Method, device and electronic equipment for identity authentication
By combining quantum-safe middleware with a security chip, encrypted login information ciphertext and message authentication codes are generated and verified, solving the security problem of username and password-based authentication in SSL VPN and improving the security of data transmission.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA TELECOM CORP LTD
- Filing Date
- 2022-12-30
- Publication Date
- 2026-05-19
AI Technical Summary
In existing SSL VPN authentication, the username and password-based verification method has poor security and is easily exploited by fake phishing websites, leading to data leakage.
By employing quantum-safe middleware in conjunction with a security chip, and through a quantum key management system, encrypted login information ciphertext and message authentication codes are generated and verified to ensure the security of data transmission.
This enhances the security of data verification, prevents data leakage, and ensures the security of subsequent data transmission.
Smart Images
Figure CN116248290B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of security verification, and more specifically, to a method, apparatus, and electronic device for identity authentication. Background Technology
[0002] SSL VPN is a new type of VPN (Virtual Private Network) technology based on the SSL (Secure Socket Layer) / TLS (Transport Layer Security) protocols. SSL VPN authentication provides users with a secure and reliable way to access internal resources.
[0003] In related technologies, during the SSL VPN authentication process, the SSL VPN client sends its username and password to the SSL VPN gateway, which then forwards them to the AAA (Authentication, Authorization, and Accounting) server for verification. If the AAA server verifies the credentials, the SSL VPN authentication is considered successful. However, when sending the username and password, both the SSL VPN client and the SSL VPN gateway rely on the AAA server's address, name, and other attribute information. This attribute information is easily exploited by phishing websites to pass authentication with unauthorized usernames and passwords, posing a significant security risk.
[0004] There is currently no effective solution to the above problems. Summary of the Invention
[0005] This application provides a method, apparatus, and electronic device for identity authentication, which at least solves the technical problem that the security of related technologies based on username and password-based security verification is poor and easily leads to data leakage.
[0006] According to one aspect of the embodiments of this application, a method for identity authentication is provided, comprising: a quantum-safe middleware sending a key request to a security chip, receiving first response information returned by the security chip, wherein the first response information includes at least a key; creating a session identifier corresponding to the current session based on an application identifier, and initiating a request to a quantum key management system for obtaining an authentication key, wherein the request includes at least a session identifier encrypted with the key; determining the authentication key returned by the quantum key management system, encrypting login authentication credentials based on the authentication key to generate ciphertext login information, and generating a message authentication code corresponding to the ciphertext login information; sending the ciphertext login information, the message authentication code, and the session identifier to an identity authentication server; and receiving second response information returned by the identity authentication server, wherein the second response information is used to indicate at least whether the ciphertext login information and the message authentication code have been successfully verified.
[0007] Optionally, determining the authentication key returned by the quantum key management system includes: receiving the authentication key in ciphertext form returned by the quantum key management system; and decrypting the authentication key in ciphertext form based on the key to obtain the authentication ciphertext in plaintext form.
[0008] Optionally, after decrypting the authentication key in ciphertext form based on the key to obtain the authentication ciphertext in plaintext form, the method further includes: caching the application identifier, the plaintext authentication key, the session identifier, and the challenge random number generated during the acquisition of the authentication key.
[0009] Optionally, the login authentication credentials are encrypted at least according to the authentication key to generate ciphertext of login information, including: encrypting time-varying parameters, application identifier, challenge random number and login authentication credentials according to the plaintext form of the authentication key to generate ciphertext of login information.
[0010] Optionally, after receiving the first response information returned by the security chip, the method further includes: determining the first identification information of the security chip; determining whether the first identification information of the security chip and the key satisfy the correspondence; and if the first identification information and the key satisfy the correspondence, determining that the key is correct.
[0011] Optionally, after receiving the second response information returned by the identity authentication server, the method further includes: if the login information ciphertext and message authentication code verification are successful, determining the second identification information and token of the chip used by the security middleware; initiating an authentication request to the Secure Sockets Layer (SSL) VPN gateway, wherein the authentication request carries the second identification information and the token; and receiving the third response information returned by the SSL VPN gateway, wherein the SSL VPN gateway is used to forward the authentication request to the AAA server for authentication.
[0012] According to another aspect of the embodiments of this application, another authentication method is also provided, including: a quantum-safe middleware sending a key request to a security chip, receiving a chip key serial number, a key, and chip identification information returned by the security chip; creating a session identifier corresponding to the current session based on the application identifier, and initiating a request to the quantum key management system to obtain an authentication key, wherein the request includes at least: time-varying parameters, a chip key serial number, and chip identification information and a session identifier encrypted with the key; receiving the authentication key ciphertext returned by the quantum key management system, decrypting the authentication key ciphertext using the key corresponding to the key serial number to obtain the authentication key plaintext, and caching the application identifier, the authentication key plaintext, the session identifier, and the challenge random number generated during the acquisition of the authentication key; the quantum-safe middleware encrypting the time-varying parameters, the application identifier, the challenge random number, and the login authentication credentials based on the authentication key plaintext to generate login information ciphertext, and generating a message authentication code corresponding to the login information ciphertext; sending the login information ciphertext, the message authentication code, and the session identifier to an authentication server; receiving response information returned by the authentication server, wherein the response information is used to indicate whether the login information ciphertext, the message authentication code, and the session identifier have been successfully verified.
[0013] According to another aspect of the embodiments of this application, an identity authentication apparatus is also provided, comprising: a first sending module, configured to send a key request to a security chip and receive first response information returned by the security chip, wherein the first response information includes at least a key; a creation module, configured to create a session identifier corresponding to the current session based on an application identifier and initiate a request to a quantum key management system for obtaining an authentication key, wherein the request includes at least a session identifier encrypted with the key; a determining module, configured to determine the authentication key returned by the quantum key management system, encrypt the login authentication credentials based on the authentication key to generate ciphertext login information, and generate a message authentication code corresponding to the ciphertext login information; a second sending module, configured to send the ciphertext login information, the message authentication code, and the session identifier to an identity authentication server; and a receiving module, configured to receive second response information returned by the identity authentication server, wherein the second response information is used to indicate at least whether the ciphertext login information and the message authentication code have been successfully verified.
[0014] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the storage medium including a stored program, wherein, when the program is running, it controls the device where the storage medium is located to perform any authentication method.
[0015] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement any authentication method.
[0016] In this embodiment, a security verification method based on quantum-safe middleware is adopted. A key request is sent to a security chip via quantum-safe middleware, and a first response information is received from the security chip. The first response information includes at least a key. A session identifier corresponding to this session is created based on the application identifier, and a request to the quantum key management system for obtaining an authentication key is initiated. This request includes at least a session identifier encrypted with the key. The authentication key returned by the quantum key management system is determined, and the login authentication credentials are encrypted using the authentication key to generate ciphertext login information and a corresponding message authentication code. The ciphertext login information, the message authentication code, and the session identifier are sent to the identity authentication server. A second response information is received from the identity authentication server, indicating at least whether the ciphertext login information and the message authentication code have been successfully verified. This improves data verification security and ensures secure subsequent data transmission, thereby solving the technical problem of poor security and easy data leakage caused by username and password-based security verification methods in related technologies. Attached Figure Description
[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0018] Figure 1 This is a flowchart illustrating an optional identity authentication method according to an embodiment of this application;
[0019] Figure 2 This is an optional identity authentication system architecture diagram based on security middleware in this application;
[0020] Figure 3 This is a flowchart illustrating another identity authentication method according to an embodiment of this application;
[0021] Figure 4 This is a schematic diagram of the structure of an identity authentication device according to an embodiment of this application. Detailed Implementation
[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.
[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0024] According to an embodiment of this application, an identity authentication method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.
[0025] Figure 1 This is an identity authentication method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:
[0026] Step S102: The quantum security middleware sends a key request to the security chip and receives the first response information returned by the security chip, wherein the first response information includes at least: a key;
[0027] Step S104: Create a session identifier corresponding to this session based on the application identifier, and send a request to the quantum key management system to obtain an authentication key. The request includes at least the session identifier encrypted with the key.
[0028] Step S106: Determine the authentication key returned by the quantum key management system, encrypt the login authentication credentials based on the authentication key to generate login information ciphertext, and generate the message authentication code corresponding to the login information ciphertext;
[0029] Step S108: Send the encrypted login information, message authentication code, and session identifier to the identity authentication server;
[0030] Step S110: Receive the second response information returned by the identity authentication server, wherein the second response information is used at least to indicate whether the login information ciphertext and message authentication code have been successfully verified.
[0031] This authentication method employs a quantum-safe middleware-based security verification approach. A key request is sent to a security chip via quantum-safe middleware, and a first response is received from the security chip. This first response includes at least the key. A session identifier is created based on the application identifier, and a request to the quantum key management system for obtaining an authentication key is initiated. This request includes at least the session identifier encrypted with the key. The authentication key returned by the quantum key management system is determined, and the login authentication credentials are encrypted using this key to generate ciphertext login information and a corresponding message authentication code. The ciphertext login information, the message authentication code, and the session identifier are sent to the authentication server. A second response is received from the authentication server, indicating whether the ciphertext login information and the message authentication code have been successfully verified. This method enhances data verification security and ensures secure data transmission, thereby addressing the vulnerability of username-and-password-based authentication methods and their tendency to lead to data leakage.
[0032] In some embodiments of this application, determining the authentication key returned by the quantum key management system includes: receiving the authentication key in ciphertext form returned by the quantum key management system; and decrypting the authentication key in ciphertext form based on the key to obtain the authentication ciphertext in plaintext form.
[0033] In some optional embodiments of this application, after decrypting the authentication key in ciphertext form based on the key to obtain the authentication ciphertext in plaintext form, the application identifier, the plaintext authentication key, the session identifier, and the challenge random number generated during the acquisition of the authentication key can be cached.
[0034] In some embodiments of this application, the login authentication credentials are encrypted to generate ciphertext of login information based on the authentication key. This can be achieved through the following steps: Specifically, the time-varying parameters, application identifier, challenge random number, and login authentication credentials can be encrypted to generate ciphertext of login information based on the plaintext authentication key.
[0035] As an optional implementation, after receiving the first response information returned by the security chip, the first identification information of the security chip can be determined; it can be determined whether the first identification information of the security chip and the key satisfy the correspondence; if the first identification information and the key satisfy the correspondence, it can be determined that the key is correct.
[0036] In some embodiments of this application, after receiving the second response information returned by the identity authentication server, if the login information ciphertext and message authentication code verification are successful, the second identification information of the chip used by the security middleware and the token can be determined; an authentication request can be initiated to the Secure Sockets Layer (SSL) VPN gateway, wherein the authentication request carries the second identification information and the token; and a third response information returned by the SSL VPN gateway can be received, wherein the SSL VPN gateway is used to forward the authentication request to the AAA server for authentication.
[0037] Figure 2 This is an optional identity authentication system architecture diagram based on security middleware, as described in this application. Figure 2 The system includes: a security chip (SIM card or USB Key shield), quantum security middleware, an identity authentication server, a quantum key management system, and an AAA server. It should be noted that the security chip (SIM card or USB Key shield) complies with certificates issued by the State Commercial Cryptography Administration, possesses security protection capabilities, and initially contains ID information, enabling it to interface with the quantum key management system to perform key filling functionality. The quantum security middleware sits between the security chip and the application client, implementing functions such as symmetric key management, cryptographic algorithm management (HMAC-SM3, SM4, etc.), identity authentication management, and data storage. The identity authentication server uses a combination of CAS and JWT technologies to complete functions such as business application management, user identity authentication and authorization, token maintenance, and interaction with the quantum key management system to obtain authentication keys using keys filled in the security chip. The quantum key management system is used to complete key filling within the security chip. After the terminal integrates the security chip, the security middleware uses the keys filled in the security chip to interact with the quantum key management system to obtain authentication keys and perform security chip authentication and verification functions. The AAA server is a server program capable of processing user access requests, providing verification authorization and account services, primarily for providing user services for SSL VPN identity authentication. During initialization, the quantum key management system fills and stores the quantum key into the secure chip integrated into the mobile terminal and the identity authentication server. Simultaneously, it records the correspondence between the stored secure chip and the key.
[0038] The process of obtaining authentication keys using quantum-secure middleware includes the following steps:
[0039] S10. The security middleware sends a key request to the security chip (SIM card), and the security chip returns the key serial number Z, key B, and chip IDa.
[0040] S11. The security middleware generates a session identifier (SessionId). Simultaneously, it initiates a request to obtain the authentication key to the quantum key management system. The authentication key request message is encrypted with key sequence number Z + key B (time-varying parameter + chip IDa + session identifier (SessionId)).
[0041] S12. The quantum key management system obtains the corresponding key B injected into the security chip based on the key sequence number Z, decrypts the ciphertext of the authentication key information, and distributes the ciphertext of the authentication key AuthKey based on the decrypted information.
[0042] S13. The security middleware obtains the ciphertext of the authentication key AuthKey, decrypts the response message using the key sequence number Z corresponding to the key B, obtains the plaintext of the key AuthKey, and caches the application identifier AppId, the authentication key AuthKey, the session identifier SessionId, and the challenge random number à data.
[0043] S14, Instance-based Figure 2 After obtaining the authentication key AuthKey from the flowchart, as in the example... Figure 3 As shown, unified identity authentication based on security middleware is performed.
[0044] S15. The quantum-safe middleware uses the authentication key AuthKey in conjunction with the SM4 and HAMC-SM3 algorithms to process the login request information, calculating the ciphertext of the login information (time-varying parameters + login authentication credentials + application identifier AppId + challenge random number) and the login information MAC value. It then forwards the ciphertext login information, the login information MAC value, and the session identifier SessionId to the identity authentication server. The identity authentication server receives the encrypted login information and the login information MAC value, and initiates a key request to the security chip. The security chip returns the key sequence number Y, the key C, and the chip ID β.
[0045] S16. The identity authentication server initiates a request to the quantum key management system to obtain the authentication key, and the authentication key request information is: key sequence number Y + key C encrypted (time-varying parameter + chip ID β + session identifier SessionId).
[0046] S17. The quantum key management system obtains the corresponding key C injected into the security chip based on the key sequence number Y and decrypts the request information. It obtains the authentication key AuthKey based on the chip IDβ+SessionId and returns the authentication key response message to the identity authentication server: key sequence number Y+key C encrypted (time-varying parameter+chip IDβ+SessionId+authentication key AuthKey).
[0047] S18. The authentication server receives the response message, decrypts the response message using the key sequence number Y corresponding to the key C, and obtains the authentication key AuthKey. Using the authentication key AuthKey, it decrypts the login encrypted data received in step S15, obtaining the user login authentication credentials, challenge random number à, application identifier AppId, and login information MAC value data.
[0048] S19. The identity authentication server verifies the user's login authentication credentials, challenges the random number, and the login information MAC value data.
[0049] 1) If the verification fails, inform the quantum security middleware of the SSL VPN login failure information.
[0050] 2) If the verification is successful, the identity authentication server uses JWT technology to generate a token and inserts the chip and token into the AAA server, and synchronously responds to the quantum security middleware.
[0051] S20: The quantum-safe middleware receives information and verifies whether the encrypted message has been successfully decrypted and whether the MAC value is consistent. If the decryption is successful and the comparison is consistent, proceed to S21. If the decryption fails and the comparison is inconsistent, respond to the user that the SSL VPN login failed.
[0052] S21. The quantum-safe middleware uses the security middleware chip ID and token to initiate an authentication request to the SSL VPN.
[0053] S22. The SSL VPN gateway receives the request and forwards it to the AAA server for authentication. It verifies whether the chip ID and token are consistent. If they are consistent, the login is successful; otherwise, the login fails.
[0054] Figure 3 This is another authentication method according to the embodiments of this application, such as... Figure 3 As shown, the method includes:
[0055] S302, the quantum security middleware sends a key request to the security chip and receives the chip key serial number, key and chip identification information returned by the security chip;
[0056] S304. Create a session identifier corresponding to this session based on the application identifier, and send a request to the quantum key management system to obtain the authentication key. The request includes at least: time-varying parameters, chip key serial number, and the chip's identification information and session identifier after key encryption.
[0057] S306 Receive the ciphertext of the authentication key returned by the quantum key management system, decrypt the ciphertext of the authentication key using the key corresponding to the key sequence number to obtain the plaintext of the authentication key, and cache the application identifier, the plaintext of the authentication key, the session identifier, and the challenge random number generated during the acquisition of the authentication key;
[0058] S308, a quantum-safe middleware, encrypts time-varying parameters, application identifiers, challenge random numbers, and login authentication credentials based on the plaintext of the authentication key to generate ciphertext for login information, and generates a message authentication code corresponding to the ciphertext for login information.
[0059] S310 sends encrypted login information, message authentication code, and session identifier to the identity authentication server;
[0060] S312, receive the response information returned by the identity authentication server, wherein the response information is used to indicate whether the login information ciphertext, message authentication code and session identifier have been successfully verified.
[0061] In this authentication method, a key request is sent to the security chip, and the chip key serial number, key, and chip identification information are received from the security chip. A session identifier corresponding to the current session is created based on the application identifier, and a request to the quantum key management system for obtaining the authentication key is initiated. This request includes at least: time-varying parameters, the chip key serial number, and the chip identification information and session identifier encrypted with the key. The ciphertext of the authentication key returned by the quantum key management system is received, and the ciphertext is decrypted using the key corresponding to the key serial number to obtain the plaintext authentication key. The application identifier, the plaintext authentication key, the session identifier, and the challenge random number generated during the authentication key acquisition process are cached. The quantum-safe middleware encrypts time-varying parameters, application identifiers, challenge random numbers, and login authentication credentials based on the plaintext authentication key to generate ciphertext login information and a corresponding message authentication code. It then sends the ciphertext login information, the message authentication code, and the session identifier to the identity authentication server. Finally, it receives a response from the identity authentication server, indicating whether the ciphertext login information, the message authentication code, and the session identifier have been successfully verified. This improves data verification security and ensures secure data transmission, thereby solving the problem of poor security and data leakage inherent in username-and-password-based authentication methods in related technologies.
[0062] Figure 4 This is an identity authentication device according to an embodiment of this application, such as... Figure 4 As shown, the device includes:
[0063] The first sending module 40 is used to send a key request to the security chip and receive a first response information returned by the security chip, wherein the first response information includes at least: a key;
[0064] The creation module 42 is used to create a session identifier corresponding to this session based on the application identifier, and to send a request to the quantum key management system to obtain an authentication key. The request includes at least the session identifier encrypted with the key.
[0065] The determination module 44 is used to determine the authentication key returned by the quantum key management system, encrypt the login authentication credentials based on the authentication key to generate login information ciphertext, and generate the message authentication code corresponding to the login information ciphertext;
[0066] The second sending module 46 is used to send the encrypted login information, message authentication code and session identifier to the identity authentication server.
[0067] The receiving module 48 is used to receive the second response information returned by the identity authentication server, wherein the second response information is used to indicate at least whether the login information ciphertext and message authentication code have been successfully verified.
[0068] In this identity authentication device, a first sending module 40 is used to send a key request to a security chip and receive a first response information returned by the security chip, wherein the first response information includes at least a key; a creation module 42 is used to create a session identifier corresponding to the current session based on the application identifier and initiate a request to the quantum key management system to obtain an authentication key, wherein the request includes at least a session identifier encrypted with the key; a determination module 44 is used to determine the authentication key returned by the quantum key management system, encrypt the login authentication credentials based on the authentication key to generate ciphertext login information, and generate a message authentication code corresponding to the ciphertext login information; a second sending module 46 is used to send the ciphertext login information, the message authentication code, and the session identifier to the identity authentication server; and a receiving module 48 is used to receive a second response information returned by the identity authentication server, wherein the second response information is used to indicate whether the ciphertext login information and the message authentication code have been successfully verified. This achieves the technical effect of improving data verification security and ensuring secure subsequent data transmission, thereby solving the technical problem that the security of the username and password-based security verification method in related technologies is poor and prone to data leakage.
[0069] According to another aspect of the embodiments of this application, a non-volatile storage medium is also provided, the storage medium including a stored program, wherein, when the program is running, it controls the device where the storage medium is located to perform any authentication method.
[0070] According to another aspect of the embodiments of this application, an electronic device is also provided, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement any authentication method.
[0071] Specifically, the aforementioned storage medium is used to store program instructions for the following functions, thereby implementing the following functions:
[0072] The system sends a key request to the security chip and receives a first response from the security chip, wherein the first response includes at least the key; it creates a session identifier corresponding to this session based on the application identifier and initiates a request to the quantum key management system to obtain an authentication key, wherein the request includes at least the session identifier encrypted with the key; it determines the authentication key returned by the quantum key management system, encrypts the login authentication credentials based on the authentication key to generate ciphertext login information, and generates a message authentication code corresponding to the ciphertext login information; it sends the ciphertext login information, the message authentication code, and the session identifier to the identity authentication server; and it receives a second response from the identity authentication server, wherein the second response indicates at least whether the ciphertext login information and the message authentication code have been successfully verified.
[0073] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0074] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0075] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.
[0076] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0077] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0078] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0079] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A method for identity authentication, characterized in that, include: The quantum-safe middleware sends a key request to the security chip and receives a first response information returned by the security chip, wherein the first response information includes at least: a key; A session identifier corresponding to this session is created based on the application identifier, and a request to obtain an authentication key is sent to the quantum key management system. The request includes at least the session identifier encrypted with the key. Determine the authentication key returned by the quantum key management system, encrypt the login authentication credentials at least according to the authentication key to generate login information ciphertext, and generate the message authentication code corresponding to the login information ciphertext; Send the encrypted login information, the message authentication code, and the session identifier to the identity authentication server; Receive a second response message returned by the identity authentication server, wherein the second response message is at least used to indicate whether the login information ciphertext and the message authentication code have been successfully verified; If the login information ciphertext and the message authentication code are successfully verified, the second identification information and the token of the chip used by the security middleware are determined; an authentication request is initiated to the virtual private network gateway based on the Secure Sockets Layer protocol, wherein the authentication request carries the second identification information and the token; and a third response information returned by the gateway is received, wherein the gateway is used to forward the authentication request to the authentication, authorization and accounting server for authentication.
2. The method according to claim 1, characterized in that, Determining the authentication key returned by the quantum key management system includes: Receive the authentication key in ciphertext form returned by the quantum key management system; The authentication key in ciphertext form is decrypted based on the key to obtain the authentication ciphertext in plaintext form.
3. The method according to claim 2, characterized in that, After decrypting the ciphertext authentication key based on the key to obtain the plaintext authentication ciphertext, the method further includes: The application identifier, the plaintext of the authentication key, the session identifier, and the challenge random number generated during the acquisition of the authentication key are cached.
4. The method according to claim 3, characterized in that, Based on the authentication key, the login authentication credentials are encrypted to generate ciphertext login information, including: The login information ciphertext is generated by encrypting the time-varying parameters, the application identifier, the challenge random number, and the login authentication credentials based on the plaintext authentication key.
5. The method according to claim 1, characterized in that, After receiving the first response information returned by the security chip, the method further includes: Determine the first identification information of the security chip; Determine whether the first identification information of the security chip and the key satisfy a correspondence; If the first identification information and the key satisfy the correspondence, the key is determined to be correct.
6. A method for identity authentication, characterized in that, include: The quantum-safe middleware sends a key request to the security chip and receives the chip key serial number, key, and chip identification information returned by the security chip. A session identifier corresponding to this session is created based on the application identifier, and a request to obtain an authentication key is sent to the quantum key management system. The request includes at least: time-varying parameters, the chip key serial number, and the chip's identification information encrypted with the key and the session identifier. The system receives the ciphertext of the authentication key returned by the quantum key management system, decrypts the ciphertext of the authentication key using the key corresponding to the key sequence number to obtain the plaintext of the authentication key, and caches the application identifier, the plaintext of the authentication key, the session identifier, and the challenge random number generated during the acquisition of the authentication key. The quantum-safe middleware encrypts the time-varying parameters, the application identifier, the challenge random number, and the login authentication credentials based on the plaintext of the authentication key to generate ciphertext of login information, and generates a message authentication code corresponding to the ciphertext of login information; Send the encrypted login information, the message authentication code, and the session identifier to the identity authentication server; The system receives a response from an identity authentication server, wherein the response indicates whether the encrypted login information, the message authentication code, and the session identifier have been successfully verified. If the encrypted login information and the message authentication code have been successfully verified, the system determines the second identification information of the chip used by the security middleware and a token. It then initiates an authentication request to a Secure Sockets Layer (SSL)-based Virtual Private Network (VPN) gateway, wherein the authentication request carries the second identification information and the token. Finally, the system receives a third response from the gateway, wherein the gateway forwards the authentication request to an authentication, authorization, and accounting server for authentication.
7. An identity authentication device, characterized in that, include: The first sending module is configured to send a key request to the security chip through a quantum-safe middleware, and receive a first response information returned by the security chip, wherein the first response information includes at least: a key; A creation module is used to create a session identifier corresponding to this session based on the application identifier, and to send a request to the quantum key management system to obtain an authentication key, wherein the request includes at least: the session identifier encrypted with the key; The determination module is used to determine the authentication key returned by the quantum key management system, encrypt the login authentication credentials based on the authentication key to generate login information ciphertext, and generate a message authentication code corresponding to the login information ciphertext; The second sending module is used to send the encrypted login information, the message authentication code, and the session identifier to the identity authentication server. The receiving module is configured to receive a second response information returned by the identity authentication server, wherein the second response information is at least used to indicate whether the login information ciphertext and the message authentication code have been successfully verified; if the login information ciphertext and the message authentication code have been successfully verified, the module determines the second identification information of the chip used by the security middleware and the token; initiates an authentication request to a virtual private network gateway based on the Secure Sockets Layer protocol, wherein the authentication request carries the second identification information and the token; and receives a third response information returned by the gateway, wherein the gateway is used to forward the authentication request to an authentication, authorization, and accounting server for authentication.
8. A non-volatile storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the authentication method according to any one of claims 1 to 6.
9. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the authentication method as described in any one of claims 1 to 6.