An identity authentication method and authentication system

Abstract

The embodiment of the present application provides an identity authentication method and an authentication system, which are used for improving the security of identity authentication. Specifically, a terminal device sends a first access request to an authentication gateway, the first access request being used for requesting access to a first business site; when the authentication gateway determines that an access subject corresponding to the first access request is not logged in and has been registered in the authentication gateway according to the first access request, the authentication gateway jumps to an authentication server in response to the first access request; the authentication server acquires login information of the access subject and performs login authentication; after determining that the access subject logs in successfully, the authentication server acquires user information of the access subject and generates a first authentication identifier; the authentication server feeds back the first authentication identifier and a login success indication message to the authentication gateway; the authentication gateway requests the authentication server to acquire the user information of the access subject according to the first authentication identifier, and forwards the first access request to the first business site in response to the login success indication message. The present application can be applied to a cloud system.

Description

Technical Field

[0001] This application relates to the field of computer applications, and in particular to an identity authentication method and authentication system. Background Technology

[0002] Most existing government service platforms maintain their own independent user systems and single authentication methods. This means that public users need to create their own accounts and passwords to access different government systems, and even multiple systems within the same government unit do not have interconnected user systems. Over time, this results in public users having to record a large amount of account and password information, leading to confusion, forgetting passwords, frequent identity verification, and password changes, which seriously affects efficiency and user experience.

[0003] Currently, to address these issues, single sign-on (SSO) is commonly used to allow users to log in once and access multiple systems. However, this solution only relies on an authentication server for login authentication and re-verification, and security cannot be guaranteed if the authentication server malfunctions.

[0004] Therefore, there is an urgent need for an identity authentication method that can improve the security of identity authentication. Summary of the Invention

[0005] This application provides an identity authentication method and system to improve the security of identity authentication.

[0006] In view of this, this application provides an identity authentication method applied to an authentication system including an authentication gateway, an authentication server, a terminal device, and multiple business sites. Specifically, the method includes: the terminal device sending a first access request to the authentication gateway, the first access request being used to request access to a first business site; when the authentication gateway determines, based on the first access request, that the access subject corresponding to the first access request is not logged in and has registered with the authentication gateway, the authentication gateway responds to the first access request and redirects to the authentication server; the authentication server obtains the login information of the access subject and performs login authentication; after determining that the access subject has successfully logged in, it obtains the user information of the access subject and generates a first authentication identifier; it sends the first authentication identifier and a login success indication message back to the authentication gateway; the authentication gateway requests the user information of the access subject from the authentication server based on the first authentication identifier, and responds to the login success indication message by forwarding the first access request to the first business site.

[0007] This application also provides an authentication system, including: an authentication gateway, an authentication server, a terminal device, and multiple service sites; the terminal device is configured to send a first access request to the authentication gateway, the first access request being for accessing a first service site; the authentication gateway is configured to, based on the first access request, if it determines that the access subject corresponding to the first access request is not logged in, respond to the first access request and redirect to the authentication server; the authentication server is configured to obtain the login information of the access subject and perform login authentication; after determining that the access subject has successfully logged in, it obtains the user information of the access subject and generates a first authentication identifier; it sends the first authentication identifier and a login success indication message back to the authentication gateway; the authentication gateway is configured to, based on the first authentication identifier, request the authentication server to obtain the user information of the access subject, and respond to the login success indication message by forwarding the first access request to the first service site.

[0008] In one possible design, in another implementation of another aspect of the embodiments of this application, the authentication gateway receives a second access request sent by the terminal device. The second access request is used to request access to a second business site, and the second access request carries the first identity credential and the second identity credential.

[0009] When the authentication gateway verifies the existence of the second identity credential, the authentication gateway forwards the second access request to the authentication server;

[0010] The authentication server verifies the authentication result of the access subject based on the first identity credential;

[0011] The authentication gateway receives the authentication result sent by the authentication server;

[0012] When the authentication result indicates that the access subject is logged in, the authentication gateway forwards the second access request to the second business site.

[0013] In one possible design, in another implementation of an embodiment of this application, the authentication gateway returns a third-party identity credential to the terminal device. It is understood that the authentication gateway also stores this third-party identity credential.

[0014] In one possible design, in another implementation of another aspect of the embodiments of this application, the authentication gateway receives a third access request sent by the terminal device, the third access request being used to request access to a third service site, and the third access request carrying the third identity credential.

[0015] When the authentication gateway verifies the existence of the third identity credential, the authentication gateway adds a fourth identity credential to the third access request and forwards the third access request to the authentication server. The fourth identity credential is used to indicate the access subject.

[0016] The authentication server verifies the authentication result of the access subject based on the fourth identity credential;

[0017] The authentication gateway receives the authentication result sent by the authentication server;

[0018] When the authentication result indicates that the access subject is logged in, the authentication gateway forwards the third access request to the third business site.

[0019] In one possible design, in another implementation of another aspect of the embodiments of this application, the authentication server receives the account and password of the access subject sent by the terminal device.

[0020] The authentication server authenticates login based on the account and password.

[0021] or,

[0022] The authentication server receives the facial or fingerprint information of the access subject sent by the terminal device;

[0023] The authentication server performs login authentication based on the facial feature information or the fingerprint feature information;

[0024] or,

[0025] The authentication server receives the verification information of the access subject sent by the third-party verification data source;

[0026] The authentication server performs login authentication based on the verification information of the access subject.

[0027] In one possible design, in another implementation of another aspect of the embodiments of this application, the terminal device displays a login authentication interface, which displays a login authentication method selection control;

[0028] The terminal device responds to the access subject's operation on the login authentication method selection control by displaying the login information input interface;

[0029] The terminal device responds to the user's actions on the input interface and obtains the user's login information.

[0030] This application also provides a computer device, including: a memory, a processor, and a bus system;

[0031] The memory is used to store programs;

[0032] The processor is used to execute programs in memory, and the processor is used to execute the methods mentioned above according to the instructions in the program code;

[0033] Bus systems are used to connect memory and processor to enable communication between them.

[0034] Another aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the methods described above.

[0035] Another aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the above aspects.

[0036] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: During the login authentication process, the authentication gateway performs an authentication on the access request to determine whether the access subject corresponding to the access request has registered with the authentication gateway and whether the access subject has logged in. If the access subject has not logged in, the request is forwarded to the authentication server for another authentication. In this way, the authentication gateway can perform a screening of access requests, thereby preventing other access subjects from launching login attacks on the network and thus improving the security of the login authentication process. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of a product architecture for the identity authentication method in the embodiments of this application;

[0038] Figure 2 This is a schematic diagram of the architecture of a communication system in an embodiment of this application;

[0039] Figure 3 This is a schematic diagram of the architecture of the identity authentication platform in the embodiments of this application;

[0040] Figure 4 This is a schematic diagram of one embodiment of the identity authentication method in this application;

[0041] Figure 5a This is a schematic diagram of an interface for a terminal device to send an access request in an embodiment of this application;

[0042] Figure 5b This is another schematic diagram of the interface for the terminal device to send an access request in an embodiment of this application;

[0043] Figure 6 This is a schematic diagram of the authentication interface in an embodiment of this application;

[0044] Figure 7 This is another schematic diagram of the authentication interface in the embodiments of this application;

[0045] Figure 8 This is another schematic diagram of the authentication interface in the embodiments of this application;

[0046] Figure 9 This is another schematic diagram of the authentication interface in the embodiments of this application;

[0047] Figure 10 This is a schematic diagram of another embodiment of the identity authentication method in this application;

[0048] Figure 11 This is a schematic diagram of another embodiment of the identity authentication method in this application;

[0049] Figure 12 This is a schematic diagram of one embodiment of the identity authentication system in this application.

[0050] Figure 13 This is a schematic diagram of an embodiment of the authentication server in the identity authentication system of this application.

[0051] Figure 14 This is a schematic diagram of an embodiment of a terminal device in the identity authentication system of this application. Detailed Implementation

[0052] This application provides an identity authentication method and system to improve the security of identity authentication.

[0053] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “corresponding to,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0054] For ease of understanding, the following is an explanation of some terms used in this application:

[0055] Authentication Gateway: This includes an admission gateway, an access gateway, and an application programming interface (API). The authentication gateway manages the traffic of user access requests. By working in conjunction with the admission gateway and identity authentication, all websites or mini-programs registered with the admission gateway can enjoy unified identity authentication and access control.

[0056] Cookies: Credentials used by clients and services to interact and establish identity. Specifically, a cookie is a simple text file stored on a client machine, associated with a specific World Wide Web (WWW) document. In other words, cookies store information about when a client accesses a WWW document, and this information is available when the client accesses the document again. Because cookies can be stored on the client machine, they can help record personal information. For example, a website might generate a unique identity document (ID) for each visitor and store it as cookies on each visitor's corresponding client machine. When you access the web using a browser, you'll see all the cookies stored on your hard drive. Each file in this folder is a text file consisting of name / value pairs, and there's another file containing information about all the corresponding websites. At this point, each cookie file is a simple text file. The filename indicates which website placed the cookie on your machine (site information is also stored in the file).

[0057] Verification source: A database of information used to verify user identity, including but not limited to personal information obtained by legitimate organizations, such as unique personal identifiers, account passwords, etc.

[0058] Access subject: In the network, the party that initiates the access, the person / device / application that accesses internal network business resources, is a digital entity composed of or combined with factors such as people, devices, and applications.

[0059] Accessed object: In this embodiment, it is also referred to as a business site. In the network, the party being accessed, namely the enterprise's intranet business resources, includes applications, systems (development and testing environments, operation and maintenance environments, production environments, etc.), data, interfaces, functions, etc.

[0060] The method provided in this application is applicable to, for example... Figure 1The product architecture shown includes an object-oriented architecture, a client, an identity authentication platform, and a verification data source (i.e., a third-party verification database). The object-oriented architecture allows any user to access business sites deployed on the client through any terminal device. Multiple different business sites are deployed on the client; these sites can be service websites; mobile applications, including mini-programs (such as those within instant messaging software) or applications (such as applications for specific banks); or business systems. In this application, the identity authentication platform includes an authentication server, a unified identity account database, and a compatible third-party verification database; verification methods can include password authentication (such as account and password), biometric authentication (such as fingerprint authentication, facial recognition authentication, etc.), electronic authentication services (i.e., CA authentication), etc.

[0061] based on Figure 1 The product architecture provided in this application can be applied to, for example, product architectures. Figure 2 Please refer to the communication system shown. Figure 2 , Figure 2This is a schematic diagram of the communication system architecture in an embodiment of this application. As shown in the figure, the communication system includes an authentication server, terminal devices, an authentication gateway, and a business site. The client corresponding to the business site is deployed on the terminal device. The client can run on the terminal device through a browser or as a standalone application (APP). The specific form of the client is not limited here. The server involved in this application can be an independent physical server, a server cluster composed of multiple physical servers, or a distributed system. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The terminal device can be a smartphone, tablet, laptop, PDA, personal computer, smart TV, smartwatch, in-vehicle device, wearable device, etc., but is not limited to these. The terminal device and the server can be directly or indirectly connected through wired or wireless communication, which is not limited here. The number of servers and terminal devices is also not limited. In this application, the identity authentication system is the user access authentication component of cloud security. Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior detection. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the Internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client. The main research directions in cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, and compliance auditing; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event and information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive amounts of information and improve the ability to control network-wide security events and risks; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0062] Based on the aforementioned communication system, the architecture of the identity authentication platform in this application can be as follows: Figure 3As shown, this identity authentication platform can include different authentication modules depending on the verification method, such as a natural person authentication subsystem, a legal person authentication subsystem, and a management subsystem. It can also include a unified account database. The natural person authentication subsystem can access natural person information from the personal basic information database or the real-name verification database via an API gateway; the legal person authentication subsystem can access legal person information from the legal person database via an API gateway; and the management subsystem can manage other third-party authentication platforms, such as third-party authentication integration platforms and data certificate authentication platforms. The third-party authentication integration platforms can include national or provincial (e.g., Hubei Province, Guangdong Province, etc.) unified identity authentication platforms or other third-party authentication platforms; while the data certificate authentication platform can include CA certificate authentication or industry certificate authentication, etc. Furthermore, this identity authentication platform can also interact with various business clients deployed on terminal devices through an access gateway. These business clients can be websites, mini-programs, business systems, or applications. It is understood that the personal basic information database, real-name verification database, or legal person database are all databases. In short, a database can be viewed as an electronic filing cabinet—a place to store electronic files, where users can perform operations such as adding, querying, updating, and deleting data. A "database" is a collection of data stored together in a certain way, shared by multiple users, with minimal redundancy, and independent of application programs. A Database Management System (DBMS) is a computer software system designed to manage databases, generally possessing basic functions such as storage, retrieval, security, and backup. DBMSs can be classified according to the database model they support, such as relational or XML (Extensible Markup Language); or according to the type of computer they support, such as server clusters or mobile phones; or according to the query language used, such as SQL (Structured Query Language) or XQuery; or according to performance priorities, such as maximum scale or highest operating speed; or other classification methods. Regardless of the classification method used, some DBMSs can cross categories, for example, supporting multiple query languages ​​simultaneously.

[0063] It is understood that in the specific implementation of this application, data related to user information and user network access are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0064] Based on the above description, the identity authentication method in the embodiments of this application will be described below. Please refer to [link / reference] for details. Figure 4 As shown, one embodiment of the identity authentication method in this application specifically includes:

[0065] 401. The terminal device sends a first access request to the authentication gateway, which is used to request access to the first service site.

[0066] The terminal device generates a first access request in response to the user's operation, and then sends the first access request to the authentication gateway. The first access request is used to request access to the first service site.

[0067] It is understandable that this user action can be a click operation performed by the user on a browser deployed on the terminal device, or a click operation performed by the user on a mini-program deployed on the terminal device. Specifically, this click operation can be performed by the user clicking controls on the screen using a mouse, or by the user clicking controls on the screen using a finger.

[0068] One possible implementation is, such as Figure 5a As shown, the user is browsing a government website in a browser, and the website's interface is as follows. Figure 5a As shown, the interface includes controls such as "Personal Information Inquiry," "Residence Permit," "Talent Introduction," "Personal Frequently Used," "Legal Person Frequently Used," and "Search Bar." If a user needs to access "Personal Information Inquiry," they can move the mouse cursor to the "Personal Information Inquiry" control and then click it. The terminal device then responds to this click, generating a first access request to request a personal information inquiry. In one exemplary solution, this first access request can be a Uniform Resource Locator (URL) or other possible message formats, which are not limited here. It is understood that a URL is a concise representation of the location and access method of a resource obtained on the Internet; it is the address of a standard resource on the Internet. A URL is globally unique, and a correct URL should be able to open the webpage through a browser. For example, if the first access request is used to access a government website, the URL corresponding to the first access request could be as follows: "http: / / www.xxx.gov.cn".

[0069] Another possible implementation, such as Figure 5b As shown, the user accesses the government affairs application on the tablet device, and the display interface of the government affairs application is as follows. Figure 5bAs shown, the device includes controls such as "Personal Information Inquiry", "Residence Permit", "Talent Introduction", "Personal Frequently Used", "Legal Person Frequently Used", and "Search Bar". If the user needs to access "Personal Information Inquiry", the user can click the "Personal Information Inquiry" control with their finger. At this time, the tablet device responds to the click operation and generates the first access request to request personal information inquiry.

[0070] 402. The authentication gateway verifies the first access request. If it determines that the access subject corresponding to the first access request has been registered with the authentication gateway and the access subject is not logged in, it responds to the first access request and redirects to the authentication server.

[0071] In this embodiment, the authentication gateway obtains the information carried in the first access request, thereby acquiring relevant information about the access subject. Then, the authentication gateway verifies whether the access subject is registered with the first business site and with the authentication gateway based on this information. After determining that the access subject and the first business site are registered with the authentication gateway, the gateway verifies again whether the access subject is logged in. If the access subject is not logged in, the authentication gateway redirects to the authentication server. At this time, the authentication interface corresponding to the authentication server will be displayed on the terminal device's screen. In one exemplary solution, the authentication interface can be as follows: Figure 6 As shown, the interface includes selection controls for login authentication methods such as "Personal Login," "Corporate Login," "Login QR Code," "Account Password," "Biometric Authentication," "Online Banking Authentication," and "CA Authentication." This embodiment provides diverse login authentication methods, including but not limited to account passwords, biometric authentication, online banking authentication, and CA authentication. This allows for access to various verification sources, thereby improving the security of identity authentication and ensuring the feasibility of this solution.

[0072] For example, user A registers for services A, B, and C on the authentication gateway. The authentication gateway will save the information of user A when registering for these services. For instance, when user A registers for service A on the authentication gateway, they use the username "ting" and password "124536" for registration. At this time, after successful registration, the authentication gateway will assign a corresponding account to user A, such as "456867895". It can be understood that the account assigned by the authentication gateway can consist only of numbers, or it can be a combination of numbers, letters, and symbols (such as "Ab-456867895"), and there is no specific limitation. The information saved by the authentication gateway will include the username "ting", password "124536" of user A, and the account "456867895" assigned by the authentication gateway. If user A also needs to undergo real-name authentication in service A, the authentication gateway can also save information such as the identity name "Xiaoxiaobai" and identity ID of user A. At the same time, after user A successfully registers on the authentication gateway, the authentication gateway can also feedback a registration certificate corresponding to user A, which can be used to indicate that user A has successfully registered on the authentication gateway. Similarly, the authentication gateway will also save the information of user A when registering for services B and C on the authentication gateway, and the details will not be elaborated here. When user A sends an access request to the authentication gateway to access service A, the access request can carry the user information of user A or the registration certificate feedback by the authentication gateway. If the user information carried by the access request is not saved by the authentication gateway, or the access request does not carry the registration certificate, or the registration certificate carried by the access request has expired, or the registration certificate carried by the access request is incorrect, the authentication gateway will confirm that user A is not registered. In this case, the authentication gateway can directly send a prompt to the terminal device used by user A (such as a desktop computer, and at this time user A accesses service A through the browser deployed on the desktop computer), indicating that the current access request cannot pass. If the authentication gateway determines that user A is registered, it will confirm whether user A is logged in based on the login certificate carried by the access request. If the access request does not carry the login certificate, or the login certificate carried by the access request has expired, or the login certificate carried by the access request is incorrect, the authentication gateway will confirm that user A is not logged in. At this time, the authentication gateway will transfer the task to the authentication server to remind user A to perform login authentication. At this time, the terminal device used by user A can display a login authentication interface as shown in Figure 6 shown below.

[0073] 403. The authentication server obtains the login information of the access subject and performs login authentication.

[0074] After the terminal device redirects to the authentication interface, it displays the login information retrieval interface in response to the user's selection of the login authentication method. Then, the authentication server can obtain the login information of the access subject according to the login authentication method and perform login authentication based on the login information.

[0075] Specifically, the authentication server can perform login authentication in several possible ways, including the following:

[0076] In one possible implementation, the terminal device displays a login interface with account and password in response to the user's selection. At this time, the authentication server obtains the account and password sent by the terminal device as the login information and performs login authentication based on the account and password. Figure 7 As shown, the terminal device displays an account input field and an account password input field. The user enters the account and password in the above input fields respectively. Then the terminal device sends the account and password to the authentication server, which then performs login authentication based on the account and password.

[0077] In another possible implementation, the terminal device displays a biometric login interface in response to the user's selection. The terminal device then acquires the user's biometric information (such as fingerprint, facial, or voiceprint data) and sends this information to the authentication server. The authentication server then performs login authentication based on the biometric information. Figure 8 As shown, the terminal device displays a fingerprint acquisition interface. The user inputs their fingerprint through the fingerprint acquisition device of the terminal device, and the terminal device sends the fingerprint feature information to the authentication server. The authentication server performs login authentication based on the fingerprint feature information.

[0078] In another possible implementation, the terminal device responds to the user's selection by displaying a third-party authentication interface. The user then enters the corresponding login authentication information based on this interface and sends it to the authentication server, allowing the server to perform login authentication using the third-party authenticated login information. For example... Figure 9 As shown, the terminal device displays a third-party real-name verification interface. Users enter their real-name information in the corresponding input fields and send the real-name information to the authentication server. The authentication server performs login authentication based on the real-name information and the real-name verification database.

[0079] 404. After the access subject successfully logs in, the authentication server obtains the user information of the access subject and generates the first authentication identifier.

[0080] After the authentication server determines that the access subject has successfully logged in, the authentication server obtains the user information of the access subject and generates a first authentication identifier (which can also be referred to as a code) based on the user information. It can be understood that the user information can be all the user information in the verification data source that the authentication server can call or the corresponding user information in a single login method. For example, if the access subject successfully logs in through an account and account password, the user information obtained by the authentication server can be only the account and account password; it can also obtain the account and account password, as well as the user information of the access subject on other authentication platforms after successful login, such as the biometric information, account, registered name, and identity identification ID, etc. corresponding to the access subject.

[0081] For example, after the authentication server verifies that user A has successfully logged in, it can call the user information of user A from multiple verification sources or only obtain the user information of user A used for login authentication. For example, it obtains that the identity name of user A is "Xiaoxiaobai", the identity identification ID is "7824679464"; the account on service A is "456867895", the user name on service A is "ting", the user name on service B is "ting0l20", the user name on service C is "sting", digital certificate 1 for CA authentication, digital certificate 2 for online banking authentication, right thumb fingerprint, right index finger fingerprint, left thumb fingerprint, photo, etc. Then the authentication server generates a unique identifier based on the user information of user A, so that when the authentication server receives the unique identifier again, it can call the user information of user A.

[0082] 405. The authentication server sends the first authentication identifier and a login success indication message to the authentication gateway.

[0083] The authentication server sends the first authentication identifier and a login success indication message indicating that the access subject has successfully logged in to the authentication gateway.

[0084] 406. The authentication gateway requests the user information from the authentication server according to the first authentication identifier.

[0085] The authentication gateway sends a request message to the authentication server, where the request message carries the first authentication identifier.

[0086] 407. The authentication server sends the user information to the authentication gateway.

[0087] After receiving the request message, the authentication server verifies according to the first authentication identifier. When the verification passes, the authentication server sends the user information of the access subject to the authentication gateway.

[0088] In this embodiment, when the authentication gateway obtains the user information, it can cache the user information.

[0089] After the authentication gateway caches the user information, if the authentication gateway receives again an access request sent by the terminal device, the authentication gateway can verify the authentication identifier carried in the access request according to the user information. For example, after the authentication gateway receives the user information of user A feedback from the authentication server, the user information received by the authentication gateway will include that the identity name of user A obtained from the real-name authentication system is "Xiaoxiaobai", the identity identifier ID is "7824679464", the account number on service A is "456867895", the user name on service A is "ting", the user name on service B is "ting0120", the user name on service C is "sting", the digital certificate 1 for CA authentication, the data certificate 2 for online banking authentication, the right thumb fingerprint, the right index finger fingerprint, the left thumb fingerprint, the photo, and so on. Then the authentication gateway saves the above information.

[0090] 408. The authentication gateway forwards the login success indication message to the terminal device.

[0091] After receiving the login success indication message feedback from the authentication server, the authentication gateway forwards the login success indication message to the terminal device. 409. The terminal device sends the first access request to the authentication gateway in response to the login success indication message.

[0092] After receiving the login success indication message, the terminal device resends the first access request to the authentication gateway.

[0093] 410. The authentication gateway verifies the first access request. When it is determined that the access subject corresponding to the first access request has been registered in the authentication gateway and the access subject is not logged in, the authentication gateway jumps to the first service site in response to the first access request.

[0094] In this embodiment, the authentication gateway obtains the information carried in the first access request, so as to obtain the relevant information of the access subject. Then the authentication gateway verifies whether the access subject is registered in the first service site and whether the access subject is registered in the authentication gateway according to the relevant information of the access subject; after the authentication gateway determines that the access subject and the first service site have been registered in the authentication gateway, it verifies again whether the access subject is in the logged-in state. If the authentication gateway verifies that the access subject is in the logged-in state according to the obtained user information, the authentication gateway forwards the first access request to the first site.

[0095] It is understood that in this embodiment, the access subject can access the business site through different clients deployed on the terminal device. However, based on different clients, during the access subject's first login process, the authentication gateway and the authentication server can also perform the following operations after the access subject's first login:

[0096] If the user accesses the business site through a browser deployed on the terminal device, after the user's first login, the authentication server will generate and store a first identity credential based on the user's user information, and the authentication gateway will generate and store a second identity credential based on the user's user information. Thus, when the user accesses the business site again, the access request sent to the authentication gateway will include both the first and second identity credentials. In one exemplary solution, the first and second identity credentials can be cookies. For example, the cookie stored on the authentication server might be "tif-sso-session-gy=1dgnla6qhi3ut6d1310ae26a24ba0ad58442aaf28f97b", and the cookie stored on the authentication gateway might be "tif_ssoid=07j8zjyqrnp2hz0lxqhzw2". Here, `tif-sso-session-gy` is a cookie type, and `1dgnla6qhi3ut6d1310ae26a24ba0ad58442aaf28f97b` is the value of that cookie. Similarly, `tif_ssoid` is a cookie type, and `07j8zjyqrnp2hz0lxqhzw2` is the value of that cookie. It can be understood that the cookie value can be randomly generated by the authentication server and the authentication gateway, or it can be calculated by the authentication server and the authentication gateway using an algorithm based on the user information of the access subject. The algorithm is not limited here, as long as it can yield a unique cookie value.

[0097] Under this scheme, the specific authentication process for the access subject to access the second business site through the terminal device can be as follows: Figure 10 As shown:

[0098] 1001. The terminal device sends a second access request to the authentication gateway. The second access request is used to request access to the second business site. The second access request carries the first identity credential and the second identity credential.

[0099] After the authentication server and the authentication gateway have stored the identity credentials (i.e., cookies), when the terminal device accesses the business again under the same browser, its access request will automatically carry the first identity credential and the second identity credential.

[0100] For example, if user A has successfully logged in and authenticated when accessing service A through a browser on a desktop computer, the authentication server and the authentication gateway will save the corresponding cookies, such as cookies1 and cookies2, within the same domain of the browser. When user A continues to access service B through the same browser on the same desktop computer, the access request will carry cookies1 and cookies2.

[0101] 1002. When the authentication gateway verifies the existence of the second identity credential, the authentication gateway forwards the second access request to the authentication server.

[0102] After the authentication gateway receives the second access request, it determines whether the access subject corresponding to the second access request is registered with the authentication gateway based on the relevant information in the second access request. If registered, the authentication gateway determines whether the second identity credential exists. If the second identity credential exists, the authentication gateway forwards the second access request to the authentication server; if not, it sends a message to the terminal device indicating that it is not logged in or that an access error has occurred. Specific details are not limited here. It is understandable that after the authentication gateway determines that the second identity credential exists, it can also retrieve cached user information based on the second identity credential and use this user information for subsequent operations.

[0103] For example, if user A sends an access request that includes cookies1 and cookies2, the authentication gateway will obtain cookies1 and cookies2 after parsing the access request. The authentication gateway will then compare cookies1 and cookies2 with its own stored cookies. If the authentication gateway confirms that one of cookies1 and cookie2 is the same as one of its stored cookies, it will forward the access request to the authentication server, allowing the authentication server to re-verify whether user A is logged in based on cookies1 and cookies2.

[0104] Understandably, before verifying the existence of the cookie itself, the authentication gateway also needs to verify whether user A has registered with the authentication gateway. For example, if user A registers for business A, business B, and business C on the authentication gateway, the gateway will store the information user A used when registering for business A, business B, and business C. For instance, if user A registers for business A on the authentication gateway using the username "ting" and password "124536", the gateway will assign a corresponding account, such as "456867895", after successful registration. It's understandable that the authentication gateway can assign an account consisting only of numbers, or a combination of numbers, letters, and symbols (such as "Ab-456867895"), without specific limitations. The information stored by the authentication gateway will include user A's username "ting", password "124536", and the account "456867895" assigned by the gateway. If user A requires real-name authentication for service A, the authentication gateway can also store user A's username "Xiaoxiaobai" and identity ID. Simultaneously, after user A successfully registers with the authentication gateway, the gateway can also provide a registration credential corresponding to user A, which indicates successful registration. Similarly, the authentication gateway will also store user A's registration information for services B and C, details of which will not be elaborated here. When user A sends an access request to service A to the authentication gateway, the request can carry user A's user information or the registration credential provided by the gateway. If the authentication gateway has not stored the user information in the access request, or if the access request does not carry the registration credential, or if the registration credential is expired or incorrect, the authentication gateway confirms that user A is not registered. If none of the above issues exist, user A can be confirmed as registered.

[0105] 1003. The authentication server verifies the authentication result of the access subject based on the first identity credential.

[0106] After receiving the second access request, the authentication server obtains the second identity credential and verifies its existence. If the second identity credential exists, the authentication server determines that the access subject corresponding to the second access request is logged in; if it does not exist, the authentication server determines that the access subject corresponding to the second access request is not logged in. For example, if user A sends an access request carrying cookies1 and cookies2, the authentication gateway obtains cookies1 and cookies2 after parsing the access request. The authentication gateway compares cookies1 and cookies2 with its own stored cookies. If the authentication gateway confirms that one of cookies1 and cookie2 matches one of its stored cookies, it forwards the access request to the authentication server, allowing the authentication server to re-verify whether user A is logged in based on cookies1 and cookies2. After receiving the access request forwarded by the authentication gateway, the authentication server parses the access request and obtains cookies1 and cookies2. The authentication server compares cookies1 and cookies2 with its own stored cookies. If the authentication server confirms that one of cookies1 and cookie2 is the same as one of its own stored cookies, it confirms to the authentication server that user A is logged in.

[0107] It is understandable that when the authentication server determines that the access subject is logged in, the authentication server can also obtain the user information corresponding to the access subject based on the first identity credential, and use the user information in subsequent operations.

[0108] 1004. The authentication server sends the authentication result to the authentication gateway. 1005. When the authentication result indicates that the access subject is logged in, the authentication gateway forwards the second access request to the second service site.

[0109] When the authentication result indicates that the access subject is logged in, the authentication gateway can directly forward the second access request to the second business site to enable the access subject to access the second business site.

[0110] If the authentication result indicates that the access subject is not logged in or the access subject's login status has expired, the authentication gateway will redirect to the authentication server based on the second access request and perform login authentication.

[0111] If the user accesses the business site via a mini-program deployed on the terminal device, the authentication gateway will send a third-party authentication credential to the terminal device after the user's first login. This third-party authentication credential will then be included in the access request sent by the user to the authentication gateway when the user accesses the business site again.

[0112] Under this scheme, the specific authentication process for the access subject to access the second business site through the terminal device can be as follows: Figure 11 As shown:

[0113] 1101. The terminal device sends a third access request to the authentication gateway. The third access request is used to request access to a third service site and carries the third identity credential.

[0114] After the authentication gateway sends the identity credential (i.e., code) back to the terminal device, the terminal device will automatically include the third identity credential in its access request when it accesses services through the mini-program again.

[0115] For example, if user A has successfully logged in and authenticated when accessing service A via a mini-program on their mobile phone, the authentication gateway will generate an identity credential and send it to the terminal device, while also storing the credential itself. For instance, code1. When user A then accesses service B via the mini-program on their mobile phone, this code1 will be included in the access request. It's understandable that code1 can be randomly generated by the authentication gateway, or it can be calculated by the gateway using an algorithm based on the user information of the accessing entity. The algorithm is not limited here, as long as a unique code1 can be obtained.

[0116] 1102. When the authentication gateway verifies the existence of the third identity credential, it adds a fourth identity credential to the third access request and forwards the third access request to the authentication server. The fourth identity credential is used to indicate the access subject.

[0117] After the authentication gateway receives the third access request, it determines whether the access subject corresponding to the third access request is registered with the authentication gateway based on the relevant information in the third access request. If registered, the authentication gateway determines whether the third identity credential exists. If the third identity credential exists, the authentication gateway forwards the third access request to the authentication server. At this time, the third access request carries a fourth identity credential, which is used to identify the access subject. If the fourth identity credential does not exist, the gateway sends a message to the terminal device indicating that it is not logged in or that an access error has occurred. Specific details are not limited here. It is understandable that after the authentication gateway determines that the third identity credential exists, it can also retrieve cached user information based on the third identity credential and use this user information for subsequent operations.

[0118] For example, user A sends an access request containing code1. After parsing the access request, the authentication gateway obtains code1 and compares it with its stored code1. If the gateway confirms that code1 matches its stored code1, it adds a new identity credential to the access request, which is used to identify user A. Then, the gateway forwards the access request to the authentication server, allowing the server to re-verify user A's login status based on the newly added identity credential. It's understandable that this new identity credential can be generated by the authentication gateway after accessing user A's user information. For example, the identity credential could be user A's identity ID, name, assigned account, fingerprint, or facial features.

[0119] 1103. The authentication server verifies the authentication result of the access subject based on the fourth identity credential.

[0120] After receiving the third access request, the authentication server obtains the fourth identity credential and verifies its existence. If the fourth identity credential exists, the authentication server determines that the access subject corresponding to the third access request is logged in; if it does not exist, the authentication server determines that the access subject is not logged in. It is understandable that when the authentication server determines that the access subject is logged in, it can also obtain the user information corresponding to the access subject based on the fourth identity credential and use this user information in subsequent operations.

[0121] For example, user A sends an access request containing code1. After parsing the access request, the authentication gateway obtains code1 and compares it with its existing stored code1s. If the gateway confirms that code1 matches its stored code1, it adds a new identity credential to the access request, which is used to identify user A. The gateway then forwards the access request to the authentication server, allowing the server to re-verify user A's login status based on the newly added identity credential. Upon receiving the access request forwarded by the gateway, the authentication server parses it to obtain the new identity credential. The server compares this new identity credential with its existing stored user information. If the server confirms that the new identity credential matches its stored cookies, it confirms that user A is logged in.

[0122] 1104. The authentication server sends the authentication result to the authentication gateway.

[0123] 1105. When the authentication result indicates that the access subject is logged in, the authentication gateway forwards the third access request to the third business site.

[0124] When the authentication result indicates that the access subject is logged in, the authentication gateway can directly forward the third access request to the third business site to enable the access subject to access the third business site.

[0125] If the authentication result indicates that the access subject is not logged in or the access subject's login status has expired, the authentication gateway will redirect the third access request to the authentication server and perform login authentication.

[0126] The identity authentication system in this application is described in detail below. Please refer to [link / reference]. Figure 12 , Figure 12 This is a schematic diagram of one embodiment of the identity authentication system in this application. The identity authentication system 20 includes:

[0127] Authentication gateway 201, authentication server 202, terminal device 203, and multiple business sites 204;

[0128] The terminal device 203 is used to send a first access request to the authentication gateway 201, the first access request being used to request access to the first business site 204;

[0129] The authentication gateway 201 is used to respond to the first access request and redirect to the authentication server 202 when it is determined that the access subject corresponding to the first access request is not logged in.

[0130] The authentication server 202 is used to obtain the login information of the access subject and perform login authentication; after confirming that the access subject has successfully logged in, it obtains the user information of the access subject and generates a first authentication identifier; and sends the first authentication identifier and a login success indication message back to the authentication gateway 201.

[0131] The authentication gateway 201 is used to request the user information of the access subject from the authentication server 202 based on the first authentication identifier, and to forward the first access request to the first business site 204 in response to the login success indication message.

[0132] This application provides an identity authentication system. Using this system, during the login authentication process, the authentication gateway performs an initial authentication of the access request to determine whether the access subject corresponding to the access request is registered with the authentication gateway and whether the access subject is logged in. If not logged in, the request is then forwarded to the authentication server for a second authentication. In this way, the authentication gateway can filter access requests, thereby preventing other access subjects from launching login attacks on the network and improving the security of the login authentication process.

[0133] Optionally, in the above Figure 12 Based on the corresponding embodiments, in another embodiment of the identity authentication system 20 provided in this application,

[0134] The authentication server 202 is used to generate and store the first identity credential based on the user information.

[0135] The authentication gateway 201 is used to generate and store a second identity credential based on the user information.

[0136] This application provides an identity authentication system. Using this system, after login authentication, both the authentication server and the authentication gateway plant cookies to prepare identity authentication credentials for the accessing subject to access the second business site. Therefore, the accessing subject can avoid further login authentication when accessing the second business site.

[0137] Optionally, in the above Figure 12 Based on the corresponding embodiments, in another embodiment of the identity authentication system 20 provided in this application, the authentication gateway 201 is used to receive a second access request sent by the terminal device 203. The second access request is used to request access to the second business site 204, and the second access request carries the first identity credential and the second identity credential.

[0138] When verifying the existence of the second identity credential, the authentication gateway 201 is used to forward the second access request to the authentication server 202;

[0139] The authentication server 202 is used to verify the authentication result of the access subject based on the first identity credential;

[0140] The authentication gateway 201 is used to receive the authentication result sent by the authentication server 202;

[0141] When the authentication result indicates that the access subject is logged in, the authentication gateway 201 is used to forward the second access request to the second business site.

[0142] This application provides an identity authentication system. Using this system, the authentication server and authentication gateway perform two authentication processes during the authentication process, improving the security of identity authentication.

[0143] Optionally, in the above Figure 12 Based on the corresponding embodiments, in another embodiment of the identity authentication system 20 provided in this application,

[0144] The authentication gateway 201 is used to send a third-party identity credential back to the terminal device 203.

[0145] This application provides an identity authentication system. Using this system, after login authentication, the authentication gateway sends identity credentials to the terminal device as credentials for the access subject to access a third service site. Therefore, the access subject can avoid re-authentication when accessing the third service site.

[0146] Optionally, in the above Figure 12 Based on the corresponding embodiments, in another embodiment of the identity authentication system 20 provided in this application,

[0147] The authentication gateway 201 is used to receive a third access request sent by the terminal device 203. The third access request is used to request access to a third service site, and the third access request carries the third identity credential.

[0148] When verifying the existence of the third identity credential, the authentication gateway 201 is used to add a fourth identity credential to the third access request and forward the third access request to the authentication server 202. The fourth identity credential is used to indicate the access subject.

[0149] The authentication server 202 is used to verify the authentication result of the access subject based on the fourth identity credential;

[0150] The authentication gateway 201 is used to receive the authentication result sent by the authentication server 202;

[0151] When the authentication result indicates that the access subject is logged in, the authentication gateway 201 is used to forward the third access request to the third business site.

[0152] This application provides an identity authentication system. Using this system, the authentication server and the authentication gateway perform two authentication processes during the authentication process, improving the security of identity authentication.

[0153] Optionally, in the above Figure 12 Based on the corresponding embodiments, in another embodiment of the identity authentication system 20 provided in this application,

[0154] The authentication server 202 is used to receive the account and password of the access subject sent by the terminal device 203; and to perform login authentication based on the account and password.

[0155] or,

[0156] The authentication server 202 is used to receive the facial feature information or fingerprint feature information of the access subject sent by the terminal device 203; and to perform login authentication based on the facial feature information or fingerprint feature information.

[0157] or,

[0158] The authentication server 202 is used to receive the verification information of the access subject sent by the third-party verification data source; and to perform login authentication based on the verification information of the access subject.

[0159] This application provides an identity authentication system. Using this system, the authentication server supports multiple login authentication methods, thereby improving the feasibility and operability of the solution.

[0160] Optionally, in the above Figure 12 Based on the corresponding embodiments, in another embodiment of the identity authentication system 20 provided in this application, the terminal device 203 is used to display a login authentication interface, which displays K login authentication method selection controls, where K is an integer greater than 1; in response to the access subject's operation on the login authentication method selection controls, a login information input interface is displayed; and in response to the access subject's operation on the input interface, the login information of the access subject is obtained.

[0161] This application provides an identity authentication system. Using this system, the login authentication interface offers multiple login authentication methods, thereby increasing the feasibility and operability of the solution.

[0162] The steps performed by the authentication server in the above embodiments can be based on this Figure 13 Please refer to the server structure shown. Figure 13, Figure 13 This is a schematic diagram of a server structure provided in an embodiment of this application. The server 300 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 322 (e.g., one or more processors) and memory 332, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 342 or data 344. The memory 332 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the server. Furthermore, the CPU 322 may be configured to communicate with the storage media 330 and execute the series of instruction operations stored in the storage media 330 on the server 300.

[0163] Server 300 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341, such as Windows Server. TM Mac OS X TM Unix TM Linux TM FreeBSD TM etc.

[0164] The steps performed by the terminal device in the above embodiments can be based on this Figure 14 Please refer to the terminal device structure shown. Figure 14 For ease of explanation, only the parts relevant to the embodiments of this application are shown. For specific technical details not disclosed, please refer to the method section of the embodiments of this application. In the embodiments of this application, a smartphone is used as an example for illustration:

[0165] Figure 14 This is a block diagram illustrating a portion of the structure of a smartphone related to the terminal device provided in the embodiments of this application. (Reference) Figure 14 The smartphone includes components such as a radio frequency (RF) circuit 410, a memory 420, an input unit 430, a display unit 440, a sensor 450, an audio circuit 460, a wireless fidelity (WiFi) module 470, a processor 480, and a power supply 490. Those skilled in the art will understand that... Figure 14 The smartphone structure shown does not constitute a limitation on smartphones and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0166] The following is combined with Figure 14 A detailed introduction to the various components of a smartphone:

[0167] RF circuit 410 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and processes it with processor 480; additionally, it transmits uplink data to the base station. Typically, RF circuit 410 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, RF circuit 410 can also communicate wirelessly with networks and other devices. The aforementioned wireless communication can use any communication standard or protocol, including but not limited to Global System for Mobile Communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Message Service (SMS), etc.

[0168] The memory 420 can be used to store software programs and modules. The processor 480 executes various functions and data processing of the smartphone by running the software programs and modules stored in the memory 420. The memory 420 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the smartphone (such as audio data, phonebook, etc.). In addition, the memory 420 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0169] The input unit 430 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of the smartphone. Specifically, the input unit 430 may include a touch panel 431 and other input devices 432. The touch panel 431, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 431), and drive the corresponding connected devices according to a pre-set program. Optionally, the touch panel 431 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 480, and can also receive and execute commands sent by the processor 480. In addition, the touch panel 431 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 431, the input unit 430 may also include other input devices 432. Specifically, other input devices 432 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0170] Display unit 440 can be used to display information input by the user or information provided to the user, as well as various menus of the smartphone. Display unit 440 may include display panel 441, optionally configured as a liquid crystal display (LCD), organic light-emitting diode (OLED), or similar form. Further, touch panel 431 may cover display panel 441. When touch panel 431 detects a touch operation on or near it, it transmits the information to processor 480 to determine the type of touch event. Subsequently, processor 480 provides corresponding visual output on display panel 441 based on the type of touch event. Although in Figure 14 In this embodiment, the touch panel 431 and the display panel 441 are two separate components to realize the input and output functions of the smartphone. However, in some embodiments, the touch panel 431 and the display panel 441 can be integrated to realize the input and output functions of the smartphone.

[0171] The smartphone may also include at least one sensor 450, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 441 according to the ambient light level, and the proximity sensor can turn off the display panel 441 and / or the backlight when the smartphone is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that recognize the smartphone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometer, tapping), etc. Other sensors that may be configured in the smartphone, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0172] Audio circuit 460, speaker 461, and microphone 462 provide an audio interface between the user and the smartphone. Audio circuit 460 converts received audio data into electrical signals and transmits them to speaker 461, where speaker 461 converts them into sound signals for output. On the other hand, microphone 462 converts collected sound signals into electrical signals, which are received by audio circuit 460, converted into audio data, and then processed by processor 480 before being transmitted via RF circuit 410 to, for example, another smartphone, or the audio data can be output to memory 420 for further processing.

[0173] WiFi is a short-range wireless transmission technology. Smartphones, through their WiFi modules (470), can help users send and receive emails, browse web pages, and access streaming media, providing wireless broadband internet access. Although Figure 14 WiFi module 470 is shown, but it is understood that it is not an essential component of a smartphone and can be omitted as needed without changing the nature of the invention.

[0174] The processor 480 is the control center of the smartphone, connecting various parts of the smartphone through various interfaces and lines. It performs various functions and processes data by running or executing software programs and / or modules stored in the memory 420, and by calling data stored in the memory 420, thereby providing overall monitoring of the smartphone. Optionally, the processor 480 may include one or more processing units; optionally, the processor 480 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the aforementioned modem processor may also not be integrated into the processor 480.

[0175] The smartphone also includes a power supply 490 (such as a battery) that supplies power to various components. Optionally, the power supply can be logically connected to the processor 480 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0176] Although not shown, smartphones may also include a camera, Bluetooth module, etc., which will not be described in detail here.

[0177] The steps performed by the authentication gateway in the above embodiments can be based on this Figure 12 The server shown, or Figure 14 The terminal device structure shown is not described in detail here.

[0178] This application also provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the methods described in the foregoing embodiments.

[0179] This application also provides a computer program product including a program, which, when run on a computer, causes the computer to perform the methods described in the foregoing embodiments.

[0180] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0181] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0182] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0183] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0184] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0185] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An identity authentication method, applied to an authentication system including an authentication gateway, an authentication server, terminal devices, and multiple business sites, characterized in that, include: The terminal device sends a first access request to the authentication gateway, the first access request being used to request access to the first service site; When the authentication gateway determines that the access subject corresponding to the first access request is not registered with the authentication gateway based on the first access request, the authentication gateway sends a prompt to the terminal device indicating that the first access request cannot be passed; When the authentication gateway determines that the access subject corresponding to the first access request is not logged in and has been registered with the authentication gateway, the authentication gateway responds to the first access request and redirects to the authentication server. The authentication server obtains the login information of the access subject and performs login authentication; after confirming that the access subject has successfully logged in, it obtains the user information of the access subject and generates a first authentication identifier; and sends the first authentication identifier and a login success indication message back to the authentication gateway. The authentication gateway requests the user information of the access subject from the authentication server based on the first authentication identifier, and forwards the first access request to the first business site in response to the login success indication message.

2. The method according to claim 1, characterized in that, After confirming that the access subject has successfully logged in, the method further includes: The authentication server generates and stores a first identity credential based on the user information. The authentication gateway generates and stores a second identity credential based on the user information.

3. The method according to claim 2, characterized in that, After forwarding the first access request to the first service site in response to the login success indication message, the method further includes: The authentication gateway receives a second access request sent by the terminal device. The second access request is used to request access to the second service site, and the second access request carries the first identity credential and the second identity credential. When the authentication gateway verifies the existence of the second identity credential, the authentication gateway forwards the second access request to the authentication server; The authentication server verifies the authentication result of the access subject based on the first identity credential; The authentication gateway receives the authentication result sent by the authentication server; When the authentication result indicates that the access subject is logged in, the authentication gateway forwards the second access request to the second service site.

4. The method according to claim 1, characterized in that, After confirming that the access subject has successfully logged in, the method further includes: The authentication gateway sends a third-party identity credential back to the terminal device.

5. The method according to claim 4, characterized in that, After forwarding the first access request to the first service site in response to the login success indication message, the method further includes: The authentication gateway receives a third access request sent by the terminal device. The third access request is used to request access to a third service site, and the third access request carries the third identity credential. When the authentication gateway verifies the existence of the third identity credential, the authentication gateway adds a fourth identity credential to the third access request and forwards the third access request to the authentication server. The fourth identity credential is used to indicate the access subject. The authentication server verifies the authentication result of the access subject based on the fourth identity credential; The authentication gateway receives the authentication result sent by the authentication server; When the authentication result indicates that the access subject is logged in, the authentication gateway forwards the third access request to the third service site.

6. The method according to any one of claims 1 to 5, characterized in that, The authentication server obtains the login information of the access subject and performs login authentication, including: The authentication server receives the account and password of the access subject sent by the terminal device; The authentication server performs login authentication based on the account and the account password; or, The authentication server receives facial feature information or fingerprint feature information of the access subject sent by the terminal device; The authentication server performs login authentication based on the facial feature information or the fingerprint feature information; or, The authentication server receives the verification information of the access subject sent by the third-party verification data source; The authentication server performs login authentication based on the verification information of the access subject.

7. The method according to any one of claims 1 to 5, characterized in that, After the authentication gateway responds to the first access request and redirects to the authentication server, the method further includes: The terminal device displays a login authentication interface, which shows K login authentication method selection controls, where K is an integer greater than 1; The terminal device displays a login information input interface in response to the access subject's operation of the login authentication method selection control. The terminal device responds to the user's actions on the input interface to obtain the user's login information.

8. An identity authentication system, characterized in that, include: Authentication gateway, authentication server, terminal devices, and multiple business sites; The terminal device is used to send a first access request to the authentication gateway, the first access request being used to request access to the first service site; The authentication gateway is configured to send a prompt indicating that the first access request cannot be passed to the terminal device when it is determined that the access subject corresponding to the first access request is not registered with the authentication gateway based on the first access request. When it is determined that the access subject corresponding to the first access request is not logged in based on the first access request, the system responds to the first access request and redirects to the authentication server. The authentication server is used to obtain the login information of the access subject and perform login authentication; after determining that the access subject has successfully logged in, it obtains the user information of the access subject and generates a first authentication identifier; and sends the first authentication identifier and a login success indication message back to the authentication gateway. The authentication gateway is configured to request the user information of the access subject from the authentication server based on the first authentication identifier, and forward the first access request to the first business site in response to the login success indication message.

9. The system according to claim 8, characterized in that, After confirming that the access subject has successfully logged in. The authentication server is used to generate and store a first identity credential based on the user information; The authentication gateway is used to generate and store a second identity credential based on the user information.

10. The system according to claim 9, characterized in that, After forwarding the first access request to the first service site in response to the login success indication message. The authentication gateway is configured to receive a second access request sent by the terminal device. The second access request is used to request access to a second business site, and the second access request carries the first identity credential and the second identity credential. When the authentication gateway verifies the existence of the second identity credential, the authentication gateway is used to forward the second access request to the authentication server; The authentication server is used to verify the authentication result of the access subject based on the first identity credential. The authentication gateway is used to receive the authentication result sent by the authentication server; When the authentication result indicates that the access subject is logged in, the authentication gateway is used to forward the second access request to the second business site.

11. The system according to claim 8, characterized in that, After confirming that the access subject has successfully logged in, the authentication gateway is also used to send a third-party identity credential back to the terminal device.

12. The system according to claim 11, characterized in that, After forwarding the first access request to the first service site in response to the login success indication message. The authentication gateway is used to receive a third access request sent by the terminal device. The third access request is used to request access to a third business site, and the third access request carries the third identity credential. When the authentication gateway verifies the existence of the third identity credential, the authentication gateway is used to add a fourth identity credential to the third access request and forward the third access request to the authentication server, wherein the fourth identity credential is used to indicate the access subject; The authentication server is used to verify the authentication result of the access subject based on the fourth identity credential; The authentication gateway is used to receive the authentication result sent by the authentication server; When the authentication result indicates that the access subject is logged in, the authentication gateway is used to forward the third access request to the third service site.

13. A computer device, characterized in that, include: Memory, processor, and bus system; The memory is used to store programs; The processor is configured to execute a program in the memory, and the processor is configured to execute the method of any one of claims 1 to 7 according to instructions in the program code; The bus system is used to connect the memory and the processor to enable communication between the memory and the processor.

14. A computer-readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method as claimed in any one of claims 1 to 7.

15. A computer program product, characterized in that, The method includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions to cause the computer device to perform the method as described in any one of claims 1 to 7.

Images