服务器上的Cordova指纹认证

Question

我正在尝试在我的(cordova)Android应用程序中创建一个身份验证机制,允许我的用户使用密码和用户名登录,或允许他们扫描他们的手指以便登录.

如何验证在客户端,服务器端注册的指纹？这甚至可以使用Cordova吗？我尝试将手指扫描的结果传输到我的服务器:这看起来像:

FingerprintAuth.isAvailable(function(result) {
  if (result.isAvailable) {
    if(result.hasEnrolledFingerprints){
      FingerprintAuth.show({
        clientId: client_id,
        clientSecret: client_secret
      }, function (result) {
        alert(JSON.stringify(result));

        $http.post('http://192.168.149.33:3000/authorize', result).then(
          function(response) {}
        );

        if (result.withFingerprint) {
          $scope.$parent.loggedIn = true;
          alert("Successfully authenticated using a fingerprint");
          $location.path( "/home" );
        } else if (result.withPassword) {
          alert("Authenticated with backup password");
        }
      }, function(error) {
        console.log(error); // "Fingerprint authentication not available"
      });
    } else {
      alert("Fingerprint auth available, but no fingerprint registered on the device");
    }
  }
}, function(message) {
  alert("Cannot detect fingerprint device : "+ message);
});

服务器端我收到以下数据(3次单独扫描):

{ withFingerprint: 't8haYq36fmBPUEPbVjiWOaBLjMPBeUNP/BTOkoVtZ2ZiX20eBVzZAs3dn6PW/R4E\n' }
{ withFingerprint: 'rA9H+MIoQR3au9pqgLAi/EOCRA9b0Wx1AvzC/taGIUc8cCeDfzfiDZkxNy5U4joB\n' }
{ withFingerprint: 'MMyJm46O8MTxsa9aofKUS9fZW3OZVG7ojD+XspO71LWVy4TZh2FtvPtfjJFnj7Sy\n' }

模式似乎每次都有所不同,有没有一种方法可以将指纹链接到例如用户在数据库中保存的模式？

Answer 1

简短的回答

此API返回的字符串不是"指纹模式".所以你将无法验证你的思维方式......

答案很长

让我们从查看您正在使用的API 的源代码开始.

看看这个文件,我们看到了这些方法:

public static void onAuthenticated(boolean withFingerprint) {
    JSONObject resultJson = new JSONObject();
    String errorMessage = "";
    boolean createdResultJson = false;
    try {

        if (withFingerprint) {
            // If the user has authenticated with fingerprint, verify that using cryptography and
            // then return the encrypted token
            byte[] encrypted = tryEncrypt();
            resultJson.put("withFingerprint", Base64.encodeToString(encrypted, 0 /* flags */));
        } else {
            // Authentication happened with backup password.
            resultJson.put("withPassword", true);

            // if failed to init cipher because of InvalidKeyException, create new key
            if (!initCipher()) {
                createKey();
            }
        }
        createdResultJson = true;

// ...

/**
 * Tries to encrypt some data with the generated key in {@link #createKey} which is
 * only works if the user has just authenticated via fingerprint.
 */
private static byte[] tryEncrypt() throws BadPaddingException, IllegalBlockSizeException {
    return mCipher.doFinal(mClientSecret.getBytes());
}

看看会发生什么"withFingerprint".它是加密客户端密钥的Base64编码.从技术上讲,这是您的身份验证.您将使用此令牌对请求进行身份验证,您的服务器将解密并验证客户端密钥.

摘要

指纹识别增加了一定程度的安全性,但它并不是唯一的安全手段.需要事先与设备和服务器建立关系.

我发现这个图有助于理解android的指纹认证的意图(参考:http://android-developers.blogspot.com/2015/10/new-in-android-samples-authenticating.html)