Interface authentication method and system based on SE chip and storage medium

Abstract

The invention discloses an interface authentication method and system based on an SE chip and a storage medium. The method comprises the following steps: receiving handshake authentication request information; verifying whether the handshake authentication request information is legal; if not, directly judging that the authentication is not passed; if yes, generating corresponding authentication response information M2; using a private key to sign the M1 and the M2 to obtain signature information S2; and forwarding the M2 and the S2 to the equipment terminal, so that the equipment terminal verifies the M2 and the S2, encrypts and stores the working secret key ciphertext K1_Enc, the Mac secret key ciphertext K2_Enc and the token by using the local secret key after the verification is passed, and sends an authentication passing result to the mobile terminal. According to the method, the legality of the identity of an interface visitor is ensured through domestic cryptographic algorithm authentication on the basis of the SE chip, so that the secret key is prevented from being illegally stolen or tampered, and the security of data transmission is improved.

Description

technical field [0001] The invention relates to the control field of interface access rights, in particular to an SE chip-based interface authentication method, system and storage medium. Background technique [0002] At present, the most commonly used interface access control / authentication modes include API key, OAuth token, and JWT token authentication. [0003] The API key authentication method is the preferred method for many developers when restricting or tracking API traffic. Its biggest advantage is that it is simple, and you only need to log in to the service to obtain the API key. However, it is this simplicity that makes API keys somewhat deficient in terms of security and user experience. Many API keys are sent as part of the URL in the query string, which makes it easy for API keys to be accessed when they should not be accessed. It's people found. And, as developers create tools for themselves, they start sharing them with others. [0004] OAuth is a better ...

AI Technical Summary

Problems solved by technology

The four authorization modes all obtain the access token and refresh token from the authentication server to verify the identity of the accessing user. According to the characteristics of different authorization modes, there are still some security holes

However, JWT uses the Base64 encoding method. Due to the reversibility of the encoding method, the content of the Token issued after encoding can be parsed, resulting in the leakage of transmission information.

Images