A system for realizing unified identity authentication of one factory and multiple places

Abstract

The application discloses a system for realizing unified identity authentication of one factory and multiple places, which comprises one main platform and more than one auxiliary platform; the main platform is used for certificate issuing and auditing, and realizes authentication login of the system; the auxiliary platform is used for issuing the certificate which has passed the auditing of the main platform, and realizes authentication login of the system. The application designs different implementation schemes of the main platform and the auxiliary platform according to the use scene of one factory and multiple places, proposes a feasible method which can realize fast and efficient unified identity authentication service and stable and reliable system-level and application-level identity authentication service, and effectively reduces the implementation cost of the whole project.

Description

Technical Field

[0001] This invention belongs to the field of computer digital encryption certificates, identity authentication, unified security authentication, and data transmission technology, and relates to a system for realizing unified identity authentication in multiple locations within a single factory. Background Technology

[0002] PKI / CA systems refer to identity authentication centers based on public key infrastructure. PKI technology solves various obstacles to network communication security, while CA technology addresses network information issues from multiple aspects such as operation, management, standardization, personnel, and permissions. From an overall architectural perspective, PKI / CA mainly consists of end users, authentication centers, and registration authorities. PKI / CA technology uses digital certificates as its core to encrypt and decrypt information transmitted over the network, as well as perform digital signatures and signature verification, thereby ensuring: ① information is not stolen by anyone other than the sender and receiver; ② information is not tampered with during transmission; ③ the sender can verify the receiver's identity through the digital certificate; ④ the sender cannot deny the authenticity of their information. PKI / CA solutions are widely used in e-commerce and national security fields globally.

[0003] To meet the new standards of the State Cryptography Administration, the Administration stipulates that "all existing and planned PKI-based systems must support the SM2 algorithm. CA authentication systems and key management systems under construction and planned should adopt the SM2 algorithm, and newly developed products containing public-key cryptography algorithms need to support both SM2 and RSA certificates." The RSA algorithm is an encryption algorithm based on internationally recognized operating systems, while the SM2 algorithm is a public-key cryptography algorithm independently designed in my country.

[0004] Therefore, for scenarios involving a single factory in multiple locations, it is urgent to design a new architecture for unified identity authentication using the SM2 algorithm of the State Cryptography Administration, which is convenient, fast, and efficient, based on PKI / CA. Summary of the Invention

[0005] Objective: To provide a system for unified identity authentication across multiple locations within a single factory. This invention addresses the scenario of a factory operating in multiple locations by designing different implementation schemes for main and auxiliary platforms. It proposes a feasible method to achieve fast, efficient, and unified identity authentication services, as well as stable and reliable system-level and application-level identity authentication services, effectively reducing the overall project implementation cost.

[0006] Technical solution: A system for unified identity authentication across multiple locations within a single factory, comprising a main platform and one or more auxiliary platforms; the main platform is used for certificate issuance and auditing to enable system authentication and login, while the auxiliary platforms are used for issuing certificates that have passed the audit by the main platform to enable system authentication and login.

[0007] In the aforementioned system for achieving unified identity authentication across multiple locations within a single factory, the main platform includes a main PKI / CA infrastructure platform and a main application security support center. The main PKI / CA infrastructure platform is used for certificate issuance and auditing of certificates provided by auxiliary platforms. The main application security support center is used to implement system authentication and login. The auxiliary platform includes an auxiliary PKI / CA infrastructure platform and a main application security support center. It is used for issuing certificates that have passed the main platform's audit. The main application security support center is used to implement system authentication and login.

[0008] In the aforementioned system for achieving unified identity authentication across multiple locations within a single factory, the primary PKI / CA infrastructure platform comprises a database, a CA certificate management center, an encryption machine, a KM key management center, a primary RA user registration management center, a primary LDAP system, a secondary LDAP system I, a primary OCSP certificate online status query system, a CDS-M certificate integrated management system, and an SA certificate security integrated audit system. The CA certificate management center is used to sign encrypted digital certificates using both SM2 and RSA algorithms. The encryption machine is used to generate asymmetric key pairs and encrypt them. The KM key management center is used to store the encrypted asymmetric key pairs. The primary RA user registration management center... The Registration Management Center is responsible for entering and reviewing certificate applicant information and issuing certificates, as well as managing the issued certificates. The primary LDAP system (Lightweight Directory Access Protocol) is used to publish directory system services for quick querying. The secondary LDAP system I is used for mutual backup and push functionality with the primary LDAP system. The primary OCSP certificate online status query system provides real-time certificate status queries. The CDS-M certificate integrated management system provides online self-service management for CA accounts and keys. The SA certificate security integrated audit system is used to conduct security audits of the CA certificate management center, KM key management center, and primary RA user registration management center.

[0009] In the aforementioned system for achieving unified identity authentication across multiple locations within a single factory, the online self-service management service provides the following functions: accepting and managing certificate applications, reviews, updates, revocations, USB key unlocking, reissues, and statistical queries via the internet; providing users with functions for downloading, revoking, and querying personal certificates; and recording certificate login and operation activities.

[0010] In the aforementioned system for achieving unified identity authentication across multiple locations within a single factory, the asymmetric key pairs include 1024 / 2048 / 3072 / 4096-bit RAS key pairs and 256-bit SM2 key pairs.

[0011] In the aforementioned system for achieving unified identity authentication across multiple locations within a single factory, the main application security support center comprises a security authentication gateway and a terminal security login server. The terminal security login system is used to achieve centralized management, log collection and analysis, unified policy distribution, and separation of personnel on the server side. The security authentication gateway is used to ensure the security of application system resources and prevent unauthorized access to application system resources, thereby meeting the application layer's requirements for enhanced identity authentication and encrypted channel establishment. It also supports RSA and SM2 algorithms and supports a self-loaded mode, enabling a two-server network management load balancing deployment.

[0012] In the aforementioned system for achieving unified identity authentication across multiple locations within a single factory, the main platform also includes a main business operation area. This main business operation area consists of one or more business terminals, each equipped with a key for secure storage of private keys and algorithms. The key includes fingerprint keys and USB keys, both supporting the domestic SM2 algorithm.

[0013] In the aforementioned system for achieving unified identity authentication across multiple locations within a single factory, the auxiliary platform consists of two parts: an auxiliary PKI / CA infrastructure platform and an auxiliary application security support center. The auxiliary PKI / CA infrastructure platform comprises an auxiliary RA user registration management center, an LDAP system II, and an auxiliary OCSP certificate online status query system.

[0014] In the aforementioned system for implementing unified identity authentication across multiple locations within a single factory, the auxiliary application security support center consists of an auxiliary security authentication gateway and an auxiliary terminal security login system.

[0015] Beneficial effects: The original solution for identity authentication in a multi-location factory setting required the same configuration and implementation plan to be used in each park, which resulted in the same equipment being used repeatedly in different parks, making it difficult to reduce construction costs.

[0016] This invention addresses the multi-location application scenario of a single factory by designing different implementation schemes for a main platform and a secondary platform. It proposes a feasible method to achieve fast, efficient, and unified identity authentication services, as well as stable and reliable system-level and application-level identity authentication services (including certificate issuance, renewal, and revocation), effectively reducing the overall project implementation cost. In this invention, the secondary platform reduces the number of servers, encryption machine, and six sub-functional modules compared to the main platform. The total construction cost of the secondary platform is only 50% of that of the main platform, effectively reducing deployment time and maintenance costs, and achieving efficient resource utilization.

[0017] While significantly reducing costs, this invention designs LDAP services on both the main and auxiliary platforms to ensure the stability of core identity authentication without affecting the stability of the core business. This enables localized and rapid authentication, and a backup LDAP is designed to ensure that the core business does not become unstable due to the significant cost reduction.

[0018] To establish a foundational platform for identity authentication (strong identity authentication) within the factory's information system, the identity authentication system issues digital identity certificates for terminals, users, and resources within the park. Considering the unique physical environment of a factory with multiple locations, this invention designs a complete PKI / CA system deployed on the main platform, with several auxiliary platforms connected to the PKI / CA digital certificate foundational platform as auxiliary certificate registration and verification centers to ensure efficient and usable functionality.

[0019] For strong authentication, the main requirements are: ① certificate issuance and related functions; ② system-level authentication; and ③ application-level authentication. To address these three requirements, a master-slave architecture will be used, with different devices deployed in different regions to ensure high efficiency and availability.

[0020] ① Certificate issuance related functions: Deploy a complete PKI / CA infrastructure platform on the main platform to handle the entire process of certificate application, approval, issuance, encryption, modification, and revocation, and to audit all certificate operations accordingly.

[0021] On the auxiliary platform, certificate issuance-related functions are only deployed in the RA user registration management center. The purpose is to enable localized operation of digital certificate application, approval and issuance, while other related facilities transmit data remotely, so as to achieve efficient use of resources while ensuring low cost.

[0022] ②System-level identity authentication: Deploy a terminal security login server on the main platform to provide hardware support for system-level identity authentication; deploy another terminal security login server on the auxiliary platform to provide hardware support for system-level identity authentication.

[0023] The purpose of deploying endpoint security login servers in two locations is to improve the efficiency of system-level identity authentication and provide backup.

[0024] ③ Application-level identity authentication: Deploy a security authentication gateway (primary and backup), LDAP (primary and backup), and an online OCSP certificate status query system on the main platform; deploy a security authentication gateway (primary and backup), LDAP (backup), and an online OCSP certificate status query system on the auxiliary platform;

[0025] Deploying three LDAP instances (one primary and two backups) in two locations, along with one OCSP instance in each location, is to improve the efficiency of local application-level identity authentication and provide backup. Attached Figure Description

[0026] Figure 1 This is the overall topology of the present invention;

[0027] Figure 2 Flowchart of the execution logic for issuing encryption certificates on the main platform;

[0028] Figure 3 Flowchart of the execution logic for issuing encryption certificates on the auxiliary platform;

[0029] Figure 4 The flowchart shows the logic for system-level identity authentication on the main platform.

[0030] Figure 5 Here is a flowchart illustrating the system-level identity authentication logic on the auxiliary platform;

[0031] Figure 6 This is the execution logic for application-level identity authentication on the main platform.

[0032] Figure 7 This is the execution logic for application-level identity authentication performed on the auxiliary platform. Detailed Implementation

[0033] Example 1. A system for implementing unified identity authentication across multiple locations within a single factory, for participants Figures 1-7 The main design scheme is to design a main platform and multiple auxiliary platforms, referred to as one main platform and multiple auxiliary platforms. This architecture is suitable for enterprise architectures with parallel hierarchies.

[0034] 1. Main Platform Planning

[0035] 1.1 Overall Planning of the Main Platform:

[0036] The main platform consists of the main PKI / CA infrastructure platform and the main application security support center.

[0037] The main PKI / CA infrastructure platform consists of a database, a CA certificate management center, a KM key management center, a main RA user registration management center, a main LDAP system, a secondary LDAP system I, an encryption machine, a main OCSP certificate online status query system, a CDS-M certificate integrated management system, and an SA certificate security integrated audit system.

[0038] The main application security support center consists of the main security authentication gateway and the main terminal security login server.

[0039] 1.2 Components of the main platform and their main functions:

[0040] The primary function of a Certificate Authority (CA) is to handle digital certificate-related operations, implementing both SM2 and RSA algorithms to comply with relevant national standards and specifications from the State Cryptography Administration and the Ministry of Industry and Information Technology. Certificate content must conform to the ITU-X509V standard, implementing a dual-certificate (encryption certificate and signing certificate) and dual-center (certificate management center and key management center) structure. Its core functions include issuing certificates and signing encrypted digital certificates.

[0041] The main function of the KM Key Management Center is to generate asymmetric key pairs through an encryption machine. These asymmetric key pairs are then encrypted using the master key system within the encryption machine, and the encrypted asymmetric key pairs are stored within the KM Key Management Center. The core functionality of the key management system comprises modules for key generation, key management, key repository management, authentication management, security auditing, key recovery, and cryptographic services. The key management system provides end-to-end management of encrypted certificate key pairs throughout their lifecycle, including key generation, key storage, key distribution, key backup, key update, key revocation, key archiving, key recovery, and security management.

[0042] The main RA (Registration Authority) user registration management center is primarily responsible for the entry, review, and issuance of certificate applicant information, as well as the management of issued certificates. Its core function is to provide certificate application, review, and issuance services. The RA system serves as the window to the CA (Certificate Authority) system, handling the entry, review, and issuance of certificate applicant information (security auditing). It also manages the issued certificates (security management).

[0043] LDAP stands for Lightweight Directory Access Protocol. A directory service is a special database for high-speed browsing and searching of data. The service stores information in a tree-like structure, containing attribute-based descriptive information and supporting advanced filtering features. LDAP can be considered an open-source implementation of Active Directory on Linux systems. The directory service has master-slave server synchronization capabilities. Therefore, the LDAP service needs to be deployed as a master LDAP service and a slave LDAP service. Its core functions are: publishing directory system services to enable fast queries, and a master-slave setup that allows for mutual backup and data push.

[0044] The encryption machine's functions include: encrypting and decrypting public keys for the RAS and SM2 algorithms. Its core function is key generation and management, capable of generating 1024 / 2048 / 3072 / 4096-bit RAS key pairs and 256-bit SM2 key pairs.

[0045] The core function of the main OCSP certificate status online query system is: online certificate status query service, providing real-time certificate status query, and the online certificate status protocol is used to query identity certificate status information (based on the blacklist of each application system).

[0046] The CDS Certificate Management System enables autonomous remote digital certificate operations, improving the timeliness and accuracy of certificate information changes. It provides online digital certificate renewal and information modification functions. The online update system directly faces end users (USBKey users), allowing them to submit requests for certificate issuance, reissue, revocation, and renewal online. Internally, it uses the management center's services and queries, along with the registration and auditing center's database, to determine the legitimacy of end-user requests and execute legitimate requests. Its core functions include providing online self-service management for CA accounts and keys, dynamically updating and synchronizing certificate and key lifecycles, and offering online services for certificate application, review, renewal, revocation, USBkey unlocking, reissue, and statistical queries. It also provides users with the ability to download, revoke, and query personal certificates, and records certificate login and operation activities.

[0047] SA Certificate Security Comprehensive Audit System: Capable of performing three-person audit management according to the requirements of the State Secrecy Bureau, and able to perform security audits on sub-modules such as CA, RA, and KM. It can completely retain access data from the identity authentication system and perform statistical operations such as log auditing, application auditing, user auditing, and certificate auditing. It can query the access records of a specified user within a specified time period, first listing all users, and then retrieving all users under a given node such as region or department. Optional operations allow for the statistical analysis of a specific user's access records over a specific period. Core functions: Behavioral auditing for digital certificates, consisting of four parts: detailed certificate statistics, detailed certificate query, access information statistics, and access information query. The functions include certificate statistics query, detailed certificate statistics and query, and access statistics query, which includes access information statistics and query.

[0048] The core functions of the terminal security login system are: to achieve centralized management on the server side, log collection and analysis, unified policy distribution, and separation of three personnel.

[0049] The core function of a security authentication gateway device is to ensure the security of application system resources and prevent unauthorized access to these resources, thereby meeting the application layer's requirements for enhanced identity authentication and encrypted channel establishment. It also supports RSA and SM2 algorithms. Furthermore, it supports a self-loaded mode, enabling a two-unit load-balanced deployment.

[0050] Fingerprint key: Used in business terminals, providing secure storage of private keys and algorithms. User private keys cannot be copied, are not readable externally, and have multi-key functionality. The private key cannot be exported as a key. The USB key's device driver uses Microsoft hardware device certification signature. It must support the domestic SM2 algorithm.

[0051] 2. Auxiliary platform planning

[0052] 2.1 Overall Planning of Auxiliary Platform

[0053] The auxiliary platform mainly consists of two parts: the auxiliary PKI / CA infrastructure platform and the auxiliary application security support center.

[0054] The secondary PKI / CA infrastructure platform consists of the secondary RA user registration management center, the secondary LDAP system II, and the secondary OCSP certificate online status query system.

[0055] The application security support center of the auxiliary platform consists of an auxiliary security authentication gateway and an auxiliary terminal security login system.

[0056] Example 2. If the physical addresses of the factory area are two addresses that are not in the same park, one main platform park and one auxiliary platform park need to be deployed; if the number of physical locations of the park is greater than two, then all parks other than the main platform park are defined as auxiliary platform parks.

[0057] 1. Main Platform Park Implementation Plan:

[0058] In terms of infrastructure: four servers, one encryption machine, two security authentication network management systems, and one terminal security login server.

[0059] 2. Deployment method for four servers:

[0060] ① Install and deploy the CA certificate management center, KM key management center, and main LDAP service on the server;

[0061] ② Install and deploy the RA User Registration Management Center, OCSP Certificate Status Online Inquiry System, and CDS Certificate Integrated Management System on Server 2.

[0062] ③ Install and deploy database services on server three;

[0063] ④ Install and deploy the SA certificate security comprehensive audit system on server 4, and access the LDAP service.

[0064] 3. Implementation plan for the auxiliary platform park:

[0065] In terms of infrastructure: one server, one terminal security login server, and two security authentication gateways.

[0066] Server installation and deployment include RA user registration management center, OCSP certificate status online query system, and LDAP service.

[0067] Detailed Implementation Plan

[0068] 4.1 System Environment Preparation

[0069] 4.1.1 System Configuration

[0070] All servers in this project are running Red Hat Linux 6.9. During installation, when selecting components, a custom installation (with all development tools installed) was chosen. Environment variables need to be configured:

[0071] vi / etc / profile

[0072] export JAVA_HOME= / usr / java / jdk1.8

[0073] export CLASSPATH=:$JAVA_HOME / lib / tools.jar

[0074] export PATH=JAVAHOME / bin:PATH

[0075] export LANG=zh_CN

[0076] 4.1.2 Database Configuration

[0077] Create a new database instance named cadb on an Oracle 11g database. The following points should be noted during the instance creation process:

[0078] 1. During the installation of Oracle 11g database, you need to select a Chinese character set and Chinese environment variables. The character set should be ZHS16GBK, and the Chinese environment should be set to zh_CN.

[0079] 2. After installing Oracle 11g database, tablespaces and corresponding users need to be created for each system (CA, KM, RA) on each server. The rules for creating database tablespaces and users are defined as follows:

[0080] Serial Number tablespace Size / Increase user 1 KM 1000MB / 10MB kmuser 2 KMHIS 1000MB / 10MB kmhisuser 3 CA 1000MB / 10MB causer 4 CAHIS 1000MB / 10MB cahisuser 5 RA 1000MB / 10MB rauser 6 CISMP 1000MB / 10MB cismp 7 CDS 1000MB / 10MB cds

[0081] 4.1.3 Server Time Calibration

[0082] 1. Set the calibration time manually: "date –s yyyy-mm-dd hh:mm:ss"

[0083] 2. Alternatively, synchronize time with a time source server using the command "ntpdate 192.168.*.*" (domain controller server address).

[0084] 3. Write the system time to the BIOS using the command "clock -w"

[0085] 4. All servers refer to this time calibration setting.

[0086] 4.2 Encryption Machine Configuration

[0087] 1. Destroy the key (initialize the device) before use.

[0088] 2. The encrypted machine requires an administrator password to access the settings menu after each restart.

[0089] 3. Set the encryption machine's own IP address and set the range of allowed IP addresses.

[0090] 4. Generate an RSA asymmetric key pair with an RSA modulus length of 2048, an exponent of 65537, and a key index of 0-9.

[0091] 5. Generate SM2 asymmetric key pairs, with an SM2 modulus length of 256, an exponent of 65537, and key indices of 0-9.

[0092] 6. Back up the key pair using a backup card.

[0093] 7. Start the key service.

[0094] 4.3 CA Certificate Management Center System Configuration

[0095] 1. Upload the CA compressed package to the server, use an Oracle database, create the CA's own users and tablespaces, access the database, and configure the connection with the encryption machine.

[0096] 2. Software Upload: Use the sshd tool to upload the CA software package to the directory / usr / local /

[0097] 3. Unpack the package in the following order:

[0098] Software packages -> Patch packages -> Industry patch packages

[0099] 4. CA installation path: / usr / local / SZT0901-KOALCA

[0100] Software deployment: Run the koalca.sh script from the extracted software package.

[0101] 5. After startup, you will see service port 8880.

[0102] 6. Open your browser and enter http: / / CA service settings IP:8880 to access the deployment page and manage the root certificate CN item definition: SCAAdminRoot

[0103] Administrator Certificate CN Item Definition:

[0104] Serial Number Certificate Type CN Item Name 1 Super Administrator Casuperadmin1 2 Super Administrator Casuperadmin2 3 Super Administrator Casuperadmin3 4 Audit Administrator Caauditadmin1 5 Audit Administrator Caauditadmin2 6 Audit Administrator Caauditadmin3 7 Business Administrator caopadmin 8 Business Operator caoperator 9 Auditor caauditor

[0105] 4.4KM Key Management Center Implementation

[0106] 1. Upload the KM software compressed package to the server, install KM using an Oracle database, access the database by creating KM's own users and tablespaces, and configure the connection with the encryption machine.

[0107] 2. Software Upload: Use the sshd tool to upload the KM software package to the directory / usr / local /

[0108] 3. Unpack the package in the following order:

[0109] Software packages -> Patch packages -> Industry patch packages

[0110] 4. KM installation path: / usr / local / SYT0901-KOALKM

[0111] Software deployment: Start the service.sh script in the decompressed software package.

[0112] 5. After startup, you will see service port 11080.

[0113] 6. Open your browser and enter http: / / KM service settings IP:11080 to access the deployment page.

[0114] Management root certificate CN item definition: KMAdminRoot

[0115] Administrator Certificate CN Item Definition

[0116]

[0117] 4.5RA User Registration Management Center Implementation

[0118] 1. Upload the RA software compressed package to the server, install RA using the Oracle database, access the database by creating RA's own users and tablespaces, and configure the connection with the encryption machine.

[0119] 2. Software Upload: Use the sshd tool to upload the RA software package to the directory / usr / local /

[0120] 3. Unpack the package in the following order:

[0121] Software packages -> Patch packages -> Industry patch packages

[0122] 4. RA installation path: / usr / local / SZT0901-KOALRA

[0123] Software deployment: Start the service.sh script in the decompressed software package.

[0124] 5. After startup, you will see service port 8080.

[0125] 6. Open your browser and enter http: / / RA service settings IP:8080 to access the deployment page.

[0126] Administrator Certificate CN Item Definition

[0127]

[0128] 4.6 LDAP Related Configuration

[0129] 1. Software Upload: Use the sshd tool to upload the LDAP software to the directory: / usr / local

[0130] 2. Mount the CD-ROM: mount / dev / cdrom / mnt / cdrom

[0131] 3. Copy the file: cp / mnt / cdrom / <installation file name><target directory>

[0132] 4. Add execute permissions to the installation file: chmod +x <installation file>

[0133] 5. Run the installation file: . / <installation file>.

[0134] 6. Resolve the IP address to LDAP on the domain controller.

[0135] 4.7 Automatic Startup Configuration

[0136] After writing the startup script, you must restart the system to verify whether the startup is normal.

[0137] Edit / etc / rc.local

[0138] export JAVA_HOME= / usr / java / jdk1.8

[0139] export PATH=JAVAHOME / bin:PATH

[0140] su-oracle-c'lsnrctl start'

[0141] su-oracle-c'dbstart'

[0142] sleep 5

[0143] cd / usr / local / SYT0901-KOALKM

[0144] sh / usr / local / SYT0901-KOALKM / service.sh

[0145] sleep 5

[0146] cd / usr / local / SZT0901-KOALCA

[0147] sh / usr / local / SZT0901-KOALCA / koalca.sh start

[0148] sleep 10

[0149] sh / usr / local / SZT0901-KOALCA / koalca.sh crl

[0150] sleep 5

[0151] cd / usr / local / SZT0901-KOALRA

[0152] sh / usr / local / SZT0901-KOALRA / service.sh start

[0153] sleep 5

[0154] cd / usr / local / ITEC-Ids3 / ldap

[0155] sh. / startslapd.sh

[0156] sleep 5

[0157] cd / usr / local / ITEC-Ids3 / admin / bin

[0158] sh. / startadmin

[0159] 4.8 Data Backup Configuration

[0160] Backup CA data

[0161] With the CA service stopped, execute `tar zcvf ca.bak2011mmddhhmm.tar.gz / usr / local / SZT0901-KOALCA` to transfer the tar-rendered backup package to a secure storage device.

[0162] With the KM service stopped, execute `tar zcvf km.bak2011mmddhhmm.tar.gz / usr / local / SZT0901-KOALKM` to transfer the tar-processed backup package to a secure storage device.

[0163] With the RA service stopped, execute `tar zcvf ra.bak2011mmddhhmm.tar.gz / usr / local / SZT0901-KOALRA` to transfer the tar-processed backup package to a secure storage device.

[0164] 4.9 Terminal Security Login System Configuration

[0165] The endpoint secure login (identity authentication system) is a security and confidentiality product, a hardware server with a built-in Linux operating system. To ensure the efficiency and stability of user login to the operating system, one server will be deployed on each of the main and auxiliary platforms to achieve local authentication and ensure stable user login. This endpoint secure login system is a network version, enabling full monitoring of endpoint PC protection within the campus through the server. System administrators can centrally manage the basic functions of these network security shields, providing effective security for computers on the internal network while allowing administrators to have a comprehensive understanding of the overall information security situation of endpoints within the campus.

[0166] 4.10 Security Authentication Gateway Configuration

[0167] The security authentication gateway series consists of hardware servers with a built-in Linux operating system. The series comprises four 10 Gigabit security authentication gateways. According to the plan, these four gateways will be deployed on both the primary and secondary platforms, implementing a dual-machine hot standby configuration, and connected in parallel with the portal system. The security authentication gateways use a forward proxy mode.

[0168] 4.11 Client Configuration

[0169] Each business client needs to install three software programs: ① Geer Identity Authentication System V6.0 ② Security Authentication Client ③ Certificate Assistant

[0170] ① The client-side Geer Identity Authentication System V6.0 achieves operating system-level identity authentication by connecting to a local terminal security login server (clients from the main platform region connect to the terminal security login server in the main platform backend, and clients from the secondary platform region connect to the terminal security login server in the secondary platform backend).

[0171] ② Client-side security authentication: The client achieves application-level identity authentication by connecting to the local security authentication gateway.

[0172] ③The client certificate assistant enables remote issuance, renewal, and revocation of certificates by connecting with the certificate management system.

[0173] 4.12 Firewall Access Policy Configuration

[0174] 1. Firewall policies that need to be configured on the client side

[0175]

[0176] 2. Firewall policies required for PKI / CA systems

[0177]

[0178] 4.13 Certificate Subject Information Configuration

[0179]

[0180] 4.14 Required Configuration for Signature Certificate

[0181]

[0182] 4.15 Required Configuration for Encryption Certificates

[0183]

[0184] 4.16 Test Plan

[0185] Based on the above design and implementation, tests were conducted on the collaborative cooperation between each module and each park:

[0186]

[0187] 5. Execution logic of each module and function:

[0188] 1. Issue encryption certificates on the main platform and execute logic.

[0189] ① Enter the user's relevant information into the integrated certificate management platform (main platform).

[0190] ② The entered user information will be reviewed in the RA system (main platform).

[0191] ③ After successful verification, the user information will be transmitted to the CA system (main platform).

[0192] ④ The CA system will send the issuance request to the KM (main platform).

[0193] ⑤ After registering and issuing the information, the KM system transmits the user information to the encryption machine (main platform).

[0194] ⑥ The encryption machine issues encryption certificates using the master key and transmits the encryption certificates to the CA system (main platform).

[0195] ⑦ The CA system digitally signs the encryption certificate and transmits the signed digital certificate to the RA (main platform).

[0196] ⑧RA issues certificates (main platform)

[0197] 2. Issue encryption certificates and execute logic on the auxiliary platform.

[0198] ① Enter the user's relevant information into the integrated certificate management platform (main platform).

[0199] ② The entered user information is entered into the RA system (auxiliary platform) for review.

[0200] ③ After successful verification, the user information will be transmitted to the CA system (main platform).

[0201] ④ The CA system will send the issuance request to the KM (main platform).

[0202] ⑤ After registering and issuing the information in the KM system, the user information is transmitted to the encryption machine (main platform).

[0203] ⑥ The encryption machine issues encryption certificates using the master key and transmits the encryption certificates to the CA system (main platform).

[0204] ⑦ The CA system digitally signs the encryption certificate and transmits the signed digital certificate to the RA (auxiliary platform).

[0205] ⑧RA issues certificates (auxiliary platform)

[0206] 3. Execution logic for system-level identity authentication on the main platform.

[0207] The first step is for the client to perform identity authentication (locally on the computer) upon entering the operating system;

[0208] The second step is to send the account password bound to the fingerprint key to the domain controller server for authentication (main platform) after successful authentication.

[0209] The third step is to simultaneously send the certificate information within the key to the terminal security server for authentication (main platform);

[0210] Step 4: After both verifications are successful, the verification success information will be returned to the local computer, and you can then enter the operating system.

[0211] 4. System-level identity authentication execution logic on the auxiliary platform

[0212] The first step is for the client to perform identity authentication (locally on the computer) upon entering the operating system;

[0213] The second step is to send the account password bound to the fingerprint key to the domain controller server for authentication (secondary platform) after successful authentication.

[0214] The third step is to simultaneously send the certificate information within the key to the terminal security server for authentication (auxiliary platform);

[0215] Step 4: After both verifications are successful, the verification success information will be returned to the local computer, and you can then enter the operating system.

[0216] 5. Application-level identity authentication execution logic on the main platform

[0217] Step 1: Local Security Authentication on the Client. The client transmits the certificate information to the security authentication gateway (main platform) for authentication.

[0218] The second step is for the security authentication gateway to first link with LDAP (the main platform) to perform identity verification;

[0219] The third step is for the security authentication gateway to confirm with the OCSP certificate status online query system (main platform) whether the account can access the application system;

[0220] Step 4: After both verifications are successful, you can use the certificate information to log in to the application system.

[0221] 6. Application-level identity authentication execution logic on the auxiliary platform

[0222] Step 1: Local security authentication on the client side. The client transmits the certificate information to the security authentication gateway for authentication (auxiliary platform).

[0223] The second step involves the security authentication gateway linking with LDAP (auxiliary platform) to perform identity legitimacy authentication;

[0224] The third step is for the security authentication gateway to confirm with the OCSP certificate status online query system (auxiliary platform) whether the account can access the application system;

[0225] Step 4: After both verifications are successful, you can use the certificate information to log in to the application system.

Claims

1. A system for achieving unified identity authentication across multiple locations within a single factory, characterized in that, The system includes one main platform and one or more auxiliary platforms. The main platform is used for certificate issuance and auditing to enable system authentication and login. The auxiliary platforms are used to issue certificates that have passed the audit of the main platform, enabling system authentication and login. The main platform includes a main PKI / CA infrastructure platform and a main application security support center. The main PKI / CA infrastructure platform is used for certificate issuance and auditing of certificates provided by the auxiliary platforms. The main application security support center is used to enable system authentication and login. The auxiliary platforms include auxiliary PKI / CA infrastructure platforms and auxiliary application security support centers; they are used to issue certificates that have passed the audit of the main platform. A secondary application security support center is used to implement system authentication and login. The main PKI / CA infrastructure platform consists of a database, a CA certificate management center, an encryption machine, a KM key management center, a main RA user registration management center, a main LDAP system, a secondary LDAP system I, a main OCSP certificate online status query system, a CDS-M certificate integrated management system, and an SA certificate security integrated audit system. The CA certificate management center is used to sign encrypted digital certificates using both SM2 and RSA algorithms. The encryption machine is used to generate and encrypt asymmetric key pairs. The KM key management center stores the encrypted asymmetric key pairs. The main RA user registration management center is responsible for entering and reviewing certificate applicant information and issuing certificates, while also managing the issued certificates. The main LDAP system is used to publish directory system services for quick querying. From LDAP system I, it is used to achieve mutual backup and mutual push with the main LDAP system; The main OCSP certificate online status query system provides real-time certificate status query. CDS-M Certificate Management System provides online self-service management for CA accounts and keys; The SA Certificate Security Comprehensive Audit System is used to conduct security audits on the CA Certificate Management Center, KM Key Management Center, and Main RA User Registration Management Center.

2. The system for achieving unified identity authentication across multiple locations within a single factory, as described in claim 1, is characterized in that, The online self-service management service provides the following functions: accepting and managing certificate application, review, renewal, revocation, USB key unlocking, reissue, and statistical query services online; providing users with functions for downloading, revoking, and querying personal certificates; and providing records of certificate login and operation activities.

3. The system for achieving unified identity authentication across multiple locations within a single factory, as described in claim 1, is characterized in that... Asymmetric key pairs include 1024 / 2048 / 3072 / 4096-bit RAS key pairs and 256-bit SM2 key pairs.

4. The system for achieving unified identity authentication across multiple locations within a single factory, as described in claim 1, is characterized in that... The main application security support center consists of a security authentication gateway and a terminal security login server; the terminal security login system is used to realize the functions of centralized management, log collection and analysis, unified policy distribution, and separation of personnel on the server side. The security authentication gateway is used to ensure the security of application system resources and prevent unauthorized access to application system resources, in order to meet the application layer's requirements for enhanced identity authentication and encrypted channel establishment; it also supports RSA and SM2 algorithms; and it supports self-load mode to realize a two-network management load balancing deployment mode.

5. The system for achieving unified identity authentication across multiple locations within a single factory, as described in claim 1, is characterized in that... The main platform also includes a main business operation area; the main business operation area consists of one or more business terminals, each of which is equipped with a key for providing private keys and secure storage of algorithms.

6. The system for achieving unified identity authentication across multiple locations within a single factory, as described in claim 1, is characterized in that, The auxiliary platform consists of two parts: an auxiliary PKI / CA infrastructure platform and an auxiliary application security support center. The auxiliary PKI / CA infrastructure platform consists of an auxiliary RA user registration management center, an LDAP system II, and an auxiliary OCSP certificate online status query system.

7. The system for achieving unified identity authentication across multiple locations within a single factory, as described in claim 6, is characterized in that... The auxiliary application security support center consists of an auxiliary security authentication gateway and an auxiliary terminal security login system.

Images