绝登录。
进一步地，所述方法还包括注销过程，所述注销过程包括：
步骤P1：当所述计算机接收到用户选择的删除信息时获取注册列表；
步骤P2：所述计算机判断接收到的删除信息是否与所述注册列表中的信息匹配，是则执行步骤P3，否则拒绝注销；
步骤P3：所述计算机提示用户确认进行删除操作，当接收到用户的确认删除信息时，将与用户选择的删除信息对应的信息从注册列表中删除，注销流程结束。
进一步地，所述方法还包括注册过程，所述注册过程包括：
步骤A1：当所述计算机接收到注册触发信息时，进行初始化并开始监控硬件设备；
步骤A2：当所述计算机监控到硬件设备插入时，获取所述硬件设备的设备标识；并获取注册列表；
步骤A3：所述计算机判断获取到的设备标识与所述注册列表中的设备标识是否匹配，是则提示当前硬件设备已注册，注册流程结束；否则执行步骤A4；
步骤A4：所述计算机与所述硬件设备协商加密密钥并保存；
步骤A5：所述计算机向所述硬件设备发送注册命令；
步骤A6：所述硬件设备接收注册命令，并更新注册索引，生成第二设备密钥和第二配套服务框架密钥并与所述注册索引对应保存，使用保存的第二加密密钥对所述第二设备密钥和所述第二配套服务框架密钥进行加密得到第三加密结果；
步骤A7：所述硬件设备将所述第三加密结果和所述注册索引发送给所述计算机；
步骤A8：所述计算机保存接收到的所述注册索引，并使用保存的第一加密密钥对接收到的所述第三加密结果进行解密；
步骤A9：所述计算机将设备标识、从所述第三加密结果中解密得到的第一设备密钥和第一配套服务框架密钥与所述注册索引对应保存在所述注册列表中。
进一步地，在所述步骤A2中的获取所述硬件设备的设备标识之前还包括：
所述计算机向所述硬件设备发送获取应用指令；所述硬件设备接收到获取应用指令后给所述计算机返回数据；所述计算机接收所述硬件设备返回的数据并根据接收到的所述数据判断获取应用是否成功，是则获取所述硬件设备的设备标识，否则提示注册失败。
进一步地，所述步骤A2中的获取所述硬件设备的设备标识包括：所述计算机向硬件设备发送获取设备标识指令；所述硬件设备接收获取设备标识指令并将自身的设备标识返回给所述计算机；所述计算机接收所述硬件设备返回的所述设备标识并保存。
进一步地，在所述步骤A3和步骤A4之间还包括：所述计算机提示用户输入用户注册名；当所述计算机接收到用户输入的用户注册名时保存所述用户注册名。
进一步地，所述步骤A4包括：
步骤A41：所述计算机生成第一密钥并保存，使用所述第一密钥根据预设算法对第一预设数据进行加密得到第五加密结果，并将所述第一密钥和所述第五加密结果发送给所述硬件设备；
步骤A42：所述硬件设备接收所述计算机发送的所述第一密钥和所述第五加密结果，使用所述第一密钥解密所述第五加密结果，判断解密结果是否为所述第一预设数据，是则执行步骤A43，否则给所述计算机返回注册错误信息，结束；
步骤A43：所述硬件设备生成第二密钥，根据所述第一密钥和所述第二密钥生成第二加密密钥并保存；使用所述第二密钥根据预设算法对所述解密结果进行加密得到第六加密结果，将所述第二密钥和所述第六加密结果发送给所述计算机；
步骤A44：所述计算机接收所述硬件设备发送的所述第二密钥和所述第六加密结果，使用所述第二密钥解密所述第六加密结果，判断解密结果是否为所述第一预设数据，是则执行步骤A45，否则提示注册失败，结束；
步骤A45：所述计算机根据保存的所述第一密钥和获取的所述第二密钥生成第一加密密钥并保存。
进一步地，所述根据所述第一密钥和所述第二密钥生成第二加密密钥包括：将所述第一密钥的前8字节数据和所述第二密钥的后8字节数据进行拼接得到第二加密密钥；
所述步骤A45包括：所述计算机将保存的所述第一密钥的前8字节数据和获取的所述第二密钥的后8字节数据进行拼接得到第一加密密钥并保存。
进一步地，所述步骤A9之前包括：
步骤B1：所述计算机弹出验证PIN码框，提示用户输入PIN码；
步骤B2：当所述计算机接收到用户输入的PIN码时，判断用户输入的PIN码是否与保存的PIN码相同，是则执行步骤A9，否则提示注册失败。
本公开又提供了一种硬件登录windows10以上系统的实现装置，包括计算机和硬件设备；所述计算机包括：
第一获取模块，用于在认证过程中当所述计算机监控到硬件设备插入时，获取所述硬件设备的设备标识；
第二获取模块，用于根据与所述第一获取模块获取的设备标识对应的注册索引获取第一数据包，所述第一数据包包括：第一随机数、第二随机数、第一会话随机数和第一加密值；
第一加密模块，用于使用保存的第一加密密钥对所述第二获取模块获取的第一数据包进行加密得到第一加密结果；
第一发送模块，用于将所述注册索引和所述第一加密模块得到的第一加密结果发送给所述硬件设备；
第一接收模块，用于在认证过程中接收所述硬件设备发送的第二加密结果或错误信息；
第一解密模块，用于使用保存的第一加密密钥对所述第一接收模块接收到的第二加密结果进行解密得到第二解密结果；
第一验证模块，用于使用保存的与所述注册索引对应的第一设备密钥、所述第一随机数和所述第一会话随机数对所述第一解密模块得到的第二解密结果进行验证；
允许登录模块，用于在所述第一验证模块验证成功时允许登录；
拒绝登录模块，用于在所述第一接收模块接收到所述错误信息后或所述第一验证模块验证失败时拒绝登录；
所述硬件设备包括：
第二接收模块，用于在认证过程中接收所述计算机发送的第一加密结果和注册索引；
第二解密模块，用于使用保存的第二加密密钥对所述第二接收模块接收到的所述第一加密结果进行解密得到第一解密结果；
第二验证模块，用于使用保存的与所述第二接收模块接收到的所述注册索引对应的第二配套服务框架密钥和所述第二解密模块得到的第一解密结果中的第三随机数、第四随机数、第二会话随机数对所述第二接收模块接收到的第一解密结果中的第二加密值进行验证；
第一生成模块，用于当所述第二验证模块验证成功时根据保存的与所述第二接收模块接收到的所述注册索引对应的第二设备密钥、所述第二解密模块得到的第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；
第二加密模块，用于使用所述第二加密密钥对所述第一生成模块生成的第三加密值和第四加密值进行加密得到第二加密结果；
第二发送模块，用于在所述第二验证模块验证失败时给所述计算机返回错误信息，还用于将所述第二加密模块得到的所述第二加密结果发送给所述计算机。
进一步地，所述计算机还包括：
第一判断模块，用于在认证过程中判断所述硬件设备是否已注册，是则触发所述第二获取模块，否则触发所述拒绝登录模块；
所述拒绝登录模块，还用于在所述第一判断模块判断为否时拒绝登录。
进一步地，所述第一判断模块包括：
第一获取单元，用于获取注册列表；
第一判断单元，用于判断所述第一获取模块获取到的设备标识与所述第一获取单元获取的所述注册列表中的设备标识是否匹配，是则所述硬件设备已注册，否则所述硬件设备未注册。
进一步地，所述计算机还包括第二判断模块；
所述第一发送模块还用于向所述硬件设备发送获取应用指令；
所述第二接收模块还用于接收所述计算机发送的获取应用指令；
所述第二发送模块还用于给所述计算机返回数据；
所述第一接收模块还用于接收所述硬件设备返回的数据；
所述第二判断模块用于根据所述第一接收模块接收到的数据判断获取应用是否成功，是则触发所述第一获取模块，否则触发所述拒绝登录模块；
所述拒绝登录模块，还用于在所述第二判断模块判断为否时拒绝登录。
进一步地，所述第一获取模块具体用于向硬件设备发送获取设备标识指令；并接收所述硬件设备返回的设备标识并保存；
所述第二接收模块还用于接收获取设备标识指令；
所述第二发送模块还用于在所述第二接收模块接收到获取设备标识指令后将自身的设备标识返回给所述计算机。
进一步地，所述计算机还包括：
拼接加密模块，用于将所述第二随机数、所述第一随机数、所述第一会话随机数进行拼接得到第一拼接结果，根据预设算法使用保存的与所述注册索引对应的第一配套服务框架密钥对所述第一拼接结果进行加密得到所述第一加密值；
所述第二验证模块具体用于将所述第二解密模块得到的第一解密结果中的第三随机数、第四随机数、第二会话随机数进行拼接得到第二拼接结果，根据预设算法使用保存的与所述第二接收模块接收到的所述注册索引对应的第二配套服务框架密钥对所述第二拼接结果进行加密得到第一加密结果；判断所述第一加密结果与所述第二接收模块接收到的第一解密结果中的第二加密值是否相同，是则验证成功，否则验证失败。
进一步地，所述第一生成模块具体用于当所述第二验证模块验证成功时，使用与所述第二接收模块接收到的所述注册索引对应的第二设备密钥根据预设算法对所述第二解密模块得到的第一解密结果中的第三随机数进行加密得到第三加密值；使用所述第二设备密钥根据预设算法对所述第 二解密模块得到的第一解密结果中的第二会话随机数进行加密得到第四加密值；
所述第一验证模块具体用于根据预设算法使用保存的与所述注册索引对应的第一设备密钥对保存的第一随机数进行加密得到第五加密值；根据所述预设算法使用所述第一设备密钥对保存的第一会话随机数进行加密得到第六加密值；判断所述第五加密值和所述第六加密值是否与所述第二解密结果匹配，是则验证成功，允许登录，否则验证失败，拒绝登录。
进一步地，所述计算机还包括第三获取模块、第三判断模块、确认删除模块：
所述第一接收模块还用于在注销过程中接收用户选择的删除信息；
所述第三获取模块用于在所述第一接收模块接收到删除信息后获取注册列表；
所述第三判断模块用于判断所述第一接收模块接收到的删除信息是否与所述第三获取模块获取的注册列表中的信息匹配，如不匹配拒绝注销；
所述确认删除模块，用于在所述第三判断模块判断为是时提示用户确认进行删除操作，当接收到用户的确认删除信息时，将与用户选择的删除信息对应的信息从注册列表中删除。
进一步地，所述计算机还包括第一初始化模块、第四获取模块、第五获取模块、第四判断模块、协商保存模块、第三解密模块、第一保存模块；
所述第一接收模块还用于在注册过程中接收注册触发信息，还用于接收所述硬件设备发送的注册索引、第三加密结果；
所述第一初始化模块，用于在所述第一接收模块接收到注册触发信息时，进行初始化并开始监控硬件设备；
所述第四获取模块，用于当所述第一初始化模块监控到硬件设备插入时，获取所述硬件设备的设备标识；
所述第五获取模块，用于在注册过程中获取注册列表；
所述第四判断模块，用于判断所述第四获取模块获取到的设备标识与所述第五获取模块获取到的注册列表中的设备标识是否匹配，如匹配则提示当前硬件设备已注册；
所述协商保存模块，用于在所述第四判断模块判断为否时与所述硬件设备协商加密密钥并保存；
所述第一发送模块还用于在注册过程中向所述硬件设备发送注册命令；
所述第一保存模块，用于在注册过程中保存所述第一接收模块接收到的所述注册索引；
所述第三解密模块用于使用保存的第一加密密钥对所述第一接收模块接收到的所述第三加密结果进行解密；
所述第一保存模块，还用于将所述第四获取模块获取的设备标识、所述第三解密模块从所述第三加密结果中解密得到的第一设备密钥和第一配套服务框架密钥与所述注册索引对应保存在所述第五获取模块获取的注册列表中；
所述硬件设备还包括：更新模块、生成保存模块、第三加密模块；
所述第二接收模块还用于在注册过程中接收所述计算机发送的注册命令；
所述更新模块用于在所述第二接收模块接收到注册命令后更新注册索引，
所述生成保存模块用于生成第二设备密钥和第二配套服务框架密钥并与所述注册索引对应保存，
所述第三加密模块用于使用保存的第二加密密钥对所述生成保存模块生成的第二设备密钥和所述第二配套服务框架密钥进行加密得到第三加密结果；
所述第二发送模块还用于将所述第三加密模块得到的第三加密结果和所述更新模块更新后的注册索引发送给所述计算机。
进一步地，所述计算机还包括第五判断模块；
所述第一发送模块还用于在注册过程中向所述硬件设备发送获取应用指令；
所述第二接收模块还用于在注册过程中接收所述计算机发送的获取应用指令；
所述第二发送模块还用于在所述第二接收模块接收到获取应用指令 后给所述计算机返回数据；
所述第一接收模块还用于在注册过程中接收所述硬件设备返回的数据；
所述第五判断模块用于根据所述第一接收模块接收到的数据判断获取应用是否成功，是则触发所述第四获取模块，否则提示注册失败。
进一步地，所述第四获取模块具体用于在注册过程中向硬件设备发送获取设备标识指令；并接收所述硬件设备返回的设备标识并保存；
所述第二接收模块还用于在注册过程中接收获取设备标识指令；
所述第二发送模块还用于在所述第二接收模块接收到获取设备标识指令后将自身的设备标识返回给所述计算机。
进一步地，所述计算机还包括：提示接收模块和第二保存模块；
所述提示接收模块，用于在注册过程中提示用户输入用户注册名并接收所述用户注册名；
所述第二保存模块，用于保存所述提示接收模块接收到的所述用户注册名。
进一步地，所述协商保存模块包括：
第一生成保存单元，用于生成第一密钥并保存；
第一加密单元，用于使用所述第一生成保存单元中的第一密钥根据预设算法对第一预设数据进行加密得到第五加密结果；
第一发送单元，用于将所述第一生成保存单元中的第一密钥和所述第一加密单元得到的第五加密结果发送给所述硬件设备；
第一接收单元，用于接收所述硬件设备发送的数据；
第二获取单元，用于从所述第一接收单元接收到的数据中获取第二密钥和第六加密结果；
解密判断单元，用于使用所述第二获取单元获取的第二密钥解密所述第二获取单元获取的第六加密结果，判断解密结果是否为所述第一预设数据，如判断为否则提示注册失败；
第二生成保存单元，用于在所述解密判断单元判断为是时根据所述第一生成保存单元保存的所述第一密钥和所述第二获取单元获取的所述第二密钥生成第一加密密钥并保存；
所述硬件设备还包括：获取判断模块和生成加密模块；
所述第二接收模块还用于在协商密钥过程中接收所述计算机发送的数据；
所述获取判断模块用于从所述第二接收模块接收到的数据中获取所述第一密钥和所述第五加密结果，使用所述第一密钥解密所述第五加密结果，判断解密结果是否为所述第一预设数据；
生成加密模块，用于在所述获取判断模块判断为是时生成第二密钥，根据所述第一密钥和所述第二密钥生成第二加密密钥并保存；使用所述第二密钥根据预设算法对所述获取判断模块得到的所述解密结果进行加密得到第六加密结果；
所述第二发送模块还用于将所述生成加密模块生成的所述第二密钥和加密得到的所述第六加密结果发送给所述计算机，还用于在所述获取判断模块判断为否时给所述计算机返回注册错误信息。
进一步地，所述生成加密模块具体用于在所述获取判断模块判断为是时生成第二密钥，将所述第一密钥的前8字节数据和所述第二密钥的后8字节数据进行拼接得到第二加密密钥并保存；使用所述第二密钥根据预设算法对所述解密结果进行加密得到第六加密结果；
所述第二生成保存单元具体用于在所述解密判断单元判断为是时将保存的所述第一密钥的前8字节数据和所述第二获取单元获取的所述第二密钥的后8字节数据进行拼接得到第一加密密钥并保存。
进一步地，所述计算机还包括：
弹出提示模块，用于在注册过程中弹出验证PIN码框，提示用户输入PIN码并接收；
第六判断模块，用于判断所述弹出提示模块接收到的用户输入的PIN码是否与保存的PIN码相同，是则触发所述第一保存模块，否则提示注册失败。
本公开与现有技术相比，具有以下优点：
本公开技术方案通过计算机中的Windows系统服务应用配合硬件设备，可以达到使用注册的硬件设备接登录Windows10以上系统的目的，提高登录过程的安全性；且本方案中硬件设备的类型没有限制，任何可以做 安全计算的设备都可以用来登录，方便用户使用。
附图说明
图1为本公开实施例一提供的一种硬件登录windows10以上系统的实现方法流程图；
图2为本公开实施例二提供的一种硬件登录windows10以上系统的实现方法中的注册过程流程图；
图3为本公开实施例二提供的一种硬件登录windows10以上系统的实现方法中的认证过程流程图；
图4为本公开实施例二提供的一种硬件登录windows10以上系统的实现方法中注销过程流程图；
图5为本公开实施例三提供的一种硬件登录windows10以上系统的实现装置方框示意图。
具体实施方式
下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
实施例一
本公开实施例一提供一种硬件登录windows10以上系统的实现方法，计算机的系统为windows10以上系统(包括windows10系统)，本实施例方法包括认证过程，如图1所示，认证过程包括：
步骤S1：当计算机监控到硬件设备插入时，获取硬件设备的设备标识，并根据与设备标识对应的注册索引获取第一数据包；
具体的，本实施例中的第一数据包包括：第一随机数、第二随机数、第一会话随机数和第一加密值；
具体的，在本实施例中，获取硬件设备的设备标识与根据与设备标识对应的注册索引获取第一数据包之间包括：计算机判断硬件设备是否已注册，是则根据与设备标识对应的注册索引获取第一数据包，否则拒绝登录。 其中，计算机判断硬件设备是否已注册，包括：计算机获取注册列表，并判断获取到的设备标识与注册列表中的设备标识是否匹配，是则硬件设备已注册，否则硬件设备未注册；
在本实施例中，计算机获取注册列表包括：计算机调用第一接口获取注册列表。
其中，在步骤S1中，获取硬件设备的设备标识之前还包括：计算机向硬件设备发送获取应用指令；硬件设备接收到获取应用指令后，给计算机返回数据；计算机接收硬件设备返回的数据并根据接收到的数据判断获取应用是否成功，是则获取硬件设备的设备标识，否则报错。
其中，步骤S1中的获取硬件设备的设备标识，包括：计算机向硬件设备发送获取设备标识指令；硬件设备接收获取设备标识指令并将自身的设备标识返回给计算机；计算机接收硬件设备返回的设备标识并保存；
在本实施例中，根据与设备标识对应的注册索引获取第一数据包包括：计算机根据与设备标识对应的注册索引调用第四接口获取第一数据包；
其中，根据与设备标识对应的注册索引获取第一数据包之前包括：计算机将第二随机数、第一随机数、第一会话随机数进行拼接得到第一拼接结果，根据预设算法使用保存的与注册索引对应的第一配套服务框架密钥对第一拼接结果进行加密得到第一加密值；
步骤S2：计算机使用保存的第一加密密钥对第一数据包进行加密得到第一加密结果，并将第一加密结果和注册索引发送给硬件设备；
步骤S3：硬件设备使用保存的第二加密密钥对接收到的第一加密结果进行解密得到第一解密结果，使用保存的与接收到的注册索引对应的第二配套服务框架密钥和第一解密结果中的第三随机数、第四随机数、第二会话随机数对第一解密结果中的第二加密值进行验证，如验证成功则执行步骤S4，如验证失败则给计算机返回错误信息；
在本实施例中，步骤S3中的使用保存的与接收到的注册索引对应的第二配套服务框架密钥和第一解密结果中的第三随机数、第四随机数、第二会话随机数对第一解密结果中的第二加密值进行验证，包括：硬件设备将第一解密结果中的第三随机数、第四随机数、第二会话随机数进行拼接 得到第二拼接结果，根据预设算法使用保存的与接收到的注册索引对应的第二配套服务框架密钥对第二拼接结果进行加密得到第一加密结果；判断第一加密结果与第一解密结果中的第二加密值是否相同，是则验证成功，否则验证失败；
在本实施例中，计算机接收到硬件设备返回的错误信息后拒绝登录；
步骤S4：硬件设备根据保存的与注册索引对应的第二设备密钥、第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；使用第二加密密钥对第三加密值和第四加密值进行加密得到第二加密结果，并将第二加密结果发送给计算机；
具体的，在本实施例中，硬件设备根据保存的与注册索引对应的第二设备密钥、第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值，包括：硬件设备使用与注册索引对应的第二设备密钥根据预设算法对第一解密结果中的第三随机数进行加密得到第三加密值；使用第二设备密钥根据预设算法对第一解密结果中的第二会话随机数进行加密得到第四加密值；
步骤S5：计算机使用第一加密密钥对接收到的第二加密结果进行解密得到第二解密结果，使用保存的与注册索引对应的第一设备密钥、第一随机数和第一会话随机数对第二解密结果进行验证，如验证成功则允许登录，如验证失败则拒绝登录。
具体的，在本实施例中，使用保存的与注册索引对应的第一设备密钥、第一随机数和第一会话随机数对第二解密结果进行验证，包括：计算机根据预设算法使用保存的与注册索引对应的第一设备密钥对保存的第一随机数进行加密得到第五加密值；根据预设算法使用第一设备密钥对保存的第一会话随机数进行加密得到第六加密值；判断第五加密值和第六加密值是否与第二解密结果匹配，是则验证成功，允许登录，否则验证失败，拒绝登录。
本实施例中的方法还可以包括注销过程，具体的，注销过程包括：
步骤P1：当计算机接收到用户选择的删除信息时获取注册列表；
步骤P2：计算机判断接收到的删除信息是否与注册列表中的信息匹配，是则执行步骤P3，否则拒绝注销；
步骤P3：计算机提示用户确认进行删除操作，当接收到用户的确认删除信息时，将与用户选择的删除信息对应的信息从注册列表中删除，注销流程结束。
本实施例中的方法还可以包括注册过程，具体的，注册过程包括：
步骤A1：当计算机接收到注册触发信息时，进行初始化并开始监控硬件设备；
在本实施例中，进行初始化包括：计算机根据硬件设备信息创建搜寻设备的监控；例如，硬件设备信息可以为PID(即产品识别码)或VID(即供应商ID)等；
具体的，步骤A1之前包括：
步骤P1：当计算机中的应用被启动时，计算机调用第一接口获取注册列表；
步骤P2：计算机显示获取到的注册列表；
步骤A2：当计算机监控到硬件设备插入时，获取硬件设备的设备标识；并获取注册列表；
在本实施例中，步骤A2中的获取硬件设备的设备标识之前还包括：计算机向硬件设备发送获取应用指令；硬件设备接收到获取应用指令后给计算机返回数据；计算机接收硬件设备返回的数据并根据接收到的数据判断获取应用是否成功，是则获取硬件设备的设备标识，否则报错。
具体的，步骤A2中的获取硬件设备的设备标识包括：计算机向硬件设备发送获取设备标识指令；硬件设备接收获取设备标识指令并将自身的设备标识返回给计算机；计算机接收硬件设备返回的设备标识并保存。
可选的，步骤A2中的获取注册列表包括：计算机调用第一接口获取注册列表；
步骤A3：计算机判断获取到的设备标识与注册列表中的设备标识是否匹配，是则提示当前硬件设备已注册，注册流程结束；否则执行步骤A4；
具体的，在步骤A3和步骤A4之间还包括：计算机提示用户输入用户注册名；当计算机接收到用户输入的用户注册名时保存该用户注册名；
步骤A4：计算机与硬件设备协商加密密钥并保存；
具体的，在本实施例中，步骤A4包括：
步骤A41：计算机生成第一密钥并保存，使用第一密钥根据预设算法对第一预设数据进行加密得到第五加密结果，并将第一密钥和第五加密结果发送给硬件设备；
步骤A42：硬件设备接收计算机发送的第一密钥和第五加密结果，使用第一密钥解密第五加密结果，判断解密结果是否为第一预设数据，是则执行步骤A43，否则给计算机返回注册错误信息，结束；
步骤A43：硬件设备生成第二密钥，根据第一密钥和第二密钥生成第二加密密钥并保存；使用第二密钥根据预设算法对解密结果进行加密得到第六加密结果，将第二密钥和第六加密结果发送给计算机；
优选的，根据第一密钥和第二密钥生成第二加密密钥包括：将第一密钥的前8字节数据和第二密钥的后8字节数据进行拼接得到第二加密密钥；
步骤A44：计算机接收硬件设备发送的第二密钥和第六加密结果，使用第二密钥解密第六加密结果，判断解密结果是否为第一预设数据，是则执行步骤A45，否则提示注册失败，结束；
步骤A45：计算机根据保存的第一密钥和获取的第二密钥生成第一加密密钥并保存；
具体的，步骤A45包括：计算机将保存的第一密钥的前8字节数据和获取的第二密钥的后8字节数据进行拼接得到第一加密密钥并保存；
步骤A5：计算机向硬件设备发送注册命令；
步骤A6：硬件设备接收注册命令，并更新注册索引，生成第二设备密钥和第二配套服务框架密钥并与注册索引对应保存，使用保存的第二加密密钥对第二设备密钥和第二配套服务框架密钥进行加密得到第三加密结果；
步骤A7：硬件设备将第三加密结果和注册索引发送给计算机；
步骤A8：计算机保存接收到的注册索引，并使用保存的第一加密密钥对接收到的第三加密结果进行解密；
步骤A9：计算机将设备标识、从第三加密结果中解密得到的第一设备密钥和第一配套服务框架密钥与注册索引对应保存在注册列表中；
在本实施例中，步骤A9之前包括：
步骤B1：计算机弹出验证PIN码框，提示用户输入PIN码；
步骤B2：当计算机接收到用户输入的PIN码时，判断用户输入的PIN码是否与保存的PIN码相同，是则执行步骤A9，否则报错。
实施例二
本公开实施例二提供一种硬件登录windows10以上系统的实现方法，计算机的系统为windows10以上系统(包括windows10系统)，本实施例方法包括注册过程和认证过程，如图2所示，注册过程包括：
步骤101：当计算机接收到注册触发信息时，进行初始化并开始监控硬件设备；
具体的，在本实施例中，进行初始化包括：计算机根据硬件设备信息创建搜寻设备的监控；
可选的，在步骤101之前还包括：
步骤a1：当计算机中的应用被启动时，调用第一接口获取注册列表；
具体的，在本实施例中，第一接口为FindAllRegisteredDeviceInfoAsync；注册列表中包括设备标识、第一设备密钥和第一配套服务框架密钥与注册索引；
步骤a2：计算机显示获取到的注册列表；
步骤102：计算机监控并判断是否有硬件设备插入，是则执行步骤103，否则提示用户插入硬件设备，返回步骤102；
步骤103：计算机向硬件设备发送获取应用指令；
例如，本实施例中的获取应用指令为00 a4 04 00 0e d1 56 00 01 32 52 68 65 6c 6c 6f 01 01 00；
步骤104：硬件设备接收获取应用指令并给计算机返回数据；
步骤105：计算机接收硬件设备返回的数据并根据该数据判断获取应用是否成功，是则执行步骤106，否则报错；
在本实施例中，步骤105中根据该数据判断获取应用是否成功包括：计算机判断接收到的数据是不是第一预设数值，是则获取应用成功，否则获取应用失败；例如本实施例中的第一预设数值为9000；
例如，本实施例中的报错具体为：计算机显示失败界面；
步骤106：计算机向硬件设备发送获取设备标识指令；
例如，本实施例中获取设备标识指令为：00 27 00 00 00；
步骤107：硬件设备接收获取设备标识指令并将自身的设备标识返回给计算机；
例如，本实施例中的设备标识为：5a e8 51 1b 83 90 2a 34 48 ce d1 75 c6 1a 30 b9 9d b1 51 c7 c5 e2 b7 78 14 f7 0d 96 7f 6f e6 8c；
步骤108：计算机接收硬件设备的设备标识并保存；
步骤109：计算机调用第一接口获取注册列表；
具体的，在本实施例中，第一接口为FindAllRegisteredDeviceInfoAsync；
步骤110：计算机判断保存的硬件标识与获取的注册列表中的设备标识是否匹配，是则提示当前硬件设备已注册，否则执行步骤111；
步骤111：计算机提示用户输入用户注册名；
步骤112：当计算机接收到用户输入的用户注册名时保存用户注册名；
例如，本实施例中的用户注册名为：A_EPASS_key；
步骤113：计算机生成第一密钥并保存，使用第一密钥根据预设算法对第一预设数据进行加密得到第五加密结果，并将第一密钥和第五加密结果发送给硬件设备；
优选的，本实施例中的第一密钥是一随机数，长度为16字节，第五加密结果长度也为16字节；例如，第一密钥为：1e e1 86 9a 87 0c 1d d0 1b 80 9b bd d8 d6 83 be；第一预设数据为：EnterSafe--Hello；第五加密结果为：f9 12 16 0c db 71 94 a3 c8 dd 10 bd ad ff 51 ec；
步骤114：硬件设备接收计算机发送的数据并从中获取第一密钥和第五加密结果，使用第一密钥解密第五加密结果，判断解密结果是否为第一预设数据，是则执行步骤115，否则给计算机返回注册错误信息；
优选的，在本实施例中，计算机接收到注册错误信息后提示注册失败；
步骤115：硬件设备生成第二密钥，根据第一密钥和第二密钥生成第二加密密钥并保存；使用第二密钥根据预设算法对解密结果进行加密得到第六加密结果，将第二密钥和第六加密结果发送给计算机；
具体的，在本实施例中，根据第一密钥和第二密钥生成第二加密密钥 包括：将第一密钥的前8字节数据和第二密钥的后8字节数据进行拼接得到第二加密密钥；例如第二密钥为：0a c8 6e 9c 30 b5 e5 d5 c1 32 86 fb 30 41 bf e4；第六加密结果为：48 57 d9 96 6c d2 74 46 43 f7 a2 90 fa 91 b6 26；
步骤116：计算机接收硬件设备发送的数据并从中获取第二密钥和第六加密结果，使用第二密钥解密第六加密结果，判断解密结果是否为第一预设数据，是则执行步骤117，否则提示注册失败；
步骤117：计算机根据第一密钥和第二密钥生成第一加密密钥并保存；
具体的，本实施例中的实现过程与步骤115的生成方法相同，在此不再赘述；
步骤118：计算机向硬件设备发送注册命令；
例如本实施例中的注册命令为：00 20 00 00 00；
步骤119：硬件设备接收注册命令，并更新注册索引，生成第二设备密钥和第二配套服务框架密钥并与注册索引对应保存，使用保存的第二加密密钥对第二设备密钥和第二配套服务框架密钥进行加密得到第三加密结果；
具体的，在本实施例中，更新注册数据为：注册索引自加1；例如：设备密钥为：24 49 94 23 06 8e b2 00 80 27 22 33 12 49 35 6b 9c 00 26 59 95 26 e3 d3 fe c0 63 a8 22 c0 65 0a；服务器密钥为：d2 06 28 ad bb ab 27 22 d1 e6 3c 04 a4 39 68 ca 57 12 e3 3f e0 b6 44 59 d7 a8 50 0b 0a 0a 3d 2d；第三加密结果为：cc 01 a8 8b 01 a9 fa ec 44 51 9f fc c5 44 be 4d e5 02 d1 f9 31 3d fa 35 69 3f 2c 2a be a1 ec a3 13 db 39 8c b6 02 d6 00 59 46 18 4b db 82 67 ad 97 ce c5 ea 79 41 38 e6 e4 b2 94 82 00 40；硬件设备在不同系统中注册对应不同的注册索引；
步骤120：硬件设备将第三加密结果和注册索引发送给计算机；
步骤121：计算机保存接收到的注册索引，并使用保存的第一加密密钥对接收到的第三加密结果进行解密，如解密成功则执行步骤122，若解密失败，则提示注册失败；
步骤122：计算机弹出验证PIN码框，提示用户输入PIN码；
步骤123：当计算机收到用户输入的PIN码时，判断用户输入的PIN码是否与保存的PIN码相同，是则执行步骤124，否则提示注册失败；
例如，本实施例中的额PIN码为：ABC123456；
步骤124：计算机将设备标识、解密得到的第一设备密钥和第一配套服务框架密钥与所述注册索引对应保存在所述注册列表中；
步骤125：当计算机接收到后台任务注册信息时，判断该后台任务是否注册过，是则提示注册完成信息，否则注册一个后台任务，锁屏；
具体的，在本实施例中，计算机通过BackgroundExecutionManager和BackgroundTaskBuilder两个类注册后台任务；并创建后台的触发事件，即通过某个事件触发后台任务，主要通过SecondaryAuthenticationFactorAuthenticationTrigger类实现，在本实施例中当用户锁屏时会触发后台任务，开始进行认证过程。
如图3所示，本方法中的认证过程包括：
步骤201：当计算机的后台任务被启动时，计算机进行初始化并开始监控硬件设备；
具体的，在本实施例中，计算机进行初始化包括：所述计算机根据所述硬件设备信息创建搜寻设备的监控；
步骤202：当计算机监控到硬件设备插入时，向硬件设备发送获取应用指令；
步骤203：硬件设备接收到获取应用指令后给计算机返回数据；
步骤204：计算机接收硬件设备返回的数据并根据该数据判断获取应用是否成功，是则执行步骤205，否则报错；
在本实施例中，步骤204包括：计算机判断接收到的数据是不是第一预设数值，是则获取应用成功，否则获取应用失败；例如本实施例中的第一预设数值为9000；
步骤205：计算机向硬件设备发送获取设备标识指令；
步骤206：硬件设备接收获取设备标识指令并将自身的设备标识返回给计算机；
步骤207：计算机接收硬件设备的设备标识并保存；
步骤208：计算机调用第一接口获取注册列表；
具体的，在本实施例中，第一接口为FindAllRegisteredDeviceInfoAsync；注册列表中包括设备标识、第一设备 密钥、第一配套服务框架密钥与注册索引；
步骤209：计算机判断保存的设备标识与注册列表中的设备标识是否匹配，是则执行步骤210，否则提示当前硬件设备未注册，报错；
步骤210：计算机根据与设备标识对应的注册索引调用第四接口获取第一数据包；
具体的，本实施例中的第四接口为StartAuthenticationAsync函数，第一数据包括：第二随机数、第一随机数、第一会话随机数和第一加密值；步骤210之前还包括：计算机将第二随机数、第一随机数、第一会话随机数进行拼接得到第一拼接结果，根据预设算法使用保存的与注册索引对应的第一配套服务框架密钥对第一拼接结果进行加密得到第一加密值；
例如，本实施例中的第二随机数为：95 c1 6d 5b 1c f6 80 40 ac 49 31 52 92 cf 7d cc 94 11 2d 0e 59 74 31 a6 ea 81 e1 c0 82 5a d7 26；第一随机数为：bb 17 71 28 25 9f 77 fb c0 5c 29 99 fd 15 2d 20 4d ee ee 7a 0d ed 96 6c 8b b8 63 e7 c8 cc d1 92；第一会话随机数为：9d 26 5b 0c 69 7c 3b b3 b5 f5 96 5e 3f 19 bf 6d 66 ff c9 50 51 d8 11 59 8a 8c 76 28 27 c7 1c dc；第一加密值为：e0 b1 88 c1 e2 91 40 68 45 76 0a 52 14 bc 8d 30 68 a6 74 11 f0 05 9c df a4 de 8f d4 f5 e9 a0 c7；
步骤211：计算机使用保存的第一加密密钥对第一数据包进行加密得到第一加密结果，并将第一加密结果和与设备标识对应的注册索引发送给硬件设备；
具体的，在本实施例中，计算机和可以预先生成第一加密密钥并保存；第一加密密钥与注册阶段的第二密钥可以为同一密钥或者不同的密钥；
步骤212：硬件设备使用保存的第二加密密钥对接收到的第一加密结果进行解密得到第一解密结果；
那种213：硬件设备将第一解密结果中的第三随机数、第四随机数、第二会话随机数进行拼接得到第二拼接结果，根据预设算法使用保存的与接收到的注册索引对应的第二配套服务框架密钥对第二拼接结果进行加密得到第一加密结果；
步骤214：硬件设备判断第一加密结果与第一解密结果中的第二加密值是否相同，是则执行步骤215，否则给所述计算机返回拒绝登录信息；
步骤215：硬件设备根据保存的与接收到的注册索引对应的第二设备密钥、第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；
具体的，在本实施例中，步骤215包括：硬件设备使用第二设备密钥根据预设算法对第一解密结果中的第三随机数进行加密得到第三加密值；使用第二设备密钥根据预设算法对第一解密结果中的第二会话随机数进行加密得到第四加密值；例如，本实施例中的第三加密值为：83 00 42 2c 5c 4a 95 3e 8c 21 fe 42 0f ed f0 ac 23 9c ac 72 82 d9 2e d3 27 b6 59 e3 64 35 7b ea；第四加密值为：bb 55 73 b3 fd 9b 08 7e 1f b4 84 b7 c7 0e 32 20 86 ce 4e ea 15 5c 27 62 5e 5e 1c b6 00 f6 35 1c e6 2c 1c 13；
步骤216：硬件设备使用第二加密密钥对第三加密值和第四加密值进行加密得到第二加密结果，并将第二加密结果发送给计算机；
步骤217：计算机使用第一加密密钥对接收到的第二加密结果进行解密得到第二解密结果；
步骤218：计算机使用保存的与注册索引对应的第一设备密钥、第一随机数和第一会话随机数对第二解密结果进行验证，如验证成功则允许登录，如验证失败则拒绝登录；
在本实施例中，步骤219具体包括：计算机根据预设算法使用保存的与注册索引对应的第一设备密钥对保存的第一随机数进行加密得到第五加密值；根据预设算法使用第一设备密钥对保存的第一会话随机数进行加密得到第六加密值；判断第五加密值和第六加密值是否与第二解密结果匹配，是则验证成功，允许登录；否则验证失败，拒绝登录。
在本实施例的方法中，还可以包括注销过程，如图4所示，包括：
步骤301：当计算机接收到用户选择的删除信息时，调用第一接口获取注册列表；
具体的，在本实施例中，第一接口为FindAllRegisteredDeviceInfoAsync；
步骤302：计算机判断接收到的删除信息是否与注册列表中的信息匹配，是则执行步骤303，否则拒绝注销；
步骤303：计算机弹出删除信息框，提示用户确认进行删除操作；
步骤304：计算机判断是否接收到用户的确认删除信息，是则执行步骤305，否则注销流程结束；
步骤305：计算机将与用户选择的删除信息对应的信息从注册列表中删除，注销流程结束。
实施例三
本公开实施例三提供一种硬件登录windows10以上系统的实现装置，如图5所示，包括计算机1和硬件设备2；其中，计算机1的系统为windows10以上系统(包括windows10系统)，计算机1包括：
第一获取模块11，用于在认证过程中当计算机1监控到硬件设备插入时，获取硬件设备的设备标识；
第二获取模块12，用于根据与第一获取模块11获取的设备标识对应的注册索引获取第一数据包；
具体的，本实施例中的第一数据包包括：第一随机数、第二随机数、第一会话随机数和第一加密值；
在本实施例中，第二获取模块12具体用于根据与第一获取模块11获取的设备标识对应的注册索引调用第四接口获取第一数据包；
第一加密模块13，用于使用保存的第一加密密钥对第二获取模块12获取的第一数据包进行加密得到第一加密结果；
第一发送模块14，用于将注册索引和第一加密模块13得到的第一加密结果发送给硬件设备2；
第一接收模块15，用于在认证过程中接收硬件设备2的第二发送模块26发送的第二加密结果或错误信息；
第一解密模块16，用于使用保存的第一加密密钥对第一接收模块接收15到的第二加密结果进行解密得到第二解密结果；
第一验证模块17，用于使用保存的与注册索引对应的第一设备密钥、第一随机数和第一会话随机数对第一解密模块16得到的第二解密结果进行验证；
允许登录模块18，用于在第一验证模块17验证成功时允许登录；
拒绝登录模块19，用于在第一接收模块15接收到错误信息后或第一验证模块17验证失败时拒绝登录；
硬件设备2包括：
第二接收模块21，用于在认证过程中接收计算机1的第一发送模块14发送的第一加密结果和注册索引；
第二解密模块22，用于使用保存的第二加密密钥对第二接收模块21接收到的第一加密结果进行解密得到第一解密结果；
第二验证模块23，用于使用保存的与第二接收模块21接收到的注册索引对应的第二配套服务框架密钥和第二解密模块22得到的第一解密结果中的第三随机数、第四随机数、第二会话随机数对第二接收模块接收到的第一解密结果中的第二加密值进行验证；
第一生成模块24，用于当第二验证模块23验证成功时根据保存的与第二接收模块21接收到的注册索引对应的第二设备密钥、第二解密模块22得到的第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；
第二加密模块25，用于使用第二加密密钥对第一生成模块24生成的第三加密值和第四加密值进行加密得到第二加密结果；
第二发送模块26，用于在第二验证模块23验证失败时给计算机1返回错误信息，还用于将第二加密模块25得到的第二加密结果发送给计算机1。
可选地，本实施例中的计算机1还包括：
第一判断模块，用于在认证过程中判断硬件设备是否已注册，是则触发第二获取模块12，否则触发拒绝登录模块19；
具体的，第一判断模块包括：
第一获取单元，用于获取注册列表；
在本实施例中，第一获取单元具体用于调用第一接口获取注册列表；
第一判断单元，用于判断第一获取模块11获取到的设备标识与第一获取单元获取的注册列表中的设备标识是否匹配，是则硬件设备已注册，否则硬件设备未注册。
拒绝登录模块19，还用于在第一判断模块判断为否时拒绝登录。
可选地，本实施例中的计算机1还包括第二判断模块；
第一发送模块14还用于向硬件设备2发送获取应用指令；
第二接收模块21还用于接收计算机1发送的获取应用指令；
第二发送模块26还用于给计算机1返回数据；
第一接收模块15还用于接收硬件设备2返回的数据；
第二判断模块，用于根据第一接收模块15接收到的数据判断获取应用是否成功，是则触发第一获取模块11，否则触发拒绝登录模块19；
拒绝登录模块19，还用于在第二判断模块判断为否时拒绝登录。
在本实施例中，第一获取模块11具体用于向硬件设备2发送获取设备标识指令；并接收硬件设备2返回的设备标识并保存；
第二接收模块21还用于接收获取设备标识指令；
第二发送模块26还用于在第二接收模块21接收到获取设备标识指令后将自身的设备标识返回给计算机1。
可选的，计算机1还包括：拼接加密模块，用于将第二随机数、第一随机数、第一会话随机数进行拼接得到第一拼接结果，根据预设算法使用保存的与注册索引对应的第一配套服务框架密钥对第一拼接结果进行加密得到第一加密值；
相应的，第二验证模块23具体用于将第二解密模块22得到的第一解密结果中的第三随机数、第四随机数、第二会话随机数进行拼接得到第二拼接结果，根据预设算法使用保存的与第二接收模块21接收到的注册索引对应的第二配套服务框架密钥对第二拼接结果进行加密得到第一加密结果；判断第一加密结果与第二接收模块21接收到的第一解密结果中的第二加密值是否相同，是则验证成功，否则验证失败。
在本实施例中，第一生成模块24具体用于当第二验证模块23验证成功时，使用与第二接收模块21接收到的注册索引对应的第二设备密钥根据预设算法对第二解密模块22得到的第一解密结果中的第三随机数进行加密得到第三加密值；使用第二设备密钥根据预设算法对第二解密模块22得到的第一解密结果中的第二会话随机数进行加密得到第四加密值；
相应的，第一验证模块17具体用于根据预设算法使用保存的与注册索引对应的第一设备密钥对保存的第一随机数进行加密得到第五加密值；根据预设算法使用第一设备密钥对保存的第一会话随机数进行加密得到第六加密值；判断第五加密值和第六加密值是否与第二解密结果匹配，是 则验证成功，允许登录，否则验证失败，拒绝登录。
可选的，本实施例的计算机1还包括第三获取模块、第三判断模块、确认删除模块：
第一接收模块15还用于在注销过程中接收用户选择的删除信息；
第三获取模块用于在第一接收模块15接收到删除信息后获取注册列表；
第三判断模块用于判断第一接收模块15接收到的删除信息是否与第三获取模块获取的注册列表中的信息匹配，如不匹配拒绝注销；
确认删除模块，用于在第三判断模块判断为是时提示用户确认进行删除操作，当接收到用户的确认删除信息时，将与用户选择的删除信息对应的信息从注册列表中删除。
可选的，本实施例中的计算机1还包括第一初始化模块、第四获取模块、第五获取模块、第四判断模块、协商保存模块、第三解密模块、第一保存模块；
第一接收模块15还用于在注册过程中接收注册触发信息，还用于接收硬件设备发送的注册索引、第三加密结果；
第一初始化模块，用于在第一接收模块15接收到注册触发信息时，进行初始化并开始监控硬件设备；
第四获取模块，用于当第一初始化模块监控到硬件设备插入时，获取硬件设备的设备标识；
第五获取模块，用于在注册过程中获取注册列表；
在本实施例中，第五获取模块具体用于在注册过程中调用第一接口获取注册列表；
第四判断模块，用于判断第四获取模块获取到的设备标识与第五获取模块获取到的注册列表中的设备标识是否匹配，如匹配则提示当前硬件设备已注册；
协商保存模块，用于在第四判断模块判断为否时与硬件设备协商加密密钥并保存；
第一发送模块14还用于在注册过程中向硬件设备发送注册命令；
第一保存模块，用于在注册过程中保存第一接收模块接收到的注册索 引；
第三解密模块用于使用保存的第一加密密钥对第一接收模块接收到的第三加密结果进行解密；
第一保存模块，还用于将第四获取模块获取的设备标识、第三解密模块从第三加密结果中解密得到的第一设备密钥和第一配套服务框架密钥与注册索引对应保存在第五获取模块获取的注册列表中；
硬件设备2还包括：更新模块、生成保存模块、第三加密模块；
第二接收模块21还用于在注册过程中接收计算机1发送的注册命令；
更新模块用于在第二接收模块21接收到注册命令后更新注册索引，
生成保存模块用于生成第二设备密钥和第二配套服务框架密钥并与注册索引对应保存，
第三加密模块用于使用保存的第二加密密钥对生成保存模块生成的第二设备密钥和第二配套服务框架密钥进行加密得到第三加密结果；
第二发送模块26还用于将第三加密模块得到的第三加密结果和更新模块更新后的注册索引发送给计算机。
在本实施例中，第一初始化模块具体用于在第一接收模块接收到注册触发信息时，根据硬件设备信息创建搜寻设备的监控，开始监控硬件设备。
可选的，本实施例中的计算机1还包括第五判断模块；
第一发送模块14还用于在注册过程中向硬件设备2发送获取应用指令；
第二接收模块21还用于在注册过程中接收计算机1发送的获取应用指令；
第二发送模块26还用于在第二接收模块21接收到获取应用指令后给计算机1返回数据；
第一接收模块15还用于在注册过程中接收硬件设备2返回的数据；
第五判断模块用于根据第一接收模块接收到的数据判断获取应用是否成功，是则触发第四获取模块，否则提示注册失败。
在本实施例中，第四获取模块具体用于在注册过程中向硬件设备2发送获取设备标识指令；并接收硬件设备2返回的设备标识并保存；
第二接收模块21还用于在注册过程中接收获取设备标识指令；
第二发送模块26还用于在第二接收模块21接收到获取设备标识指令后将自身的设备标识返回给计算机1。
可选的，本实施例中的计算机还包括：提示接收模块和第二保存模块；
提示接收模块，用于在注册过程中提示用户输入用户注册名，并接收用户输入的用户注册名；
第二保存模块用于保存提示接收模块接收到的用户注册名。
具体的，在本实施例中，协商保存模块包括：
第一生成保存单元，用于生成第一密钥并保存；
第一加密单元，用于使用第一生成保存单元中的第一密钥根据预设算法对第一预设数据进行加密得到第五加密结果；
第一发送单元，用于将第一生成保存单元中的第一密钥和第一加密单元得到的第五加密结果发送给硬件设备2；
第一接收单元，用于接收硬件设备2发送的数据；
第二获取单元，用于从第一接收单元接收到的数据中获取第二密钥和第六加密结果；
解密判断单元，用于使用第二获取单元获取的第二密钥解密第二获取单元获取的第六加密结果，判断解密结果是否为第一预设数据，如判断为否则提示注册失败；
第二生成保存单元，用于在解密判断单元判断为是时根据第一生成保存单元保存的第一密钥和第二获取单元获取的第二密钥生成第一加密密钥并保存；
硬件设备2还包括：获取判断模块和生成加密模块；
第二接收模块21还用于在协商密钥过程中接收计算机1发送的数据；
获取判断模块用于从第二接收模块21接收到的数据中获取第一密钥和第五加密结果，使用第一密钥解密第五加密结果，判断解密结果是否为第一预设数据；
生成加密模块，用于在获取判断模块判断为是时生成第二密钥，根据第一密钥和第二密钥生成第二加密密钥并保存；使用第二密钥根据预设算法对解密结果进行加密得到第六加密结果；
第二发送模块26还用于将生成加密模块生成的第二密钥和加密得到 的第六加密结果发送给计算机1，还用于在获取判断模块判断为否时给计算机1返回注册错误信息。
其中，生成加密模块具体用于在获取判断模块判断为是时生成第二密钥，将第一密钥的前8字节数据和第二密钥的后8字节数据进行拼接得到第二加密密钥并保存；使用第二密钥根据预设算法对解密结果进行加密得到第六加密结果；
相应的，第二生成保存单元具体用于在解密判断单元判断为是时将保存的第一密钥的前8字节数据和第二获取单元获取的第二密钥的后8字节数据进行拼接得到第一加密密钥并保存。
可选的，本实施例中的计算机1还包括：
弹出提示模块，用于在注册过程中弹出验证PIN码框，提示用户输入PIN码并接收；
第六判断模块，用于判断弹出提示模块接收到的用户输入的PIN码是否与保存的PIN码相同，是则触发第一保存模块，否则提示注册失败。
本公开技术方案通过计算机中的Windows系统服务应用+配合硬件设备，可以达到使用注册的硬件设备登录Windows10以上系统的目的，提高登录过程的安全性；且本方案中硬件设备的类型没有限制，任何可以做安全计算的设备都可以用来登录，方便用户使用。
以上所述，仅为本公开较佳的具体实施方式，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开公开的技术范围内，可轻易想到的变化或替换，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应该以权利要求的保护范围为准。

Claims (20)

  1. 一种硬件登录windows10以上系统的实现方法，其特征在于，包括认证过程，所述认证过程包括：
    步骤S1：当计算机监控到硬件设备插入时，获取所述硬件设备的设备标识，并根据与所述设备标识对应的注册索引获取第一数据包，所述第一数据包包括：第一随机数、第二随机数、第一会话随机数和第一加密值；
    步骤S2：所述计算机使用保存的第一加密密钥对所述第一数据包进行加密得到第一加密结果，并将所述第一加密结果和所述注册索引发送给所述硬件设备；
    步骤S3：所述硬件设备使用保存的第二加密密钥对接收到的所述第一加密结果进行解密得到第一解密结果，使用保存的与接收到的所述注册索引对应的第二配套服务框架密钥和所述第一解密结果中的第三随机数、第四随机数、第二会话随机数对所述第一解密结果中的第二加密值进行验证，如验证成功则执行步骤S4，如验证失败则给所述计算机返回错误信息，所述计算机接收到所述错误信息后拒绝登录；
    步骤S4：所述硬件设备根据保存的与所述注册索引对应的第二设备密钥、所述第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；使用所述第二加密密钥对所述第三加密值和第四加密值进行加密得到第二加密结果，并将所述第二加密结果发送给所述计算机；
    步骤S5：所述计算机使用所述第一加密密钥对接收到的第二加密结果进行解密得到第二解密结果，使用保存的与所述注册索引对应的第一设备密钥、所述第一随机数和所述第一会话随机数对所述第二解密结果进行验证，如验证成功则允许登录，如验证失败则拒绝登录。
  2. 如权利要求1所述的方法，其特征在于，所述获取所述硬件设备的设备标识与所述根据与所述设备标识对应的注册索引获取第一数据包之间包括：所述计算机判断所述硬件设备是否已注册，是则根据与所述设备标识对应的注册索引获取第一数据包，否则拒绝登录。
  3. 如权利要求1所述的方法，其特征在于，在所述步骤S1中，所述 获取所述硬件设备的设备标识之前还包括：
    所述计算机向所述硬件设备发送获取应用指令；所述硬件设备接收到获取应用指令后，给所述计算机返回数据；所述计算机接收硬件设备返回的数据并根据接收到的数据判断获取应用是否成功，是则获取所述硬件设备的设备标识，否则拒绝登录。
  4. 如权利要求1所述的方法，其特征在于，所述步骤S1中的获取所述硬件设备的设备标识，包括：所述计算机向硬件设备发送获取设备标识指令；所述硬件设备接收获取设备标识指令并将自身的设备标识返回给所述计算机；所述计算机接收所述硬件设备返回的所述设备标识并保存。
  5. 如权利要求1所述的方法，其特征在于，所述根据与所述设备标识对应的注册索引获取第一数据包之前包括：所述计算机将所述第二随机数、所述第一随机数、所述第一会话随机数进行拼接得到第一拼接结果，根据预设算法使用保存的与所述注册索引对应的第一配套服务框架密钥对所述第一拼接结果进行加密得到所述第一加密值；
    所述步骤S3中的使用保存的与接收到的所述注册索引对应的第二配套服务框架密钥和所述第一解密结果中的第三随机数、第四随机数、第二会话随机数对所述第一解密结果中的第二加密值进行验证，包括：所述硬件设备将第一解密结果中的第三随机数、第四随机数、第二会话随机数进行拼接得到第二拼接结果，根据预设算法使用保存的与接收到的所述注册索引对应的第二配套服务框架密钥对所述第二拼接结果进行加密得到第一加密结果；判断所述第一加密结果与所述第一解密结果中的第二加密值是否相同，是则验证成功，否则验证失败。
  6. 如权利要求1所述的方法，其特征在于，所述步骤S4中的所述硬件设备根据保存的与所述注册索引对应的第二设备密钥、所述第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值，包括：所述硬件设备使用与所述注册索引对应的第二设备密钥根据预设算法对所述第一解密结果中的第三随机数进行加密得到第三加密值；使用所述第二设备密钥根据预设算法对所述第一解密结果中的第二会话随机数进行加密得到第四加密值；
    所述步骤S5中的使用保存的与所述注册索引对应的第一设备密钥、所述第一随机数和所述第一会话随机数对所述第二解密结果进行验证，包括：所述计算机根据预设算法使用保存的与所述注册索引对应的第一设备密钥对保存的第一随机数进行加密得到第五加密值；根据所述预设算法使用所述第一设备密钥对保存的第一会话随机数进行加密得到第六加密值；判断所述第五加密值和所述第六加密值是否与所述第二解密结果匹配，是则验证成功，允许登录，否则验证失败，拒绝登录。
  7. 如权利要求1所述的方法，其特征在于，还包括注销过程，所述注销过程包括：
    步骤P1：当所述计算机接收到用户选择的删除信息时获取注册列表；
    步骤P2：所述计算机判断接收到的删除信息是否与所述注册列表中的信息匹配，是则执行步骤P3，否则拒绝注销；
    步骤P3：所述计算机提示用户确认进行删除操作，当接收到用户的确认删除信息时，将与用户选择的删除信息对应的信息从注册列表中删除，注销流程结束。
  8. 如权利要求1所述的方法，其特征在于，还包括注册过程，所述注册过程包括：
    步骤A1：当所述计算机接收到注册触发信息时，进行初始化并开始监控硬件设备；
    步骤A2：当所述计算机监控到硬件设备插入时，获取所述硬件设备的设备标识；并获取注册列表；
    步骤A3：所述计算机判断获取到的设备标识与所述注册列表中的设备标识是否匹配，是则提示当前硬件设备已注册，注册流程结束；否则执行步骤A4；
    步骤A4：所述计算机与所述硬件设备协商加密密钥并保存；
    步骤A5：所述计算机向所述硬件设备发送注册命令；
    步骤A6：所述硬件设备接收注册命令，并更新注册索引，生成第二设备密钥和第二配套服务框架密钥并与所述注册索引对应保存，使用保存的第二加密密钥对所述第二设备密钥和所述第二配套服务框架密钥进 行加密得到第三加密结果；
    步骤A7：所述硬件设备将所述第三加密结果和所述注册索引发送给所述计算机；
    步骤A8：所述计算机保存接收到的所述注册索引，并使用保存的第一加密密钥对接收到的所述第三加密结果进行解密；
    步骤A9：所述计算机将设备标识、从所述第三加密结果中解密得到的第一设备密钥和第一配套服务框架密钥与所述注册索引对应保存在所述注册列表中。
  9. 如权利要求8所述的方法，其特征在于，在所述步骤A2中的获取所述硬件设备的设备标识之前还包括：
    所述计算机向所述硬件设备发送获取应用指令；所述硬件设备接收到获取应用指令后给所述计算机返回数据；所述计算机接收所述硬件设备返回的数据并根据接收到的所述数据判断获取应用是否成功，是则获取所述硬件设备的设备标识，否则提示注册失败。
  10. 如权利要求8所述的方法，其特征在于，所述步骤A4包括：
    步骤A41：所述计算机生成第一密钥并保存，使用所述第一密钥根据预设算法对第一预设数据进行加密得到第五加密结果，并将所述第一密钥和所述第五加密结果发送给所述硬件设备；
    步骤A42：所述硬件设备接收所述计算机发送的所述第一密钥和所述第五加密结果，使用所述第一密钥解密所述第五加密结果，判断解密结果是否为所述第一预设数据，是则执行步骤A43，否则给所述计算机返回注册错误信息，结束；
    步骤A43：所述硬件设备生成第二密钥，根据所述第一密钥和所述第二密钥生成第二加密密钥并保存；使用所述第二密钥根据预设算法对所述解密结果进行加密得到第六加密结果，将所述第二密钥和所述第六加密结果发送给所述计算机；
    步骤A44：所述计算机接收所述硬件设备发送的所述第二密钥和所述第六加密结果，使用所述第二密钥解密所述第六加密结果，判断解密结果是否为所述第一预设数据，是则执行步骤A45，否则提示注册失败，结束；
    步骤A45：所述计算机根据保存的所述第一密钥和获取的所述第二密钥生成第一加密密钥并保存。
  11. 一种硬件登录windows10以上系统的实现装置，其特征在于，包括计算机和硬件设备；所述计算机包括：
    第一获取模块，用于在认证过程中当所述计算机监控到硬件设备插入时，获取所述硬件设备的设备标识；
    第二获取模块，用于根据与所述第一获取模块获取的设备标识对应的注册索引获取第一数据包，所述第一数据包包括：第一随机数、第二随机数、第一会话随机数和第一加密值；
    第一加密模块，用于使用保存的第一加密密钥对所述第二获取模块获取的第一数据包进行加密得到第一加密结果；
    第一发送模块，用于将所述注册索引和所述第一加密模块得到的第一加密结果发送给所述硬件设备；
    第一接收模块，用于在认证过程中接收所述硬件设备发送的第二加密结果或错误信息；
    第一解密模块，用于使用保存的第一加密密钥对所述第一接收模块接收到的第二加密结果进行解密得到第二解密结果；
    第一验证模块，用于使用保存的与所述注册索引对应的第一设备密钥、所述第一随机数和所述第一会话随机数对所述第一解密模块得到的第二解密结果进行验证；
    允许登录模块，用于在所述第一验证模块验证成功时允许登录；
    拒绝登录模块，用于在所述第一接收模块接收到所述错误信息后或所述第一验证模块验证失败时拒绝登录；
    所述硬件设备包括：
    第二接收模块，用于在认证过程中接收所述计算机发送的第一加密结果和注册索引；
    第二解密模块，用于使用保存的第二加密密钥对所述第二接收模块接收到的所述第一加密结果进行解密得到第一解密结果；
    第二验证模块，用于使用保存的与所述第二接收模块接收到的所述注册索引对应的第二配套服务框架密钥和所述第二解密模块得到的第一 解密结果中的第三随机数、第四随机数、第二会话随机数对所述第二接收模块接收到的第一解密结果中的第二加密值进行验证；
    第一生成模块，用于当所述第二验证模块验证成功时根据保存的与所述第二接收模块接收到的所述注册索引对应的第二设备密钥、所述第二解密模块得到的第一解密结果中的第三随机数和第二会话随机数生成第三加密值和第四加密值；
    第二加密模块，用于使用所述第二加密密钥对所述第一生成模块生成的第三加密值和第四加密值进行加密得到第二加密结果；
    第二发送模块，用于在所述第二验证模块验证失败时给所述计算机返回错误信息，还用于将所述第二加密模块得到的所述第二加密结果发送给所述计算机。
  12. 如权利要求11所述的装置，其特征在于，所述计算机还包括：
    第一判断模块，用于在认证过程中判断所述硬件设备是否已注册，是则触发所述第二获取模块，否则触发所述拒绝登录模块；
    所述拒绝登录模块，还用于在所述第一判断模块判断为否时拒绝登录。
  13. 如权利要求11所述的装置，其特征在于，所述计算机还包括第二判断模块；
    所述第一发送模块还用于向所述硬件设备发送获取应用指令；
    所述第二接收模块还用于接收所述计算机发送的获取应用指令；
    所述第二发送模块还用于给所述计算机返回数据；
    所述第一接收模块还用于接收所述硬件设备返回的数据；
    所述第二判断模块用于根据所述第一接收模块接收到的数据判断获取应用是否成功，是则触发所述第一获取模块，否则触发所述拒绝登录模块；
    所述拒绝登录模块，还用于在所述第二判断模块判断为否时拒绝登录。
  14. 如权利要求11所述的装置，其特征在于，所述第一获取模块具体用于向硬件设备发送获取设备标识指令；并接收所述硬件设备返回的 设备标识并保存；
    所述第二接收模块还用于接收获取设备标识指令；
    所述第二发送模块还用于在所述第二接收模块接收到获取设备标识指令后将自身的设备标识返回给所述计算机。
  15. 如权利要求11所述的装置，其特征在于，所述计算机还包括：
    拼接加密模块，用于将所述第二随机数、所述第一随机数、所述第一会话随机数进行拼接得到第一拼接结果，根据预设算法使用保存的与所述注册索引对应的第一配套服务框架密钥对所述第一拼接结果进行加密得到所述第一加密值；
    所述第二验证模块具体用于将所述第二解密模块得到的第一解密结果中的第三随机数、第四随机数、第二会话随机数进行拼接得到第二拼接结果，根据预设算法使用保存的与所述第二接收模块接收到的所述注册索引对应的第二配套服务框架密钥对所述第二拼接结果进行加密得到第一加密结果；判断所述第一加密结果与所述第二接收模块接收到的第一解密结果中的第二加密值是否相同，是则验证成功，否则验证失败。
  16. 如权利要求11所述的装置，其特征在于，所述第一生成模块具体用于当所述第二验证模块验证成功时，使用与所述第二接收模块接收到的所述注册索引对应的第二设备密钥根据预设算法对所述第二解密模块得到的第一解密结果中的第三随机数进行加密得到第三加密值；使用所述第二设备密钥根据预设算法对所述第二解密模块得到的第一解密结果中的第二会话随机数进行加密得到第四加密值；
    所述第一验证模块具体用于根据预设算法使用保存的与所述注册索引对应的第一设备密钥对保存的第一随机数进行加密得到第五加密值；根据所述预设算法使用所述第一设备密钥对保存的第一会话随机数进行加密得到第六加密值；判断所述第五加密值和所述第六加密值是否与所述第二解密结果匹配，是则验证成功，允许登录，否则验证失败，拒绝登录。
  17. 如权利要求11所述的装置，其特征在于，所述计算机还包括第三获取模块、第三判断模块、确认删除模块：
    所述第一接收模块还用于在注销过程中接收用户选择的删除信息；
    所述第三获取模块用于在所述第一接收模块接收到删除信息后获取注册列表；
    所述第三判断模块用于判断所述第一接收模块接收到的删除信息是否与所述第三获取模块获取的注册列表中的信息匹配，如不匹配拒绝注销；
    所述确认删除模块，用于在所述第三判断模块判断为是时提示用户确认进行删除操作，当接收到用户的确认删除信息时，将与用户选择的删除信息对应的信息从注册列表中删除。
  18. 如权利要求11所述的装置，其特征在于，所述计算机还包括第一初始化模块、第四获取模块、第五获取模块、第四判断模块、协商保存模块、第三解密模块、第一保存模块；
    所述第一接收模块还用于在注册过程中接收注册触发信息，还用于接收所述硬件设备发送的注册索引、第三加密结果；
    所述第一初始化模块，用于在所述第一接收模块接收到注册触发信息时，进行初始化并开始监控硬件设备；
    所述第四获取模块，用于当所述第一初始化模块监控到硬件设备插入时，获取所述硬件设备的设备标识；
    所述第五获取模块，用于在注册过程中获取注册列表；
    所述第四判断模块，用于判断所述第四获取模块获取到的设备标识与所述第五获取模块获取到的注册列表中的设备标识是否匹配，如匹配则提示当前硬件设备已注册；
    所述协商保存模块，用于在所述第四判断模块判断为否时与所述硬件设备协商加密密钥并保存；
    所述第一发送模块还用于在注册过程中向所述硬件设备发送注册命令；
    所述第一保存模块，用于在注册过程中保存所述第一接收模块接收到的所述注册索引；
    所述第三解密模块用于使用保存的第一加密密钥对所述第一接收模块接收到的所述第三加密结果进行解密；
    所述第一保存模块，还用于将所述第四获取模块获取的设备标识、 所述第三解密模块从所述第三加密结果中解密得到的第一设备密钥和第一配套服务框架密钥与所述注册索引对应保存在所述第五获取模块获取的注册列表中；
    所述硬件设备还包括：更新模块、生成保存模块、第三加密模块；
    所述第二接收模块还用于在注册过程中接收所述计算机发送的注册命令；
    所述更新模块用于在所述第二接收模块接收到注册命令后更新注册索引，
    所述生成保存模块用于生成第二设备密钥和第二配套服务框架密钥并与所述注册索引对应保存，
    所述第三加密模块用于使用保存的第二加密密钥对所述生成保存模块生成的第二设备密钥和所述第二配套服务框架密钥进行加密得到第三加密结果；
    所述第二发送模块还用于将所述第三加密模块得到的第三加密结果和所述更新模块更新后的注册索引发送给所述计算机。
  19. 如权利要求18所述的装置，其特征在于，所述计算机还包括第五判断模块；
    所述第一发送模块还用于在注册过程中向所述硬件设备发送获取应用指令；
    所述第二接收模块还用于在注册过程中接收所述计算机发送的获取应用指令；
    所述第二发送模块还用于在所述第二接收模块接收到获取应用指令后给所述计算机返回数据；
    所述第一接收模块还用于在注册过程中接收所述硬件设备返回的数据；
    所述第五判断模块用于根据所述第一接收模块接收到的数据判断获取应用是否成功，是则触发所述第四获取模块，否则提示注册失败。
  20. 如权利要求18所述的装置，其特征在于，所述协商保存模块包括：
    第一生成保存单元，用于生成第一密钥并保存；
    第一加密单元，用于使用所述第一生成保存单元中的第一密钥根据预设算法对第一预设数据进行加密得到第五加密结果；
    第一发送单元，用于将所述第一生成保存单元中的第一密钥和所述第一加密单元得到的第五加密结果发送给所述硬件设备；
    第一接收单元，用于接收所述硬件设备发送的数据；
    第二获取单元，用于从所述第一接收单元接收到的数据中获取第二密钥和第六加密结果；
    解密判断单元，用于使用所述第二获取单元获取的第二密钥解密所述第二获取单元获取的第六加密结果，判断解密结果是否为所述第一预设数据，如判断为否则提示注册失败；
    第二生成保存单元，用于在所述解密判断单元判断为是时根据所述第一生成保存单元保存的所述第一密钥和所述第二获取单元获取的所述第二密钥生成第一加密密钥并保存；
    所述硬件设备还包括：获取判断模块和生成加密模块；
    所述第二接收模块还用于在协商密钥过程中接收所述计算机发送的数据；
    所述获取判断模块用于从所述第二接收模块接收到的数据中获取所述第一密钥和所述第五加密结果，使用所述第一密钥解密所述第五加密结果，判断解密结果是否为所述第一预设数据；
    生成加密模块，用于在所述获取判断模块判断为是时生成第二密钥，根据所述第一密钥和所述第二密钥生成第二加密密钥并保存；使用所述第二密钥根据预设算法对所述获取判断模块得到的所述解密结果进行加密得到第六加密结果；
    所述第二发送模块还用于将所述生成加密模块生成的所述第二密钥和加密得到的所述第六加密结果发送给所述计算机，还用于在所述获取判断模块判断为否时给所述计算机返回注册错误信息。
PCT/CN2018/123211 2018-01-10 2018-12-24 硬件登录windows10以上系统的实现方法及装置 Ceased WO2019137193A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/770,569 US11314853B2 (en) 2018-01-10 2018-12-24 Method and apparatus for implementing logging-on of hardware to windows system with version 10 or higher

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810021013.5 2018-01-10
CN201810021013.5A CN108256309B (zh) 2018-01-10 2018-01-10 硬件登录windows10以上系统的实现方法及装置

Publications (1)

Publication Number Publication Date
WO2019137193A1 true WO2019137193A1 (zh) 2019-07-18

Family

ID=62725084

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/123211 Ceased WO2019137193A1 (zh) 2018-01-10 2018-12-24 硬件登录windows10以上系统的实现方法及装置

Country Status (3)

Country Link
US (1) US11314853B2 (zh)
CN (1) CN108256309B (zh)
WO (1) WO2019137193A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113242212A (zh) * 2021-04-15 2021-08-10 杭州链城数字科技有限公司 网络节点双向通信认证方法及装置、电子设备、存储介质
CN115174187A (zh) * 2022-06-30 2022-10-11 济南浪潮数据技术有限公司 一种用户安全登录方法、系统及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108256309B (zh) * 2018-01-10 2020-01-03 飞天诚信科技股份有限公司 硬件登录windows10以上系统的实现方法及装置
CN109450852B (zh) * 2018-10-09 2020-09-29 中国科学院信息工程研究所 网络通信加密解密方法及电子设备
CN117097476B (zh) * 2023-10-19 2024-01-26 浪潮云洲工业互联网有限公司 一种基于工业互联网的数据处理方法、设备及介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102811211A (zh) * 2011-05-30 2012-12-05 索尼公司 支持登录验证的设备和进行登录验证的方法
CN102831335A (zh) * 2011-06-16 2012-12-19 中国科学院数据与通信保护研究教育中心 一种Windows操作系统的安全保护方法和系统
CN104104687A (zh) * 2014-07-28 2014-10-15 飞天诚信科技股份有限公司 一种安全登录的方法和系统
US20150358820A1 (en) * 2013-05-07 2015-12-10 Huawei Device Co., Ltd. Method for Establishing Connection Between Devices, Configuration Device, and Wireless Device
CN106034028A (zh) * 2015-03-17 2016-10-19 阿里巴巴集团控股有限公司 一种终端设备认证方法、装置及系统
CN108256309A (zh) * 2018-01-10 2018-07-06 飞天诚信科技股份有限公司 硬件登录windows10以上系统的实现方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070174429A1 (en) * 2006-01-24 2007-07-26 Citrix Systems, Inc. Methods and servers for establishing a connection between a client system and a virtual machine hosting a requested computing environment
CN100365974C (zh) * 2006-03-31 2008-01-30 北京飞天诚信科技有限公司 一种控制计算机登录的设备及方法
KR101416541B1 (ko) * 2012-12-27 2014-07-09 주식회사 로웸 안전 로그인 시스템과 방법 및 이를 위한 장치
CN104639516B (zh) * 2013-11-13 2018-02-06 华为技术有限公司 身份认证方法、设备及系统
CN107241192B (zh) * 2017-05-27 2019-08-30 飞天诚信科技股份有限公司 一种使用指纹key进行登录的方法及装置
CN107563176A (zh) * 2017-08-17 2018-01-09 广州视源电子科技股份有限公司 基于u盘的登录认证方法、系统、可读存储介质和计算机

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102811211A (zh) * 2011-05-30 2012-12-05 索尼公司 支持登录验证的设备和进行登录验证的方法
CN102831335A (zh) * 2011-06-16 2012-12-19 中国科学院数据与通信保护研究教育中心 一种Windows操作系统的安全保护方法和系统
US20150358820A1 (en) * 2013-05-07 2015-12-10 Huawei Device Co., Ltd. Method for Establishing Connection Between Devices, Configuration Device, and Wireless Device
CN104104687A (zh) * 2014-07-28 2014-10-15 飞天诚信科技股份有限公司 一种安全登录的方法和系统
CN106034028A (zh) * 2015-03-17 2016-10-19 阿里巴巴集团控股有限公司 一种终端设备认证方法、装置及系统
CN108256309A (zh) * 2018-01-10 2018-07-06 飞天诚信科技股份有限公司 硬件登录windows10以上系统的实现方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113242212A (zh) * 2021-04-15 2021-08-10 杭州链城数字科技有限公司 网络节点双向通信认证方法及装置、电子设备、存储介质
CN115174187A (zh) * 2022-06-30 2022-10-11 济南浪潮数据技术有限公司 一种用户安全登录方法、系统及装置

Also Published As

Publication number Publication date
US20210165868A1 (en) 2021-06-03
US11314853B2 (en) 2022-04-26
CN108256309B (zh) 2020-01-03
CN108256309A (zh) 2018-07-06

Similar Documents

Publication Publication Date Title
WO2019137193A1 (zh) 硬件登录windows10以上系统的实现方法及装置
US11811952B2 (en) Authentication system and working method thereof
KR102018971B1 (ko) 네트워크 액세스 디바이스가 무선 네트워크 액세스 포인트를 액세스하게 하기 위한 방법, 네트워크 액세스 디바이스, 애플리케이션 서버 및 비휘발성 컴퓨터 판독가능 저장 매체
CN104426659B (zh) 动态口令生成方法、认证方法及系统、相应设备
CN108377190B (zh) 一种认证设备及其工作方法
CN104412273B (zh) 用于进行激活的方法和系统
WO2018133686A1 (zh) 一种密码保护方法、装置及存储介质
CN101964789B (zh) 安全访问受保护资源的方法及系统
US12192376B2 (en) Method and apparatus for realizing secure signature
US8397281B2 (en) Service assisted secret provisioning
CN104202163B (zh) 一种基于移动终端的密码系统
WO2016115807A1 (zh) 无线路由器的接入处理、接入方法及装置
CN113114668A (zh) 一种信息传输方法、移动终端、存储介质及电子设备
WO2023124958A1 (zh) 密钥更新方法、服务器、客户端及存储介质
CN105915338A (zh) 生成密钥的方法和系统
CN107040520A (zh) 一种云计算数据共享系统及方法
CN115600215A (zh) 系统启动方法、系统信息处理方法、装置、设备及其介质
CN102143190B (zh) 一种安全登陆方法和装置
JP7079528B2 (ja) サービス提供システム及びサービス提供方法
CN112632589A (zh) 密钥托管方法、装置、设备及计算机可读存储介质
CN108768655B (zh) 动态口令生成方法和系统
CN115987597A (zh) 基于软件、终端设备、虚拟服务器的密钥更新方法及系统
CN114978543B (zh) 一种凭证注册和认证的方法及系统
CN114117404B (zh) 一种用户认证方法、装置、设备、系统及存储介质
CN106452845A (zh) 一种在线解锁的实现方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18900023

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18900023

Country of ref document: EP

Kind code of ref document: A1