User identity authentication method and system

Abstract

The present disclosure discloses a user identity authentication method and system, which relates to the field of network and information security. The method includes: obtaining the eID of the user's SIM card; preferentially using the authentication account information in the local synchronization account book to authenticate the eID of the SIM card, wherein the authentication account information includes the user identity information; if the authentication account information in the local synchronization account book cannot be used to authenticate the eID of the SIM card, then the eID of the SIM card is authenticated according to the user identity information in the private blockchain of the user login record; if the eID of the SIM card cannot be authenticated according to the user identity information in the private blockchain of the user login record, then the eID unified authentication system is called to authenticate the eID of the SIM card. The present disclosure improves the efficiency of identity authentication.

Description

Technical Field

[0001] The present disclosure relates to the field of network and information security, and in particular to a user identity authentication method and system. Background Art

[0002] eID (Electronic Identity), also known as an online electronic ID card, refers to a string of electronic information that can uniquely identify a user in cyberspace. Relying on the Ministry of Public Security's national citizen identity information database covering 1.3 billion people, the eID system generates a set of unique network identifiers and digital certificates to ensure the authenticity and uniqueness of user identities. At the same time, it does not contain any personal identity privacy information. eID-related identity information is created and managed by a unified organization, which not only ensures the authenticity of personal identity, but also effectively avoids the risk of exposure and leakage when user identity information is retained by various network operators. Using eID can avoid users from frequently entering usernames and passwords, and achieve quick login and other trusted operations while ensuring the security and reliability of their identities.

[0003] The current eID system is based on PKI (Public Key Infrastructure) and transmits information in a network environment. Using digital certificates based on PKI, digital information to be transmitted is encrypted and signed, ensuring confidentiality, authenticity, integrity, and non-repudiation, thereby ensuring secure transmission. However, existing user identity authentication is inefficient, resulting in a poor user experience. Summary of the Invention

[0004] A technical problem to be solved by the present disclosure is to provide a user identity authentication method and system that can improve the efficiency of identity authentication.

[0005] According to one aspect of the present disclosure, a user identity authentication method is proposed, including: obtaining an electronic identifier (eID) of a user's SIM card; preferentially authenticating the SIM card's eID using authentication ledger information in a local synchronized ledger, wherein the authentication ledger information includes user identity information; if the SIM card's eID cannot be authenticated using the authentication ledger information in the local synchronized ledger, authenticating the SIM card's eID based on user identity information in a private blockchain of user login records; if the SIM card's eID cannot be authenticated based on the user identity information in the private blockchain of user login records, invoking a unified eID authentication system to authenticate the SIM card's eID.

[0006] In some embodiments, preferentially utilizing the authentication ledger information in the local synchronized ledger to authenticate the eID of the SIM card includes: querying the cached authentication scenarios of the most recent predetermined number of logins to the application system in the local synchronized ledger; determining whether the eID of the SIM card meets at least one of the most recent predetermined authentication scenarios; if so, authenticating the eID of the SIM card using the user identity information in the compliant authentication scenario; if not, authenticating the eID of the SIM card based on the user identity information in the private blockchain of the user login record.

[0007] In some embodiments, authenticating the eID of the SIM card based on the user identity information in the private blockchain of the user login record includes: determining whether the user identity information exists in the private blockchain of the user login record; if so, authenticating the eID of the SIM card based on the user identity information in the private blockchain of the user login record.

[0008] In some embodiments, after authenticating the eID of the SIM card based on the user identity information in the private blockchain of the user login record, the method further includes: synchronizing the authentication ledger information to the local synchronization ledger.

[0009] In some embodiments, the eID unified authentication system records the user's identity information when the user registers with real name and the identity certificate associated with the user's identity information; verifies the user's access rights to the application system based on the user's identity information and the identity certificate; if the verification is successful, the user's identity information, the identity certificate associated with the user's identity information, and the application system access rights information associated with the user's identity information are saved to the user's login record private blockchain.

[0010] In some embodiments, whether a user can log in to the application system is determined based on the application system access permission information in the user login record private blockchain.

[0011] In some embodiments, if the eID of the user's SIM card cannot be obtained, an eID application is sent to the eID unified authentication system.

[0012] According to another aspect of the present disclosure, a user identity authentication system is also proposed, including: an eID client, configured to obtain the electronic identification eID of the user's SIM card; a local synchronization ledger, configured to preferentially use the stored authentication ledger information to authenticate the eID of the SIM card, wherein the authentication ledger information includes user identity information; a user login record private blockchain, configured to authenticate the eID of the SIM card based on the stored user identity information if the authentication ledger information in the local synchronization ledger cannot be used to authenticate the eID of the SIM card; an eID unified authentication system, configured to be called to authenticate the eID of the SIM card if the user identity information in the user login record private blockchain cannot be used to authenticate the eID of the SIM card.

[0013] According to another aspect of the present disclosure, a user identity authentication system is provided, including: a memory; and a processor coupled to the memory, wherein the processor is configured to execute the user identity authentication method described above based on instructions stored in the memory.

[0014] According to another aspect of the present disclosure, a computer-readable storage medium is further provided, on which computer program instructions are stored, and when the instructions are executed by a processor, the above-mentioned user identity authentication method is implemented.

[0015] Compared with the related art, the present disclosure prioritizes identity authentication of the SIM card's eID based on the authentication ledger information in the local synchronized ledger. If authentication fails, the SIM card's eID is authenticated based on the user identity information in the private blockchain of the user's login record. If authentication still fails, the eID unified authentication system is called to authenticate the SIM card's eID, thereby avoiding the disadvantage that the user needs to perform remote authentication on the eID unified authentication system every time they access the application system, thereby improving the efficiency of identity authentication.

[0016] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0018] The present disclosure can be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0019] Figure 1 The following is a flowchart of some embodiments of the user identity authentication method disclosed herein.

[0020] Figure 2Schematic diagram of the flow of other embodiments of the user identity authentication method disclosed herein.

[0021] Figure 3 Schematic diagram of the structure of some embodiments of the user identity authentication system disclosed in the present invention.

[0022] Figure 4 Schematic diagram of the structure of some other embodiments of the user identity authentication system disclosed in the present invention.

[0023] Figure 5 Schematic diagram of the structure of some other embodiments of the user identity authentication system disclosed in the present invention.

[0024] Figure 6 Schematic diagram of the structure of some other embodiments of the user identity authentication system disclosed in the present invention. DETAILED DESCRIPTION

[0025] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that unless otherwise specifically stated, the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure.

[0026] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0027] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0028] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0029] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0030] It should be noted that like reference numerals and letters refer to like items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0031] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0032] Figure 1 The following is a flowchart of some embodiments of the user identity authentication method disclosed herein.

[0033] In step 110, the eID of the user's SIM (Subscriber Identification Module) card is obtained.

[0034] In some embodiments, when a user needs to access an application system, the user identity information needs to be authenticated. The SIM card stores an eID, so the eID of the user's SIM card can be obtained first through the eID client.

[0035] In step 120, the authentication ledger information in the local synchronized ledger is preferentially used to authenticate the SIM card's eID. The authentication ledger information includes the user's recent login information and access rights.

[0036] In some embodiments, after the user login record private blockchain records the user identity information and access rights and other authentication ledger information of the user's recent logins to the application system, the authentication ledger information recorded in the user login record private blockchain can be copied locally and saved in the local synchronization ledger, so that the user identity information can be authenticated based on the authentication ledger information in the local synchronization ledger first, thereby achieving secure and fast identity authentication.

[0037] In step 130, if the authentication ledger information in the local synchronized ledger cannot be used to authenticate the eID of the SIM card, the eID of the SIM card is authenticated based on the user identity information in the private blockchain of the user login record.

[0038] In some embodiments, the eID unified authentication system records the user's identity information when the user registers with real name and the identity certificate associated with the user's identity information; verifies the user's access rights to the application system based on the user's identity information and the identity certificate; if the verification is successful, the user's identity information, the identity certificate associated with the user's identity information, and the application system access rights information associated with the user's identity information are saved to the user's login record private blockchain.

[0039] Blockchain technology can be categorized into three types: public blockchains, private blockchains, and consortium blockchains. Public blockchains are fully decentralized and open to the public, resulting in the lowest efficiency; private blockchains are not decentralized, operated by a single organization, and offer high efficiency; and consortium blockchains are partially decentralized, with open nodes within the consortium, but efficiency decreases as the number of nodes increases. These differ in their focus and characteristics, but using public or consortium blockchains for identity authentication can lead to concurrent performance bottlenecks. Therefore, in this embodiment, private blockchain technology is used to authenticate user identity information.

[0040] In step 140, if the eID of the SIM card cannot be authenticated based on the user identity information in the private blockchain of the user login record, the eID unified authentication system is called to authenticate the eID of the SIM card.

[0041] In this embodiment, without changing the principle of traditional eID identity authentication, the SIM card's eID is authenticated based on the authentication ledger information in the local synchronized ledger. If authentication is unsuccessful, the SIM card's eID is authenticated based on the user identity information in the private blockchain of the user's login record. If authentication is still unsuccessful, the eID unified authentication system is called to authenticate the SIM card's eID. This avoids the disadvantage of the user having to perform remote authentication on the eID unified authentication system every time they access the application system, thereby improving the efficiency of identity authentication.

[0042] Figure 2 Schematic diagram of the flow of other embodiments of the user identity authentication method disclosed herein.

[0043] In step 210 , it is determined whether the eID in the SIM card can be read. If not, step 220 is executed. If yes, step 230 is executed.

[0044] In step 220, an eID application is sent to the eID unified authentication system.

[0045] Since there is no eID information in the SIM card, you need to submit an eID application to the eID unified authentication system, which will then authorize the unified authentication certificate.

[0046] In some embodiments, when a user registers their real name, the eID unified authentication system obtains the user's identity information and an identity certificate associated with the user's identity information; based on the user's identity information and identity certificate, the user's access rights to the application system are verified, i.e., the asset ledger address information is verified; if the verification is successful, the user's identity information, the identity certificate associated with the user's identity information, and the application system access rights information associated with the user's identity information are saved to the eID authentication ledger in the user's private blockchain login record. The eID unified authentication system then associates the user's identity information with the public key and sends the user's identity information and public key to a certificate authority, which performs authorization authentication and associates the identity certificate with the user's identity information.

[0047] In step 230, the cached local synchronized ledger is queried for the most recent predetermined number of authentication scenarios for logging into the application system. For example, the local synchronized ledger may store user identity information and access rights information corresponding to the most recent 10 authentication scenarios. The application client is used to log in to the local synchronized ledger for querying.

[0048] In step 240 , it is determined whether the eID of the SIM card meets at least one of the most recently predetermined authentication scenarios. If so, step 250 is executed; otherwise, step 260 is executed.

[0049] In step 250, the SIM card's eID is authenticated using the user identity information in the applicable authentication scenario. For example, the application client sends the SIM card's eID to the local synchronized ledger, compares the SIM card's eID with the user identity information in the authentication scenario, and determines whether the user is authenticated. In this step, the application access rights information stored in the local synchronized ledger can also be used to determine whether the user has access rights to the application system.

[0050] In step 260 , it is determined whether the user identity information exists in the private blockchain of the user login record. If so, step 270 is executed; otherwise, step 280 is executed.

[0051] In step 270, the eID of the SIM card is authenticated based on the user identity information in the private blockchain of the user login record.

[0052] For example, the application client sends the eID of the SIM card to the private blockchain of the user's login record, compares the eID of the SIM card with the user identity information of the private blockchain of the user's login record, and determines whether the user can pass the authentication.

[0053] In some embodiments, it is possible to determine whether the user has access rights to the application system based on the application access rights information in the user login record private blockchain. If the user has access rights to the application system, the application system is accessed using the application system interface.

[0054] In some embodiments, a ledger synchronization engine is used to synchronize authentication ledger information such as user identity information and application system access permission information into a local synchronization ledger.

[0055] In step 280, the eID unified authentication system is called to authenticate the eID of the SIM card.

[0056] In this embodiment, a local synchronized ledger, a private blockchain, and a third-party eID unified authentication system are comprehensively adopted to authenticate the user identity, which solves the timeliness problem of the existing eID authentication system and the massive centralized unified identity authentication, and solves the performance bottleneck problem that exists whether traditional centralized authentication or alliance chain / public blockchain identity authentication is adopted. This application adopts a private blockchain and a local synchronized ledger to improve the efficiency of user identity authentication and improve the user identity authentication experience.

[0057] Figure 3Figure 3 is a schematic diagram of the structure of some embodiments of the user identity authentication system disclosed herein. The system includes an eID client 310, a local synchronization ledger 320, a private blockchain 330 for user login records, and an eID unified authentication system 340.

[0058] The eID client 310 is configured to obtain the eID of the user's SIM card.

[0059] The local synchronization ledger 320 is configured to preferentially use the stored authentication ledger information to authenticate the eID of the SIM card.

[0060] The user login record private blockchain 330 is configured to authenticate the SIM card eID based on the stored user identity information if the authentication ledger information in the local synchronization ledger cannot be used to authenticate the SIM card eID.

[0061] The eID unified authentication system 340 is configured to be called to authenticate the eID of the SIM card if it cannot authenticate the eID of the SIM card based on the user identity information in the private blockchain of the user login record.

[0062] In this embodiment, the SIM card's eID is authenticated based on the authentication ledger information in the local synchronized ledger. If authentication fails, the SIM card's eID is authenticated based on the user identity information in the private blockchain of the user's login record. If authentication still fails, the eID unified authentication system is called to authenticate the SIM card's eID. This avoids the disadvantage of requiring the user to perform remote authentication on the eID unified authentication system every time the user accesses the application system, thereby improving the efficiency of identity authentication.

[0063] Figure 4 Figure 1 is a schematic diagram of the structure of another embodiment of the user identity authentication system disclosed herein. In this embodiment, the system includes a user side, an application service provider, and an eID identity authentication provider. The user side includes an eID client 410, a SIM card 411, an application client 420, and a local synchronization ledger 430. The application service provider includes an application system server 440 and a user login record private blockchain 450. The user login record private blockchain 450 includes an application system interface 451, an eID authentication ledger 452, and a ledger synchronization engine 453. The eID identity authentication provider includes an eID unified authentication server 460 and an eID unified authentication system 470.

[0064] The eID client 410 is configured to obtain the eID of the user's SIM card 411 .

[0065] The user can log in to the local synchronization ledger 430 and the user login record private blockchain 450 through the application client 420.

[0066] The local synchronization ledger 430 stores the identity information corresponding to the authentication scenarios of the user's most recent scheduled logins to the application system and the authentication ledger information such as the access rights for logging into the application system, and provides various digital assets and transaction systems related to eID.

[0067] The application system server 440 may be a server for various asset application systems.

[0068] The eID authentication ledger 452 of the private blockchain 450, which records user logins, stores authentication ledger information, including user identity information, the identity certificate associated with the user identity information, and application system access rights associated with the user identity information. The ledger synchronization engine 453 synchronizes the authentication ledger information with the local synchronization ledger 430. The application system interface 451 provides an interface for users to log in to the application system server 440.

[0069] The eID unified authentication server 460 generates an identity certificate based on the user identity information and public key, and sends the identity certificate to the eID unified authentication system 470 .

[0070] In this embodiment, the SIM card's eID is authenticated based on the authentication ledger information in the local synchronized ledger. If authentication fails, the SIM card's eID is authenticated based on the user identity information in the private blockchain of the user's login record. If authentication still fails, the eID unified authentication system is called to authenticate the SIM card's eID. This avoids the disadvantage of requiring the user to perform remote authentication on the eID unified authentication system every time the user accesses the application system, thereby improving the efficiency of identity authentication.

[0071] Figure 5 Schematic diagram of the structure of some other embodiments of the user identity authentication system disclosed herein. The system includes a memory 510 and a processor 520, wherein:

[0072] The memory 510 can be a disk, flash memory or any other non-volatile storage medium. Figure 1 、 2 The processor 520 is coupled to the memory 510 and can be implemented as one or more integrated circuits, such as a microprocessor or a microcontroller. The processor 520 is used to execute the instructions stored in the memory.

[0073] In some embodiments, it is also possible to Figure 6As shown, the system 600 includes a memory 610 and a processor 620. The processor 620 is coupled to the memory 610 via a BUS 630. The system 600 can also be connected to an external storage device 660 via a storage interface 640 to access external data, and can also be connected to a network or another computer system (not shown) via a network interface 660, which will not be described in detail here.

[0074] In this embodiment, the memory stores data instructions, and the processor processes the instructions, thereby improving the efficiency of identity authentication.

[0075] In some other embodiments, a computer readable storage medium stores computer program instructions, which when executed by a processor implement Figure 1 、 2 The steps of the method in the corresponding embodiment. Those skilled in the art will understand that the embodiments of the present disclosure can be provided as methods, devices, or computer program products. Therefore, the present disclosure can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present disclosure can take the form of a computer program product implemented on one or more computer-usable non-transitory storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0079] The present disclosure has been described in detail so far. To avoid obscuring the concept of the present disclosure, some details known in the art have not been described. Based on the above description, those skilled in the art can fully understand how to implement the technical solutions disclosed herein.

[0080] Although some specific embodiments of the present disclosure have been described in detail by way of examples, those skilled in the art will appreciate that the above examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Those skilled in the art will appreciate that modifications may be made to the above embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A user identity authentication method, comprising: Obtain the electronic identification eID of the user's SIM card; In the local synchronization account book, query the cached authentication scenarios for the most recent scheduled number of logins to the application system; Determining whether the eID of the SIM card meets at least one authentication scenario among the most recent predetermined number of authentication scenarios; If it is in compliance, the eID of the SIM card is authenticated using the authentication account information in the local synchronization account in the authentication scenario that meets the requirements, wherein the authentication account information includes the user identity information; If the authentication account information in the local synchronization account book cannot be used to authenticate the eID of the SIM card, the eID of the SIM card is authenticated according to the user identity information in the private blockchain of the user login record; If the eID of the SIM card cannot be authenticated based on the user identity information in the private blockchain of the user login record, the eID unified authentication system is called to authenticate the eID of the SIM card.

2. The user identity authentication method according to claim 1, wherein: According to the user identity information in the private blockchain of the user login record, the eID of the SIM card is authenticated including: Determine whether the user identity information exists in the private blockchain of the user login record; If it exists, the eID of the SIM card is authenticated according to the user identity information in the private blockchain of the user login record.

3. The user identity authentication method according to claim 2, wherein: After authenticating the eID of the SIM card according to the user identity information in the private blockchain of the user login record, the method further includes: Synchronize the authentication ledger information to the local synchronization ledger.

4. The user identity authentication method according to any one of claims 1 to 3, further comprising: The eID unified authentication system records the user identity information when the user registers with real name and the identity certificate associated with the user identity information; Verifying the user's access rights for logging into the application system based on the user identity information and the identity certificate; If the verification is successful, the user identity information, the identity certificate associated with the user identity information, and the application system access permission information associated with the user identity information are saved to the user login record private blockchain.

5. The user identity authentication method according to claim 4, further comprising: Determine whether the user can log in to the application system based on the application system access permission information in the private blockchain of the user login record.

6. The user identity authentication method according to any one of claims 1 to 3, further comprising: If the eID of the user's SIM card cannot be obtained, an eID application is sent to the eID unified authentication system.

7. A user identity authentication system, comprising: The eID client is configured to obtain the electronic identification eID of the user's SIM card; The local synchronization account book is configured to query the cached authentication scenarios of the most recent predetermined number of logins to the application system in the local synchronization account book, determine whether the eID of the SIM card meets at least one of the authentication scenarios of the most recent predetermined number of authentication scenarios, and if so, perform identity authentication on the eID of the SIM card using the authentication account book information stored in the authentication scenario that meets the requirements, wherein the authentication account book information includes user identity information; The user login record private blockchain is configured to authenticate the eID of the SIM card based on the stored user identity information if the authentication ledger information in the local synchronization ledger cannot be used to authenticate the eID of the SIM card; The eID unified authentication system is configured to be called to authenticate the eID of the SIM card if the eID of the SIM card cannot be authenticated based on the user identity information in the private blockchain of the user login record.

8. A user identity authentication system, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the user identity authentication method according to any one of claims 1 to 6 based on instructions stored in the memory.

9. A computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the user identity authentication method described in any one of claims 1 to 6.

Images