Cross-platform identity authentication and authorization method, system, equipment and medium

Abstract

The invention discloses a cross-platform identity authentication and authorization method. The cross-platform identity authentication and authorization method comprises the following steps: S01, logging in an application program of a mobile terminal; s02, the user authorizes the PC client on the mobile device, and the PC client registers a temporary AK / SK to the identity authentication and authorization service through the mobile device; s03, the PC client uses AK / SK to generate JWS as a resource access token to initiate a service request to the service; s04, after the business service receives the business request, the JWS in the request is taken out to verify whether the token valid request and the association relationship are correct or not to the identity authentication and authorization service, and the JWS in the current request is recorded; and S05, after the verification is passed, the business service carries out business processing and records the resource access condition of the current AK. According to the method, the JWS token is dynamically generated and verified in real time, so that the token is effectively prevented from being stolen and reused, high-security cross-platform authorized access is ensured, and the transaction security is improved.

Description

Technical Field

[0001] The present invention relates to the field of information management security technology, and in particular to a cross-platform identity authentication and authorization method, system, device and medium. Background Art

[0002] In the fields of information security, network security, and identity and resource access management, the method commonly used in cross-platform identity authentication and authorization is: the user uses the logged-in application (APP or mini-program) on the mobile device to scan the code, and once the user completes the authorization confirmation on the application interface, the authorization server will immediately issue an authorized access token. During the validity period of the access token, the user can use this token to seamlessly access the authorized resources.

[0003] Although this authentication method is convenient for scanning and authorizing through a logged-in application on a mobile device, it has several significant disadvantages:

[0004] First, this authentication model mainly relies on single-factor authentication, that is, the scanning behavior itself (usually regarded as the user owning and controlling the device), and ignores the importance of multi-factor authentication, which may lead to insufficient security. In complex or high-security environments, relying solely on single-factor authentication may not be enough to fully guarantee the security of resource access;

[0005] Secondly, some authorization servers use the JWT (JSON Web Tokens) format when issuing resource access tokens. Once a token in this format is generated by an authorization server and issued to a user, it is generally considered to be tamper-proof and the authorization server no longer directly manages it. This means that once the token is leaked or used improperly, it will be difficult for the user to directly revoke the access rights authorized based on the scan code through the authorization server, thereby increasing potential security risks.

[0006] To this end, this application specifically proposes a cross-platform identity authentication and authorization method to solve the above technical problems. Summary of the invention

[0007] The main purpose of the present invention is to provide a cross-platform identity authentication and authorization method to solve the technical problems raised in the background technology.

[0008] The present invention adopts the following technical solutions to solve the above technical problems:

[0009] A cross-platform identity authentication and authorization method, based on a PC client, a mobile terminal, an identity authentication and authorization service, and a business service, performs operations, including the following specific steps:

[0010] Step S01: The user logs in on the application of the mobile terminal;

[0011] Step S02: The user authorizes the PC client on the mobile device. The PC client registers a temporary AK / SK with the identity authentication and authorization service through the mobile device. Subsequent service calls use the temporary AK / SK to generate a JWS as a resource access token.

[0012] Step S03: The PC client uses AK / SK to generate JWS as a resource access token to initiate a service request to the business service;

[0013] Step S04: After receiving the business request, the business service takes out the JWS in the request and verifies the validity of the token request and whether the association relationship is correct with the identity authentication and authorization service, and records the JWS in the current request to prevent the JWS from being reused;

[0014] Step S05: After the verification is passed, the business service will perform business processing and record the resource access status of the current AK.

[0015] Preferably, the login authentication method in step S01 is not limited to account password SMS verification, fingerprint recognition, and face recognition.

[0016] Preferably, the specific operation process of the PC client registering a temporary AK / SK with the identity authentication and authorization service in step S02 includes:

[0017] Step S21: The PC client obtains the network MAC address of the machine, generates a random number R, and calculates the SM3 hash value R-SM3 of R, and records the first 16 bytes of R-SM3 as R-SM3-Front, and the last 16 bytes as R-SM3-Back;

[0018] Step S22: The PC client sends MAC||R-SM3-Front and the MAC address to the identity authentication and authorization service, submitting a resource access permission request, where || represents data splicing;

[0019] Step S23: After receiving the request, the identity authentication and authorization service temporarily stores the PC client information, generates a 16-byte random number R2, and returns R2 and related service information to the PC client.

[0020] Step S24: The PC client receives the relevant business information and generates a QR code with R-SM3-Back, and the user scans the QR code using the scanning function of the mobile terminal application.

[0021] Step S25: The user performs authorization confirmation of the application on the mobile terminal that has passed the personal identity login authentication, and after confirming the relevant business information and R-SM3-Back, sends the relevant business information and R-SM3-Back to the identity authentication and authorization service. After the identity authentication and authorization service confirms that the user information is correct, it registers MAC||R-SM3-Front as AK and R2⊕R-SM3-Back as SK, where ⊕ represents an exclusive OR operation;

[0022] Step S26: The PC client queries the identity authentication and authorization service for the user authentication result through the service ID in a polling request manner. After receiving the query request, the identity authentication and authorization service returns the relevant authentication information. After the authentication is successful, the PC client and the identity authentication and authorization service agree that AK is MAC||R-SM3-Front and SK is R2⊕R-SM3-Back.

[0023] Preferably, in step S03, when JWS is used as a resource access token, the signature value is generated using an HMAC algorithm, and the request time, request header, and request content in the request body need to be signed.

[0024] Preferably, when the identity authentication and authorization service verifies the JWS in step S04, it is necessary to perform HMAC operation on the request time, request header, and request content and compare the consistency with the signature value in the JWS. After the comparison is successful, the current JWS is recorded to solve the problem of multiple uses of JWS.

[0025] Preferably, the method further includes step S06: when the number of resource accesses reaches an upper limit or the identity authentication and authorization service returns that AK is expired or the user revokes the authorization to the PC client on the mobile terminal, the PC client needs to re-perform the above-mentioned process of S21 to S26 to register the PC client.

[0026] A cross-platform identity authentication and authorization system, used to execute any of the above cross-platform identity authentication and authorization methods, comprising:

[0027] PC client: used to initiate service requests and receive processing results;

[0028] Mobile terminal: used to initiate requests for user identity authentication and resource access authorization;

[0029] Authentication and authorization service: used to process user authentication and access rights management for PC clients;

[0030] Business service: It is called according to business requests and used to process actual business data;

[0031] When the PC client initiates a service request to call a service service, it must carry a JWS generated based on the registered and verified AK / SK as an authorized access token;

[0032] The JWS ensures that the authorized usage times of the current PC client are still within the valid access period and that the current request is legal and valid.

[0033] Preferably, the system includes the following specific application methods:

[0034] L1. The user logs in using the application on the mobile terminal;

[0035] L2. The user initiates a service request using a PC client. If the current PC client has not been authorized, a QR code will pop up on the PC client screen, requiring the user to perform a secondary identity authentication;

[0036] L3. If a QR code appears, the user uses the app to scan the QR code and complete the face recognition authentication;

[0037] L4. After the user completes the face recognition, the identity authentication and authorization service will register AK / SK for the PC client;

[0038] L5. After completing the PC client authorization, the PC client will use AK / SK to generate JWS locally and submit a service request to the business service with JWS;

[0039] L6. After receiving the business request, the business service will verify the JWS carried in the request with the identity authentication and authorization service.

[0040] L7. Only after the verification is passed will the business service complete the corresponding operation according to the business request and return the business processing result.

[0041] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0042] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0043] It can be seen from the above technical solution that the present invention provides a cross-platform identity authentication and authorization method. Compared with the prior art, the present invention has the following advantages:

[0044] 1. The present invention generates a new JWS as an access token for each service request, and signs and verifies the key information of the request in combination with the HMAC algorithm, which can effectively defend against token interception and replay attacks, ensure the authenticity and uniqueness of each request, and maintain the integrity of authorized communications.

[0045] 2. The present invention realizes dynamic management of access credentials by setting the number of uses and validity period limits of AK / SK, forcing regular re-verification, thereby significantly reducing the risk of long-term valid credentials being stolen and enhancing the security continuity of the system.

[0046] 3. The present invention implements the centralized management of AK / SK of PC clients by identity authentication and authorization services, allowing the immediate revocation of access rights of suspicious or no longer trusted clients, and even adding their MAC addresses to blacklists, which greatly enhances the controllability and security management capabilities of client access.

[0047] 4. The present invention sets a temporary AK / SK mechanism during the interaction between the PC client and the business service, and uses these credentials to generate JWS as a resource access token, which can play a role in dynamic, one-time authorized access control, ensuring that each request carries a strictly encrypted and signed information package, effectively preventing unauthorized access and token reuse attacks.

[0048] 5. The present invention verifies the received JWS in real time through business services and verifies its validity and relevance with the identity authentication and authorization service, which not only strengthens the authenticity and timeliness verification of the request, but also realizes the tracking and recording of AK usage, which helps to monitor and prevent potential abuse, greatly enhances the security and reliability of the cross-platform identity authentication and authorization system, protects user resources from illegal intrusion, and ensures the efficiency and legitimacy of business processing.

[0049] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become easy to understand through the following description. Of course, it is not necessary to achieve all of the advantages described above simultaneously for any product implementing the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0051] Figure 1 It is a schematic diagram of the overall timing of the method of the present invention;

[0052] Figure 2Schematic diagram of the interaction of the system of the present invention. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. In the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0054] In the embodiment, see Figure 1 to Figure 2 .

[0055] like Figure 1 As shown, a cross-platform identity authentication and authorization method proposed in an embodiment of the present invention performs operations based on a PC client, a mobile terminal, an identity authentication and authorization service, and a business service, including the following specific steps:

[0056] Step S01: The user logs in on the application of the mobile terminal;

[0057] The login authentication method is not limited to account password SMS verification, fingerprint recognition, and face recognition. Generally, face recognition is used more frequently. From the perspective of the security of the authorized trusted PC client, the user's face recognition method is used as part of the multi-factor authentication. Since facial recognition relies on the user's physical presence, it is equivalent to adding a biometric layer, which reduces the risk of authorization through stolen devices, thereby improving the security of user use. Therefore, by integrating face recognition in the user authorization process, biometrics, a strong identity authentication method, is added, which effectively ensures the physical presence of the operation, greatly reduces the risk of unauthorized access, improves the account protection level, and ensures the security of user resource access;

[0058] Step S02: The user authorizes the PC client on the mobile device. The PC client registers a temporary AK / SK with the identity authentication and authorization service through the mobile device. Subsequent service calls use the temporary AK / SK to generate a JWS (JSON Web Signature) as a resource access token;

[0059] The specific operation process of the PC client registering a temporary AK / SK with the identity authentication and authorization service includes:

[0060] Step S21: The PC client obtains the network MAC address of the machine, generates a random number R, and calculates the SM3 hash value R-SM3 of R, and records the first 16 bytes of R-SM3 as R-SM3-Front, and the last 16 bytes as R-SM3-Back;

[0061] Step S22: The PC client sends MAC||R-SM3-Front and the MAC address to the identity authentication and authorization service, submitting a resource access permission request, where || represents data splicing;

[0062] Step S23: After receiving the request, the identity authentication and authorization service temporarily stores the PC client information, generates a 16-byte random number R2, and returns R2 and related service information (such as service ID) to the PC client.

[0063] Step S24: The PC client generates a QR code with the received relevant business information (except R2) and R-SM3-Back, and the user scans the QR code using the scanning function of the mobile terminal application.

[0064] Step S25: The user performs authorization confirmation of the application on the mobile terminal that has passed the personal identity login authentication, and after confirming the relevant business information and R-SM3-Back, sends the relevant business information and R-SM3-Back to the identity authentication and authorization service. After the identity authentication and authorization service confirms that the user information is correct, it registers MAC||R-SM3-Front as AK and R2⊕R-SM3-Back as SK, where ⊕ represents an exclusive OR operation;

[0065] Step S26: The PC client queries the identity authentication and authorization service for the user authentication result through the service ID in a polling request mode. After receiving the query request, the identity authentication and authorization service returns the relevant authentication information. After the authentication is successful, the PC client and the identity authentication and authorization service agree that AK is MAC||R-SM3-Front and SK is R2⊕R-SM3-Back.

[0066] Step S03: The PC client uses AK / SK to generate JWS as a resource access token to initiate a service request to the business service;

[0067] From the perspective of the security of using authorization tokens, each time a PC client initiates a service request, it needs to generate a new JWS as a resource access token. When JWS is used as a resource access token, the signature value is generated using the HMAC algorithm, and the request time, request header, and request content in the request body need to be signed.

[0068] Step S04: After receiving the business request, the business service takes out the JWS in the request and verifies the validity of the token request and whether the association relationship is correct with the identity authentication and authorization service, and records the JWS in the current request to prevent the JWS from being reused;

[0069] When the identity authentication and authorization service verifies JWS, it needs to perform HMAC operation on the request time, request header, and request content and compare the consistency with the signature value in JWS. After the comparison is successful, the current JWS is recorded to solve the problem of multiple uses of JWS. The JWS generation and verification operation of the token can reduce the risk of misappropriation by intercepting the authorization code or token;

[0070] Therefore, by generating a new JWS as an access token for each business request, and signing and verifying the key information of the request with the HMAC algorithm, it can effectively defend against token interception and replay attacks, ensure the authenticity and uniqueness of each request, and maintain the integrity of authorized communications. At the same time, by setting a temporary AK / SK mechanism during the interaction between the PC client and the business service, and using these credentials to generate JWS as a resource access token, it can play a role in dynamic, one-time authorized access control, ensuring that each request carries a strictly encrypted and signed information package, effectively preventing unauthorized access and token reuse attacks;

[0071] Step S05: After the verification is passed, the business service will perform business processing and record the resource access status of the current AK;

[0072] At this time, the received JWS is verified in real time through the business service and its validity and relevance are verified with the identity authentication and authorization service. This not only strengthens the authenticity and timeliness verification of the request, but also realizes the tracking and recording of AK usage, which helps to monitor and prevent potential abuse. It greatly enhances the security and reliability of the cross-platform identity authentication and authorization system, protects user resources from illegal intrusion, and ensures the efficiency and legitimacy of business processing.

[0073] Step S06: When the resource access times reaches the upper limit or the identity authentication and authorization service returns that the AK is expired or the user revokes the authorization to the PC client on the mobile terminal, the PC client needs to re-perform the above steps S21 to S26 to register the PC client;

[0074] At this time, the number of times and time of use of AK / SK have upper limits. When either of them exceeds the threshold, re-registration is required. Therefore, by setting the number of times and validity period limits of AK / SK, dynamic management of access credentials is achieved, forcing regular re-verification, thereby significantly reducing the risk of long-term valid credentials being stolen and enhancing the security continuity of the system.

[0075] In summary, this application can effectively prevent the theft and reuse of JWS tokens by dynamically generating JWS tokens and verifying them in real time, ensuring highly secure cross-platform authorized access and improving system protection capabilities and transaction security.

[0076] On the other hand, Figure 2 As shown, the present invention also discloses a cross-platform identity authentication and authorization system, which is used to execute any of the above cross-platform identity authentication and authorization methods as an operating principle. The system structure includes:

[0077] PC client: used to initiate service requests and receive processing results;

[0078] Mobile terminal: used to initiate requests for user identity authentication and resource access authorization;

[0079] Authentication and authorization service: used to process user authentication and access rights management for PC clients;

[0080] Business service: It is called according to business requests and used to process actual business data;

[0081] When a PC client initiates a business request to call a business service, it must carry a JWS generated based on the registered and verified AK / SK as an authorized access token;

[0082] JWS ensures that the authorized usage count of the current PC client is still within the valid access range and that the current request is legal and valid.

[0083] At this time, the AK / SK of the PC client is centrally managed by the identity authentication and authorization service. When the PC client is considered untrustworthy, the AK of the PC client can be deregistered and its network MAC address can be added to the blacklist, which improves the manageability of the PC client.

[0084] In addition, when the user completes the business, he can revoke the authorization of the PC client on the mobile terminal, which solves the problem that the authorization cannot be revoked after the PC client is authorized, and the risk that the subsequent user of the PC client can steal the identity of the previous user to complete the business.

[0085] Therefore, in summary, this application implements AK / SK of PC clients centrally managed by identity authentication and authorization services, allowing the immediate revocation of access rights of suspicious or no longer trusted clients, and even adding their MAC addresses to blacklists, greatly enhancing the controllability and security management capabilities of client access.

[0086] Furthermore, the identity authentication and authorization system includes the following specific usage methods during use:

[0087] L1. The user uses the application on the mobile terminal to log in, and the login authentication method is not limited to account password SMS verification, fingerprint recognition, face recognition, etc.;

[0088] L2. The user initiates a service request using a PC client. If the current PC client has not been authorized, a QR code will pop up on the PC client screen, requiring the user to perform a secondary identity authentication;

[0089] L3. If a QR code appears, the user uses the app to scan the QR code and complete the face recognition authentication;

[0090] L4. After the user completes the face recognition, the identity authentication and authorization service will register AK / SK for the PC client;

[0091] L5. After completing the PC client authorization, the PC client will use AK / SK to generate JWS locally and submit a service request to the business service with JWS;

[0092] L6. After receiving the business request, the business service will verify the JWS carried in the request with the identity authentication and authorization service.

[0093] L7. Only after the verification is passed will the business service complete the corresponding operation according to the business request and return the business processing result.

[0094] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0095] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0096] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any cross-platform identity authentication and authorization method in the above embodiments.

[0097] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

[0098] The embodiment of the present application also provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus.

[0099] Memory, used to store computer programs;

[0100] The processor is used to implement the above-mentioned cross-platform identity authentication and authorization method when executing the program stored in the memory.

[0101] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0102] The communication interface is used for communication between the above electronic device and other devices.

[0103] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0104] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0105] It should also be noted that the electronic equipment also includes terminal equipment, which can also be called terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc. The terminal equipment can be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal equipment, an augmented reality (AR) terminal equipment, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

[0106] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive So lid State Dis sk (SSD)), etc.

[0107] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

[0108] In addition, it should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components in a certain specific posture. If the specific posture changes, the directional indication will also change accordingly.

[0109] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the meaning of "and / or" appearing in the full text includes three parallel schemes. Taking "A and / or B" as an example, it includes scheme A, or scheme B, or schemes that A and B meet at the same time. In addition, in the embodiments of the present invention, "multiple" refers to more than two. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

Claims

1. A cross-platform identity authentication and authorization method, based on PC client, mobile terminal, identity authentication and authorization service and business service execution operation, characterized in that: The specific steps include: Step S01: The user logs in on the application of the mobile terminal; Step S02: The user authorizes the PC client on the mobile device. The PC client registers a temporary AK / SK with the identity authentication and authorization service through the mobile device. Subsequent service calls use the temporary AK / SK to generate a JWS as a resource access token. Step S03: The PC client uses AK / SK to generate JWS as a resource access token to initiate a service request to the business service; Step S04: After receiving the business request, the business service takes out the JWS in the request and verifies the token validity request and whether the association relationship is correct with the identity authentication and authorization service, and records the JWS in the current request to prevent the JWS from being reused; Step S05: After the verification is passed, the business service will perform business processing and record the resource access status of the current AK.

2. The cross-platform identity authentication and authorization method according to claim 1, characterized in that: The login authentication method in step S01 is not limited to account password SMS verification, fingerprint recognition, and face recognition.

3. The cross-platform identity authentication and authorization method according to claim 1, characterized in that: The specific operation process of the PC client registering a temporary AK / SK with the identity authentication and authorization service in step S02 includes: Step S21: The PC client obtains the network MAC address of the machine, generates a random number R, and calculates the SM3 hash value R-SM3 of R, and records the first 16 bytes of R-SM3 as R-SM3-Front, and the last 16 bytes as R-SM3-Back; Step S22: The PC client sends MAC||R-SM3-Front and the MAC address to the identity authentication and authorization service, submitting a resource access permission request, where || represents data splicing; Step S23: After receiving the request, the identity authentication and authorization service temporarily stores the PC client information, generates a 16-byte random number R2, and returns R2 and related service information to the PC client. Step S24: The PC client receives the relevant business information and generates a QR code with R-SM3-Back, and the user scans the QR code using the scanning function of the mobile terminal application. Step S25: The user performs authorization confirmation of the application on the mobile terminal that has passed the personal identity login authentication, and after confirming the relevant business information and R-SM3-Back, sends the relevant business information and R-SM3-Back to the identity authentication and authorization service. After the identity authentication and authorization service confirms that the user information is correct, it registers MAC||R-SM3-Front as AK and R2⊕R-SM3-Back as SK, where ⊕ represents an exclusive OR operation; Step S26: The PC client queries the identity authentication and authorization service for the user authentication result through the service ID in a polling request manner. After receiving the query request, the identity authentication and authorization service returns the relevant authentication information. After the authentication is successful, the PC client and the identity authentication and authorization service agree that AK is MAC||R-SM3-Front and SK is R2⊕R-SM3-Back.

4. The cross-platform identity authentication and authorization method according to claim 3, characterized in that: The method further includes step S06: when the resource access times reaches the upper limit or the identity authentication and authorization service returns that the AK is expired or the user revokes the authorization to the PC client on the mobile terminal, the PC client needs to re-perform the process of steps S21 to S26 to register the PC client.

5. The cross-platform identity authentication and authorization method according to claim 1, characterized in that: In step S03, when JWS is used as a resource access token, the signature value is generated using the HMAC algorithm, and the request time, request header, and request content in the request body need to be signed.

6. The cross-platform identity authentication and authorization method according to claim 5, characterized in that: In step S04, when the identity authentication and authorization service verifies the JWS, it needs to perform HMAC operation on the request time, request header, and request content and compare the consistency with the signature value in the JWS. After the comparison is successful, the current JWS is recorded to solve the problem of multiple uses of JWS.

7. A cross-platform identity authentication and authorization system, characterized in that: The cross-platform identity authentication and authorization method used to execute any one of claims 1 to 6 above comprises: PC client: used to initiate service requests and receive processing results; Mobile terminal: used to initiate requests for user identity authentication and resource access authorization; Authentication and authorization service: used to process user authentication and access rights management for PC clients; Business service: It is called according to business requests and used to process actual business data; When the PC client initiates a service request to call a service service, it must carry a JWS generated based on the registered and verified AK / SK as an authorized access token; The JWS ensures that the authorized usage times of the current PC client are still within the valid access period and that the current request is legal and valid.

8. The cross-platform identity authentication and authorization system according to claim 7, characterized in that: Including the following specific usage methods: L1. The user logs in using the application on the mobile terminal; L2. The user initiates a service request using a PC client. If the current PC client has not been authorized, a QR code will pop up on the PC client screen, requiring the user to perform a secondary identity authentication; L3. If a QR code appears, the user uses the app to scan the QR code and complete the face recognition authentication; L4. After the user completes the face recognition, the identity authentication and authorization service will register AK / SK for the PC client; L5. After completing the PC client authorization, the PC client will use AK / SK to generate JWS locally and submit a service request to the business service with JWS; L6. After receiving the business request, the business service will verify the JWS carried in the request with the identity authentication and authorization service. L7. Only after the verification is passed will the business service complete the corresponding operation according to the business request and return the business processing result.

9. A computer-readable storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a processor, the processor is caused to execute the steps of the method according to any one of claims 1 to 6.

10. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 6.

Images