TW200820042A - Multi-factor authentication system and a logon method of a windows OS - Google Patents

Abstract

A multi-factor authentication system and a logon method of a Windows operation system are provided. The system and method thereof is essentially applied to a Windows VistaTM operation system. Without any influence to the common usage of a user, a multi-factor authentication window is established on a logon screen of the windows operation system, so as to establish a more secure and convenient logon method. The system includes a means for logging on a Windows OS by a logon program ''Winlogon.exe'', a means for calling LogonUI.exe by the Winlogon.exe, a means for certifying a user by credential provider, a means for displaying the logon screen having the multi-factor authentication window, a means for authenticating with multi-factor, a means for verifying a user's identification by comparing the user's ID with the user's information in a database, a means for refilling the user's ID/password, and a means for messaging.

Description

200820042 IX. Description of the Invention: [Technical Field] The present invention provides a multi-factor authentication system and a login method for a window operating system, in particular, a multi-factor and a customized multi-factor for a Windows Vista operating system. Login method. [Prior Art] The commonly used Windows operating system (Windows® OS) is a multi-user disk operating environment, in which there are several user-authenticated login (Logon) methods to establish a security for the system and its data. With a confidential working environment. In addition to the conventional Windows operating system, the newly developed Windows VistaTM operating system adopts a completely different login authentication method than the previous Windows operating system. Please refer to the technology inside the Microsoft (Microsoft®) official website. The user account control (UAC) is used as the Windows VistaTM to manage the rights of the user, which can be obtained between the flexibility and function of the administrator account and the security of the general user account. Clever balance. The VistaTM operating system proposes a new authentication model that allows the login login (LogonUI) to communicate directly with the winlogon program of the management window login program. This demonstration model provides simplicity, scalability and flexibility. Flexibility), and abandoning the traditional Windows operating system (such as Windows XP or Windows 2000) using a graphical identification and verification (GIN A) module to manage user authentication and login. Unlike the previous GINA module approach, the programmer does not modify any user interface or login window to create a new authentication environment. The Windows VistaTM operating system provides a credential provider that contacts the Windows login page. (credential provider) module, through the user's "credential" and passed to the Winlogon login program, the system login 0 The above window VistaTM operating system also provides an environment for programmers to carry out other login methods. In order to introduce methods other than the user ID and password authentication provided by the traditional Windows operating system, such as using biometrics (bi〇metrics). The credential provider module to which the & is is an additive module, which can provide credentials for multi-person use, and coexist in the system, such as providing a window VistaTM operating system generally using an identification code ( ID) and the certificate of the weight and the certificate of the smart card (smart car(j). That is to say, in addition to the authentication method provided by the operating system, the second party (thlrd party) can be provided by the window vistaTM operating system. The provider joins the service to be authenticated. For example, a voucher can be added to the login login (LogonUI) to specify the smart card authentication provided by the third party; or a voucher can be used to use the palm print, iris. Biometric means such as (iris), retina (retma), facial (facial), deafness (c auricle), voiceprint (v〇iceprint), fingerprint (fingerprint), finger/palm/vein vein distribution (vein) Or other authentication methods, so that under the same login, you can use the traditional authentication method using ID and password for system login. A Windows Vista operating system login authentication architecture as shown in the first figure 'This architecture is included in the boot (b〇〇t) into the Windows login 200820042 (Wml〇g〇n) Cai (11), this window Login process strategy; this program picks up the file: (Logonm) program 〇 3), in order to generate the window, the face to know that the current window VlstaTM operating environment has been injected and borrowed, that is, borrowed The login user interface program obtains the data of the certificate of the user or the user, as shown in the figure, L〇g〇nUl(9) type solid: the interface of the provider is obtained by the provider _ (151) and the test is provided by = Good all the credentials (credentials), each of which displays a small marriage representing different credentials on the login page (13). The user clicks to authenticate. By default ^ (then 'for the password credendal provider), L〇go^ m ^ password credential provider, get all the passwords available, (4) enter the window login face to display the small picture of the certificate and; The password certificate provider should display the number: #额"3 for the user to enter the password (9), the password certificate provider for the second,; after entering the password, confirm the identity of the person who is the person who is the person (authentication package), through L〇g〇nUl ((1) and back to 匕

Wmlogon ^ 〇 t ^ ^

Seomty Authonty, LSa ) ( ) 9 ) Submitted to the Security Accounts Manager (SAM) database for authentication. This security account %> is a repository for storing credential information for all credentials, including Username and password. 200820042 [Summary of the Invention] The above-mentioned Windows VistaTM operating system uses a credential provider to perform various user authentications. The credentials established by the original user use a set of user names and passwords or smart cards. In addition to the authentication method, other customized authentication methods such as biometric identification require the establishment of a separate certificate for other authentication procedures. However, the multi-factor authentication system and the login method of the window operating system of the present invention create a new credential provider, and generate a multi-factor (multi-factor) on the login window of the window system without affecting the user's usage habits. -factor) The authentication screen is used to generate a safer and more convenient login method when executing the login system. The multi-factor authentication system of the window operating system disclosed by the present invention includes a user identity comparison means for comparing the user identification data generated by the multi-factor authentication program with the user data registered in an identity identification database. In order to confirm the identity of the user; a means of authentication using the credential provider, which is a user management means in the management window VistaTM operating system; a user identification code/password backfilling means, the user generated by the multi-factor authentication program The user identification code/password in the identification data and the identification database is backfilled to the user ID/Mist stone field in the window login program; and the signal transmission between the multi-factor authentication program and the window login program is achieved. Means of message delivery. The invention is mainly applied to the user of the Windows Vista operating system. The application example includes the first booting and loading the operating system. At this time, the Winlogon.exe system program is used to start the window login program, and then the above-mentioned visual login program ( Winiogon.exe) calls a login user interface program 9 200820042 (=LogonUI.exe execution), which describes the program after the window login, and then the manned window for (4), the standard password credential provider (passed aedendal pn) Vlder A custom credential provider comprising a multi-factor authentication module as provided by the present invention. This login user interface program (L〇g〇nUI exe) calls each credential provider's API to define the aspect of each credential when it logs into the operating system. When the login user interface program calls to the customized credential provider of the present invention, the provider will display a multi-factor authentication window in the entry window of the operating system' and establish multi-factor authentication and a message passing channel between the custom credential providers' such as (1) Pipe mechanism; or (2) Message mechanism; or (3) Message sharing mechanism to perform the multi-factor authentication procedure and the provisioning credential The transmission of information between people.

In addition, the custom credential provider of the present invention will create a masqueraded cryptographic credential provider (wrappedpassw〇rdcredentia pr〇vider). When logging in to the user interface program call API: GetCredentialC(nmt(), H takes the number of credentials provided by each credential provider, and when calling GetCredentlalCount to retrieve the number of credentials, the number of returns is 〇 (c side t drink, Aut〇 L〇g〇nWithDefault is, and then enters the authentication procedure. After successfully confirming the identity of the user, to the authentication database ^, the above message delivery channel notifies the voucher provider, and sends out the user ID/password to be sent out. If the k is bad, the vulgar supplier of the system will be able to view the voucher provided by the user interface program, and then the custom voucher provider will call the kb. The password voucher provider's password vouchers number 200820042 and the voucher data, and then compare the voucher that matches the authenticated user name, and immediately establish the account voucher of the account and a disguised password voucher. At this time, GetCredentialCount( The number of postbacks is 1 (count 2) and AutoLogonWithDefault is True. Then, the user interface program calls GetCredentialAt(), and the custom credentials are returned. The login user interface program will automatically perform the login and log in with the customized credentials specified by the default value. The custom certificate will backfill the password with respect to the password of the account to be logged in to the password of the disguised password certificate to obtain the password. The authentication package corresponding to the password voucher is passed to the login user interface program in the operating system. [Embodiment] Microsoft (M1Cr〇S0ftTM) has released a file called Wml〇g〇n Re- The new architecture of Architecture, the user authentication architecture for the Windows VistaTM operating system, includes a module called a credential provider that replaces the GINa used in Windows χρ/2〇〇〇 (graphic recognition). And authentication). A multi-factor authentication system and login method mainly applied to the Windows V1StaTM operating system disclosed in the present invention is improved according to the new architecture of the above-mentioned Windows VlstaTM operating system. A credential established by a user is authenticated using a general user name and password, and In addition to the use of the authentication method of the group user name and password, the credentials established by the above-mentioned credential provider's authentication framework can no longer refer to other methods of authentication, including the use of authentication methods other than the original authentication method, including 11 200820042 Certification: The method provided by a third party requires the establishment of a user certificate using this method. The multi-factor authentication system and the login method disclosed in the present invention change the login procedure of the original window operation system, take the original authentication information, and replace the authentication information corresponding to the multi-factor authentication, so that the user is not changed. Under the operating habits, the voucher already existing in the system can successfully use the multi-factor authentication method, such as adding various biometrics, smart cards and other authentication methods, and generating a multi-factor authentication face on the login window of the window system to generate more Safe and convenient login method. The above-mentioned Windows VistaTM operating system supports an interactive login method in which a Winlogon program is used to manage the Windows operating system authentication login policy in the operating system, which is responsible for maintaining and transmitting messages, and maintaining the status of the operating system, such as Welcome face, login, logout, workstation lock, etc. However, the multi-factor authentication system and the login method of the window operating system of the present invention generate another customization by changing the program of the original operating system, such as the authentication information created by the login user interface program (LogonULexe). The login program 'This multi-factor authentication program is completed in an instant. The present invention generates a multi-factor authentication login window on the Windows system login screen without affecting the general user usage habits. The second A picture is not shown in the multi-factor $ forensic application of the login screen of the VistaTM operating system. After the boot, the operating system is loaded, and then the above window login (Winl〇g〇n) is loaded. The program, and call the login user interface (LogonUI) program to generate a window login screen, enter the login screen 20 in the icon, the side will display one or more windows Vista.TM operating system user account credentials (credential As shown in Figure 12 200820042, the system administrator 2〇1, the user one 203 and the user two 205, etc., further provides a plurality of system command menus 24, including restarting, suspending, shutting down, etc. Change the login procedure of the original operating system, modify the login screen generated by the login user interface program (LogonUI.exe) to display a multi-factor authentication window 22 at a specific location in the screen. The original operating habits use this multi-factor authentication window 22 to log into the system. Taking the preset state as an example, the user clicks one of the credentials, for example, clicks the user two 205, the associated schema becomes larger (or other ", the member shows the fruit) and uses the second B map. The next authentication page shown indicates that the user identification code (or name) 21 and the corresponding password 23 are not entered, and the user can log in to the system. + Zhuang In this example, the method of using fingerprint authentication is displayed, and a fingerprint scanning device can be used to scan the fingerprint of the user, and then the authentication procedure of the feature comparison is performed. The multi-factor authentication method may include a smart card, a token card, a palm printr (palmprmt), an iris (five) small retina (such as), a facial (facial), an auricle (a) that requires a person pass code or an identification code. Aye), voice voice C voiceprint), έ文έ Γ ·

Uem 彳 gerPnnt), finger / palm / hand veins II - identification mechanism, or other equivalent authentication methods. The third picture shows the private day--the two screens displayed on the screen 20: Shi:] Schematic's in the window login option of the current #j~6 on the window 22 to have a plurality of authentication diagrams Express I several kinds of multi-factor authentication functions, so that users and media can properly authenticate the way, such as Wen A ^ 裱 用 者 T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T In particular, the type 223 and the like, wherein the received user code and ί will correspond to each other through the identification method of the identity of the person... The certificate provider who used the original password will recognize and log in, and the user can select The authentication method supported by the user does not need to change the original == the computer system has a branch;; the multi-factor authentication window displayed in the login screen is different, and the VistaTM operating system discloses the technical file for the third party. The evidence-based mechanism needs to establish its own advice, provider, and the invention. The invention is based on the modification of the multi-factor authentication program provided by credential, so that the original # uses the second-in order, joins the Can not change account or Multi-factor authentication state of use of this factor as much as Windows operating system such as muddy water card system architecture diagram of a fourth diagram shows, the primary means including the following features

(1) Windows login means (Winlogon) 41, after the computer system is turned on, 'loads the Windows Vista operating system to which the present invention is applied, and creates a window login program by using the Winlogon.exe program. This Winlogon.exe is a Windows operating system. The login management program manages the user name/password login operation performed by the administrator to establish a secure management login and logout procedure; (2) Login user interface means (LogonUI) 42, call by the above window login program The user interface program executes LogonUI.exe. The login user interface means to obtain the credential information included in the Windows VistaTNMiF system and display it on the Windows login page. (3) Login screen The display means 43, the invention provides a customized credential provider, and after being loaded by the login user interface program (LogonUI.exe), displays a multi-level 14200820042 factor authentication window on the login screen; (4) Multi-factor authentication 44, using the above-mentioned face display means to generate a multi-factor authentication program for display Multi-factor authentication on the factor authentication window' This means may include a smart card, a token card, a palm print, an iris, a retina, a facial, which requires a passcode or an identification code. Biometric mechanisms such as auricie, voiceprint, fingerprint, finger/palm/vein distribution, or other authentication methods, for example, can be scanned using a fingerprint scanner The fingerprint of the user is used to perform the multi-factor authentication procedure; (5) The user identity comparison means 45 is to log in to the identity identification database for the user identification data generated after the multi-factor authentication procedure. The user data is compared to confirm the identity of the user; in another embodiment, the user identification data generated by the multi-factor authentication program is corresponding to a set of user identification codes and passwords, and is transmitted back to the customized certificate. Provider, using the authentication program to compare the user's identity; (6) Certification (Certification) 46, this is the management window VlstaTM operation The user management means in the system describes the user interface of each credential by using a credential provider module loaded in the login user interface program, and transmits the collected credential information to the window login program. In order to create a login screen (login screen display hand 15 200820042 paragraph), the credential provider can provide credentials for multi-person use, such as providing the Windows VistaTM operating system generally using identification code (ID) and the use of the certificate and use of the code Smart card (smart car (j) credentials. And 'in addition to the authentication method provided by the operating system, the third party can also join the service to be authenticated by the credential provider provided by the Windows VistaTM operating system, for example, can be added to the Windows login screen (L〇gonui). A smart card authentication credential, or a multi-factor authentication credential provider provided by the present invention; (7) a user ID/password backfilling means 48, when multi-factor authentication is performed, a multi-factor authentication program is generated The user identification code/password in the user identification data and the identification database is used to perform the user identification code/password backfilling of the specific certificate when the user logs in, that is, the user identification code/password placement back to the window login program. And (8) the message passing means 47, by means of a message passing channel to achieve the signal transmission between the multi-factor authentication program and the credential provider, and then transmitting the user ID/password to the credential provider via the message passing channel. For example, when the user enters the fingerprint according to the multi-factor authentication window and successfully authenticates through the identity, the above-mentioned message delivery channel notifies the credential provider and notifies the login and user interface programs to rearrange all the credential providers. The above message delivery means may include the following various mechanisms: ===== 16 200820042 The message is transmitted by directing the standard round of the program in front of the pipeline to the standard input of the program behind the pipeline. If the above-mentioned multi-factor § forcible procedure, the so-called smart card message, the scanned fingerprint or other bio-hazard eigenvalues are output by standard, and passed through the pipeline to the authentication operation program of the window operating system; The message mechanism in the Windows operating system can peek or receive the message in the delivery column. The message mechanism provides the multi-factor authentication program of the present invention to transmit the smart card message, know the fingerprint of the field or other The characteristic value of the bio-torture is to see the g-login procedure; (3) or use a message-sharing mechanism to use a shared memory for smart card messages, scanned allegations or other creatures. The exchange of information such as the characteristic value of the certificate. The fifth figure shows a schematic diagram of the operation of the credential provider when the multi-factor authentication method is used in the present invention. The multi-factor authentication method first establishes a custom credential provider 53 to coexist with the credential provider 51 of the original Windows VlstaTM operating system, and also loads the login user interface program ogonUI.exe) 50 A password credential provider 51 within the operating system and a custom credential provider 53 utilized by the present invention. The custom credential provider 53 generates a pseudo-wrapped credential credential provider 55 to provide the credential credential 51 that can be referred to the operating system by the above-mentioned custom vending provider 53 for authentication. This multi-factor authentication method also uses the original password authentication system, and compares the multi-factor authentication to obtain the identification code/password to be logged into the account. 200820042 When the customized credential provider 53 of the present invention receives the identification code/password through the pipeline (message transfer), after confirming the credential of the account to be logged, the custom credential of the account is established. 57 and a disguised password credential 59. After that, the customized credential 57 backfills the password of the account to the spoofed password credential 59' and calls the API of the spoofed credential voucher 59 to obtain the authentication packet, and then returns the authentication packet to the login user interface program 5 Sign in. An embodiment of the present invention: the multi-factor authentication login method of the window operating system of the present invention is performed by using the functions of the means shown in the fourth figure, and the main steps are as shown in the sixth figure: loading the operating system after the system is powered on ( Step S601); Then enter the Windows login (Winlogon) program, and the Windows login program (Winlogon.exe) starts the Windows login program, and the window is logged into the Spearmaster Management window VistaTM operation system authentication login program (Step S603) After that, the login user interface program (L0g0nui.exe) is called (step S605), and the login user interface program is used to manage various window login screen parameters, and then all the credential providers are loaded. , including the password credential provider provided by the Windows operating system and the custom password credential provider of the present invention, by means of several parameters (such as CPUS-LOGON, let the user select the login face of the account; CPUS-UNLOCK-WORKSTATION , after the computer is locked, waiting for the screen to be unlocked; with CPUS_CREDUI, user account control window and other parameters) Information of one or more vouchers for obtaining information of registered accounts in the current 2008 20082 Windows vlsta operating system (steps s6-7); - the above login user interface program display window login screen, in the embodiment of the present invention The login screen including the multi-factor authentication window is displayed, and each credential is displayed on the board of the user by the user interface program = a small tile of different credentials or an account included a name for the user to click to perform login authentication (step S609); ,,, and then establish a multi-factor authentication window and a credential provider_message pass (step S611), including transmitting a credential message, corresponding multi-factor authentication = User identification code/password, etc., the message delivery channel includes (1) pipe (7) ^) mechanism or (7) message mechanism; or (3) message sharing mechanism; after the message delivery channel is established, a masqueraded password certificate is established ^ 'This can be used to successfully transfer the 使用者 ι and message to the 糸 所 沟通 、 ( ( ( ( ( ( ( 、 、 、 、 、 、 、 、 与 与 与 与 与 与 与 与The provided password voucher provider (step S613); at this time, the user uses the above-mentioned multi-factor authentication login method to perform the e-factor authentication procedure (step S615); one to five tortuous tribute library comparison, through the delivery station After the corresponding user recognizes that the user identity is successfully confirmed, the message delivery channel notifies the voucher provider of the code/password (step S617); f wn $ the customer (4) voucher provider calls the application to re-^^^ Slightly notify the login user interface step S6^) all the credentials provided by the provider ((4) dentmls) (

The credential provider of the invention will call the above-mentioned camouflage code "provider's API, such as Get^dentlala" untG 19 200820042

GetCredentmlAtO, to retrieve the number of password voucher S62i), one from the multi-factor authentication pass #,; ^ 贝枓 (step. Confirm 'if the user identity cannot be confirmed' in the error code = to step S6G7 shirt factor certification If the password is confirmed, the password of the account to be logged in is established and a masqueraded password certificate is created (step S623); mi is defined by the login user interface program. The application interface (API) GetCredendalAtO asks and obtains the custom certificate S 62 5) 'Customized certificate then backfills the password corresponding to the account identification code; goes to the established masqueraded password certificate and obtains the authentication packet (at the end of the step, The system login is performed through the authentication packet (step S629).

In performing the above login process, the data transfer between the login user interface program and the credential provider of the Windows operating system uses some calls, as shown in the seventh embodiment, the flow of the preferred embodiment of the present invention, which is mainly For the user authentication of the Visual Studio operating system, the embodiment details include: loading the operating system after booting (step S701); at this time, starting the window login program by using the Winlogon.exe system program (step S703); Communicate with the Windows Vista operating system login page 'The above window login program (Winlogon.exe) calls a login user interface program (executed by LogonUI.exe) to describe the program after the window login' and collects the registrations. The account information (credential) 20 200820042 information, including the number of credentials of the window operating system, the permissions of each voucher to the resources in the system, and draws the login face, interacting with the authentication module of the operating system (step S705); Then load the credential provider of the user in this window VistaTM operating system management, and load the view at the same time. The operating system standard password credential provider and the customized credential provider including the multi-factor authentication module provided by the present invention (step S707); the login user interface program (LogonUI.exe) calls each credential The technology provider's API · SetUsageScenario() 'hunting to communicate with the credential provider whether there is support for the function to be processed, that is, defining the sadness of each credential login operation system (step S 7 0 9 )' The parameters passed in the timing include: (l) CPUS_L〇GON: After logging in, after the boot or after the logout, the user can select a different account to log in; (2) CPUS-UNLOCK-WORKSTATION: Unlocking, after the user has logged in through an account, if they do not log out, they will wait for the screen after unlocking the computer; (3) CPUS-CREDUI: UAC (User Account Control) pop-up window In this window VistaTM operating system, when a low-privileged account wants to perform a high-privilege function, such as adding an account, the UAC will pop up as the system administrator (Administrator). The account number is selected by the user. If the password is successfully confirmed, the function can be performed with the high-privileged account; afterwards, the login user interface program adds the multi-factor authentication window provided by the present invention to the obtained credential information. The login pattern of each credential is displayed on the window login screen, and the multi-factor authentication window is displayed in the same login window as the operation system provides (step 21 200820042 S711); and multi-factor authentication is established. Customized voucher

If (= S713) 'The better implementation of the message passing channel and the secure channel through the encryption and decryption process, such as (1) f road (¥ (2) tfl 4 (Message) (3) ΐ κ4, the eclipse argument program and the custom The transmission of the message between the vouchers; / 证提二' (: Mao Ming Γ 1 提供 建立 建立 建立 建立 建立 建立 ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki ki At the time of authentication, it can be referred to the MM== in the system (4) to smoothly make the multi-factor authentication method (4), and the above-mentioned login user interface program call. Αρι : ;=CredentlaiC嶋t(), in order to retrieve the credentials provided by each credential provider: the catalogue, that is, the login voucher is not required, such as the number of voucher returned by the original password credential provider, plus The number of voucher returned by the custom certificate provided by the present invention (step S717); the number of voucher retrieved by the wide private S717 call GetCredentialCountO, which is returned when the customized credential provider is described The number is 〇^C〇Unt—〇), Aut〇L〇gonWithDefault is False, If the voucher is not provided, the login user interface program is not provided to display the customized voucher in 昼S719. The original voucher (cre<^entials) is still displayed on the bean screen (the step is to wait for the user to authenticate, Including the multi-factor authentication 盥 蜞 蜞 识别 宓 宓 μ μ μ μ μ μ μ μ μ 、 、 、 、 、 、 、 ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( In addition to the login method of the password and the password, the user authentication information of the authentication method provided by the third party, such as biometric identification, smart card or other equivalent authentication method (step S723) may be used; when the user complies with multi-factor authentication When the window indicates multi-factor authentication, such as inputting fingerprint, shooting face, inputting smart card, etc., and successfully confirming the user's identity; in other situations, if the user's identity cannot be confirmed, after returning the error message, 'return to step S711 displays the login face of the multi-factor authentication window and accepts re-authentication; after successfully confirming the identity of the user, it compares to the authentication database, through the above message The delivery channel notifies the voucher provider to send the corresponding user ID/password (step S725); then, the customized credential provider of the present invention receives the user ID/password through the message delivery channel, and then : CredentialsChanged will notify the login user interface program (step S727), after which, the login user interface program reorganizes the credentials provided by all the credential providers (step S729); the login user interface program calls the API again · GetCredentialCount() ( Step S731) · 'Customized by the invention') The beta provider calls the above-mentioned established camouflage password credential provider:

GetCredentmlCountO, GetCredentialAtO, in order to retrieve the number of password voucher and voucher data (step S733); ... after comparing the voucher corresponding to the authenticated user name, immediately establish a customized credential of the account and a disguised password voucher (step S735) · After the custom credential provider of the present invention returns GetCredentialCount(), including the number (count), automatically presets to 200820042 (AutoLogonWithDefault) and the default value (Default), where the number is 1 (ccmnt= l), the representative generates a voucher for display; and sets the default login account as the first preset (Default=0), which means that the login user interface program automatically logs in with the first voucher; and the number of tables

The AutoLogonWithDefault is True, and the login user interface program automatically performs the login, and logs in with the credentials specified by the preset value (step S737); then, the login user interface program calls the API of the custom credential provider of the present invention: GetCredentialAtQ, and The incoming index is 〇, and the customized credential to be logged in is obtained for automatic login (step S739); when the login user interface program communicates with the customized credential of the above step by the defined interface, the customized credential It will be referred to the password certificate of the established masquerading (step S741); the login user interface program finally calls the GetSerialization of the customized certificate (step S743); following the above steps, the customized certificate is the corresponding user. The identification code/password is backfilled with respect to the password of the account to be logged in to the password of the masqueraded password certificate (step S745); then 转: GetSerialization() of the cryptographic password certificate is called to obtain the authentication packet (step S747) And transmitting the authentication packet back to the login user interface program (step S749), and performing login (step S751)In summary, the multi-factor authentication system and the login method disclosed in the present invention are mainly applied to the Windows Vista operating system and the operating system using the credential provider authentication architecture, which can be used in Microsoft without affecting the user's usage habits. A multi-factor authentication view 2008 20082 window is generated on the Windows system login screen. This multi-factor authentication method is used to generate a safer and more convenient login method when executing the login system. In the embodiment of the present invention, the user uses the multi-factor authentication means (such as fingerprint scanning with the fingerprint scanning device) to quickly establish a password credential after confirming the identity of the user. The system is logged in by backfilling the password relative to the user ID (or name). The advantages include: (1) interactive login page; (2) support multi-factor window login, return the corresponding password back to the credential provider, conform to the authentication procedure of Windows VistaTM operating system, does not affect the original User habits; (3) Automatic login to the Windows system using multi-factor authentication; (4) The system is stable according to the program in the original operating system login program; (5) Generate the directory and permissions of the operating system when logging in; 6) The default user ID/password authentication method can still be used; (7) A customized login screen can also be generated; (8) More secure authentication mechanism; (9) Multi-factor authentication login The window can include a number of authentication functions that allow the user to select the appropriate authentication method. However, the above description is only a preferred embodiment of the present invention, and thus the scope of the present invention is not limited thereto, and equivalent structural changes made by using the present specification and the illustrated contents are equally included in the present invention. Within the scope of the agreement, Chen Ming. 25 200820042 [Simple description of the schema], the first diagram is a schematic diagram of the Windows Vista operating system login authentication architecture; the second A diagram shows one of the login schematic diagrams of the multi-factor authentication applied to the Windows VistaTM operating system; FIG. 2B is a schematic diagram showing the login of the multi-factor authentication system of the present invention to the Windows Vista operating system; the third diagram is a schematic diagram of the multi-factor authentication login of the present invention; Schematic diagram of the multi-factor authentication system architecture of the system; Figure 5 is a schematic diagram of the architecture of the credential provider and the customized credential provider of the window operating system of the present invention; Figure 6 is a multi-factor authentication of the window operating system of the present invention. The login method flow; the seventh figure is the flow of the preferred embodiment of the multi-factor authentication login method of the present invention. [Main component symbol description]

Winlogon 11 LSA 19 LogonUI 13 Username/Password 凭证 Credential 151 Credential 2 152 26 200820042 Login Page 20 - System Manager 201 User 203 User 2 205 Multi-factor authentication window 22 System Command Menu 24 User ID 21 Password 23 Fingerprint authentication pattern 221 Chip card authentication pattern 222 Face authentication pattern 223 Window Vista operating system login means 41 Login user interface means 42 Login face display means 43 Multi-factor authentication means 44 User identity comparison means 45 Authentication means 4 6 Authentication transfer means 47 User ID / Password backfill means 48 Login user interface program (LogonUI.exe) 50 Password voucher provider 51 Custom credential provider 53 Camouflaged password voucher provider 55 Password voucher 57 27 200820042 Disguised, password credentials 59

28

Claims (1)

200820042 X. Patent application scope: 1. A multi-factor authentication system for Windows operating system, including: a window login method, using a window login program (Winlogon.exe) to establish a window login program; a login user interface means By the window login program call-login user interface program (LogonULexe) to load the credential provider of the window operating system; an authentication means, using the credential provider's authentication means, to describe the credential User interface, and collect the voucher information f; send to the window login program; a login screen display means, a customized certificate provider generates a multi-factor by-cenary window in the system default window login a multi-factor authentication method for generating a multi-factor authentication program by using the multi-factor authentication window; a user identity comparison means for user identification data and an identification data generated by the multi-factor authentication program The user data registered in the library is compared to confirm the identity of the user; User ID/password backfilling means, backfilling the user identification data generated by the multi-factor authentication program with the corresponding user ID/password in the identity database to the user ID/password in the window login program The field; and a message delivery means, by means of a message delivery channel, to achieve signal transmission between the multi-factor authentication program and the credential provider. 2. The multi-factor 29 200820042 authentication system of the window operating system described in the scope of the patent application, wherein the multi-factor authentication window includes a plurality of authentication schema options to express a plurality of multi-factor authentication functions. 0. The multi-factor authentication system of the window operating system according to claim i, wherein the window operating system is an operating system of a window vistaTM operating system and a credential provider authentication architecture. 4. The multi-factor authentication system for a window operating system according to claim 1, wherein the multi-factor authentication means comprises a smart card, a token card, a palm prmt, an iris that requires a pass code or an identification code. (iris), retina, facial, auricle (catch), speech sculpt, fingerprint, finger/palm/vein distribution One of the mechanisms, or the other five ways of forbearing. 5. The multi-factor authentication system for a window operating system according to claim 1, wherein the user identification code/password backfilling means is utilized. The home message transmission channel backfills the user ID/password into the user ID/password field in the window entry procedure. 6. The multi-factor "heart 4 system of the window operating system according to claim 1 of the patent scope, wherein the message transmission means is a pipe machine f, the multi-factor authentication program and the window The message passing channel between the credential providers of the operating system. 7. The multi-factor of the window operating system described in the patent scope of the patent scope: also the system, wherein the message transmission means is a message (Message) to view or receive the multi-factor authentication program and the window 30 200820042 The system's login program passes the message in the queue. y 8. The multi-factor authentication system of the window operating system according to claim 1, wherein the message transmission means is a message sharing mechanism, that is, using a shared memory to perform the multi-factor authentication procedure and The message transfer between the login programs of the Windows operating system. 9. The multi-factor authentication system of the window operating system according to claim 1, wherein the message delivery channel is a secure channel for the encryption and decryption process. 10. A multi-factor authentication login method for a Windows operating system, comprising: loading the window operating system after booting up, starting a window login program by a window login program (Winlogon.exe); a program interface (LogonUI.exe); loading one or more credential providers, including a password credential provider provided by the window operating system and at least one custom credential credential provider; The password credential provider displays a login screen including a multi-factor authentication window; establishing a message delivery channel between the multi-factor authentication window and the credential provider; establishing a wrecked password credential providing By means of the referral of the authentication message to the password certificate provider; using the multi-factor authentication window to perform a multi-factor authentication procedure; after successfully confirming the identity of the user, the authentication database is compared to an authentication database, and the message is transmitted through 31 200820042 The delivery channel notifies the credential provider to send out the user ID/password; ' , notify Bian Deng 7V The peak-type reorganization _ has the voucher to provide the provided voucher; the servant system provider is called the API of the masqueraded cryptographic voucher provider to retrieve the number of vouchers and the voucher data; The voucher and the masqueraded password are tf (passw〇rd credential); the custom voucher backfills the password to a password block of the masqueraded voucher, and obtains an authentication package; and logs into the system. 11. The multi-factor authentication login method of the window operating system according to claim 10, wherein the step of loading the credential provider in the login user interface program comprises a CPUS-LOGON (login written), CPUS—UNLOCK—W〇RKSTATI〇N (Unlock ^ and CPUS – CREDUH User Account Control Window). 12. The multi-factor authentication login method of the window operating system according to claim 10, wherein after the multi-factor authentication procedure, if the user is confirmed by the benefit method, it is necessary to return to the login page to perform the login. 2. Authentication 13 · A multi-factor authentication login method for a Windows operating system as described in claim 1G, wherein the multi-factor authentication window includes a plurality of authentication schema options to express a plurality of multi-factor authentications One of the features. 14. The multi-factor 32 of the Windows operating system as disclosed in claim 10, wherein the window operating system is a Windows Vista operating system. The method of multi-factor ugly entry of the window operating system described in claim 9 of the patent scope, wherein the multi-factor authentication includes a smart card, a token card, a palm print (a _), which requires a pass code or an identification code. Rainbow trout!!=), retina (she added), facial (fa(10)1), auncle, language"1=voiceprint, fingerprint, finger/palm/vein distribution One of the biometric mechanisms is his authentication method.疋 16. For the multi-factor (4) login method, the message delivery channel is a pipe mechanism, which serves as the message transfer between the multi-factor authentication program and the window login program. 17. The multi-factor 5 forcible login method of the Windows operating system as described in the scope of claim 1 of the patent application, wherein the message transmission channel is a message mechanism to peek or connect (4) multi-factor authentication ^ The credential provider passes the message in the queue. If the team applies for the lion's multi-certification login method as described in the first paragraph of the patent scope, the message transmission channel is the message from the eight-year-old factor 3 and the program. transfer. 19. If the application is based on the _ window, the message transmission channel is - after the addition: 20. The method of multi-factor authentication for the window operating system is to use 33 200820042 To authenticate a method of logging into a VistaTM operating system, the method steps include: loading the window VistaTM operating system after booting; launching a window login program; calling a login user interface program (LogonUI.exe); loading the a password credential provider of the Windows Vista operating system and at least one custom credential provider; the login user interface program calls the respective credential provider's API: SetUsageScenario(); displays a login window, including a Multi-factor authentication window; establish a message delivery channel between the multi-factor authentication and the credential provider; establish a fake password credential provider; the login user interface program call API: GetCredentialCount() ; The number of return is 0 ( count=0 ), AutoLogonWithDefault is False; Multi-factor authentication procedure; after successfully confirming the identity of the user, the authentication database is compared to an authentication database, and the voucher provider is notified through the message delivery channel to send the corresponding user ID/password; through the API: CredentialsChanged notification The login user interface 34 200820042 program reorganizes the credentials provided by the credential provider; the login user interface program calls the API again: GetCredentialCount(); creates a custom credential and a disguised password credential; 1 (count 2 1), AutoLogonWithDefault is True; return the custom certificate to the login user interface program; login user interface program to call the custom certificate GetSerialization (); custom certificate backfill password to the masqueraded password certificate The password field; each of the 'values vouchers of the gamma bean call pseudo-I getSerialization(), obtain the s-bearing package corresponding to the 4-pass code voucher, and pass it to the login user interface program; and perform the login. 21 · The multi-factor 5 login method of the Windows operating system as described in claim 20, wherein the number of the functions of the function SetUsageScenarioQ includes CPUS-LOGON (login page), CPUS-UNLOCK-WORKSTATION (Unlock) and CPUS—CREDUI (User Account Control Window). 22. The multi-factor authentication login method of the window operating system according to claim 20 of the patent scope, wherein after the authentication fails, the step returns to the login face re-authentication displaying the multi-factor authentication window. The multi-factor authentication login method of the window operating system according to claim 20, wherein the multi-factor authentication window includes a plurality of authentication schema options to express a plurality of multi-factor authentications. 24. The method of the window operating system described in Section 2°: The method, wherein the multi-factor authentication includes typing 诵疒=identification, Leica, (Palmp=_: axis (retina), face (faciaO) Bio-identification mechanism such as the ear, the north ear (V01cepnm), the fingerprint (fmgerpnnt), the finger: the vein (vein) distribution: his authentication method. The second cooking device 25♦ , wherein the message delivery channel is -ίΪΓρ:sub)=delivery"the multi-order and the view 2:26:11: the multi-factor of the window operating system described in item 20: Method 'where the message The transmission channel is a mechanism for the message - the material is peeped or connected to the (four) multi-factor authentication program ^ Haishi _ Beanman program-transfer (four) message. 2 7. The registration method as described in the second paragraph of the patent application scope , where the message is passed: = not use - share memory (such as ed me bribe ^^ 2 "multi:: the program between the program and the window login program, the channel described in the third item: the whole channel: - the information transmission channel Is - the process of encryption and decryption 36