A code scanning authentication method and system based on PKI system

Abstract

The invention discloses a code scanning authentication method and system based on PKI system, including a login terminal, a coding module, an authentication module and a code scanning terminal; specifically: generating a random character string Nonce, signing Nonce with a system private key SPRIK, generating a two-dimensional code image with signature information NSign and Nonce and sending it together with the signature; calling the public key SPUBK of the target system to verify the signature, initiating communication monitoring with Nonce as an identifier, and displaying the two-dimensional code image after the verification is passed; scanning the two-dimensional code to read the information content and decode it, re-signing NSign with a user private key to generate new signature information NSSign, and packaging the user UID, Nonce and NSSign for sending; decoding the user UID, Nonce and NSSign, finding the corresponding user public key UPUBK through the user UID, verifying NSSign, and after the verification is successful, sending a verified Token to the communication monitoring terminal corresponding to Nonce; S5. storing the Token and jumping to the target system; realizing two-way mutual recognition between the terminal and the remote end, efficient authentication of the user identity and real-time push of the authentication result.

Description

Technical Field

[0001] The present invention relates to the field of authentication security technology, and more specifically to a code scanning authentication method and system based on a PKI system. Background Art

[0002] At present, with the development of technology, people use more and more information systems. Users often need to remember a large number of passwords. In addition, for the sake of system security, each system requires the system password set by the user to reach a certain complexity, which further increases the difficulty of user password memorization.

[0003] Therefore, the function of scanning code to authenticate identity appeared later. However, the existing method of scanning code to authenticate identity involves the following problems:

[0004] (1) The generated QR code is easy to forge and cannot be identified as coming from a trusted system;

[0005] (2) When the user authenticates the user's identity, the local identity + QR code data is uploaded to the authentication center for authentication, but the problem of being unable to identify whether it is a trusted terminal is present;

[0006] (3) When performing identity comparison, data comparison needs to be performed again in the database, which puts tremendous pressure on the database under high concurrency conditions.

[0007] Therefore, how to provide a code scanning authentication method and system based on the PKI system is a problem that technical personnel in this field urgently need to solve. Summary of the invention

[0008] In view of this, the present invention provides a code scanning authentication method and system based on the PKI system, which realizes two-way system trusted verification and fast and efficient identity authentication, avoiding the problems of QR code forgery, authentication system hijacking, and authentication process causing pressure on the back end.

[0009] In order to achieve the above object, the present invention adopts the following technical solution:

[0010] A code scanning authentication method based on a PKI system comprises the following steps:

[0011] S1. Generate a random string Nonce, sign Nonce with the system private key SPRIK, generate a QR code image with the signature information NSign and Nonce, and send the QR code image together with the signature;

[0012] S2. Call the target system's public key SPUBK to verify the signature, initiate communication monitoring with Nonce as the identifier, and display the QR code image after the signature verification is passed;

[0013] S3. Scan the QR code, read the information content of the QR code, and decode the information content into Nonce and NSign, and re-sign NSign with the user's private key to generate a new signature information NSSign, and package the user UID, Nonce and NSSign to send the message;

[0014] S4. After receiving the message, decode the user UID, Nonce and NSSign, and find the corresponding user public key UPUBK through the user UID. Verify the NSSign with the user public key UPUBK. After the verification is successful, send the verified Token to the communication monitoring terminal corresponding to Nonce;

[0015] S5. Store the token and transfer it to the target system.

[0016] Preferably, before step S1, it also includes issuing a system public-private key pair based on the PKI system, and making the system public key public and storing it; generating a user public-private key pair based on the PKI, and making the user public key public and uploading it, and binding the user public key to the user UID.

[0017] Preferably, the method for randomly generating a character string in S1 is to call a random generation function random based on a computer clock to generate a random character string Nonce of a specified length not less than 8 bits from a base64 character set.

[0018] Preferably, S1 also includes storing the corresponding relationship between Nonce and signature in the system cache and setting a valid time, which will be automatically cleared and invalidated upon expiration.

[0019] Preferably, when the signature verification in S3 passes, it is the intended target system to be logged in, otherwise it is a counterfeit system.

[0020] Preferably, the decoding method in S4 is to unpack the received authentication message to decompose the message header and the message body, call the decryption tool decrypt to decrypt, and call sign to perform signature verification.

[0021] A code scanning authentication system based on a KPI system includes a login terminal, an identity authentication subsystem and a code scanning terminal; the identity authentication subsystem includes a coding module and an authentication module;

[0022] The login terminal is bidirectionally connected to the coding module, the code scanning terminal is connected to the authentication module, and the authentication module is connected to the login terminal;

[0023] The login terminal is used to generate a random string Nonce and send it to the coding module. It is also used to receive the QR code image and signature, call the public key SPUBK of the target system to verify the signature, and use Nonce as the identifier to initiate communication monitoring with the authentication module. After the signature verification is passed, the QR code image is displayed. It is also used to store the Token and jump to the target system;

[0024] The coding module is used to sign Nonce with the system private key SPRIK, generate a QR code image with the signature information NSign+Nonce, and send the QR code image and the signature to the login terminal;

[0025] The code scanning terminal is used to scan the QR code, read the information content of the QR code, and decode the information content into Nonce and NSign, and re-sign the NSign with the user's private key to generate a new signature information NSSign, and package the user UID, Nonce and NSSign to send a message to the authentication module;

[0026] The authentication module is used to receive messages, decode the user UID, Nonce and NSSign, find the corresponding user public key UPUBK through the user UID, verify the NSSign through the user public key UPUBK, and after the verification is successful, send the verified Token to the communication monitoring terminal login terminal corresponding to the Nonce.

[0027] Preferably, the KPI system-based code scanning authentication system also includes a PKI issuance module, which is used to issue a system public-private key pair, and make the system public key public and store it in the login terminal, and the system private key is stored in the coding module; it is also used to generate a user public-private key pair, and make the user public key public and upload it to the authentication module, and the user private key is stored in the code scanning terminal.

[0028] Preferably, the authentication module is also used to bind the user public key to the user UID.

[0029] It can be seen from the above technical solution that, compared with the prior art, the present invention discloses a code scanning authentication method and system based on the PKI system, which has the following beneficial effects:

[0030] 1. Two-way mutual recognition: Through remote coding, the generated code information is verifiable, thus forming a two-way mutual recognition mechanism between the server and the terminal, avoiding problems such as credential forgery;

[0031] 2. Efficient authentication: After receiving the information, the authentication module directly unpacks, decodes, and authenticates without interacting with the database. Only after the authentication is passed will the user role, authority, application and other contextual information be extracted and processed from the database, avoiding the problem of having to perform database comparison for each identity authentication;

[0032] 3. Actively push authentication results: Change the traditional timed polling method, which causes a large request pressure on the server, and adopt a single connection real-time monitoring mechanism to push the authentication results to the login terminal in real time;

[0033] The present invention realizes two-way mutual recognition between the terminal and the remote business system, efficient authentication of the user identity and real-time push of the authentication result, which helps to improve the reliability, credibility and security of the system, while improving the authentication efficiency, reducing the computing power consumption and reducing the authentication requests to the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0035] Figure 1 The accompanying drawing is a schematic flow chart of the code scanning authentication method based on the PKI system provided by the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] The embodiment of the present invention discloses a code scanning authentication method based on a PKI system, comprising the following steps:

[0038] S1. Generate a random string Nonce, sign Nonce with the system private key SPRIK, generate a QR code image with the signature information NSign and Nonce, and send the QR code image together with the signature;

[0039] S2. Call the target system's public key SPUBK to verify the signature, initiate communication monitoring with Nonce as the identifier, and display the QR code image after the signature verification is passed;

[0040] S3. Scan the QR code, read the information content of the QR code, and decode the information content into Nonce and NSign, and re-sign NSign with the user's private key to generate a new signature information NSSign, and package the user UID, Nonce and NSSign to send the message;

[0041] S4. After receiving the message, decode the user UID, Nonce and NSSign, and find the corresponding user public key UPUBK through the user UID. Verify the NSSign with the user public key UPUBK. After the verification is successful, send the verified Token to the communication monitoring terminal corresponding to Nonce;

[0042] S5. Store the token and transfer it to the target system.

[0043] In this embodiment, if the signature verification in S2 is passed, it is proved that the QR code is generated by a trusted system and is displayed.

[0044] In order to further implement the above technical solution, step S1 also includes issuing a system public-private key pair based on the PKI system, and making the system public key public and storing it; generating a user public-private key pair based on PKI, and making the user public key public and uploading it, binding the user public key to the user UID, and the user UID is the user's unique ID in the target system.

[0045] In order to further implement the above technical solution, the method for randomly generating a character string in S1 is to call a random generation function random based on a computer clock to generate a random character string Nonce of a specified length of not less than 8 bits from a base64 character set.

[0046] In order to further implement the above technical solution, S1 also includes storing the correspondence between Nonce and signature in the system cache and setting the validity period, which will be automatically cleared and invalidated when expired.

[0047] In order to further implement the above technical solution, when the signature verification in S3 passes, it is the intended target system to be logged in, otherwise it is a counterfeit system.

[0048] In order to further implement the above technical solution, the decoding method in S4 is to unpack the received authentication message to decompose the message header and the message body, call the decryption tool decrypt to decrypt, and call sign to perform signature verification.

[0049] A code scanning authentication system based on a KPI system includes a login terminal, an identity authentication subsystem and a code scanning terminal; the identity authentication subsystem includes a coding module and an authentication module;

[0050] The login terminal is bidirectionally connected to the coding module, the code scanning terminal is connected to the authentication module, and the authentication module is connected to the login terminal;

[0051] The login terminal is used to generate a random string Nonce and send it to the coding module. It is also used to receive the QR code image and signature, call the public key SPUBK of the target system to verify the signature, and use Nonce as the identifier to initiate communication monitoring with the authentication module. After the signature verification is passed, the QR code image is displayed. It is also used to store the Token and jump to the target system;

[0052] The coding module is used to sign Nonce with the system private key SPRIK, generate a QR code image with the signature information NSign and Nonce, and send the QR code image and the signature to the login terminal;

[0053] The code scanning terminal is used to scan the QR code, read the information content of the QR code, and decode the information content into Nonce and NSign, and re-sign the NSign with the user's private key to generate a new signature information NSSign, and package the user UID, Nonce and NSSign to send a message to the authentication module;

[0054] The authentication module is used to receive messages, decode the user UID, Nonce and NSSign, find the corresponding user public key UPUBK through the user UID, verify the NSSign through the user public key UPUBK, and after the verification is successful, send the verified Token to the communication monitoring terminal login terminal corresponding to the Nonce.

[0055] In actual applications, the scanning terminal is not limited to any form, including mobile phone APP, or dedicated devices with scanning function. The equipment has basic capabilities such as public and private key storage, encryption and decryption, signing / signature verification, etc.

[0056] In this embodiment, initiating communication monitoring with Nonce as an identifier is specifically as follows: the identity authentication subsystem will establish a session binding relationship between Nonce and the login terminal to ensure that after the user is authenticated, the result can be pushed to the Nonce terminal immediately.

[0057] In order to further implement the above technical solution, a code scanning authentication system based on the KPI system also includes a PKI issuance module, which is used to issue a system public-private key pair, and make the system public key public and store it in the login terminal, and the system private key is stored in the coding module; it is also used to generate a user public-private key pair, and make the user public key public and upload it to the authentication module, and the user private key is stored in the code scanning terminal.

[0058] In order to further implement the above technical solution, the authentication module is also used to bind the user public key with the user UID.

[0059] After the identity authentication is passed, the system will jump to the target system. The target system will load the user's department information, menu information, permission information, application and other contextual information according to the ID of the logged-in user and perform subsequent operations such as extraction and processing.

[0060] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0061] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A code scanning authentication method based on PKI system, characterized in that: The following steps are involved: S1. The identity authentication subsystem receives the random string Nonce generated by the login terminal, signs Nonce with the system private key SPRIK, generates a QR code image with the signature information NSign and Nonce, and sends the QR code image and the signature to the login terminal; S2. The login terminal calls the public key SPUBK of the target system to verify the signature, initiates communication monitoring with Nonce as the identifier, and displays the QR code image after the signature verification is passed; S3. The scanning terminal scans the QR code, reads the information content of the QR code, and decodes the information content into Nonce and NSign, and re-signs NSign with the user's private key to generate new signature information NSSign, and packages the user UID, Nonce and NSSign and sends the message to the identity authentication subsystem; S4. After receiving the message, the identity authentication subsystem decodes the user UID, Nonce and NSSign, and finds the corresponding user public key UPUBK through the user UID. It verifies the NSSign with the user public key UPUBK. After the verification is successful, it sends the verified Token to the communication monitoring terminal corresponding to the Nonce. S5. The login terminal stores the Token and transfers it to the target system; Before step S1, it also includes issuing a system public-private key pair based on the PKI system, and making the system public key public and storing it; Generate a user public-private key pair based on PKI, make the user's public key public and upload it, bind the user's public key to the user's UID, and the user's UID is the user's unique ID in the target system; The specific steps of initiating communication monitoring with Nonce as the identifier are as follows: a session binding relationship is established between Nonce and the login terminal to ensure that after the user is authenticated, the result can be pushed to the Nonce terminal immediately.

2. According to the PKI system-based code scanning authentication method of claim 1, it is characterized in that: The method for randomly generating a character string in S1 is that the login terminal calls the random generation function random based on the computer clock to generate a random character string Nonce of a specified length of not less than 8 bits from the base64 character set.

3. According to the PKI system-based code scanning authentication method of claim 1, it is characterized in that: S1 also includes an identity authentication subsystem that stores the correspondence between Nonce and signature in the system cache and sets a validity period, which will be automatically cleared and invalidated upon expiration.

4. According to the PKI system-based code scanning authentication method of claim 1, it is characterized in that: If the signature verification in S3 passes, it is the intended target system to be logged in, otherwise it is a fake system.

5. According to the PKI system-based code scanning authentication method of claim 1, it is characterized in that: The decoding method in S4 is that the identity authentication subsystem unpacks the received authentication message to decompose the message header and message body, calls the decryption tool decrypt for decryption, and calls sign for signature verification.

6. A code scanning authentication system based on a KPI system, based on a code scanning authentication method based on a PKI system as described in any one of claims 1 to 5, characterized in that: Includes login terminal, identity authentication subsystem and code scanning terminal; The identity authentication subsystem includes a coding module and an authentication module; The login terminal is bidirectionally connected to the coding module, the code scanning terminal is connected to the authentication module, and the authentication module is connected to the login terminal; The login terminal is used to generate a random string Nonce and send it to the coding module. It is also used to receive the QR code image and signature, call the public key SPUBK of the target system to verify the signature, and use Nonce as the identifier to initiate communication monitoring with the authentication module. After the signature verification is passed, the QR code image is displayed. It is also used to store the Token and jump to the target system; The coding module is used to sign Nonce with the system private key SPRIK, generate a QR code image with the signature information NSign+Nonce, and send the QR code image and the signature to the login terminal; The code scanning terminal is used to scan the QR code, read the information content of the QR code, and decode the information content into Nonce and NSign, and re-sign the NSign with the user's private key to generate a new signature information NSSign, and package the user UID, Nonce and NSSign to send a message to the authentication module; The authentication module is used to receive the message, decode the user UID, Nonce and NSSign, find the corresponding user public key UPUBK through the user UID, verify the NSSign through the user public key UPUBK, and after the verification is successful, send the verified Token to the communication monitoring terminal login terminal corresponding to the Nonce; It also includes a PKI issuance module for issuing a system public-private key pair, making the system public key public and storing it in the login terminal, and storing the system private key in the coding module; it is also used to generate a user public-private key pair, and making the user public key public and uploading it to the authentication module, and the user private key is stored in the code scanning terminal; The authentication module is also used to bind the user's public key to the user's UID; the communication monitoring initiated with Nonce as the identifier is specifically as follows: the identity authentication subsystem will establish a session binding relationship between Nonce and the login terminal to ensure that after the user is authenticated, the result can be pushed to the Nonce terminal immediately.

Images