Identity recognition method based on dormitory management system

Abstract

The present invention provides an identity recognition method based on a host management system. The method comprises: registering a user with a cloud proxy; receiving a request from a user at a host management system terminal to register their terminal with the cloud proxy; registering multiple services with the proxy; authorizing the user to access services at the host management system terminal; receiving a user terminal watermark, generating a user token request at the host management system terminal, generating a one-time user token, and sending the token to the host management system terminal; and decrypting an encrypted password using the terminal watermark. This present invention provides an identity recognition method based on a host management system. The user password does not need to be manually entered, and the terminal watermark used for identity recognition is not stored in the terminal. This prevents attackers from using leaked passwords, thereby improving the security of identity recognition.

Description

Technical Field

[0001] The present invention relates to system security, and in particular to an identity recognition method based on a dormitory management system. Background Art

[0002] Authentication mechanisms are credentials that identify legitimate users. In networked campus dormitory management systems, students must enter their username and password to log in to the platform. However, leaking passwords can lead to intrusion and data breaches. Furthermore, increasingly stringent password strength requirements make it difficult for users to remember passwords. This password-centric authentication model is no longer suitable for users of modern networked dormitory management platforms. Summary of the Invention

[0003] To address the problems of the prior art, the present invention proposes an identity recognition method based on a dormitory management system, which is used by a dormitory management system terminal to provide user identity recognition to the accessed campus cloud service, including:

[0004] registering a user with the cloud agent to create a password and a user identification code for the user, the password and user identification code being linked to an account associated with the user group;

[0005] receiving a request from a user of the terminal of the host management system to register the terminal with the cloud agent, to create a terminal profile including the received unique terminal identifier required for generating a terminal watermark and a terminal pre-shared key, and to create a terminal asset identification number for the terminal of the host management system;

[0006] registering a plurality of services with the agent according to a service profile used by the user, wherein the service profile includes a service subject name, a user name associated with the service subject name, a password and a terminal asset identification number, and a password encrypted at a terminal of a host management system using a terminal watermark;

[0007] storing registered user, dormitory management system terminal, and service profiles in a repository of a cloud agent; authorizing the user to access services at the dormitory management system terminal, wherein the cloud agent is executed on the accessed campus cloud service;

[0008] receiving a user terminal watermark from a user, generating a user token request by the host management system terminal, the user token request including a terminal asset identification number, an account, a timestamp, a digital signature generated using the terminal watermark and the timestamp, a service principal name, a user name associated with the service, and a digital signature service ID received via a cloud-based proxy; and sending the generated user token request by the host management system terminal to the cloud-based proxy;

[0009] Processing the received user token request to generate a one-time user token linked to the accessed campus cloud service;

[0010] Sending the generated one-time user token to the dormitory management system terminal; decrypting the encrypted password in the received one-time user token by the terminal watermark of the dormitory management system terminal; forwarding the decrypted password and the pre-authentication token with the one-time user token to the cloud agent of the accessed campus cloud service by the dormitory management system terminal;

[0011] verifying, by a cloud agent of the accessed campus cloud service, a one-time user token received from the client application; authenticating the user based on the received password and a pre-authentication token included in the verified one-time user token; and

[0012] Notify the user of the authentication result of the dormitory management system terminal access service.

[0013] Compared with the prior art, the present invention has the following advantages:

[0014] The present invention proposes an identity recognition method based on a host management system, in which user passwords do not need to be memorized or manually input, and a terminal watermark used for identity recognition is not stored in the terminal, thereby preventing attackers from using leaked passwords and improving the security of identity recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 4 is a flow chart of an identity recognition method based on a host management system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following and the accompanying drawings illustrate the principles of the present invention. Figure 1 A detailed description of one or more embodiments of the present invention is provided below. The present invention is described in conjunction with such embodiments, but the invention is not limited to any of the embodiments. The scope of the present invention is limited solely by the claims, and the invention encompasses numerous alternatives, modifications, and equivalents. In the following description, numerous specific details are set forth to provide a thorough understanding of the present invention. These details are provided for illustrative purposes only, and the present invention may be practiced according to the claims without some or all of these specific details.

[0017] One aspect of the present invention provides an identity recognition method based on a host management system. Figure 1 4 is a flow chart of an identity recognition method based on a host management system according to an embodiment of the present invention.

[0018] This invention proposes a method for authoritatively proving the identity of a dormitory management system terminal. This method provides for identifying users and dormitory management system terminals in a service session, watermarking the origin of the user's dormitory management system terminal, scoring users based on legitimate social relationships, and modeling attribute-based relationships using dynamic data fusion using directed graphs. User authentication utilizes a user token issued by the cloud and a service ID issued by the accessed campus cloud service, along with a terminal watermark associated with the user's dormitory management system terminal and the user's social relationships in the service session. Attachment information is transmitted as a user token containing dynamically calculated attachment weights, component weights, and attachment attributes.

[0019] The terminal watermark of the present invention is not stored on the user's host management system terminal or proxy server, nor is it transmitted over the network. Instead, it is automatically and dynamically generated on the user's host management system terminal and proxy server using a hash function. The terminal watermark is generated using multiple terminal identifiers that are tightly coupled and bound to the user's host management system terminal. Furthermore, the terminal watermark does not require any external physical host management system terminal, such as a hardware key card, to receive the one-time password.

[0020] The service ID issued by the accessed campus cloud service is digitally signed with the server's private key and transmitted through a secure encrypted channel with extended server authentication. User tokens for social relationships are generated only when the service ID is verified and transmitted through a secure encrypted channel.

[0021] Prior to the authentication process, the terminal watermark associated with the user's dormitory management system terminal is used to verify the service ID of the accessed campus cloud service before the user's dormitory management system terminal transmits the encrypted password for decryption. The encrypted password is decrypted on the user's dormitory management system terminal using the terminal watermark and the user's personal identification code, where the user's personal identification code is unique to the user and is linked to the accessed campus cloud service that requires user authentication, or a user identification code pre-shared with the dormitory management system terminal of the accessed campus cloud service that does not require user authentication. The personal identification code includes both a service authentication code and a user identification code.

[0022] The social relationship is a mechanism for generating and issuing a user token, which includes the user's attachment weight, component weight, and attachment attributes requested by the accessed campus cloud service and is agreed upon by the user during the service session with user authentication. The user token request generation requires the use of a terminal watermark, a pre-shared password for the dormitory management system terminal, and a user identification code. In addition, a user's attachment relationships are relationships between other users and organizations. The service authentication code and user identification code allow multiple users to securely share a single terminal and related terminal watermark using different personal identification codes.

[0023] For access to services requiring authentication, a user-created, user-only known terminal watermark is represented by a PIC. This terminal watermark is dynamically and automatically generated by the host management system terminal and agent to establish proof of the user's presence at the host management system terminal during the service session. The terminal watermark is used to encrypt the password associated with the accessed service for use during the authentication process. The user's terminal watermark is not registered with the identity provider and is used only to encrypt the user's original authentication password. This facilitates the use of stronger passwords and regular password changes, eliminating the need to recall difficult-to-remember passwords, and prevents attackers from using compromised passwords.

[0024] For access to services that don't require authentication, the host management system terminal encrypts the user identification code using a terminal pre-shared key for transmission to the agent over a secure channel. Requiring a private user's terminal watermark protects compromised terminal watermarks from malicious use by an attacker's host management system terminal, while requiring a matching terminal watermark protects compromised user terminal watermarks from malicious use by an attacker's host management system terminal. Furthermore, leaking the terminal watermark requires leaking the terminal pre-shared key and multiple terminal identifiers associated with the user's registered host management system terminal.

[0025] Unlike traditional proxy authentication processes, the present invention provides authoritative identification of users at the dormitory management system terminal, rather than a user authentication mechanism based on biometrics or terminal attributes. Users provide authentication credentials to the accessed campus cloud service without having to manually enter a service login password that is difficult to remember. The method does not store the user's password in a library protected by a single password to perform automatic authentication using form auto-fill. The user encrypts the password on the dormitory management system terminal using a private user terminal watermark and a dynamically generated terminal watermark, and registers the encrypted password with the agent to generate a user token that includes the encrypted password in subsequent access to the service. The encrypted password can only be decrypted on the dormitory management system terminal using the dynamically generated terminal watermark and the private user terminal watermark. The user can use the same terminal watermark for all accessed campus cloud services from one terminal, use a different terminal watermark for each accessed campus cloud service on one terminal, or use different terminal watermarks for the same accessed campus cloud service on different terminals. If the terminal identifier changes, the registered host management system terminal only needs to be resynchronized once, and if the user's terminal watermark is destroyed on the host management system terminal, all passwords protected by the same user terminal watermark only need to be re-encrypted once without changing all passwords.

[0026] The present invention constructs a directed graph including entity vertices and relationship links, processes attributes as dependent variables or independent variables, maps attributes to components, and evaluates the relative influence of component weights and attributes in the calculation of user's attachment weights.

[0027] The social relationship of the present invention is not based on attribute-based access control, but is based on the weights of entity relationships in a directed graph for post-access permission management, where entities include users, organizations, and profiles, and relationships include dependent and independent attributes of entities.

[0028] The present invention uses multiple local terminal identifiers and terminal pre-shared keys, which are shared by the agent with the host management system terminal via a secure channel. A terminal watermark is dynamically generated using a hash function for host management system terminal identification. User identification is based on the username associated with the service principal name. The user terminal watermark can be associated with multiple passwords on multiple user host management system terminals and multiple accessed campus cloud services.

[0029] The authentication method is based on server confirmation of the registered host management system terminal as proof of the user's presence at the identified host management system terminal, and verification of the user based on a manually entered user terminal watermark. The user terminal watermark is not transmitted over the network during the authentication handshake or management session.

[0030] Terminal registration and dynamic verification in the DMS are based on multiple attributes and components of the group account and terminal. These attributes include hardware identification, trusted platform module chip identifier, processor identification, and terminal asset identification number. These attributes are used to dynamically generate a globally unique terminal watermark and associated terminal asset identification number, which remain unchanged across sessions.

[0031] A globally unique terminal watermark is dynamically generated using a hash function using the terminal's pre-shared key (PSK) and the terminal identifier associated with the registered host management system terminal. The pre-shared key is shared with the host management system terminal over a secure channel, and the terminal identifier is automatically generated by the host management system terminal. Therefore, the terminal watermark is not stored on the host management system terminal or the agent.

[0032] The user's identification is based on the account, terminal registration, and service profile. The password in the service profile is encrypted using the terminal watermark and the user's terminal watermark. It includes the service principal name (e.g., URL) that uniquely identifies the service instance, the user name, password, and the terminal asset identification number. The user's terminal watermark is entered locally on the terminal in the terminal to decrypt the password in the service profile. The password contained in the service profile is encrypted using the terminal watermark.

[0033] During a user session for a registration service that registers a terminal in the host management system, the user token request to the agent includes the terminal asset identification number, account, timestamp, digital signature generated using the terminal watermark and timestamp, service principal name, user name for the service to be accessed that requires authentication or user identification code encrypted using the terminal pre-shared key for the service to be accessed that does not require authentication, service ID of the digital signature received via the cloud agent, and IP address of the service to be accessed. The user token response may include an encrypted password in the service profile, which was originally encrypted using the terminal watermark during service registration. The encrypted password in the service profile can only be decrypted using the user's terminal watermark. By using standard timestamps and message integrity signatures on the secure channel between the host management system terminal and the agent, the user token request can be protected from replay attacks.

[0034] Identification in real-time sessions requires a one-time user token linked to a service profile. The one-time user token is issued by the proxy based on verification of the endpoint watermark to authenticate the identified user to the service. Optional attachment context includes attachment weights, component weights, and classification attachment attributes. The one-time user token can include an encrypted password or the user's pre-authentication token.

[0035] Identity-based social relationships are established by processing various large datasets collected from multiple third-party data sources as directed graphs and querying them by username, address, phone number, etc. The received datasets include user profile information. The query also receives datasets related to organizations with which the user may be associated, including organizational profile information. Social relationships are used to fully qualify the user's associations with multiple independent and trusted nodes to establish integrity based on the user's profile.

[0036] A user's attachment weight is a measure of legitimate attributes and relationships, which are determined based on information about the user available in the cloud. Social relationship weights are derived based on multiple component weights, each of which is further determined based on the relative weights and classifications of related attributes received from multiple data sources about the user. The privacy of the user's profile is protected by first encrypting the data with a private user's terminal watermark on the user's host management system terminal, and then further encrypting the data on the remote server with a server platform identification number dynamically generated based on the user's profile information and the server hardware. This provides dual protection for the user's static data.

[0037] Dependent weights are calculated using a directed graph, where a set of objects, or nodes, are connected together, and all edges, or links, point from one node to another. Functional homomorphic encryption is used for obfuscation. The proxy service retrieves various user attributes from multiple data sources through directed queries on users. User attributes that can be cached in the repository include personal, social, professional, and organizational information. The user's static and associated attributes are used to construct a dynamic directed graph, representing entities as nodes and relationships as links. Entities include user communities, social networks, organizations, and roles. The relationships represent a type of association, such as relatives, colleagues, and friends. Multiple component weights are calculated by traversing the directed graph based on a scoring function. The weight function calculates a weighted value for each entity and relationship that matches the weight criteria.

[0038] Social relationship weights are calculated based on the interdependencies between entities. Each node is an entity and can be assigned attributes. Each link represents a relationship with a specified attribute and either a static or dynamic absolute weight. The attachment weight of a user entity is calculated based on a conditional weight based on the weighted absolute weights of other entities and relationships in the directed graph.

[0039] Applications installed on a registered host management system terminal conduct online sessions with services that require authentication or do not require authentication. Services can query the affiliations of users who are conducting online sessions with services. A set of user controls is provided to users on the registered host management system terminal to manage the identity identification and social relationship mode of operation. Users do not have to remember or manually enter passwords when accessing services that require authentication. When the user leaves the registered host management system terminal, a proximity-based automatic disabling of the operation mode is provided as a security lock mechanism. Users are allowed to provide confirmation to the service platform to disclose the requested affiliations when the user accesses a service. Users share the registered host management system terminal with other members of a group account.

[0040] In one exemplary embodiment of the present invention, the agent requests a pre-authentication token from the service by sending an authentication component containing a secret key issued by the service platform for the agent, the user's username, an optional timestamp, and an optional IP address of the host management system terminal. The user token includes the pre-authentication token issued by the user to the agent. When the pre-authentication token is included, a password is not required; a valid username alone is sufficient to authenticate the user to the service. The user's pre-authentication token can be stored in the agent repository and set to expire based on the session duration.

[0041] The agent can issue a single user token for both identification and attribution, or issue separate user tokens, one user token for identification and one usage token for attribution.

[0042] A user accesses a service that requires authentication to authorize the user. The user provides a terminal watermark to the client application to request a user token. On the user's host management system terminal, the token request creation method requires a dynamically generated terminal watermark, a terminal pre-shared key, a terminal asset identification number, and a service ID issued to the service by the receiving agent. The agent verifies the received service ID and, only upon successful verification using the associated public key, generates and issues a user token with attached information and an encrypted password for decryption at the user's host management system terminal with the terminal watermark. The username, decrypted password, and user token are forwarded to the service via an encrypted secure channel, and the server certificate is extended validated.

[0043] Register with the proxy using a service principal name. The client certificate of the server hosting the service and the server certificate of the proxy server hosting the proxy are used to establish a mutually secure connection using Secure Sockets Layer, or TLS. The proxy generates and returns a universally unique service ID linked to the server's fully qualified domain name.

[0044] The user of the host management system terminal uses the proxy server's server certificate to register a service profile with the proxy over a secure connection. The client application on the host management system terminal encrypts the password in the service profile using the terminal watermark and the user's terminal watermark, and then transmits it to the proxy. The user's registered service profile is further encrypted using the proxy server's hardware key and stored in the proxy repository. The client application on the host management system terminal can query the registered service profile for a service when the user accesses the service.

[0045] In summary, the present invention proposes an identity recognition method based on a host management system, in which the user password does not need to be manually entered, and the terminal watermark used for identity recognition is not stored in the terminal, which prevents attackers from using leaked passwords and improves the security of identity recognition.

[0046] Obviously, those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using a general-purpose computing system. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Alternatively, they can be implemented using program code executable by a computing system, which can then be stored in a storage system and executed by the computing system. Thus, the present invention is not limited to any specific combination of hardware and software.

[0047] It should be understood that the above-described specific embodiments of the present invention are merely illustrative or illustrative of the principles of the present invention and do not constitute limitations of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included within the scope of protection of the present invention. In addition, the appended claims are intended to cover all variations and modifications that fall within the scope and metes and bounds of the appended claims, or equivalents thereof.

Claims

1. A method for identifying a user based on a dormitory management system, wherein a dormitory management system terminal provides user identification to an accessed campus cloud service, characterized in that: include: registering a user with the cloud agent to create a password and a user identification code for the user, the password and user identification code being linked to an account associated with the user group; receiving a request from a user of the terminal of the host management system to register the terminal with the cloud agent, to create a terminal profile including the received unique terminal identifier required for generating a terminal watermark and a terminal pre-shared key, and to create a terminal asset identification number for the terminal of the host management system; registering a plurality of services with the agent according to a service profile used by the user, wherein the service profile includes a service subject name, a user name associated with the service subject name, a password and a terminal asset identification number, and a password encrypted at a terminal of a host management system using a terminal watermark; storing registered user, dormitory management system terminal, and service profiles in a repository of a cloud agent; authorizing the user to access services at the dormitory management system terminal, wherein the cloud agent is executed on the accessed campus cloud service; receiving a user terminal watermark from a user, generating a user token request by the host management system terminal, the user token request including a terminal asset identification number, an account, a timestamp, a digital signature generated using the terminal watermark and the timestamp, a service principal name, a user name associated with the service, and a digital signature service ID received via a cloud-based proxy; and sending the generated user token request by the host management system terminal to the cloud-based proxy; Processing the received user token request to generate a one-time user token linked to the accessed campus cloud service; Sending the generated one-time user token to the dormitory management system terminal; decrypting the encrypted password in the received one-time user token by the terminal watermark of the dormitory management system terminal; forwarding the decrypted password and the pre-authentication token with the one-time user token to the cloud agent of the accessed campus cloud service by the dormitory management system terminal; The one-time user token received from the client application is verified by the cloud agent of the accessed campus cloud service; authenticating the user based on the received password and a pre-authentication token included in the verified one-time user token; as well as Notify the user of the authentication result of the dormitory management system terminal access service.

Images