Enterprise-level business system authentication method, device and system

Abstract

The present application provides an enterprise-level business system authentication method, device and system, which relates to the field of information authentication technology and can be used in the financial field. The method includes: receiving the customer login request authentication information sent by the business system server and verifying the login request, returning the login page to the client browser after the verification is passed; receiving the account and password information submitted by the customer and verifying the legitimacy of the customer; extracting the account association information of the customer's multiple business systems after the legitimacy verification is passed, encrypting the account association information and sending it to the business system server, and opening the transaction page for the customer after the decryption and verification by the business system server. The present application decouples the transaction function and the authentication function from multiple business systems, and integrates the authentication function into the authentication server, thereby enhancing the independence of the authentication system, making the module division and responsibilities relatively clear, and minimizing the impact of changes in the module itself on transactions of other partner systems, thereby ensuring the flexibility of the business.

Description

Technical Field

[0001] The present application relates to the field of information authentication technology, can be used in the financial field, and particularly relates to an enterprise-level business system authentication method, device and system. Background Art

[0002] At present, banks have more and more business systems for corporate customers, such as corporate online banking, corporate mobile banking, Rong E Shopping B2B Mall, Rong E Shopping Merchant Center, Rong E Lian Service Management Platform, etc. If corporate customers currently need to use the functions of a business system, they need to first register their user information in the current business system in the following way: first open the business system page, enter the group name, business license or organization code, insert the U-Shield, mobile phone number, enter the SMS verification code and other trusted authentication elements, and complete the registration of the current business system. When this corporate customer wants to use the functions in another business system, he needs to go to another system and repeat the registration process. This leads to the following problems in the current enterprise-level business system authentication: (1) When corporate customers use a new system, they need to re-register their customer information before using it, and the registration process is cumbersome. (2) When customers switch between multiple business systems, they need to log in again, and the switching login process is cumbersome. (3) Customers need to manage the user information of multiple business systems separately, which is complicated. (4) When banks launch a system, their existing customer base cannot be quickly expanded to customers of the target new system. (5) Customer authentication information and basic customer information are coupled with customer information in the business system and permission information, resulting in poor scalability. (6) Registration and authentication information of different business systems are managed separately, but the business tends to share information, which increases the complexity of the system. Summary of the invention

[0003] In view of this, the present invention provides an enterprise-level business system authentication method, device and system to solve at least one of the above-mentioned problems.

[0004] In order to achieve the above object, the present invention adopts the following scheme:

[0005] According to a first aspect of the present invention, there is provided an enterprise-level business system authentication method, the method comprising: receiving customer login request authentication information sent by a business system server; performing login request verification according to the customer login request authentication information, and in response to the login request verification being successful, returning a login page to the client browser; receiving account and password information submitted by the customer based on the login page; performing legitimacy verification on the customer according to the account and password information; in response to the legitimacy verification being successful, extracting the customer's account association information of multiple business systems, and encrypting the account association information and sending it to the business system server, which will decrypt and verify the information and then open a business system transaction page for the customer.

[0006] According to a second aspect of the present invention, there is provided an enterprise-level business system authentication device, the device comprising: a first receiving unit, for receiving customer login request authentication information sent by a business system server; a login verification unit, for performing login request verification according to the customer login request authentication information, and returning a login page to the client browser in response to the login request verification being successful; a second receiving unit, for receiving account and password information submitted by the customer based on the login page; an account verification unit, for performing legitimacy verification on the customer according to the account and password information; a login feedback unit, for extracting the customer's account association information of multiple business systems in response to the legitimacy verification being successful, and encrypting the account association information and sending it to the business system server, which will decrypt and verify the information and then open a business system transaction page for the customer.

[0007] According to a third aspect of the present invention, there is provided an enterprise-level business system authentication system, the system comprising: a client, a business system server and an authentication server, the client being communicatively connected to the business system server and the authentication server respectively, the business system server and the authentication server being communicatively connected to each other, and the authentication server comprising the enterprise-level business system authentication device as described above.

[0008] According to a fourth aspect of the present invention, there is provided an electronic device comprising a memory, a processor and a debugging program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned enterprise-level business system authentication method when executing the debugging program.

[0009] According to a fifth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above-mentioned enterprise-level business system authentication method when executed by a processor.

[0010] According to a sixth aspect of the present invention, there is provided a computer program product, comprising a computer program / instruction, which implements the steps of the above-mentioned enterprise-level business system authentication method when executed by a processor.

[0011] The enterprise-level business system authentication method, device and system provided by the embodiments of the present invention decouple the transaction function and the authentication function from multiple business systems and integrate the authentication function into the authentication server, thereby enhancing the independence of the authentication system, making the module division and responsibilities relatively clear, and minimizing the impact of changes in the module itself on transactions with other partner systems, thereby ensuring business flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0013] Figure 1 It is a flowchart of an enterprise-level business system authentication method provided in an embodiment of the present application;

[0014] Figure 2 It is a detailed flow chart of an enterprise-level business system authentication method provided in an embodiment of the present application;

[0015] Figure 3 It is a structural diagram of an enterprise-level business system authentication device provided in an embodiment of the present application;

[0016] Figure 4 It is a schematic diagram of the structure of an enterprise-level business system authentication system provided by an embodiment of the present application;

[0017] Figure 5 is a schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0019] It should be noted that the enterprise-level business system authentication method, device and system disclosed in this application can be used in the financial field, and can also be used in any field other than the financial field. This application does not limit the application field of the disclosed enterprise-level business system authentication method, device and system.

[0020] The following is a brief introduction to some technical terms in the field involved in this application:

[0021] The term "SM4": is a block cipher algorithm commonly used in areas such as wireless Internet encryption.

[0022] Term "SM2": A public key algorithm with an encryption strength of 256 bits.

[0023] like Figure 1The figure shows a flow chart of an enterprise-level business system authentication method provided by an embodiment of the present application. The implementation subject of this embodiment is an authentication server. In the specific implementation, the function of the authentication server can be integrated into the existing enterprise electronic communication certificate server to save the hardware cost of development. The method includes the following steps:

[0024] S101: Receive customer login request authentication information sent by the business system server.

[0025] In this embodiment, when the customer initiates registration and account login through the browser, such as clicking the registration and login buttons in the browser page, after the business system server receives the click message, it will send a customer login request authentication information to the authentication server.

[0026] Preferably, the login request authentication information in this step can be sent by the business system server in the form of interface request message information, and the login request authentication information can include: interface request message information after SM4 symmetric encryption, valid timestamp and SM2 private key signature. Through the encrypted transmission of national secret algorithms SM4 and SM2, the login request authentication information can be effectively prevented from being tampered with, and the valid timestamp can prevent the login request authentication information from being reused, which can protect the effective operation of the system.

[0027] S102: Performing login request verification according to the client login request authentication information, and returning a login page to the client browser in response to the login request being verified successfully.

[0028] In this embodiment, the login request verification can be authenticated according to the rules agreed upon between the business system server and the authentication server. For example, when the above-mentioned login request authentication information includes the interface request message information, valid timestamp and SM2 private key signature after SM4 symmetric encryption, the login request verification can include the following methods: decrypt the interface message information in the customer login request authentication information according to the agreed symmetric key SM4, and use the SM2 public key reserved by the business system to verify the signature.

[0029] When the login request is verified, the authentication center can return the login page directly to the client's browser instead of going through the business system processing server, shortening the system response time and avoiding affecting the customer's user experience due to long response time.

[0030] S103: Receive the account and password information submitted by the customer based on the login page.

[0031] S104: Verify the legitimacy of the customer based on the account and password information.

[0032] Preferably, this step can verify the legitimacy of the customer by comparing the account and password information with the inventory information for consistency.

[0033] S105: In response to the legitimacy verification being passed, extract the account association information of the customer's multiple business systems, encrypt the account association information and send it to the business system server, which will decrypt and verify the information and open the business system transaction page for the customer.

[0034] In this embodiment, corporate customers only need one account in multiple business systems. They can sign a unified access agreement at the counter and have the staff enter their account information into the authentication server. Therefore, the account association information in this embodiment may include the following information: the corresponding business system information of the account opening and the authority information of the account in the corresponding business system, etc. In addition, if the corporate customer has registered one or more business system accounts through the registration page, he can also sign a unified access agreement at the counter and retain one of the accounts to open the login authority of other required business systems. By associating multiple business system accounts in the authentication server, the authentication functions of the business systems can be gathered together to improve the customer experience.

[0035] Preferably, in this step, encrypting the account association information and sending it to the business system server may include: using SM4 symmetric encryption to generate a unified token for the account association information, and attaching a valid timestamp and SM2 private key signature to send it to the business system server. Correspondingly, in this step, the business system server decryption verification includes: the business system server uses the symmetric key SM4 agreed upon by both parties to decrypt, and then uses the SM2 public key to verify the signature.

[0036] Preferably, after receiving the unified token in this step, the business system server can also perform integrity check on the unified token after the token is restored. If the integrity check fails, the authentication server is notified to resend the unified token. From the above description, it can be seen that this embodiment adopts two-way authentication based on the unified token of national secrets to ensure the integrity and consistency of the storage, transmission and verification of user information, and avoid the risk of tampering with information by unauthorized tampering.

[0037] In order to explain this application more clearly, Figure 2 The method flow of this application is further described as follows: Figure 2The figure shows a detailed flow chart of an enterprise-level business system authentication method provided by an embodiment of the present application, the method comprising the following steps: the client browser initiates a login request authentication to the business system server; after receiving the request, the business system server performs SM4 encryption and SM2 signing on the interface information and then sends the client login request authentication information to the enterprise electronic pass server; after receiving the login request interface information, the enterprise electronic pass server parses the interface information message, obtains the appid, ciphertext and signature, and then performs SM4 decryption according to the corresponding symmetric key, and performs public key SM2 signature verification on the content, and after the signature verification passes, opens the authentication service page for the customer in the client browser page; the client The browser enters the account and password in the authentication service page to log in, and the account and password information is sent to the enterprise electronic pass server through the network; after receiving the account and password information, the enterprise electronic pass server verifies its legitimacy. After the verification passes, it extracts the account association information of the customer's multiple business systems, and uses SM4 encryption and SM2 signature on the account association information to generate a unified token and send it to the business system server; the business system server restores the received token and checks the integrity of the token. After the integrity check passes, it continues to use the symmetric key for SM4 decryption and performs public key SM2 signature verification on the content. After the signature verification passes, the business system transaction page is opened for the client browser for customer operation.

[0038] In summary, the enterprise-level business system authentication method provided by the embodiment of the present invention decouples the transaction function and the authentication function from multiple business systems and integrates the authentication function into the authentication server, thereby enhancing the independence of the authentication system, making the module division and responsibilities relatively clear, and minimizing the impact of changes in the module itself on transactions with other partner systems, thereby ensuring business flexibility.

[0039] like Figure 3 The figure shows a schematic diagram of the structure of an enterprise-level business system authentication device provided in an embodiment of the present application. The device comprises: a first receiving unit 310, a login verification unit 320, a second receiving unit 330, an account verification unit 340 and a login feedback unit 350. The first receiving unit 310 is connected to the login verification unit 320, and the account verification unit 340 is respectively connected to the second receiving unit 330 and the login feedback unit 350.

[0040] The first receiving unit 310 is used to receive client login request authentication information sent by the business system server.

[0041] Preferably, the customer login request authentication information includes the interface request message information after SM4 symmetric encryption, a valid timestamp and an SM2 private key signature.

[0042] The login verification unit 320 is used to verify the login request according to the client login request authentication information received by the first receiving unit 310, and return a login page to the client browser in response to the login request being verified successfully.

[0043] Preferably, the login verification unit 320 performs login request verification on the customer login request authentication information, which may specifically include: decrypting the interface message information in the customer login request authentication information according to the agreed symmetric key SM4, and using the SM2 public key reserved by the business system to verify the signature.

[0044] The second receiving unit 330 is used to receive the account and password information submitted by the customer based on the login page.

[0045] The account verification unit 340 is used to verify the legitimacy of the client according to the account and password information received by the second receiving unit 330 .

[0046] Preferably, the account verification unit 340 verifies the legitimacy of the customer according to the account and password information, which may specifically include: verifying the legitimacy of the customer by comparing the account and password information with inventory information for consistency.

[0047] The login feedback unit 350 is used to extract the customer's account association information of multiple business systems in response to the legitimacy verification being passed, and encrypt the account association information and send it to the business system server, which will then decrypt and verify it and open the business system transaction page for the customer.

[0048] Preferably, the account association information includes information about the corresponding business system opened for the account and permission information of the account in the corresponding business system.

[0049] Preferably, the login feedback unit 350 encrypts the account association information and sends it to the business system server, which may specifically include: using SM4 symmetric encryption to generate a unified token for the account association information, and attaching a valid timestamp and SM2 private key signature to send it to the business system server.

[0050] Correspondingly, the business system server decryption verification includes: the business system server uses the symmetric key SM4 agreed upon by both parties to decrypt, and then uses the SM2 public key to verify the signature.

[0051] Preferably, after receiving the unified token, the business system server may also perform an integrity check on the unified token. If the integrity check fails, the authentication server is notified to resend the unified token.

[0052] The detailed description of the above units can refer to the corresponding description in the aforementioned method embodiment, which will not be repeated here.

[0053] The enterprise-level business system authentication device provided by the embodiment of the present invention decouples the transaction function and the authentication function from multiple business systems, and integrates the authentication function into the authentication server, thereby enhancing the independence of the authentication system, making the module division and responsibilities relatively clear, and minimizing the impact of changes in the module itself on transactions with other partner systems, thereby ensuring the flexibility of the business. In addition, due to the use of two-way authentication based on a unified token of national secrets, the integrity and consistency of the storage, transmission and verification of user information can be guaranteed, and the risk of unauthorized tampering with information can be avoided.

[0054] like Figure 4 As shown is a schematic diagram of the structure of an enterprise-level business system authentication system provided in an embodiment of the present application, the system includes: a client 401, a business system server 402 and an authentication server 403, the client 401 is respectively communicated with the business system server 402 and the authentication server 403, the business system server 402 and the authentication server 403 are communicated with each other, and the authentication server 403 includes the enterprise-level business system authentication device as described above.

[0055] The enterprise-level business system authentication system provided by the embodiment of the invention decouples the transaction function and the authentication function from multiple business systems, and integrates the authentication function into the authentication server, thereby enhancing the independence of the authentication system, making the module division and responsibilities relatively clear, and minimizing the impact of changes in the module itself on transactions with other partner systems, thereby ensuring the flexibility of the business. In addition, due to the use of two-way authentication based on a unified token of national secrets, the integrity and consistency of the storage, transmission and verification of user information can be guaranteed, and the risk of unauthorized tampering with information can be avoided.

[0056] Figure 5 is a schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 5 The electronic device shown is a general data processing device, which includes a general computer hardware structure, which at least includes a processor 501 and a memory 502. The processor 501 and the memory 502 are connected via a bus 503. The memory 502 is suitable for storing one or more instructions or programs executable by the processor 501. The one or more instructions or programs are executed by the processor 501 to implement the steps in the enterprise-level business system authentication method.

[0057] The processor 501 may be an independent microprocessor or a collection of one or more microprocessors. Thus, the processor 501 executes the commands stored in the memory 502, thereby executing the method flow of the embodiment of the present invention as described above to realize the processing of data and the control of other devices. The bus 503 connects the above-mentioned multiple components together, and at the same time connects the above-mentioned components to the display controller 504 and the display device and the input / output (I / O) device 505. The input / output (I / O) device 505 may be a mouse, a keyboard, a modem, a network interface, a touch input device, a somatosensory input device, a printer, and other devices known in the art. Typically, the input / output (I / O) device 505 is connected to the system via an input / output (I / O) controller 506.

[0058] The memory 502 may store software components such as an operating system, a communication module, an interaction module, and an application program. Each of the modules and applications described above corresponds to a set of executable program instructions that implement one or more functions and methods described in the embodiments of the invention.

[0059] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned enterprise-level business system authentication method are implemented.

[0060] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned enterprise-level business system authentication method when executed by a processor.

[0061] In summary, the enterprise-level business system authentication method, device and system provided by the embodiment of the present invention can enhance the independence of the authentication system by decoupling the transaction function and the authentication function from multiple business systems and integrating the authentication function into the authentication server, so that the module division and responsibilities are relatively clear, and the changes in the module itself minimize the impact on the transactions of other partner systems, thereby ensuring the flexibility of the business. In addition, due to the use of two-way authentication based on the unified token of national secrets, the integrity and consistency of the storage, transmission and verification of user information can be guaranteed, and the risk of unauthorized tampering of information can be avoided.

[0062] The preferred embodiments of the present invention are described above with reference to the accompanying drawings. Many features and advantages of these embodiments are clear from this detailed description, and therefore the claims are intended to cover all such features and advantages of these embodiments that fall within their true spirit and scope. In addition, since many modifications and changes are easily conceivable to those skilled in the art, it is not intended to limit the embodiments of the present invention to the precise structure and operation illustrated and described, but all suitable modifications and equivalents falling within its scope may be covered.

[0063] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0064] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0065] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0066] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0067] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An enterprise-level business system authentication method, characterized in that: The method is performed by an enterprise electronic pass server, and includes: Receive a login request authentication initiated by a client to a business system server via a client browser, and the client login request authentication information sent by the business system server includes: interface request message information after SM4 symmetric encryption, a valid timestamp and an SM2 private key signature; Performing login request verification according to the client login request authentication information, and returning a login page to the client browser in response to the login request verification being successful; Receiving the account and password information submitted by the customer based on the login page; Verify the legitimacy of the customer based on the account and password information; In response to the legitimacy verification being passed, extracting the account association information of the customer's multiple business systems, and encrypting the account association information and sending it to the business system server, which then decrypts and verifies the information and opens a business system transaction page for the customer; the account association information includes the corresponding business system information of the account and the authority information of the account in the corresponding business system; The step of encrypting the account association information and sending it to the business system server includes: using SM4 symmetric encryption to generate a unified token for the account association information, and attaching a valid timestamp and an SM2 private key signature to send it to the business system server; The business system server decryption verification includes: the business system server uses the symmetric key SM4 agreed by both parties to decrypt, and then uses the SM2 public key to verify the signature; After receiving the unified token, the business system server performs an integrity check on the unified token. If the integrity check fails, the enterprise electronic pass server is notified to resend the unified token.

2. The enterprise-level business system authentication method according to claim 1, characterized in that: The performing of login request verification according to the client login request authentication information comprises: The interface request message information in the customer login request authentication information is decrypted according to the agreed symmetric key SM4, and the signature is verified using the SM2 public key reserved by the business system.

3. The enterprise-level business system authentication method according to claim 1, characterized in that: The verifying the legitimacy of the customer based on the account number and password information includes: verifying the legitimacy of the customer by comparing the account number and password information with inventory information for consistency.

4. An enterprise-level business system authentication device, characterized in that: include: The first receiving unit is used to receive the client's login request authentication sent by the business system server via the client browser, wherein the client's login request authentication information includes: interface request message information after SM4 symmetric encryption, a valid timestamp and an SM2 private key signature; A login verification unit, configured to verify the login request according to the client login request authentication information, and return a login page to the client browser in response to the login request being verified successfully; A second receiving unit, used to receive the account and password information submitted by the customer based on the login page; An account verification unit, used to verify the legitimacy of the customer based on the account and password information; A login feedback unit, in response to the passing of the legitimacy verification, extracts the account association information of the customer's multiple business systems, encrypts the account association information and sends it to the business system server, which decrypts and verifies the information and opens the business system transaction page for the customer; the account association information includes the corresponding business system information of the account and the authority information of the account in the corresponding business system; The step of encrypting the account association information and sending it to the business system server includes: using SM4 symmetric encryption to generate a unified token for the account association information, and attaching a valid timestamp and an SM2 private key signature to send it to the business system server; The business system server decryption verification includes: the business system server uses the symmetric key SM4 agreed by both parties to decrypt, and then uses the SM2 public key to verify the signature; After receiving the unified token, the business system server performs an integrity check on the unified token. If the integrity check fails, the authentication server is notified to resend the unified token.

5. An enterprise-level business system authentication system, characterized in that: The system includes: a client, a business system server and an authentication server, the client is respectively connected to the business system server and the authentication server for communication, the business system server and the authentication server are connected to each other for communication, and the authentication server includes the enterprise-level business system authentication device as described in claim 4.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the enterprise-level business system authentication method according to any one of claims 1 to 3 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the enterprise-level business system authentication method according to any one of claims 1 to 3 are implemented.

Images