A method and system for unified authentication of distributed network elements

Abstract

This invention provides a unified authentication method and system for distributed network elements. In the method, the server includes a plurality of network elements and an SDK for interacting with an authentication center. The method includes: a user sending an account and password to the authentication center; the authentication center, after successful verification, writes an encrypted password, publishes an encrypted password update notification, and returns the encrypted password information to the user; the user, carrying the encrypted password, initiates an access request to a network element on the server; the network element calls the SDK to verify the encrypted password information; the SDK initiates a verification of the encrypted password information with the authentication center; the authentication center returns the validity of the encrypted password to the SDK; the SDK returns the validity of the encrypted password to the network element; and the network element, based on the validity of the encrypted password returned by the SDK, returns a corresponding business response result to the user. This invention is designed to ensure the encryption security of each network element on the server while reducing the complexity of processing business logic.

Description

Technical Field

[0001] This invention relates to the field of electronic information technology, and in particular to a unified authentication method and system for distributed network elements. Background Technology

[0002] For server-side authentication, the current mainstream approach is to use username and password authentication. Since servers are unlikely to frequently change their configured passwords, this makes them highly vulnerable to brute-force attacks. Server-side systems can be viewed as being composed of network elements with different functions. Currently, there are publicly available unified authentication methods that involve each network element on the server directly configuring authentication center information to interact with the authentication center. However, this requires configuring each network element, which is cumbersome, and changes are prone to errors or omissions. This creates operational difficulties for systems with many microservices.

[0003] To address the above problems, this invention provides a unified authentication method and system for distributed network elements that can reduce the risk of password brute-force attacks and eliminates the need for configuration of each network element. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a unified authentication method and system for distributed network elements, which ensures the encryption security of existing server-side network elements while reducing authentication configuration and lowering the difficulty of processing business logic.

[0005] In a first aspect, the present invention provides a unified authentication method for distributed network elements, the method being applied in the interaction between a user terminal and a server, the server comprising a plurality of network elements and an SDK for interacting with an authentication center, the method comprising the following steps:

[0006] Step 101: Send the account and password to the authentication center through the user terminal. After the authentication center verifies the password, it writes the encrypted password, issues an encrypted password update notification, and returns the encrypted password information to the user terminal.

[0007] Step 102: The user sends an access request to the network element on the server with an encrypted password.

[0008] Step 103: Verify the encrypted password information by calling the SDK through the network element;

[0009] Step 104: The SDK initiates a verification of the encrypted password information to the authentication center. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the network element.

[0010] Step 105: The network element returns the corresponding service response result to the user terminal based on the validity of the encrypted password returned by the SDK.

[0011] Furthermore, if step 103 is being executed for the first time, the following operations are performed after step 3:

[0012] The SDK obtains the authentication center information, the authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications.

[0013] Furthermore, the encrypted password is encrypted using a combination of MD5 and AES algorithms.

[0014] Secondly, the present invention provides a unified authentication method for distributed network elements, the method being applied to interactions between network elements within a server, the server comprising a plurality of network elements and a method for authentication.

[0015] The SDK for interaction with the certificate center includes the following steps:

[0016] Step 201: Network element service A sends the authentication code to the server SDK. The server SDK...

[0017] The authentication code is encrypted, and then the encrypted authentication code is sent to the authentication center.

[0018] Step 202: The authentication center verifies the encryption logic and authentication code. After the verification is successful, it writes the encryption password, issues an encryption password update notification, and returns the encryption password information to the server SDK.

[0019] Step 203: The server SDK returns the encrypted password to network element service A, and network element service A initiates a service request to other network elements;

[0020] Step 204: The other network elements call the SDK to verify the encrypted password information;

[0021] Step 205: The SDK sends a verification request to the authentication center to verify the encrypted password information. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the other network elements.

[0022] Step 206: The other network elements return a response based on the validity of the encrypted password returned by the SDK.

[0023] The corresponding service response result is given to network element A.

[0024] Furthermore, step 201 specifically involves: the network element service A calling the server-side SDK's "Get Encrypted Password API" and simultaneously passing the authentication code to the "Get Encrypted Password API." After the server-side SDK performs encryption processing, the encrypted authentication code is sent to the authentication center via HTTP.

[0025] Furthermore, step 202 specifically involves: the authentication center reading out the authentication code, random number, and ciphertext according to the predetermined encryption logic, determining the validity of the authentication code, encrypting the authentication code and random number into ciphertext according to another encryption logic, comparing whether the two ciphertexts are consistent, and if they are consistent, the verification passes, generating an encrypted password and returning it to the server SDK, while simultaneously issuing an encrypted password update notification.

[0026] Furthermore, the authentication code is encrypted using a combination of MD5 and AES algorithms.

[0027] Furthermore, if step 204 is being executed for the first time, the following operations are performed after step 204 is executed:

[0028] The SDK obtains the authentication center information, the authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications.

[0029] Thirdly, the present invention provides a unified authentication system for distributed network elements, which requires providing a user terminal and a server terminal. The server terminal includes a plurality of network elements and an SDK for interacting with an authentication center. The system includes:

[0030] The encrypted password acquisition module is used to send the user's account and password to the authentication center. After the authentication center verifies the password, it writes the encrypted password, issues an encrypted password update notification, and returns the encrypted password information to the user.

[0031] The request initiation module is used to initiate access requests to the network elements on the server side by sending encrypted passwords through the user terminal;

[0032] The verification module is used to call the SDK through the network element to verify the encrypted password information;

[0033] The validity acquisition module is used to initiate a verification of encrypted password information to the authentication center through the SDK. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the network element.

[0034] The service response module is used to return the corresponding service response result to the user terminal based on the validity of the encrypted password returned by the SDK through the network element.

[0035] Furthermore, if the verification module is being executed for the first time, a connection module is also included after the verification module is executed;

[0036] The connection module is used to obtain authentication center information from the SDK, the authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications.

[0037] The present invention provides one or more technical solutions, which have at least the following technical effects or advantages: Unified authentication of distributed network elements is achieved through an SDK combined with an authentication center, allowing each network element to focus on business implementation development, thus achieving single-business functionality; the SDK provides a plug-and-play approach, facilitating unified authentication of distributed network elements, with each network element implementing authentication through the same SDK; the SDK also provides the generation of server-side encrypted passwords, facilitating interaction between network elements using HTTP. The present invention can reduce authentication configuration work and lower the complexity of processing business logic while ensuring the encryption security of existing server-side network elements. Attached Figure Description

[0038] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0039] Figure 1 This is an execution flowchart of a unified authentication method for distributed network elements in Embodiment 1 of the present invention;

[0040] Figure 2 This is an interactive schematic diagram corresponding to Embodiment 1 of the present invention;

[0041] Figure 3 This is an execution flowchart of a unified authentication method for distributed network elements in Embodiment 2 of the present invention;

[0042] Figure 4 This is an interactive schematic diagram corresponding to Embodiment 2 of the present invention;

[0043] Figure 5 This is a schematic diagram of the structure of a unified authentication system for distributed network elements in Embodiment 3 of the present invention. Detailed Implementation

[0044] This application provides a unified authentication method and system for distributed network elements to solve the existing problem of brute-force attacks on ordinary user passwords, while also solving the problem of cumbersome configuration of various network elements.

[0045] The overall idea of ​​the technical solution in this application embodiment is as follows: A dedicated SDK for authentication is set up on the server side. This SDK provides an API for verifying encrypted passwords to each network element on the server side. When each network element needs to perform authentication, it only needs to call this API to automatically obtain the connection information of the authentication center and perform the authentication operation. This achieves centralized account management, and each network element does not need to directly configure the authentication center information to interact with the authentication center, reducing the cumbersome configuration of each network element and allowing the network element to focus on business implementation development, achieving single business. The SDK approach of this invention can achieve plug-and-play functionality, which facilitates the introduction of this method by network elements.

[0046] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0047] Example 1

[0048] This embodiment provides a unified authentication method for distributed network elements, such as... Figure 1 and Figure 2 As shown, the method is applied to the interaction between the user terminal and the server terminal. The server terminal includes a plurality of network elements and an SDK for interacting with the authentication center. The method includes the following steps:

[0049] Step 101: Send the account and password to the authentication center through the user terminal. After the authentication center verifies the password, it writes the encrypted password, issues an encrypted password update notification, and returns the encrypted password information to the user terminal.

[0050] Step 102: The user sends an access request to the network element on the server with an encrypted password.

[0051] Step 103: Verify the encrypted password information by calling the SDK through the network element;

[0052] Step 104: The SDK initiates a verification of the encrypted password information (carrying the encrypted password) to the authentication center. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the network element.

[0053] Step 105: The network element returns the corresponding service response result to the user terminal based on the validity of the encrypted password returned by the SDK.

[0054] Preferably, if step 103 is being performed for the first time, the following operations are performed after step 103:

[0055] The SDK obtains the authentication center information and carries the encrypted password. The authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications.

[0056] This process is executed only once: verifying the encrypted password and decrypting the request parameters (including server information and the encrypted password) in the SDK. It also verifies the built-in encryption / decryption logic. Upon successful verification, connection information is returned. The SDK establishes a connection based on this information. Once connected, the SDK subscribes to the encrypted password change channel to receive notifications of password changes. Subsequently, when a network element needs timely encrypted password information (updated via an authentication center's update mechanism), it can obtain it via a callback. After connection, the encrypted password verification process simply involves calling the SDK to verify the encrypted password information. The SDK initiates verification with the authentication center, which returns the encrypted password's validity to the SDK. The SDK then returns the validity to the network element, thus completing the encrypted password verification.

[0057] Preferably, the encrypted password is encrypted using a combination of MD5 and AES algorithms.

[0058] Example 2

[0059] This embodiment provides a unified authentication method for distributed network elements, such as... Figure 3 and Figure 4 As shown, the method is applied to the interaction between network elements within the server. The server includes a plurality of network elements and an SDK (i.e., a common SDK in the server) for interacting with the authentication center. The method includes the following steps:

[0060] Step 201: Network element service A sends the authentication code to the server SDK (a server SDK specifically used for login). The server SDK encrypts the authentication code and then sends the encrypted authentication code to the authentication center.

[0061] Step 202: The authentication center verifies the encryption logic and authentication code. After the verification is successful, it writes the encryption password, issues an encryption password update notification, and returns the encryption password information to the server SDK.

[0062] Step 203: The server SDK returns the encrypted password to network element service A, and network element service A initiates service requests to other network elements;

[0063] Step 204: The other network elements call the SDK to verify the encrypted password information;

[0064] Step 205: The SDK sends a verification request to the authentication center to verify the encrypted password information (carrying the encrypted password). The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the other network elements.

[0065] Step 206: The other network elements return the corresponding service response result to network element A based on the validity of the encrypted password returned by the SDK.

[0066] Preferably, step 201 specifically involves: the network element service A calling the server-side SDK's "Get Encrypted Password" API, simultaneously passing the authentication code to the "Get Encrypted Password" API; after the server-side SDK performs encryption processing, the encrypted authentication code is sent to the authentication center via HTTP.

[0067] Preferably, step 202 specifically involves: the authentication center reading out the authentication code, random number, and ciphertext according to the predetermined encryption logic, determining the validity of the authentication code, encrypting the authentication code and random number into ciphertext according to another encryption logic, comparing whether the two ciphertexts are consistent, and if they are consistent, the verification passes, generating an encrypted password and returning it to the server SDK, while simultaneously issuing an encrypted password update notification.

[0068] Preferably, the authentication code is encrypted using a combination of MD5 and AES algorithms.

[0069] Preferably, if step 204 is being performed for the first time, the following operations are performed after step 204:

[0070] The SDK obtains the authentication center information and carries the encrypted password. The authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications.

[0071] This process is executed successfully only once: verifying the encrypted password and decrypting the request parameters (including server information and the encrypted password) in the SDK. It also verifies the built-in encryption / decryption logic. Upon successful verification, connection information is returned, and the SDK establishes a connection based on this information. Once connected, the SDK subscribes to the encrypted password change channel to receive notifications of password changes. Subsequently, when other network elements need timely encrypted password information (encrypted password updates are performed using the authentication center's update mechanism), they can obtain it via callback. In other words, after connection, the encrypted password verification method only requires calling the SDK to verify the encrypted password information. The SDK initiates verification of the encrypted password information to the authentication center, which returns the encrypted password validity to the SDK. The SDK then returns the encrypted password validity to the other network elements, thus completing the encrypted password verification.

[0072] Example 3

[0073] This embodiment provides a unified authentication system for distributed network elements, such as... Figure 5As shown, a user terminal and a server terminal need to be provided. The server terminal includes a plurality of network elements and an SDK for interacting with the authentication center. The system includes:

[0074] The encrypted password acquisition module is used to send the user's account and password to the authentication center. After the authentication center verifies the password, it writes the encrypted password, issues an encrypted password update notification, and returns the encrypted password information to the user.

[0075] The request initiation module is used to initiate access requests to the network elements on the server side by sending encrypted passwords through the user terminal;

[0076] The verification module is used to call the SDK through the network element to verify the encrypted password information;

[0077] The validity acquisition module is used to initiate a verification of encrypted password information (carrying an encrypted password) to the authentication center through the SDK. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the network element.

[0078] The service response module is used to return the corresponding service response result to the user terminal based on the validity of the encrypted password returned by the SDK through the network element.

[0079] Preferably, if the verification module is being executed for the first time, a connection module is also included after the verification module is executed;

[0080] The connection module is used to obtain authentication center information from the SDK. The SDK also carries the encrypted password. The authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications. This process is executed only once in the entire process, namely, verifying the encrypted password, which also includes decrypting the request parameters in the SDK (including server information and the encrypted password), verifying the built-in encryption and decryption logic, and returning connection information when the verification is successful. The SDK connects based on the returned information. Once connected, the SDK subscribes to the encrypted password change channel to obtain encrypted password change notifications. Subsequently, when other network elements need to obtain real-time encrypted password information (the encrypted password is updated on demand using the authentication center's update mechanism, not shown in the figure), they can obtain it through a callback. That is, after the connection is established, the encrypted password verification method only needs to call the SDK to verify the encrypted password information. The SDK initiates the verification of the encrypted password information to the authentication center, and the authentication center returns the validity of the encrypted password to the SDK. The SDK then returns the validity of the encrypted password to the other network elements to complete the encrypted password verification.

[0081] Preferably, the encrypted password is encrypted using a combination of MD5 and AES algorithms.

[0082] This technology achieves passwordless authentication based on MD5 and AES, ensuring secure and reliable authentication. MD5 is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value to ensure the integrity and consistency of transmitted information. AES encryption is a block cipher standard and one of the most popular algorithms in symmetric-key encryption. It allows the decryptor to quickly parse the original string. The block length of AES is fixed at 128 bits, while the key length can be 128, 192, or 256 bits. The encryption in this invention can be performed using a hybrid encryption method combining MD5 and AES algorithms. The specific process of this hybrid encryption is as follows:

[0083] The random number s0 is encrypted using MD5 to obtain s1. s1 is then encrypted using AES and a pre-defined fixed encryption key to obtain s2. s2 is then encrypted using the key and MD5 to obtain the encrypted string m1. The random number s0 is then encrypted using the key to obtain the encrypted string m2. m1 and m2 are the final encrypted strings, which are the final encrypted password or authentication code.

[0084] This invention achieves unified authentication for distributed network elements through an SDK combined with an authentication center, allowing each network element to focus on business implementation development, thus achieving single-function authentication. The SDK provides plug-and-play functionality, facilitating the introduction of network elements. This invention employs a special encryption algorithm combined with authentication codes or encrypted passwords. This method reduces the complexity of processing business logic while ensuring encryption security, allowing the server to obtain the authentication encrypted password and obtain authorization without a password. The server-side SDK also provides the generation of server-side encrypted passwords, facilitating interaction between network elements via HTTP. For user-side authentication, an API encapsulation is provided, namely the SDK's API for verifying encrypted passwords. Network element authentication only requires a simple call to the SDK's judgment, eliminating the need for configuration on individual network elements, reducing configuration work and error rates, and improving overall network element authentication efficiency.

[0085] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the present invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A unified authentication method for distributed network elements, characterized in that: The method is applied to the interaction between a user terminal and a server terminal, wherein the server terminal includes a plurality of network elements and an SDK for interacting with an authentication center, and the method includes the following steps: Step 101: Send the account and password to the authentication center through the user terminal. After the authentication center verifies the password, it writes the encrypted password, issues an encrypted password update notification, and returns the encrypted password information to the user terminal. Step 102: The user sends an access request to the network element on the server with an encrypted password. Step 103: Verify the encrypted password information by calling the SDK through the network element; Step 104: The SDK initiates a verification of the encrypted password information to the authentication center. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the network element. Step 105: The network element returns the corresponding service response result to the user terminal based on the validity of the encrypted password returned by the SDK; The method also includes the interaction process between internal network elements on the server, specifically including: Step 201: Network element service A sends the authentication code to the server SDK. The server SDK encrypts the authentication code and then sends the encrypted authentication code to the authentication center. Step 202: The authentication center verifies the encryption logic and authentication code. After the verification is successful, it writes the encryption password, issues an encryption password update notification, and returns the encryption password information to the server SDK. Step 203: The server SDK returns the encrypted password to network element service A, and network element service A initiates service requests to other network elements; Step 204: The other network elements call the SDK to verify the encrypted password information; Step 205: The SDK sends a verification request to the authentication center to verify the encrypted password information. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the other network elements. Step 206: The other network elements return the corresponding service response result to network element A based on the validity of the encrypted password returned by the SDK.

2. The method of claim 1, wherein: If step 103 is being executed for the first time, the following operations will be performed after step 103 is executed: The SDK obtains the authentication center information, the authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications.

3. The method of claim 1, wherein: The encrypted password is encrypted using a combination of MD5 and AES algorithms.

4. A method for unified authentication of distributed network elements, characterized in that: The method is applied to the interaction between network elements within a server, wherein the server includes a plurality of network elements and an SDK for interacting with an authentication center, and the method includes the following steps: Step 201: Network element service A sends the authentication code to the server SDK. The server SDK encrypts the authentication code and then sends the encrypted authentication code to the authentication center. Step 202: The authentication center verifies the encryption logic and authentication code. After the verification is successful, it writes the encryption password, issues an encryption password update notification, and returns the encryption password information to the server SDK. Step 203: The server SDK returns the encrypted password to network element service A, and network element service A initiates service requests to other network elements; Step 204: The other network elements call the SDK to verify the encrypted password information; Step 205: The SDK sends a verification request to the authentication center to verify the encrypted password information. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the other network elements. Step 206: The other network elements return the corresponding service response result to network element A based on the validity of the encrypted password returned by the SDK.

5. The method of claim 4, wherein: Step 201 specifically involves the following steps: The network element service A calls the server-side SDK's "Get Encrypted Password API" and simultaneously passes the authentication code to the "Get Encrypted Password API". After the server-side SDK performs encryption processing, the encrypted authentication code is sent to the authentication center via HTTP.

6. The method of claim 4, wherein: Step 202 specifically involves the authentication center reading out the authentication code, random number, and ciphertext according to the predetermined encryption logic. After determining the validity of the authentication code, the authentication code and random number are encrypted into ciphertext according to another encryption logic. The two ciphertexts are compared to see if they are consistent. If they are consistent, the verification is successful. An encrypted password is generated and returned to the server SDK. At the same time, an encrypted password update notification is issued.

7. The method of claim 6, wherein: The authentication code is encrypted using a combination of MD5 and AES algorithms.

8. The method of claim 4, wherein: If step 204 is being executed for the first time, the following operations will be performed after step 204 is executed: The SDK obtains the authentication center information, the authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications. 9.A system for unified authentication of distributed network elements, characterized in that: The system needs to provide a user terminal and a server terminal. The server terminal includes a plurality of network elements and an SDK for interacting with the authentication center. The system includes: The encrypted password acquisition module is used to send the user's account and password to the authentication center. After the authentication center verifies the password, it writes the encrypted password, issues an encrypted password update notification, and returns the encrypted password information to the user. The request initiation module is used to initiate access requests to the network elements on the server side by sending encrypted passwords through the user terminal; The verification module is used to call the SDK through the network element to verify the encrypted password information; The validity acquisition module is used to initiate a verification of encrypted password information to the authentication center through the SDK. The authentication center returns the validity of the encrypted password to the SDK, and the SDK returns the validity of the encrypted password to the network element. The service response module is used to return the corresponding service response result to the user terminal based on the validity of the encrypted password returned by the SDK through the network element; The system also includes an interaction module between internal network elements on the server side, specifically: Network element service A sends the authentication code to the server SDK, which encrypts the authentication code and then sends the encrypted authentication code to the authentication center. The authentication center verifies the encryption logic and authentication code. After the verification is successful, it writes the encryption password, issues an encryption password update notification, and returns the encryption password information to the server SDK. The server-side SDK returns the encrypted password to network element service A, which then initiates service requests to other network elements. The other network elements call the SDK to verify the encrypted password information; The SDK initiates a verification of the encrypted password information to the authentication center. The authentication center returns the validity of the encrypted password to the SDK. The SDK returns the validity of the encrypted password to the other network elements. The other network elements return the corresponding service response result to network element A based on the validity of the encrypted password returned by the SDK.

10. The system of claim 9, wherein: If the verification module is being executed for the first time, a connection module is also included after the verification module is executed; The connection module is used to obtain authentication center information from the SDK, the authentication center verifies the encryption logic and the encrypted password, and returns the authentication center information to the SDK. The SDK subscribes to encrypted password update notifications.

Images