Single sign-on method and system for shared terminal equipment

Abstract

The invention relates to the field of network communication, and provides a single sign-on method and system for shared terminal equipment. The method comprises the following steps: performing security packaging on first equipment identity data of terminal equipment through a national secret encryption algorithm to generate a dynamic authentication code; identifying and analyzing the dynamic authentication code through a user side application, executing password-free verification on the identity of the user side, and establishing secure binding between the terminal equipment and the identity of the user; reporting second equipment identity data of the terminal equipment to a cloud authority control center, and constructing a network environment feature library; when it is detected that the network environment feature change exceeds a preset security threshold, performing multi-factor identity authentication on the identity of the user side; and when the verification is passed, embedding the session security identifier into the transmission protocol extension field through the gateway service, and establishing an end-to-end trusted transmission link. According to the invention, the convenience of single sign-on is improved, and the user experience and safety are improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network communication, and particularly relates to a single sign-on method and system for a shared terminal device. BACKGROUND

[0002] With the rapid development of smart home ecology, shared smart devices, such as screen-equipped sound boxes, are gradually changing from simple voice assistants to full-house smart central control devices, and are playing an increasingly important role as user interaction portals in shared scenarios. Existing screen-equipped sound box login authentication schemes mainly use two-dimensional code scanning binding, face recognition, or voiceprint recognition techniques. Among them, the two-dimensional code scanning scheme displays a static or dynamic two-dimensional code on the screen of the sound box, and the user completes device binding and identity authentication by scanning the code using a mobile application; the face recognition scheme relies on a 2D camera built into the sound box to capture user facial images, and performs identity comparison through cloud or local algorithms; the voiceprint recognition scheme matches and verifies the user's voice features with the pre-registered user voiceprint template. These technologies to some extent solve the identity authentication needs of smart sound boxes and provide users with a variety of login method choices.

[0003] However, the existing technical solutions have significant shortcomings in shared environment applications. First, the traditional two-dimensional code scanning requires users to perform a complex operation process, which has a high operation threshold for user groups with weak operation ability, and static two-dimensional codes lack anti-replay and anti-forgery mechanisms, posing a security risk; second, face recognition based on a 2D camera is easily deceived by high-definition photos, video playback, or even 3D printed masks, and lacks effective liveness detection capabilities; third, existing voiceprint recognition schemes almost entirely rely on cloud inference, resulting in extremely high recognition delays in weak network environments, and there is a risk of privacy leakage due to the transmission of voice data in plaintext; in addition, the home broadband export IP is dynamically allocated by the operator, and the public network address of a user may be completely different at different time periods and in different network environments, and the existing system cannot sense network environment changes in real time, resulting in a serious security vulnerability as the issued authentication tokens may be maliciously used for cross-network attacks. SUMMARY

[0004] In view of the shortcomings of the above existing technologies, the purpose of the present application is to provide a single sign-on method and system for a shared terminal device.

[0005] The present application provides a single sign-on method for a shared terminal device, comprising the following steps:

[0006] S1: securely packaging the first device identity data of the terminal device through a national encryption algorithm to generate a dynamic authentication code;

[0007] S2: The user terminal application identifies and parses the dynamic authentication code, calls a unified identity authentication interface to perform a password-free verification on the user terminal identity, establishes a secure binding between the terminal device and the user identity, and obtains a first verification identifier;

[0008] S3: The second device identity data of the terminal device is reported to a cloud permission control center, and a multi-dimensional network environment feature mapping library is constructed;

[0009] S4: When it is detected that the network environment feature change in the multi-dimensional network environment feature mapping library exceeds a preset security threshold, multi-factor identity authentication is performed on the user terminal identity, and a second verification identifier is obtained;

[0010] S5: When the first verification identifier and the second verification identifier are both passed, a session security identifier is embedded into a transmission protocol extension field through a gateway service, an end-to-end trusted transmission link is established, and single sign-on of the shared terminal device is completed.

[0011] According to the single sign-on method for the shared terminal device provided by the application, the first device identity data in step S1 includes device identity identification information, a random check code, a time control parameter and digital signature data;

[0012] The second device identity data in step S3 includes a public network exit address, an autonomous domain identifier and geographic location data.

[0013] According to the single sign-on method for the shared terminal device provided by the application, step S1 further includes:

[0014] S11: A random check code is generated by a hardware random number generator;

[0015] S12: The device identity identification information and the terminal hardware fingerprint are subjected to a hash operation to obtain a unique device identity digest;

[0016] S13: The unique device identity digest is encrypted using an SM4 key to obtain an encrypted identity identifier;

[0017] S14: The encrypted identity identifier, the random check code, the time control parameter and the current timestamp are combined to generate anti-forgery digital signature data by an RSA-SM2 algorithm;

[0018] S15: The encrypted identity identifier, the random check code, the time control parameter and the digital signature data are encapsulated to generate a dynamic authentication code.

[0019] According to the single sign-on method for the shared terminal device provided by the application, step S2 further includes:

[0020] S21: The user terminal application identifies and obtains the dynamic authentication code in TLV format, and extracts the parsed digital signature data in the dynamic authentication code;

[0021] S22: The parsed digital signature data is verified by RSA-SM2 using the preset public key, and an authentication code verification result is obtained;

[0022] S23: The session identifier is parsed from the authentication code verification result, and the unified identity authentication SDK is called to obtain the access token by calling the password-free login interface;

[0023] S24: The HMAC binding credential is generated according to the user identifier and the session identifier in the access token;

[0024] S25: The HMAC binding credential is sent to the device management platform, and the terminal device and the user identity are securely bound and associated in the database, and a one-time verification identifier is obtained.

[0025] According to the single sign-on method for sharing terminal equipment provided by the application, step S3 further comprises:

[0026] S31: Obtain the public network exit address of the NAT converted terminal equipment;

[0027] S32: The public network exit address is used as a query condition to query the autonomous domain system number by using the BGP routing information base, and an autonomous domain identifier is obtained;

[0028] S33: Based on the public network exit address, the network coordinate position information is calculated by the geographic location database, and the geographic location data is obtained;

[0029] S34: The public network exit address after the mask desensitization, the autonomous domain identifier and the geographic location data are combined to form a network feature vector;

[0030] S35: The network feature vector is reported to the cloud authority control center, and the multi-dimensional network environment feature mapping library is updated.

[0031] According to the single sign-on method for sharing terminal equipment provided by the application, step S4 further comprises:

[0032] S41: Obtain the network exit address of the current login request of the terminal equipment, and calculate the geographic offset distance between the network exit address and the historically bound public network exit address, to obtain the geographic offset distance;

[0033] S42: Based on the network exit address, the autonomous domain information is queried, and the historical autonomous domain identifier in the multi-dimensional network environment feature mapping library is compared, to obtain an autonomous domain information comparison result;

[0034] S43: generating an environment exception identifier when the geographic offset distance exceeds a safety threshold or the autonomous domain information comparison result is inconsistent;

[0035] S44: performing identity verification on the user terminal identity based on a multi-factor identity authentication mechanism according to the environment exception identifier, and obtaining a secondary verification identifier.

[0036] According to the single sign-on method for a shared terminal device provided by the application, the multi-factor identity authentication mechanism in step S44 includes biometric recognition and secondary identity verification.

[0037] According to the single sign-on method for a shared terminal device provided by the application, when the multi-factor identity authentication mechanism is biometric recognition, step S44 further includes:

[0038] S441: collecting a user voice signal and performing preprocessing to obtain original voice data;

[0039] S442: performing energy threshold detection on the original voice data to obtain valid voice data;

[0040] S443: calculating a spectral flatness parameter of the valid voice data, determining biometric authenticity through a flatness threshold, and obtaining real voice data;

[0041] S444: inputting the real voice data into a local quantized voiceprint recognition model to extract a voice feature vector;

[0042] S445: performing similarity calculation on the voice feature vector and a pre-stored user biometric template to perform secondary identity verification on the user terminal identity, and obtaining a secondary verification identifier.

[0043] According to the single sign-on method for a shared terminal device provided by the application, step S5 further includes:

[0044] S51: generating a session key based on the secondary verification identifier;

[0045] S52: performing digest calculation on the session key and a user session identifier using an HMAC-SM3 algorithm to obtain a session security identifier;

[0046] S53: embedding the session security identifier in an extension field of a TCP data packet to obtain an extension data packet;

[0047] S54: after receiving the extension data packet, extracting the session security identifier from the extension field of the extension data packet for validity verification, and establishing a full-link trusted transmission channel based on the validity verification result.

[0048] The application further provides a single sign-on system for a shared terminal device, comprising:

[0049] a security packaging module and a data reporting module arranged in the terminal device, an authentication processing module arranged in the user end, and a permission control and gateway module arranged in the cloud end;

[0050] The security packaging module is used for securely packaging the first device identity data of the terminal device through a national encryption algorithm to generate a dynamic authentication code.

[0051] The authentication processing module is used for identifying and analyzing the dynamic authentication code, calling a unified identity authentication interface to perform a password-free verification on the user end identity, establishing a secure binding between the terminal device and the user identity, and obtaining a one-time verification identifier.

[0052] The data reporting module is used for reporting the second device identity data to the permission control center of the cloud end.

[0053] The permission control and gateway module comprises:

[0054] The permission control center is used for receiving the second device identity data reported by the terminal device to construct a multi-dimensional network environment feature mapping library; when detecting that a network environment feature change in the multi-dimensional network environment feature mapping library exceeds a preset security threshold, triggering a multi-factor identity authentication on the user end identity to obtain a two-time verification identifier.

[0055] The gateway service unit is used for embedding a session security identifier into a transmission protocol extension field when the one-time verification identifier and the two-time verification identifier are both passed, establishing an end-to-end trusted transmission link to complete the single sign-on of the shared terminal device.

[0056] The application has the following beneficial effects:

[0057] The application provides a single sign-on method and system for shared terminal equipment, which significantly improves the security and attack prevention capability of the device binding process by using the technical means of generating a dynamic authentication code through the safe packaging of device identity information, random check code, time control parameter and digital signature data by a national secret encryption algorithm, effectively preventing the security risks of traditional static two-dimensional codes being easily forged and subject to replay attacks, so that malicious users cannot perform illegal device binding by intercepting or copying the authentication code, and the security of user accounts and devices is fundamentally guaranteed; secondly, the dynamic authentication code is identified and analyzed by a mobile terminal application, and the password-free verification process of the unified identity authentication interface greatly simplifies the user operation steps, shortens the completion time of the complex binding process which originally requires multiple interactive confirmations, and provides significant convenience improvement for the user group with weak operation ability, and truly realizes the zero threshold device use experience; subsequently, the network exit address, autonomous domain identifier and geographic location information are reported to the sound box terminal to build a multi-dimensional network environment feature mapping library, which provides real-time network environment perception capability for the system, and can complete network anomaly detection in a short time; compared with the traditional scheme which only relies on the change of a single IP address to determine, the application reduces the false positive rate through the geographic location and autonomous domain double threshold mechanism, greatly improves the accuracy and reliability of anomaly detection; and then when the network environment feature changes exceed the safety threshold, the multi-factor identity authentication mechanism is started, which not only shortens the voiceprint recognition delay from the traditional cloud scheme time, improves the fluency of user experience, and more importantly, the voice feature data is completely processed locally, completely eliminating the risk of interception and leakage of sensitive biological feature information in the network transmission process, providing a solid guarantee for user privacy security; finally, after verification, the gateway service embeds the session security identifier into the transmission protocol extension field to establish an end-to-end trusted transmission link, realizing the full-link security protection from identity authentication to business access, so that even in a complex network attack environment, the user's business data transmission can still maintain a high degree of security and integrity, effectively resisting various network security threats such as man-in-the-middle attacks and session hijacking, and laying a solid foundation for the safe application of smart home devices in a shared environment. BRIEF DESCRIPTION OF DRAWINGS

[0058] The accompanying drawings are included to provide a further understanding of embodiments of the application, and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments of the application and, together with the description, serve to explain the principles of the application. In the drawings:

[0059] Figure 1 A single sign-on process schematic diagram for shared terminal equipment is provided for the embodiments of the application.

[0060] Figure 2 A single sign-on system structure diagram for sharing terminal devices is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order for those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions of the present application will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. It should be understood that these descriptions are only exemplary, and are not intended to limit the scope of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work should fall within the scope of protection of the present application.

[0062] In addition, in the following description, the description of well-known structures and techniques is omitted to avoid unnecessary confusion of the concepts disclosed in the present application.

[0063] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the orientation or positional relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, the terms "first", "second", "third" are only for description purposes and cannot be understood as indicating or implying relative importance. The terms "mounting", "connection", "connection" should be understood broadly, for example, it can be fixed connection, or detachable connection, or integrally connected; it can be mechanical connection, or electrical connection; it can be directly connected, or indirectly connected through intermediate medium, or the communication between two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0064] The exemplary embodiments will be described in detail hereinbelow with reference to the accompanying drawings. In the following description, the same numbers refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments are not meant to represent all implementations consistent with the present application. Rather, they are merely examples that can be consistent with some aspects of the present application, as detailed in the appended claims.

[0065] The embodiments of the present application will be described below in conjunction with the drawings.

[0066] In this embodiment, a smart speaker with screen is described as a terminal device.

[0067] As Figure 1 shown, the application provides a single sign-on method for sharing terminal devices, comprising:

[0068] S1: securely package the first device identity data of the terminal device through the national encryption algorithm to generate a dynamic authentication code.

[0069] Among them, the first device identity data in step S1 includes: device identity identification information, random check code, time control parameter and digital signature data.

[0070] Among them, step S1 further comprises:

[0071] S11: generate a random check code through a hardware random number generator.

[0072] In step S11, first, the application generates a 16-byte (128-bit) random check code through a hardware random number generator built into the sound box terminal using a true random number generation mechanism by collecting physical entropy sources such as internal thermal noise and clock jitter, and processing through an entropy extraction algorithm. The generated random check code is stored in binary format, ensuring that the generated check code has unpredictable and unique features.

[0073] S12: Hash the device identity identification information and the terminal hardware fingerprint to obtain a unique device identity digest.

[0074] In step S12, the application first extracts the CTEI device identity of the sound box terminal, CTEI is the intelligent sound box ecosystem identifier, and obtains the terminal hardware fingerprint information, including device MAC address, serial number SN, firmware version number and other hardware feature data; subsequently, the application concatenates the CTEI identifier and the hardware fingerprint information, the complete string after concatenation is used as the input data of the SHA-256 hash algorithm, the hash algorithm performs 256-bit digest calculation on the input string, and outputs a unique device identity digest, which is obtained as the unique identifier of the terminal device in the system.

[0075] S13: encrypt the unique device identity digest using SM4 key to obtain an encrypted identity identifier.

[0076] In step S13, the application uses the SM4 symmetric encryption key pre-stored in the EAL4+ level secure chip of the sound box to input the device identity digest generated in step S12 as plaintext, and performs encryption processing through the SM4 encryption algorithm. Specifically, the SM4 algorithm uses a 128-bit packet length, divides the input 32-byte data into two 128-bit packets for encryption operation, and outputs 128-bit ciphertext packets after each packet is transformed through 32 rounds of round function transformation. The two ciphertext packets are combined to form 32-byte encrypted identity identification data, which is the ciphertext representation of the device identity.

[0077] S14: Combine the encrypted identity identification, the random check code, the time-to-live control parameter, and the current timestamp to generate anti-forgery digital signature data through the RSA-SM2 algorithm.

[0078] In step S14, the application combines the encrypted identity identification obtained in step S13, the random check code generated in step S11, the time-to-live control parameter (TTL = 300 seconds, represented in Unix timestamp format), and the current timestamp in a fixed order to form a data block to be signed. Subsequently, the application calls the pre-stored RSA-SM2 private key in the sound box security chip and performs digital signature operation through the PKCS#11 interface. The RSA-SM2 signature algorithm first performs SM3 hash operation on the data to be signed to obtain a 32-byte digest value, and then performs modular exponentiation operation on the digest value using the private key to finally generate digital signature data.

[0079] S15: Encapsulate the encrypted identity identification, the random check code, the time-to-live control parameter, and the digital signature data to generate a dynamic authentication code.

[0080] In step S15, the application encapsulates the encrypted identity identification generated in step S13, the random check code generated in step S11, the time-to-live control parameter, and the digital signature data generated in step S14 in TLV (Type-Length-Value) format. The four data blocks are encapsulated as independent TLV structures, and finally combined into a dynamic authentication code data packet. For this data packet, the application also converts it to Base64 encoding format to generate a displayable dynamic authentication code string, which is presented in the form of a two-dimensional code on the sound box screen.

[0081] S2: Identify and analyze the dynamic authentication code through the user terminal application, and call the unified identity authentication interface to perform password-free verification on the user terminal identity, establish secure binding between the terminal device and the user identity, and obtain a one-time verification identifier.

[0082] Wherein, step S2 further comprises:

[0083] S21: The user terminal application identifies and obtains the dynamic authentication code in TLV format analysis, and extracts the analysis digital signature data in the dynamic authentication code.

[0084] In step S21, the user first acquires the two-dimensional code image displayed on the screen of the sound box through the camera of the user terminal application, obtains the dynamic authentication code string after decoding by image recognition algorithm, and then performs Base64 decoding processing on the string to restore it to a binary data packet. Subsequently, the binary data packet is parsed according to the TLV format specification. First, the Type field of the first 2 bytes is read to determine the data type, then the Length field of the last 2 bytes is read to determine the data length, and finally the corresponding Value data is extracted according to the length value. By sequentially analyzing the four TLV structures, the encrypted identity identifier, random check code, time control parameter and analysis digital signature data are finally extracted.

[0085] S22: Using the pre-set public key to verify the analysis digital signature data, obtaining the authentication code verification result.

[0086] In step S22, the RSA-SM2 public key pre-set in the user terminal application is used to verify the analysis digital signature data extracted in step S21. The public key is used in pairs with the sound box terminal private key. Specifically, the encrypted identity identifier, random check code, time control parameter and timestamp are recombined into a verification data block, and then the SM3 hash operation is performed on the data block to obtain the digest value. Subsequently, the public key is used to perform modular inverse operation on the 64-byte signature data to obtain the original digest value at the time of signing. Finally, the calculated digest value and the digest value obtained by inverse operation are compared byte by byte. If they are completely identical, the authentication code verification result is passed; if there is any difference, the verification fails.

[0087] S23: From the authentication code verification result, the session identifier is parsed from the authentication code, and the unified identity authentication SDK is called to call the password-free login interface to obtain the access token.

[0088] Further, when the authentication code verification result in step S22 is passed, the session identifier field is extracted from the TLV data parsed in step S21 as the unique identifier of the current binding session. Subsequently, the password-free login interface ssoSilentLogin() in the unified identity authentication SDK is called, and the session identifier is passed as an input parameter to the interface function. The SDK internally sends a login request to the corresponding server through the HTTPS protocol, and the request body contains authentication information such as session identifier, application identifier and device fingerprint. The server verifies the legality of the request and returns response data containing user identifier, access token and expiration time. Finally, the user terminal receives the access token returned by the server, which contains user identity information and permission range.

[0089] S24: generating an HMAC binding credential according to the user identifier and the session identifier in the access token.

[0090] In step S24, the application first parses the user identifier field and the session identifier field from the JWT format access token obtained in step S23, concatenates the data therein into a string to form binding data, and then performs an HMAC-SHA256 operation on the 40-byte binding data using a preset HMAC key to finally output an HMAC binding credential.

[0091] S25: sending the HMAC binding credential to the device management platform, establishing a secure binding and association record of the terminal device and the user identity in the database, and obtaining a one-time verification identifier.

[0092] Further, in step S25, the application first constructs a binding request data packet containing the HMAC binding credential, the user identifier, the session identifier, and the current timestamp, and then sends the data packet to the / device / bind interface of the device management platform through the HTTPS protocol. After receiving the request, the device management platform first verifies the validity of the HMAC binding credential, recalculates the user identifier, the session identifier, and the random check code using the same HMAC key and algorithm, compares the calculation result with the received binding credential for verification, and after verification, the device management platform inserts a new record in the device_user_binding table of the MySQL database, which contains device hash value, user identifier, binding timestamp, and permission level fields. After all database operations are completed, the platform generates a one-time verification identifier as a unique identifier for this binding operation, which is returned to the user terminal application through an HTTP response.

[0093] S3: reporting the second device identity data of the terminal device to the cloud authority control center to build a multi-dimensional network environment feature mapping library.

[0094] Among them, the second device identity data in step S3 includes public network exit address, autonomous domain identifier and geographic location data.

[0095] Among them, step S3 further includes:

[0096] S31: obtaining the public network exit address of the terminal device after NAT conversion; S32: using the public network exit address as a query condition, querying the autonomous domain system number using the BGP routing information base to obtain the autonomous domain identifier; S33: based on the public network exit address, calculating the network coordinate position information through the geographic location database to obtain the geographic location data.

[0097] Further, in steps S31 to S33, the sound box terminal first sends a GET request to an external IP detection service through the built-in HTTP client module, and the service returns the real public network exit address of the sound box after NAT gateway conversion; then the cloud authority control center takes the public network exit address as a query condition to access the BGP routing information base to perform an autonomous domain query operation, and the BGP routing information base maintains a mapping relationship between global IP address segments and autonomous system numbers. The application locates the network segment to which the target IP address belongs in the routing table through a binary search algorithm, and extracts the corresponding ASN (autonomous system number). At the same time, the application calls the MaxMind GeoIP2 geographic location database interface to perform geographic coordinate query with the public network exit address as an input parameter. The GeoIP2 database returns a geographic location data structure containing longitude, latitude, city ID and country code through an IP address prefix matching algorithm. The longitude and latitude data are stored in IEEE 754 double-precision floating-point format.

[0098] S34: Form a network feature vector with the public network exit address after mask desensitization, the autonomous domain identifier, and the geographic location data.

[0099] Further, in step S34, the application performs a / 24 subnet mask desensitization process on the public network exit address obtained in step S31, sets the last 8 bits of the IP address to 0 to form a network segment identifier, and then combines the desensitized 24-bit network segment identifier, the autonomous domain number AS4134 obtained in step S32, and the geographic coordinate data obtained in step S33 in fixed byte order to form a multi-dimensional network feature vector containing network layer identifier, autonomous domain layer identifier, and geographic layer identifier.

[0100] S35: Report the network feature vector to the cloud authority control center and update the multi-dimensional network environment feature mapping library.

[0101] In step S35, the application encapsulates the network feature vector together with the CTEI identifier of the sound box device and the current Unix timestamp into a JSON format data packet. The obtained data packet structure contains CTEI identifier, desensitized IP address, autonomous domain number, geographic coordinates, and timestamp. Subsequently, the JSON data packet is sent to the / network / report interface of the cloud authority control center through the HTTPS protocol. After receiving the data packet, the cloud authority control center establishes a key-value pair mapping relationship in the Redis in-memory database with the CTEI identifier as the primary key and the network feature vector as the value, thereby constructing a multi-dimensional network environment feature mapping library.

[0102] S4: When it is detected that the network environment feature change in the multi-dimensional network environment feature mapping library exceeds a preset security threshold, multi-factor identity authentication is performed on the user end identity to obtain a secondary verification identifier.

[0103] In step S4, further comprising:

[0104] S41: Obtain the network exit address of the current login request of the terminal device, and calculate the geographical offset distance between the network exit address and the historically bound public network exit address to obtain the geographical offset distance; S42: Query the autonomous domain information based on the network exit address, and compare the autonomous domain information with the historical autonomous domain identifier in the multi-dimensional network environment feature mapping library to obtain an autonomous domain information comparison result; and S43: When the geographical offset distance exceeds a security threshold or the autonomous domain information comparison result is inconsistent, generate an environment abnormal identifier.

[0105] In steps S41-S43, after the cloud permission control center receives the service login request initiated by the sound box terminal, the real IP address of the client is first extracted from the HTTP request header, which is the current network exit address of the sound box, then the desensitized public network exit address and geographic coordinate information in the historical bound network feature vector are extracted from the Redis mapping library according to the CTEI identifier, and then the geographic distance calculation module is called, the Haversine spherical distance calculation is used, the geographic coordinates corresponding to the current network exit address and the geographic coordinates of the historically bound address are used as input parameters, the latitude and longitude are converted from degrees to radian values, the latitude difference and longitude difference between the two points are calculated, the spherical angle distance is obtained through the sine and cosine trigonometric function operation, and finally the actual geographical offset distance is obtained by multiplying the earth's radius. At the same time, the current autonomous domain number is obtained by performing BGP routing query on the current network exit address, and numerical comparison is performed with the historical autonomous domain number stored in the mapping library. When the geographical offset distance exceeds the preset 50km security threshold or the autonomous domain number changes in value, the environment abnormal identifier is generated, and the UUID format is used to mark the abnormal event.

[0106] S44: According to the environment abnormal identifier, identity verification based on a multi-factor identity authentication mechanism is performed on the user end identity to obtain a secondary verification identifier.

[0107] In step S44, after the cloud permission control center receives the environment abnormal identifier, an HTTP 401 status code and an error_code="IP_DRIFT" error response are returned to the sound box terminal. After the sound box terminal parses the error response, a multi-factor identity authentication option menu is displayed on the screen interface, including voiceprint recognition, face recognition and SIM card scanning. When the user selects an authentication method, the sound box terminal starts the authentication process, and finally generates a session identifier as the unique identifier for this secondary authentication.

[0108] wherein the multi-factor identity authentication mechanism in step S44 comprises biometric recognition and secondary identity verification.

[0109] wherein when the multi-factor identity authentication mechanism is biometric recognition, step S44 further comprises:

[0110] S441: Collecting user voice signals and performing preprocessing to obtain raw voice data.

[0111] When the selected authentication method is voiceprint recognition, the sound box terminal activates the built-in microphone array to start collecting user voice signals. The microphone array continuously collects 1 second of audio signals to generate raw voice data of multiple sampling points. After collection, the application also performs pre-emphasis filtering processing on the raw audio data, using a high-pass filter to attenuate low-frequency noise components. The filter coefficient is set to 0.97. The processed voice data is used as the input for subsequent analysis.

[0112] S442: Energy threshold detection is performed on the raw voice data to obtain valid voice data.

[0113] In step S442, the application performs frame segmentation on the preprocessed voice data, with each frame length set to 25 milliseconds corresponding to 400 sampling points, and the frame shift set to 10 milliseconds corresponding to 160 sampling points. The 1 second of voice is segmented into 100 frames of data. Subsequently, the application calculates the short-time energy value of each frame of voice, using a window function to perform weighted summation operation on each frame of 400 sampling points to obtain the energy value of that frame. After calculation, the application sets the energy threshold to 10 decibels, corresponding to a linear energy value of 3.16. Then, based on the energy value, the calculated energy value is compared with the set threshold frame by frame to filter out the valid voice frames with energy values greater than the threshold, and to filter out the silent segments and low-energy noise segments. The filtered valid voice frames are recombined into valid voice data.

[0114] S443: Calculating the spectral flatness parameter of the valid voice data to determine the authenticity of the biometric feature through a flatness threshold to obtain true voice data.

[0115] Further, in step S443, the application performs Fast Fourier Transform on the valid voice data to convert the time-domain signal into a frequency-domain spectrum. After FFT transformation, a complex spectrum is obtained. Then, the amplitude spectrum of each frequency point is calculated to form a spectral amplitude array. Subsequently, the application uses the ratio of the geometric mean value to the arithmetic mean value as a measure of flatness. The geometric mean value is calculated by taking the logarithm of all frequency point amplitudes, averaging, and then taking the exponential. The arithmetic mean value is the direct average of all frequency point amplitudes.

[0116] After calculating the spectral flatness parameter, the application compares the calculated spectral flatness value with the preset threshold value 0.3, and when the flatness is less than 0.3, it is determined that the synthesized speech attack is rejected for subsequent processing, and when the flatness is greater than or equal to 0.3, it is confirmed that the real speech data is continued for subsequent feature extraction process.

[0117] S444: input the real speech data into the local quantized voiceprint recognition model to extract the obtained speech feature vector.

[0118] In step S444, the application inputs the confirmed real speech data into the locally deployed Sherpa voiceprint recognition model, which uses INT8 quantization technology and uses MNN inference framework for local inference calculation. The Sherpa model uses a VGG-like deep convolutional neural network architecture inside, extracts deep feature representations of speech through multiple layers of convolution and pooling, and finally outputs a 128-dimensional feature vector. After output, the application uses the model output floating point vector as the user's voiceprint feature representation, which contains the personalized feature information of the user's speech.

[0119] S445: calculate the similarity between the speech feature vector and the pre-stored user biological template, perform secondary identity verification on the user terminal identity, and obtain a secondary verification identifier.

[0120] In step S445, the application uploads the speech feature vector extracted in step S444 to the cloud permission control center through an encrypted channel. The cloud permission control center queries the user's pre-registered voiceprint template from the user biological template database, then calculates the cosine similarity between the current feature vector and the template vector, and then compares the calculated similarity value with the preset recognition threshold 0.85. When the similarity is greater than the threshold, it is confirmed that the user identity matches successfully. When the identity verification is passed, a secondary verification identifier is generated, which uses UUID format as the credential identifier for this authentication success.

[0121] S5: when the primary verification identifier and the secondary verification identifier are both passed, embed the session security identifier into the transmission protocol extension field through the gateway service to establish an end-to-end trusted transmission link to complete the single sign-on of the shared terminal device.

[0122] Wherein, step S5 further comprises:

[0123] S51: generate a session key based on the secondary verification identifier.

[0124] Further, the cloud permission control center verifies that the first verification identifier and the second verification identifier are both in a pass state, and then initiates a session key generation process. The application uses an encrypted secure pseudo-random number generator, combines the current system timestamp, the user identifier and the device CTEI as an entropy source, and generates a session key. The generated session key is used as the symmetric encryption key for the current login session. After the key is generated, the key is securely distributed between the cloud and the gateway service.

[0125] S52: The session key and the user session identifier are subjected to digest calculation using the HMAC-SM3 algorithm to obtain a session security identifier.

[0126] Further, in step S52, the application obtains the user session identifier established in step S23, then concatenates the session key and the user session identifier in byte sequence to form input data, and then performs message authentication code calculation on the input data using the HMAC-SM3 algorithm. The HMAC algorithm uses a pre-shared HMAC key as the authentication key. In the HMAC-SM3 calculation process, the HMAC key is first subjected to XOR operation with a fixed inner padding value, then concatenated with the input data to perform SM3 hash calculation to obtain an inner digest. Then, the HMAC key is XORed with an outer padding value, and the inner digest is concatenated again to perform SM3 hash calculation, and finally the session security identifier is output.

[0127] S53: The session security identifier is embedded in the extension field of the TCP data packet to obtain an extended data packet.

[0128] In step S53, after the gateway service receives the session security identifier, it performs data packet processing in the TCP connection between the sound box terminal and the cloud service. Specifically, the Option 0x1F extension field is allocated in the Options field of the TCP data packet header, and the field contains a 4-byte option header and a 32-byte security identifier data. Then the session security identifier data is written into the data part of the Option 0x1F field to form an extended TCP data packet containing the security identifier.

[0129] S54: After the downstream microservice receives the extended data packet, the session security identifier is extracted from the extension field of the extended data packet for validity verification, and a full-link trusted transmission channel is established based on the validity verification result.

[0130] Further, when the downstream microservice receives the TCP extension packet, the Options field of the TCP header is first parsed, the Option 0x1F extension field is located, and the session security identification data therein is extracted, then the application uses the pre-shared HMAC key and the same HMAC-SM3 algorithm to re-calculate the authentication code of the session key and the user identification of the current session, obtains the verification identification, and subsequently the application compares the extracted session security identification with the re-calculated verification identification byte by byte, when the two are completely consistent, it is confirmed that the session security identification is valid, after verification, the application finally establishes an encrypted full-link trusted transmission channel between the sound box terminal and the cloud service, and all subsequent business data transmission is carried out in the secure channel.

[0131] As shown in Figure 2 The application further provides a single sign-on system for a shared terminal device, comprising:

[0132] A security packaging module 100 and a data reporting module 200 arranged in the terminal device, an authentication processing module 300 arranged in the user end, and a permission control and gateway module 400 arranged in the cloud end;

[0133] The security packaging module 100 is configured to securely package the first device identity data of the terminal device by using a national encryption algorithm to generate a dynamic authentication code;

[0134] The authentication processing module 300 is configured to identify and analyze the dynamic authentication code, and call a unified identity authentication interface to perform a password-free verification on the user end identity, establish a secure binding between the terminal device and the user end identity, and obtain a primary verification identification;

[0135] The data reporting module 200 is configured to report the second device identity data to the permission control center 410 of the cloud end;

[0136] The permission control and gateway module 400 comprises:

[0137] The permission control center 410 is configured to receive the second device identity data reported by the terminal device to construct a multi-dimensional network environment feature mapping library, and trigger a multi-factor identity authentication on the user end identity when detecting that the network environment feature change in the multi-dimensional network environment feature mapping library exceeds a preset security threshold, and obtain a secondary verification identification;

[0138] The gateway service unit 420 is configured to embed a session security identification into a transmission protocol extension field when the primary verification identification and the secondary verification identification are both passed, to establish an end-to-end trusted transmission link, so as to complete the single sign-on of the shared terminal device.

[0139] The application aims to completely eliminate the cumbersome steps of user code scanning login, and combines the dynamic two-dimensional code refreshed in real time through the screen of the sound box with the code scanning of the mobile phone. The first binding takes no more than 3 seconds, and in subsequent daily use, the user only needs to say a fixed wake-up word to complete the voiceprint login, so as to truly realize the 0-click experience of zero threshold operation for people with low operation ability.

[0140] In view of the objective limitation of no 3D structured light hardware, the Sherpa voiceprint engine is completely sunk to the sound box side, 1 second of voice can output 128-dimensional Embedding, and the energy-spectrum dual-channel liveness detection is used, so that the EER is as low as 0.18%, which effectively resists recording, synthesized voice and high-definition photo attacks, the voice feature plaintext does not go out of the terminal, and the cloud privacy leakage risk is completely eliminated.

[0141] When the first binding is performed, the cloud network authentication center of the cloud establishes a mapping table of the export IP, ASN, city ID and CTEI, and sets a geographic threshold (≥ 50km) and an autonomous domain threshold (ASN change) double trigger condition. After that, the traffic gateway completes real-time comparison within 1ms for each business request. Once the abnormal scene such as moving, VPN, hotspot sharing is detected, the risk state of device environment change is returned immediately and secondary authorization is guided.

[0142] When the secondary authorization is triggered, the user can select three ways of code scanning password-free, face recognition or voiceprint recognition to complete identity reconfirmation on the screen of the sound box. At the same time, the traffic gateway injects 64-bit HMAC-SM3 Session-Seal into TCP Option 0x1F for the legal session, so that the downstream microservice can be verified without decryption, the link delay is increased by less than 1ms, and a full-link security closed loop from login to call is formed.

[0143] The implementation process of the single sign-on method and system for sharing terminal devices provided by the application will be described below in combination with specific embodiments.

[0144] The dynamic two-dimensional code generation and verification process: the sound box end generates a dynamic two-dimensional code every 30 seconds, which contains the following fields: encrypted CTEI: the encrypted CTEI is encrypted by the SM4 algorithm, and the key is stored in the sound box EAL4+ level security chip; random nonce: 16-byte nonce is generated by a hardware random number generator to ensure unpredictability; TTL: TTL is set to 300s (5 minutes), and it is automatically refreshed when it expires; signature: the above fields are signed by using the private key built-in the device.

[0145] After the user scans the code through the App, the App locally verifies the validity of the signature and parses out session_id=S202308041530, and then calls the / device / bind interface to complete the binding, and the whole process takes ≤2.8 seconds.

[0146] IP drift detection and secondary authorization trigger flow:

[0147] Initial binding phase: cloud network authentication center records device initial network characteristics: egress IP: 113.108.23.XXX; ASN: AS4134; geographic threshold: 50 km, autonomous domain threshold: ASN change.

[0148] Abnormal scenario trigger: when the user carries the device to another area (120 km away from the initial area), the traffic gateway completes the following detection within 1 ms: calculate the IP drift distance d = 120 km > 50 km through the MaxMind GeoIP2 database, query the ASN through the BGP routing table in real time, support NAT after / 24 network segment drift tolerance, when detecting that the IP belongs to a new ASN autonomous domain, immediately trigger secondary authentication.

[0149] Secondary authorization flow: the speaker screen pops up options, the user selects "scan code for free password": generates a temporary two-dimensional code (TTL = 120 seconds), containing challenge = CH202308041645, after the mobile phone scans the code, the App sends user_id = U7890 and challenge to the cloud side through HTTPS, the cloud side verifies and passes, updates the IP mapping table and issues a new access_token, the link delay increases <1 ms.

[0150] Voiceprint end-side reasoning and live detection flow:

[0151] End-side deployment: model: Sherpa quantized 8.1 MB, MNN reasoning delay 95 ms, EER = 0.18% (recording attack).

[0152] Live detection: energy threshold > 10 dB and spectral flatness < 0.3 (to prevent synthetic speech); collect 1 second of user speech (16 kHz sampling, 16 bit quantization), extract 128-dimensional Embedding through Sherpa voiceprint model, model based on VGG-like backbone + Angular Prototypical Loss training.

[0153] Live detection: energy detection: filter silent segments (energy threshold < 10 dB).

[0154] Spectral analysis: detect the spectral flatness of the recording signal (threshold > 0.3 to determine as synthetic speech).

[0155] Anti-attack performance: on a 1000-person test set, the EER (equal error rate) of recording, synthetic speech attack reaches 0.18%, better than the traditional GMM-UBM model (EER = 5.2%).

[0156] The application combines the device binding process with the traffic gateway password-free login process through a dynamic two-dimensional code, realizes "0-click" first-time binding login, improves user experience, and is especially convenient to operate; secondly, through the application of Sherpa voiceprint end-side reasoning technology, the sound box with a screen can still quickly and accurately complete voiceprint recognition in a weak network environment, and the voice feature plaintext does not go out of the terminal, eliminating the risk of cloud privacy leakage from the source, effectively protecting the privacy and security of users; thirdly, the application uses the export IP + time window reverse lookup mechanism to monitor the changes in the network environment in real time, timely discovers and prevents Token cross-network abuse, enhances the security and attack resistance of the system, and prevents illegal users from stealing the rights of legal users by means such as IP drift; in addition, the secondary authentication introduces code scanning password-free login and device flow gateway number taking, providing a safe and convenient login method. The code scanning password-free login simplifies the process and improves user experience; while the device flow gateway number taking ensures the legality of login, prevents illegal devices from accessing, enhances the security of the system, and effectively protects the security of the user account; at the same time, the application also uses the full-link application of the national encryption algorithm (SM2 / SM3 / SM4) to ensure the security of data encryption transmission, signature verification and identity authentication and other aspects, meet the information security standards, and improve the security and reliability of the entire system.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, and not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed by the present application should be covered within the protection scope of the present application.

Claims

1. A single sign-on method for sharing terminal devices, characterized by, include: S1: Securely encapsulate the terminal device's primary device identity data using national cryptographic algorithms to generate a dynamic authentication code; S2: The user terminal application identifies and parses the dynamic authentication code, and calls the unified identity authentication interface to perform passwordless verification of the user terminal identity, establishes a secure binding between the terminal device and the user identity, and obtains a verification identifier; S3: Report the secondary device identity data of the terminal device to the cloud-based access control center to build a multi-dimensional network environment feature mapping library; S4: When the network environment feature changes in the multi-dimensional network environment feature mapping library exceed the preset security threshold, multi-factor authentication is performed on the user's identity to obtain a secondary verification identifier. S5: When both the primary verification identifier and the secondary verification identifier pass, the session security identifier is embedded into the transmission protocol extension field through the gateway service to establish an end-to-end trusted transmission link, thereby completing single sign-on for the shared terminal device.

2. The single sign-on method for shared terminal devices according to claim 1, characterized in that, The first device identity data in step S1 includes: device identity information, random verification code, timeliness control parameters, and digital signature data; The second device identity data in step S3 includes: public network exit address, autonomous system identifier, and geographic location data.

3. A single sign-on method for shared terminal devices according to claim 2, characterized in that, Step S1 further includes: S11: Generate a random check code using a hardware random number generator; S12: Perform a hash operation between the device identification information and the terminal hardware fingerprint to obtain a unique device identity digest; S13: Encrypt the unique device identity digest using the SM4 key to obtain an encrypted identity identifier; S14: Combine the encrypted identity identifier, the random verification code, the time control parameter, and the current timestamp to generate anti-counterfeiting digital signature data using the RSA-SM2 algorithm; S15: Encapsulate the encrypted identity identifier, the random verification code, the timeliness control parameter, and the digital signature data to generate a dynamic authentication code.

4. A single sign-on method for shared terminal devices according to claim 1, characterized in that, Step S2 further includes: S21: Parse the dynamic authentication code obtained by the user application in TLV format and extract the parsed digital signature data from the dynamic authentication code; S22: Use a preset public key to perform RSA-SM2 verification on the parsed digital signature data to obtain the authentication code verification result; S23: Parse the session identifier from the authentication code that has passed the authentication code verification, and call the passwordless login interface through the unified identity authentication SDK to obtain the access token; S24: Generate an HMAC binding credential based on the user identifier and session identifier in the access token; S25: Send the HMAC binding credential to the device management platform, establish a secure binding and association record between the terminal device and the user identity in the database, and obtain a verification identifier.

5. A single sign-on method for shared terminal devices according to claim 2, characterized in that, Step S3 further includes: S31: Obtain the public network exit address of the terminal device after NAT translation; S32: Using the public network exit address as a query condition, query the Autonomous System Number using the BGP routing information database to obtain the Autonomous System Identifier; S33: Based on the public network exit address, calculate the network coordinate location information through the geographic location database to obtain geographic location data; S34: Combine the masked and anonymized public network exit address, the autonomous system identifier, and the geographic location data to form a network feature vector; S35: Report the network feature vector to the cloud-based access control center and update the multidimensional network environment feature mapping library.

6. A single sign-on method for shared terminal devices according to claim 1, characterized in that, Step S4 further includes: S41: Obtain the network egress address of the current login request of the terminal device, and calculate the geographical offset distance between the network egress address and the historically bound public network egress address to obtain the geographical offset distance; S42: Query autonomous system information based on the network exit address, compare it with the historical autonomous system identifiers in the multidimensional network environment feature mapping library, and obtain the autonomous system information comparison result; S43: When the geographical offset distance exceeds the safety threshold or the autonomous region information comparison result is inconsistent, an environmental anomaly identifier is generated; S44: Based on the environmental anomaly identifier, perform identity verification on the user terminal using a multi-factor authentication mechanism to obtain a secondary verification identifier.

7. A single sign-on method for shared terminal devices according to claim 6, characterized in that, The multi-factor authentication mechanism in step S44 includes biometric identification and secondary authentication, wherein the biometric identification includes voiceprint recognition and face recognition.

8. A single sign-on method for shared terminal devices according to claim 7, characterized in that, When the multi-factor authentication mechanism is voiceprint recognition based on biometrics, step S44 further includes: S441: Collect user voice signals and preprocess them to obtain raw voice data; S442: Perform energy threshold detection on the raw speech data to obtain valid speech data; S443: Calculate the spectral flatness parameter of the effective speech data, determine the authenticity of biometric features through the flatness threshold, and obtain real speech data; S444: Input the real speech data into the local quantized speaker recognition model to extract and obtain the speech feature vector; S445: Calculate the similarity between the voice feature vector and the pre-stored user biometric template to perform secondary identity verification on the user and obtain a secondary verification identifier.

9. A single sign-on method for shared terminal devices according to claim 1, characterized in that, Step S5 further includes: S51: Generate a session key based on the secondary verification identifier; S52: Use the HMAC-SM3 algorithm to perform digest calculation on the session key and user session identifier to obtain the session security identifier; S53: Embed the session security identifier into the extended field of the TCP packet to obtain the extended packet; S54: After receiving the extended data packet, the downstream microservice extracts the session security identifier from the extended field of the extended data packet for validity verification, and establishes a full-link trusted transmission channel based on the validity verification result.

10. A single sign-on system for shared terminal devices, characterized in that, include: The security encapsulation module and data reporting module are located in the terminal device; the authentication processing module is located in the user terminal; and the access control and gateway module is located in the cloud. The secure encapsulation module is used to securely encapsulate the terminal device's primary device identity data using national cryptographic algorithms and generate a dynamic authentication code. The authentication processing module is used to identify and parse the dynamic authentication code, and call the unified identity authentication interface to perform passwordless verification of the user's identity, establish a secure binding between the terminal device and the user's identity, and obtain a verification identifier. The data reporting module is used to report the identity data of the second device to the permission control center in the cloud. The access control and gateway module includes: The access control center is used to receive second device identity data reported by terminal devices in order to build a multi-dimensional network environment feature mapping library; When the network environment feature changes in the multidimensional network environment feature mapping library exceed the preset security threshold, multi-factor authentication of the user's identity is triggered to obtain a secondary verification identifier. The gateway service unit is used to embed the session security identifier into the transmission protocol extension field when both the primary authentication identifier and the secondary authentication identifier are passed, thereby establishing an end-to-end trusted transmission link to complete single sign-on for the shared terminal device.

Images