A unified identity authentication method, device and medium of an operating system platform

Abstract

The application discloses a kind of unified identity authentication method, device and medium of operating system platform, the unified identity authentication method of operating system platform includes according to user request to carry out user login verification;When login user needs to access the service system in trusted domain, the integrity of the token of login user is verified, if the token of login user is complete, the access control list ACL of login user is obtained from token, if access control list ACL allows access the service system, then the token of login user is passed to service system to realize unified identity authentication.The application aims to realize a new type of unified authentication mode, uses trust chain transmission technology to realize once login, and the access mechanism of all service system passage, lays a solid foundation for access control and security audit, while providing safe, reliable, convenient and efficient protection for user.

Description

Technical Field

[0001] This invention belongs to the fields of computer operating systems and network security technology, and specifically relates to a unified identity authentication method, device and medium for an operating system platform. Background Technology

[0002] In recent years, with the rapid development of network communication technology, the application of new technologies such as cloud computing and big data has become increasingly widespread, and enterprises are undergoing a comprehensive digital transformation. While digitalization brings cost reduction and efficiency improvement to enterprises, it also brings new challenges to information security. In order to provide a more secure and reliable office environment and business platform, more and more security technologies have been invented and put into use. Although this application model can ensure the security of business systems and user data, it also brings a new problem: the inconvenience caused to users by multiple logins and strong passwords.

[0003] The primary purpose of identity authentication is to prove the trust relationship between subjects and objects in a network system, ensuring that the subject's access, control, and operation of the object are legitimate. Therefore, for business systems within the same work domain, requiring users to verify their identity by providing IDs and passwords is merely one form of proving this trust relationship, not a mandatory step. If this proof of trust can be transmitted within a certain scope, thereby authenticating user identity, the inconvenience caused to users by repeated logins and the use of overly strong passwords can be resolved.

[0004] With the continuous development and maturation of mobile computing, biometric recognition, and mobile internet technologies, identity authentication methods are no longer limited to traditional methods like username and password encryption. Domestically developed and controllable operating system platforms, based on trusted hardware platforms, have undergone security enhancements and have also hardened the security of system components such as networks, storage, and input / output, forming an integrated hardware and software security platform. These platforms already support trusted computing functions, utilizing trusted measurement technology to achieve trusted computing from the hardware platform to critical application software. Therefore, how to achieve unified identity authentication across these operating system platforms has become a critical technical problem that urgently needs to be solved. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a unified identity authentication method, device and medium for an operating system platform, addressing the aforementioned problems of the prior art. This invention aims to realize a new unified authentication method, utilizing trust chain transmission technology to achieve a one-time login and access mechanism that allows access to all business systems. This lays a solid foundation for access control and security auditing, while providing users with secure, reliable, convenient and efficient protection.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0007] A unified identity authentication method for an operating system platform includes:

[0008] S101, Perform user login verification based on user request;

[0009] S102, when a logged-in user needs to access a business system within a trusted domain, verify the integrity of the logged-in user's token. If the logged-in user's token is intact, obtain the logged-in user's Access Control List (ACL) from the token. If the ACL allows access to the business system, then pass the logged-in user's token to the business system to achieve unified identity authentication.

[0010] Optionally, step S102 includes, when a logged-in user needs to access a business system within a trusted domain, the user process sends an access request to a designated system process, and the operation of the designated system process responding to the access request includes:

[0011] S201, query the token corresponding to the logged-in user based on the user ID of the logged-in user;

[0012] S202, verify the integrity of the logged-in user's token. If the logged-in user's token is complete, proceed to step S203; if the logged-in user's token is incomplete, prompt that there is a security risk in the current system, freeze the current logged-in user, lock the system and return to the user login interface, end and exit.

[0013] S203, Obtain the Access Control List (ACL) of the logged-in user from the logged-in user's token;

[0014] S204. Determine whether the user has access permissions to the business system based on the Access Control List (ACL). If the user does not have access permissions, return an "Access Denied" error message and exit; otherwise, proceed to step S205.

[0015] S205 If the access control list (ACL) allows access to the business system, then the login user's token will be passed to the business system to achieve unified identity authentication.

[0016] Optionally, verifying the integrity of the logged-in user's token in step S202 includes: decoding the logged-in user's token T using a preset decoding function ψ(·) to obtain the logged-in user's user trust certificate C, wherein the user trust certificate C contains the logged-in user's user ID, access control permissions ACL, and user access device HID; and encoding the user trust certificate C and the system's current trust metric ξ using a preset encoding function. Encode to obtain the encoded result If the encoding result If the token T is the same as the logged-in user's token, the user's token is considered complete; otherwise, the user's token is considered incomplete.

[0017] Optionally, step S101, which verifies user login based on user request, includes:

[0018] S301, Receive authentication credentials submitted by the user, the authentication credentials including identity information and login credentials;

[0019] S302, retrieve the user ID based on the identity information in the authentication credentials. If the user ID exists, proceed to step S303.

[0020] S303, match the login credentials in the authentication credentials with the identity authentication credentials submitted by the registered user. If the identity authentication credentials submitted by the user match, proceed to step S304.

[0021] S304, user login verification is successful.

[0022] Optionally, step S302 further includes handling login failure when the user ID does not exist, and step S303 further includes handling login failure when the identity authentication credentials submitted by the user do not match; the login failure handling includes: accumulating the number of authentication failures for the current user ID, determining whether the number of authentication failures for the current user ID has reached the authentication failure limit, if the authentication failure limit has not been reached, returning authentication failure information and prompting the user to resubmit identity authentication credentials, ending and exiting; if the authentication failure limit has been reached, freezing the current user and starting a countdown, unfreezing after the freeze time is reached, prompting the user to resubmit identity authentication credentials, ending and exiting.

[0023] Optionally, a user initialization step may be included before step S101:

[0024] S401, Receive authentication credentials submitted by the user, the authentication credentials including identity information and login credentials;

[0025] S402 generates a user ID for the user;

[0026] S403, check if the user ID is available. If the user ID is unavailable, return an error message indicating that the current ID is unavailable and proceed to step S402; otherwise, bind the identity information and login credentials in the authentication credentials to the user ID.

[0027] S404 generates an initial access control ACL for the user, generates a user trust certificate C based on the user ID, the initial access control ACL, and the user's access device HID, and uses a preset encoding function to encode the user trust certificate C and the system's current trust metric ξ. Encode to obtain the encoded result Used as the user's token, the user's token is stored in read-only mode, and the owner is the ROOT user;

[0028] S405: Obtain other authentication credentials that the user needs to associate through interaction. If other authentication credentials entered by the user are obtained, bind and register the other authentication credentials submitted by the user to the user ID. If the user does not need to associate other authentication credentials, end and exit.

[0029] Optionally, step S405 may further include the step of a specified system process updating the access control permission ACL for the user who issued the permission update request:

[0030] S501, extract the user ID from the permission update request;

[0031] S502, determine if the user ID exists. If the user ID exists, proceed to step S503; if the user ID does not exist, return an error message indicating that the current ID does not exist, end and exit.

[0032] S503, Read the token corresponding to the user ID.

[0033] S504, retrieve the access control list (ACL) of the logged-in user from the token and output it;

[0034] S505 retrieves the updated Access Control List (ACL) from the administrator through interaction. Based on the user's ID, the updated ACL, and the user's access device HID, it generates a user trust certificate C. The user trust certificate C and the system's current trusted metric ξ are then encoded using a preset function. Encode to obtain the encoded result To replace the user's original token.

[0035] Furthermore, the present invention also provides a unified identity authentication device for an operating system platform, comprising a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the unified identity authentication method of the operating system platform.

[0036] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program that is programmed or configured by a microprocessor to execute a unified identity authentication method of the operating system platform.

[0037] Furthermore, the present invention also provides a computer program product, including a computer program / instruction, which is programmed or configured by a microprocessor to provide a unified identity authentication method for the operating system platform.

[0038] Compared with the prior art, the present invention has the following main advantages:

[0039] 1. This invention provides an integrated user authentication system based on a user trust proof transmission mechanism. Using this system, users only need to perform identity authentication once to easily access various business systems within a trusted domain, without needing to repeatedly perform user identity authentication.

[0040] 2. This invention fully considers various security issues and provides an efficient, convenient, and effective unified identity authentication method on the basis of ensuring system security and reliability. Unlike traditional single sign-on technology, the method in this embodiment makes full use of the trust advantages of domestic operating systems, providing the maximum access control authority within the trusted domain, and providing users with a convenient and secure integrated business platform. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.

[0042] Figure 2 This is a general framework diagram of the unified identity authentication system of the operating system platform in this embodiment of the invention.

[0043] Figure 3 This is a flowchart illustrating the user authentication initialization process in an embodiment of the present invention.

[0044] Figure 4 This is a flowchart illustrating the user identity authentication and trust proof generation process in an embodiment of the present invention.

[0045] Figure 5 This is a flowchart illustrating the unified user identity authentication and trust proof transmission process in an embodiment of the present invention.

[0046] Figure 6 This is a flowchart illustrating the management and maintenance process of user trust proof in this embodiment of the invention.

[0047] Figure 7 This is a flowchart illustrating the system user management and maintenance process in an embodiment of the present invention. Detailed Implementation

[0048] like Figure 1 As shown, the unified identity authentication method of the operating system platform in this embodiment includes:

[0049] S101, Perform user login verification based on user request;

[0050] S102, when a logged-in user needs to access a business system within a trusted domain, verify the integrity of the logged-in user's token. If the logged-in user's token is intact, obtain the logged-in user's Access Control List (ACL) from the token. If the ACL allows access to the business system, then pass the logged-in user's token to the business system to achieve unified identity authentication.

[0051] Figure 2 This is a general framework diagram of the unified identity authentication system of the operating system platform in this embodiment. The unified identity authentication system of the operating system platform in this embodiment includes a unified authentication service module for handling multiple authentication methods simultaneously, an authentication authorization module for enabling login-free access within a trusted domain with a single authentication, and a real-time user behavior monitoring module for system security protection. The main functions of each module are described below: The unified authentication service module is mainly responsible for extracting and verifying user identity credentials when a user logs into the system for the first time. To provide a more convenient, faster, and more secure unified identity authentication service, the method in this embodiment supports multiple user identity credentials (i.e., login methods), which are implemented by modules such as password authentication, certificate authentication, biometric authentication, and mobile credential authentication. The authentication authorization module is mainly responsible for generating and transmitting user trust proofs, thereby enabling access to all business systems within the trusted domain with a single login. Specifically, the system login module is responsible for various initialization functions after the user logs into the system for the first time; the business system identity authentication module is responsible for transmitting user trust proofs, thereby enabling access to various business systems within the trusted domain, including various C / S applications and Web applications; the user permission management module is used to dynamically adjust user permissions and to authorize and access different application systems within the trusted domain. The real-time user behavior monitoring module is used to monitor and audit user behavior in real time to ensure system security, handle potential security incidents, and perform post-incident analysis. This module relies on the auditing function of a domestically developed and controllable operating system.

[0052] See Figure 2As can be seen, the user login verification methods of the operating system platform in this embodiment include password authentication, certificate authentication, and biometric (fingerprint, iris, etc.) feature authentication. Mobile credential authentication, specifically for mobile platforms, includes mobile fingerprint, mobile face, and QR code authentication. These authentication methods are integrated with a unified authentication service, which can be called by the unified authentication service to verify user login and then authorize authentication, supporting upper-layer business operations, including user permission management, C / S applications, Web applications, system login, and business system identity authentication. Simultaneously, a real-time user behavior monitoring module is included to monitor user behavior in real time for auditing purposes. Identity authentication is one of the core functions of the unified identity authentication of this invention and is the foundation of all applications of the method in this embodiment. This embodiment provides multiple user identity authentication methods and solutions for different application scenarios and different security level requirements. During system initialization, users must first complete registration and obtain a unique user identity identifier (user ID) and its corresponding password. Next, before each re-entry into the system, users must undergo identity authentication. This involves submitting their user ID and password to the system. The system compares the received user ID and password with its internal authentication table. If a match is found, authentication is successful, and the authentication information is recorded. If the authentication fails, the current number of attempts is accumulated, and a failure result is returned. If the user is not registered, an "unregistered user" message is returned, and the system's authentication failure count is accumulated. To prevent brute-force attacks, once a user's authentication failure count reaches its limit, their user ID will be frozen. The freeze will be lifted after a certain period, with the freeze duration increasing exponentially with the number of authentication failures and freezes, preventing the leakage of user identity information and related user data. If the system's authentication failure count reaches its limit, the system will suspend user authentication and render the entire system inaccessible to ensure system and user data security. The freeze will also be lifted after a certain period, with the freeze duration again increasing exponentially with the number of authentication failures and freezes. Unfreezing requires a super administrator or special auxiliary hardware (such as a U-key). To meet the requirements of different application scenarios and security levels, this embodiment provides multiple user authentication solutions, including password authentication, digital signature, biometric authentication, and mobile credential authentication. Users can add multiple authentication methods during system initialization as needed, or add new authentication methods later, provided they have already passed system authentication. All authentication methods are based on user identity (i.e., user ID). When multiple authentication methods coexist, authentication credentials are registered based on the user identity. When a user performs authentication, they also need to submit their user ID and authentication credentials; however, the carrier of the authentication credentials differs depending on the authentication method, but the authentication method remains consistent with the previous description.The purpose of this embodiment is to provide a unified identity authentication service, enabling a one-time login and access control mechanism across all business systems within a trusted domain. Unlike ordinary single sign-on (SSO) technology, this embodiment transmits the trustworthiness of the user's identity to achieve unified identity authentication and login-free access between different business systems within the trusted domain, rather than using a single sign-on-encrypted transmission mode for user identity credentials. When a user completes identity authentication, they complete a user trust relationship proof. The system stores this trust relationship proof for use in all identity authentications during the user's system login period. The user trust proof is managed by the system process and stored in the system directory only during the period the user is logged in and has not logged out. The management of the user trust proof is separate from the user and is entirely maintained by the system process to ensure system security. When logging into the system, the user needs to provide identity authentication credentials, i.e., the different authentication methods described above. Once the system identity authentication is successful, the system process first accesses the user permission management system, queries the user's access control ACL within the trusted domain based on the user ID, and then constructs a user trust proof together with the user ID, login time, and other information. The user trust proof is then encoded into a user token using the encoding function described above and stored in the system directory with read-only permissions. User trust credentials can only exist during a user's system login. Upon user logout or system lockout due to prolonged inactivity, the user trust credentials will be simultaneously revoked to ensure system security. This process is called user trust credential lifecycle management. User trust credentials are the core of unified identity authentication, and user authentication is achieved through the transmission of user trust credentials when accessing other business systems within the trusted domain. To ensure system security, this embodiment restricts the transmission of user trust credentials to within the system to reduce potential risks. Only access credentials for that business system are transmitted. System security auditing provides a method for recording system security information. It issues warnings when security events or violations of security principles occur within the system and provides necessary evidence and support for subsequent security event handling. System security audit information includes: auditable event names, event status (success or failure), and security information. The auditing system can provide different reporting functions based on user needs, thereby enabling functions such as tracking, reviewing, statistically analyzing, and reporting system information. System security auditing is a crucial component of unified identity authentication. It provides detailed and reliable evidence and support for the system to investigate and locate the causes of incidents, predict and alert before incidents occur, and handle incidents in real time after they happen. The security auditing mechanism creates and maintains access logs for protected objects and prevents unauthorized users from accessing or damaging these logs.The goal of this embodiment is to provide a convenient, fast, secure, and reliable business platform that allows users to authenticate once and move freely within a trusted domain. When accessing other business systems within the trusted domain, users with the appropriate permissions do not need to repeatedly authenticate. To prevent security incidents caused by the hijacking of user trust credentials, the system monitors user behavior in real time during activity, especially auditing abnormal behaviors such as unauthorized access and access to core directories, and promptly blocking such behaviors. If the abnormal behavior exceeds a system-set threshold, the user will be directly frozen. In this embodiment, the system user management function primarily aims to solve the problem of users being unable to use the system due to forgotten passwords. Although this embodiment provides multiple user authentication methods, considering user habits and product after-sales maintenance statistics, this problem still exists and requires a convenient and effective solution. Therefore, this embodiment provides a system user management module based on the ROOT user. The owner of user authentication information is the ROOT user, so using the ROOT user for management is an effective means. To ensure overall system security, this module operates completely offline in this embodiment, requiring local operation. Furthermore, this embodiment also configures a strong password and encryption function for the ROOT user. Using the ROOT user for system user management requires dedicated hardware devices (such as a U-key), and real-time trust measurement is necessary for each operation to prevent system breaches due to a compromised ROOT user account, ensuring overall system security and reliability. During unified identity authentication, the system needs to verify whether the user has permission to access a specific business system within the trusted domain, i.e., checking the user's Access Control List (ACL). The main function of this module is to manage and maintain the ACL corresponding to each user. First, during system initialization registration, users are also registered in the user permission management system, generating an ACL corresponding to their user ID. To ensure system security, the ACL for new users is initialized according to the principle of minimization. Next, as user needs change, the user's ACL permissions are dynamically adjusted, authorizing new needs while revoking long-unused permissions. Finally, when a user is logged out, the ACL corresponding to that user ID is also deactivated.

[0053] In this embodiment, step S102 includes the following: when a logged-in user needs to access a business system within a trusted domain, the user process sends an access request to a designated system process, and the operation of the designated system process responding to the access request includes:

[0054] S201, query the token corresponding to the logged-in user based on the user ID of the logged-in user;

[0055] S202, verify the integrity of the logged-in user's token. If the logged-in user's token is complete, proceed to step S203; if the logged-in user's token is incomplete, prompt that there is a security risk in the current system, freeze the current logged-in user, lock the system and return to the user login interface, end and exit.

[0056] S203, Obtain the Access Control List (ACL) of the logged-in user from the logged-in user's token;

[0057] S204. Determine whether the user has access permissions to the business system based on the Access Control List (ACL). If the user does not have access permissions, return an "Access Denied" error message and exit; otherwise, proceed to step S205.

[0058] S205 If the access control list (ACL) allows access to the business system, then the login user's token will be passed to the business system to achieve unified identity authentication.

[0059] In this embodiment, step S202, verifying the integrity of the logged-in user's token, includes: decoding the logged-in user's token T using a preset decoding function ψ(·) to obtain the logged-in user's trust certificate C, which contains the logged-in user's user ID, access control permissions ACL, and user access device HID; and encoding the user trust certificate C and the system's current trust measurement code ξ (which can be read using the interface provided by the trust measurement technology) using a preset encoding function. Encode to obtain the encoded result If the encoding result If the token T is the same as the logged-in user's token, the user's token is considered complete; otherwise, the user's token is considered incomplete.

[0060] The user trust certificate C (Credit) is the carrier of the unified identity authentication service, and other business systems within the trusted domain require this information for authentication. This embodiment proposes an "encode-decode" method. First, the user trust certificate is encoded into a low-dimensional, measurable vector, which is referred to as the token T in this embodiment. This vector is then stored and transmitted, while trustworthiness is measured. When unified identity authentication is required, the user ID, authentication credentials, and other information are decoded from the token T to complete the authentication. Furthermore, this "encode-decode" method is a one-to-one mapping; that is, a user trust certificate can be uniquely encoded into a token, and similarly, a token can be uniquely decoded into a user trust certificate. This can be represented as:

[0061] C = {UID, ACL, HID}

[0062]

[0063] Where C represents the user trust proof, which includes information such as the user's UID, access control permissions (ACL), and the user's access device HID; ξ represents the trust metric; and T represents the token. ψ(·) and ψ(·) are the encoding and decoding functions, respectively, and are inverse functions of each other. The storage of token T is crucial, requiring assurance of its integrity, availability, and security to ensure the safety of the entire system and user data. To prevent modification or damage, in this embodiment, token T is stored in the system directory in read-only mode, and its owner is the ROOT user. Furthermore, the storage, retrieval, and decoding of token T are all handled by system processes; user processes have no access permissions to token T. This method separates the user's token T from the user themselves for separate storage and maintenance, ensuring overall system security. To ensure the legitimacy of the token used for current user authentication, a trust measurement is required before authentication. During token encoding, a trust measurement code ξ from the current system startup has been added; therefore, only a trust measurement is needed to determine if the token is legitimate and complete. Since token reading and other operations are performed by system processes, the reliability and legitimacy of the token are ensured to a certain extent. When a user needs to access other business systems within the trusted domain, unified identity authentication is required. At this point, the system process retrieves the token corresponding to the user based on the user ID. Since the business system may not be local at this time, the token needs to be transmitted to the remote business system for verification. Although the business system is within the trusted domain, the security of the token itself must be ensured during the transmission process. Therefore, the identity authentication of the business system within the trusted domain will also be completed locally, and a business system access credential will be generated after completion. Upon receiving the user access credential, it is first verified. If the verification is successful, identity authentication is completed, and specific services are provided.

[0064] In this embodiment, step S101, which verifies user login based on user request, includes:

[0065] S301, Receive authentication credentials submitted by the user, the authentication credentials including identity information and login credentials;

[0066] S302, retrieve the user ID based on the identity information in the authentication credentials. If the user ID exists, proceed to step S303.

[0067] S303, match the login credentials in the authentication credentials with the identity authentication credentials submitted by the registered user. If the identity authentication credentials submitted by the user match, proceed to step S304.

[0068] S304, user login verification is successful.

[0069] Figure 4This embodiment describes the user authentication and trust certificate generation process. The process details how a user completes unified identity authentication, as follows: 1. Before logging into the system, the user must submit authentication credentials, provided they have already registered for those credentials; 2. The system extracts the user ID based on the submitted authentication credentials and performs a search. Based on the search results, the system branches out the process: If the user ID does not exist, it first accumulates the number of authentication failures, then checks if the number of failures has reached its limit. If the limit has not been reached, it returns an authentication failure message, requesting the user to resubmit their authentication credentials. If the cumulative limit has been reached, it indicates that the system may be at security risk. The system will be frozen to ensure overall security, and a countdown will begin. When the freeze time is reached, the system will be restored, prompting the user to resubmit their authentication credentials. If the user ID exists, the system will match the user credentials corresponding to that ID in the authentication list. If the match fails, the number of authentication failures for the current user ID will be accumulated. If the authentication failure limit has not been reached, an authentication failure message will be returned, and the user will be prompted to resubmit their authentication credentials. If the authentication failure limit has been reached, the current user will be frozen, and a countdown will begin. When the freeze time is reached, the system will be unfrozen, and the user will be prompted to resubmit their authentication credentials. 3. If the user's authentication credentials are successfully verified, the system will access the user access control system to obtain the current user's access control list (ACL). Next, a user trust certificate and token will be generated. At this point, the user authentication process is complete, and the user successfully logs in to the system.

[0070] In this embodiment, step S302 further includes handling login failure when the user ID does not exist, and step S303 further includes handling login failure when the identity authentication credentials submitted by the user do not match. The login failure handling includes: accumulating the number of authentication failures for the current user ID, determining whether the number of authentication failures for the current user ID has reached the authentication failure limit, if the authentication failure limit has not been reached, returning authentication failure information, prompting the user to resubmit identity authentication credentials, ending and exiting; if the authentication failure limit has been reached, freezing the current user and starting a countdown, unfreezing after the freeze time is reached, prompting the user to resubmit identity authentication credentials, ending and exiting.

[0071] Users need to register their identity information during system initialization in order to log in and access the system normally. For example... Figure 3 As shown, this embodiment further includes a user initialization step before step S101:

[0072] S401, Receive authentication credentials submitted by the user, the authentication credentials including identity information and login credentials;

[0073] S402 generates a user ID (globally unique) for the user;

[0074] S403, check if the user ID is available. If the user ID is unavailable, return an error message indicating that the current ID is unavailable and proceed to step S402; otherwise, bind the identity information and login credentials in the authentication credentials to the user ID.

[0075] S404 generates an initial access control ACL for the user, generates a user trust certificate C based on the user ID, the initial access control ACL, and the user's access device HID, and uses a preset encoding function to encode the user trust certificate C and the system's current trust metric ξ. Encode to obtain the encoded result Used as the user's token, the user's token is stored in read-only mode, and the owner is the ROOT user;

[0076] S405: Obtain other authentication credentials that the user needs to associate through interaction. If other authentication credentials entered by the user are obtained, bind and register the other authentication credentials submitted by the user to the user ID. If the user does not need to associate other authentication credentials, end and exit.

[0077] See Figure 2 The system checks if the user ID is available. If it is unavailable, it returns an error message indicating that the current ID is unavailable and regenerates the user ID until it becomes available. If it is available, it registers the ID with the user access control system, generates a corresponding Access Control List (ACL), and returns the ACL. Upon receiving the ACL, the system generates a user trust certificate and a user token, storing them in read-only mode in the system directory, owned by the ROOT user. Finally, it checks if the user has associated other authentication credentials. If the user wishes to add a login method, it prompts the user to enter authentication credentials, such as... Figure 2 The system processes the various authentication methods described in the document, then associates the authentication credentials with the user ID and writes them to the authentication list. It then checks again to see if the user has associated new credentials; if not, it ends the current initialization process.

[0078] Following step S405 in this embodiment, the step of having a designated system process update the access control permission ACL for the user who issued the permission update request is also included:

[0079] S501, extract the user ID from the permission update request;

[0080] S502, determine if the user ID exists. If the user ID exists, proceed to step S503; if the user ID does not exist, return an error message indicating that the current ID does not exist, end and exit.

[0081] S503, Read the token corresponding to the user ID.

[0082] S504, retrieve the access control list (ACL) of the logged-in user from the token and output it;

[0083] S505 obtains the updated Access Control List (ACL) from the administrator through interaction, generates a user trust certificate C based on the user ID, the updated ACL, and the user's access device HID, and then uses a preset encoding function to combine the user trust certificate C and the system's current trust metric ξ. Encode to obtain the encoded result To replace the user's original token.

[0084] Figure 5 The unified user identity authentication and trust certificate transmission process in this embodiment is as follows: First, when a user needs to access a business system within a trusted domain, an identity authentication request is triggered. At this time, the system will query the token corresponding to the current user based on the user ID, and simultaneously perform a trust measurement on the token to check its integrity. If the token trust measurement fails, it indicates that the current system may be in a security incident. A security risk warning is issued immediately, the current user is frozen, the system is locked, and the user is returned to the login interface to ensure overall system security. This process ends. If the trust measurement is successful, the access control list of the user is obtained using the process described in step 2, and it is checked whether the user has permission to access the business system. If no access permission is granted, an "access denied" error message is returned, and the process ends. If access permission is granted, the user access credentials are generated using the process described in step 3 and transmitted to the corresponding business system to complete the unified identity authentication for accessing the business system. This process ends.

[0085] Figure 6This is a flowchart illustrating the management and maintenance process of user trust certificates in this embodiment. User trust certificates are the carrier and core of unified identity authentication. To ensure system security, these certificates need to be regularly managed and their trustworthiness measured. Furthermore, to ensure security, access control lists for users are initialized according to the principle of minimization, permissions are allocated as needed during use, and unused permissions are promptly revoked. This process primarily accomplishes the above functions. The system first obtains the current user's ID, then queries the user's status. If the user is not logged in, it queries the user's trust certificate. If it exists, the trust certificate needs to be deactivated, and the current process ends; if it does not exist, the current system status is normal, and the current process ends. If the user is logged in, after obtaining their trust certificate, a trust measurement is performed to check its completeness. If the trust measurement is successful, the current system status is normal, and the current process ends; if the trust measurement fails, the system may be in a risk event, a security risk warning is immediately issued, the current user is frozen, the trust certificate is deleted, the system is locked, and the user is returned to the login interface, ending the process.

[0086] Figure 7 This is a flowchart of the user management and maintenance process in this embodiment. This process is the main business process of the user permission management system, which exists independently of the user system and provides permission management and maintenance for all business platforms and user systems within the trusted domain. The specific process can be divided into two categories: user registration and user permission change. User Registration Process: When the system receives a user registration request, it first extracts the user ID and then checks if the ID exists. If the requested ID already exists, it returns an error message indicating that the current user ID is unavailable, and the system registration process regenerates the user ID and repeats the process. If the requested ID does not exist, the current ID is available, and the ID is registered in the system. An Access Control List (ACL) corresponding to the ID is created and returned, and the process ends. User Permission Change Process: When the system receives a user permission change request, it first extracts the user ID and then searches for the ID in the system. If the requested ID does not exist, it returns an error message indicating that the current ID does not exist and ends the current process. If the requested ID exists, it extracts the Access Control List (ACL) corresponding to the ID and modifies it according to the requested permissions, and the process ends.

[0087] In summary, this embodiment implements a novel unified user authentication method. Utilizing trust chain transmission technology, it achieves a one-time login, access mechanism that allows seamless communication across all business systems. This enables unified authentication between business systems within a trusted domain, requiring users to authenticate only once upon logging into the operating system, eliminating the need for multiple authentication steps. This method allows users to seamlessly navigate the trusted domain with a single authentication. The method in this embodiment, based on trusted measurement technology, transmits user trusted proofs to users within the operating system, rather than at the application level. This lays a solid foundation for access control and security auditing while providing users with secure, reliable, convenient, and efficient protection. It is applicable to various computer platforms supporting trusted measurement technology, including domestically developed and controllable operating system platforms. This embodiment does not rely on the specific authentication method used for user login verification. For application scenarios with different security levels, it supports multiple authentication methods such as password authentication, certificate authentication, biometric authentication, and mobile credential authentication, improving the portability and efficiency of unified identity authentication. To ensure user business and data security, full lifecycle user behavior auditing can also be performed during operation.

[0088] Furthermore, this embodiment also provides a unified identity authentication device for an operating system platform, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the unified identity authentication method of the operating system platform. Additionally, this embodiment also provides a computer-readable storage medium storing a computer program for being programmed or configured by a microprocessor to execute the unified identity authentication method of the operating system platform. Furthermore, this embodiment also provides a computer program product, including a computer program / instructions, which is programmed or configured by a microprocessor to execute the unified identity authentication method of the operating system platform.

[0089] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0090] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A unified identity authentication method for an operating system platform, characterized in that, include: S101, Perform user login verification based on user request; S102, When a logged-in user needs to access a business system within a trusted domain, verify the integrity of the logged-in user's token. If the logged-in user's token is intact, obtain the logged-in user's Access Control List (ACL) from the token. If the ACL allows access to the business system, then pass the logged-in user's token to the business system to achieve unified identity authentication. Step S102 includes the following steps: When a logged-in user needs to access a business system within a trusted domain, the user process sends an access request to a designated system process. The operation of the designated system process in responding to the access request includes: S201, query the token corresponding to the logged-in user based on the user ID of the logged-in user; S202, verify the integrity of the logged-in user's token. If the logged-in user's token is complete, proceed to step S203; if the logged-in user's token is incomplete, prompt that there is a security risk in the current system, freeze the current logged-in user, lock the system and return to the user login interface, end and exit. S203, Obtain the Access Control List (ACL) of the logged-in user from the logged-in user's token; S204. Determine whether the user has access permissions to the business system based on the Access Control List (ACL). If the user does not have access permissions, return an "Access Denied" error message and exit; otherwise, proceed to step S205. S205, If the Access Control List (ACL) allows access to the business system, then the login user's token will be passed to the business system to achieve unified identity authentication. Step S202, verifying the integrity of the logged-in user's token, includes: using a preset decoding function. Decode the login user's token T to obtain the login user's user trust proof. The user trust proof This includes the logged-in user's user ID, access control permissions (ACL), and the user's access device HID; it also includes user trust credentials. The current trusted measurement code of the system Use the preset encoding function Encode to obtain the encoded result If the encoding result If the token T is the same as the logged-in user's token, the user's token is considered complete; otherwise, the user's token is considered incomplete.

2. The unified identity authentication method for an operating system platform according to claim 1, characterized in that, Step S101, which verifies user login based on user request, includes: S301, Receive authentication credentials submitted by the user, the authentication credentials including identity information and login credentials; S302, retrieve the user ID based on the identity information in the authentication credentials. If the user ID exists, proceed to step S303. S303, match the login credentials in the authentication credentials with the identity authentication credentials submitted by the registered user. If the identity authentication credentials submitted by the user match, proceed to step S304. S304, user login verification is successful.

3. The unified identity authentication method for an operating system platform according to claim 2, characterized in that, Step S302 also includes handling login failure when the user ID does not exist, and step S303 also includes handling login failure when the authentication credentials submitted by the user do not match. The login failure handling includes: accumulating the number of authentication failures for the current user ID, determining whether the number of authentication failures for the current user ID has reached the authentication failure limit, and if the authentication failure limit has not been reached, returning authentication failure information, prompting the user to resubmit identity authentication credentials, ending and exiting; If the limit for the number of failed authentication attempts has been reached, the current user will be frozen and a countdown will begin. Once the freeze time is up, the user will be unfrozen, prompted to provide identity verification credentials again, and the process will end and the user will be logged out.

4. The unified identity authentication method for an operating system platform according to claim 3, characterized in that, Before step S101, there is also a step of user initialization: S401, Receive authentication credentials submitted by the user, the authentication credentials including identity information and login credentials; S402 generates a user ID for the user; S403, check if the user ID is available. If the user ID is not available, return an error message that the current ID is not available and jump to step S402. Otherwise, bind the identity information and login credentials in the authentication credentials to the user ID; S404 generates an initial access control ACL for the user, and generates a user trust certificate based on the user ID, the initial access control ACL, and the user's access device HID. Proof of user trust The current trusted measurement code of the system Use the preset encoding function Encode to obtain the encoded result Used as the user's token, the user's token is stored in read-only mode, and the owner is the ROOT user; S405: Obtain other authentication credentials that the user needs to associate through interaction. If other authentication credentials entered by the user are obtained, bind and register the other authentication credentials submitted by the user to the user ID. If the user does not need to associate other authentication credentials, the process ends and the user exits.

5. The unified identity authentication method for an operating system platform according to claim 4, characterized in that, Step S405 is followed by the step of a specified system process updating the access control ACL for the user who issued the permission update request: S501, extract the user ID from the permission update request; S502, determine if the user ID exists. If the user ID exists, proceed to step S503; if the user ID does not exist, return an error message indicating that the current ID does not exist, end and exit. S503, Read the token corresponding to the user ID. S504, retrieve the access control list (ACL) of the logged-in user from the token and output it; The S505 obtains the updated Access Control List (ACL) from the administrator through interaction, and generates a user trust certificate based on the user ID, the updated ACL, and the user's access device HID. Proof of user trust The current trusted measurement code of the system Use the preset encoding function Encode to obtain the encoded result To replace the user's original token.

6. A unified identity authentication device for an operating system platform, comprising a microprocessor and a memory interconnected, characterized in that, The microprocessor is programmed or configured to execute the unified identity authentication method of the operating system platform according to any one of claims 1 to 5.

7. A computer-readable storage medium storing a computer program, characterized in that, The computer program is used to be programmed or configured by a microprocessor to execute the unified identity authentication method of the operating system platform according to any one of claims 1 to 5.

8. A computer program product comprising a computer program / instructions, characterized in that, The computer program / instructions are programmed or configured by a microprocessor to execute the unified identity authentication method of the operating system platform described in any one of claims 1 to 5.

Images