User-centered multi-factor authentication method for multi-IDP aggregation

Abstract

A user-centered multi-IDP aggregation-oriented multi-factor authentication method is used for solving the problems of user identity privacy and incapability of realizing multi-IDP expandability, and comprises the following specific steps: a data registration center generates a public parameter and a signature key and a verification key of each identity provider IDP; each identity provider IDP issues identity certificates for different authentication factors of the user and stores the identity certificates in the data registration center; according to an authorization strategy of a service provider (SP), the user obtains a certificate from the data registration center; the user aggregates a plurality of certificates into one certificate; a service provider (SP) verifies authentication factors in credentials using zero-knowledge attestation and bilinear mapping techniques. The method has user non-linkability and non-trackability, reduces the calculation overhead of multi-IDP scene authentication, and can be widely applied to high-security-level identity authentication application systems.

Description

technical field [0001] The invention belongs to the technical field of information security, and further relates to a multi-factor authentication method in the technical field of identity authentication, which is user-centered and oriented to the aggregation of multiple identity providers (IDPs). The present invention relies on the remote server to perform identity authentication on the verifier (terminal user), and can be widely used in identity authentication scenarios of multiple IDP scenarios to handle the relationship between terminal user identity and authentication factors. Background technique [0002] Multi-factor authentication refers to the use of password technology combined with two or more different authentication factors to achieve identity authentication, among which authentication factors are classified into three categories, namely secrets (passwords) that people can remember, devices held by people, smart cards, and long-term passwords. key, etc., as well ...

AI Technical Summary

Problems solved by technology

The present invention adopts a user-centered authentication architecture. The user interacts with the IDP to obtain credentials, interacts with the SP to verify the credentials, and interacts with the data registration center to store and retrieve credentials. Except for the user, the other three entities cannot interact. User-centered The architecture ensures that IDP does not participate in the process of verifying credentials, and cannot track the SP accessed by the user, so as to solve the problem that the SP entrusts IDP authentication, and the IDP can track the SP accessed by the user

Images