A client identity-based trust boundary implementation method

Abstract

The present invention relates to a method for implementing a trust boundary based on client identity, comprising the following steps: collecting device information through a client and signing the device information, sending the device information and the device signature to a trusted access security control center, the trusted access security control center verifying whether the device information and the device signature are trustworthy, registering the device with a server after successful verification, and allocating a unique device token to the device, the client using the device token of the device to obtain an access token through the trusted access security control center; each time the client on the device accesses the server, the client generates a one-time token based on the access token of the device and sends the token to a trusted access gateway, the trusted access gateway authorizing the trusted access security control center to verify the one-time token, and allowing the client on the device to access the server after successful verification.

Description

Technical Field

[0001] The present invention relates to a method for realizing a trust boundary based on client identity, and belongs to the technical field of computer network security. Background Art

[0002] Computer network security refers to the protection of software, hardware and the data carried in networks and information systems to prevent them from being damaged, altered or leaked due to accidental or malicious reasons, ensuring that the system operates continuously, reliably and normally and that network services are not interrupted.

[0003] Existing invention patents with patent numbers such as "CN112187724B" disclose an access control method, device, gateway, client and security token service. The client sends an API access request to the gateway. The API access request contains parameters for requesting signature verification and parameters for permission identification. Therefore, after the gateway receives the API access request, it can directly perform request signature verification based on the parameters for requesting signature verification carried in the API access request, and perform permission identification based on the parameters for permission identification. There is no need to access the database to obtain the required parameters, which reduces the network I / O and database query time. If the request signature verification passes and the permission identification passes, the gateway forwards the API access request to the corresponding business line interface, thereby improving the API access efficiency.

[0004] Existing invention patents such as "CN102984252B" disclose a cloud resource access control method based on dynamic cross-domain security tokens. The specific steps are as follows: an access agent is preset at the cloud resource service provider; after the agent authenticates the dynamic temporary user, it requests a dynamic security token from the cloud resource provider for each dynamic temporary user; the cloud resource provider generates a dynamic security token and sets its access policy, and sends it to the dynamic temporary user; a shared key is set between each dynamic temporary user and the cloud resource provider; the dynamic temporary user signs the access request with the shared key and sends an authentication request message to the cloud resource provider; the cloud resource provider signs the authentication request message with the shared key. If the signatures are the same, the authentication is passed; the access policy of the dynamic security token and its access agent is determined, and the access request of the dynamic temporary user is responded to according to the determination result. The present invention realizes an efficient cross-domain authentication mechanism with high determination efficiency.

[0005] However, the traditional identity authentication mentioned above uses parameters or security tokens that request signature verification, which are vulnerable to brute force cracking, social engineering attacks, and other problems, which may lead to unauthorized access and attacks. In addition, it is impossible to bind devices and identities, and it is impossible to trace the source when an attack occurs. Summary of the Invention

[0006] In order to solve the above problems in the prior art, the present invention proposes a method for implementing a trust boundary based on client identity.

[0007] The technical solutions of the present invention are as follows:

[0008] In one aspect, the present invention provides a method for implementing a trust boundary based on a client identity, comprising the following steps:

[0009] The client collects device information and signs it, then sends it to the Trusted Access Security Control Center. The Trusted Access Security Control Center verifies that the device information and signature are trustworthy. Upon successful verification, the device is registered with the server and a unique device token is assigned to the device. The client uses the device token to obtain an access token from the Trusted Access Security Control Center.

[0010] Each time the client on the device accesses the server, the client generates a one-time token based on the device's access token and sends it to the trusted access gateway. The trusted access gateway authorizes the trusted access security control center to verify the one-time token. After successful verification, the client on the device is allowed to access the server.

[0011] As a preferred embodiment of the present invention, the trusted access security control center generates a device token for the corresponding device, encrypts the token, and saves the token to the corresponding client.

[0012] As a preferred embodiment of the present invention, the client decrypts the saved device token to generate a request code and generates a request code signature. The client requests an access token from the trusted access security control center through the device token, request code and request code signature. The trusted access security control center verifies whether the request code is credible through the request code signature. After the verification is successful, the request code is verified by the server. After the server verifies successfully, the trusted access security control center generates an access token, encrypts it and saves it to the corresponding client.

[0013] As a preferred embodiment of the present invention, the access token is set with an expiration time, and the client needs to regularly update the access token through the trusted access security control center.

[0014] As a preferred embodiment of the present invention, the administrator creates user information and grants user permissions through the server. When the user logs in to access the server through the client, the server binds the device information of the login device with the corresponding user information of the server after verification.

[0015] On the other hand, the present invention also provides a client identity-based trust boundary system, including a client and a server;

[0016] The client is provided in a local device, the server is provided in a remote server, and a trusted access security control center is also provided in the remote server;

[0017] The client collects device information and signs it, then sends it to the Trusted Access Security Control Center. The Trusted Access Security Control Center verifies that the device information and signature are trustworthy. Upon successful verification, the device is registered with the server and a unique device token is assigned to the device. The client uses the device token to obtain an access token from the Trusted Access Security Control Center.

[0018] When accessing the server through the client, the client generates a one-time token based on the access token of the device and sends it to the trusted access gateway. The trusted access gateway authorizes the trusted access security control center to verify the one-time token. After successful verification, the client on the device is allowed to access the server.

[0019] On the other hand, the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any embodiment of the present invention when executing the program.

[0020] In another aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in any embodiment of the present invention.

[0021] The present invention has the following beneficial effects:

[0022] 1. This invention increases the reliability of identity authentication by binding device information to user identity. Device registration ensures that only users with legitimate devices can perform identity authentication, thereby preventing unauthorized devices from accessing the system or performing sensitive operations.

[0023] 2. The device token and access token generation algorithm and encrypted storage mechanism of the present invention enhance system security. Device tokens ensure that only client components with legitimate devices can generate valid access tokens, thereby preventing unauthorized devices from attempting to access the system. Access tokens have a short lifespan and expiration time, limiting the window of opportunity for potential attackers and reducing the risk of token misuse.

[0024] 3. The one-time token of this invention effectively resists replay attacks. Each generated one-time token can only be used within a specific time period. Once used or expired, even if the token is leaked, an attacker cannot use it again for identity authentication. This greatly reduces the risk of token reuse.

[0025] 4. Device registration in this invention binds device information to user identity, making it easy to track and audit unusual activities or violations. When an anomaly occurs, the issue can be traced and analyzed using device information and related token usage records, improving security monitoring and risk management. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0027] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0028] It should be understood that the step numbers used herein are only for convenience of description and are not intended to limit the order in which the steps are to be executed.

[0029] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0030] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0031] The term "and / or" refers to and includes any and all possible combinations of one or more of the associated listed items.

[0032] Example 1:

[0033] A method for implementing a trust boundary based on client identity includes the following steps:

[0034] The client collects device information and signs it, then sends it to the Trusted Access Security Control Center. The Trusted Access Security Control Center verifies that the device information and signature are trustworthy. Upon successful verification, the device is registered with the server and a unique device token is assigned to the device. The client uses the device token to obtain an access token from the Trusted Access Security Control Center.

[0035] Each time the client on the device accesses the server, the client generates a one-time token based on the device's access token and sends it to the trusted access gateway. The trusted access gateway authorizes the trusted access security control center to verify the one-time token. After successful verification, the client on the device is allowed to access the server.

[0036] See also Figure 1 In this embodiment, the method is implemented through a financial management system:

[0037] System administrators create user information and assign user permissions through the Financial Invoice Service, and synchronize user permissions to the Trusted Access Security Control Center;

[0038] When a user uses a device to communicate with the server for the first time, the client on the device will collect the current device information and sign the device information through Cakey to obtain the device information and device signature. The client will then transmit the device information and device signature to the Trusted Access Security Control Center to register the device. The Trusted Access Security Control Center will then transmit the device signature to the financial signature server to verify whether the current device signature is credible and return the verification result to the Trusted Access Security Control Center. If the device is a trusted device, the device will be registered with the Trusted Access Security Control Center, a unique device token will be assigned to the device, and the encrypted device token will be transmitted back to the client for storage.

[0039] The client decrypts the stored device token, generates a request code based on the device token, and signs the request code using Cakey. The client then requests an access token from the Trusted Access Security Control Center using the device token, request code, and request code signature. The Trusted Access Security Control Center then transmits the request code signature to the financial signature server to verify whether the request code signature is credible, and transmits the verification result back to the Trusted Access Security Control Center. If the verification is successful, the corresponding access token is generated, encrypted, and transmitted back to the client for storage.

[0040] As a preferred implementation of this embodiment, the access token is set with an expiration time, and the client needs to regularly update the access token through the trusted access security control center. The access token has a short life cycle, thereby limiting the window for potential attackers.

[0041] Each time a user accesses the server through the client, the client generates a one-time token using the saved access token. When accessing the server with the one-time token, the trusted access gateway authorizes the trusted access security control center to verify the one-time token. After successful verification, the trusted access security control center allows the client to communicate with the server, and then verifies the user's permissions through the financial ticketing service, and returns the business processing results based on the user's available permissions.

[0042] Example 2:

[0043] A client identity-based trust boundary system, including a client and a server;

[0044] The client is provided in a local device, the server is provided in a remote server, and a trusted access security control center is also provided in the remote server;

[0045] The client collects device information and signs it, then sends it to the Trusted Access Security Control Center. The Trusted Access Security Control Center verifies that the device information and signature are trustworthy. Upon successful verification, the device is registered with the server and a unique device token is assigned to the device. The client uses the device token to obtain an access token from the Trusted Access Security Control Center.

[0046] When accessing the server through the client, the client generates a one-time token based on the access token of the device and sends it to the trusted access gateway. The trusted access gateway authorizes the trusted access security control center to verify the one-time token. After successful verification, the client on the device is allowed to access the server.

[0047] This system is used to implement the functions in Example 1 and will not be described in detail here.

[0048] Example 3:

[0049] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method described in any embodiment of the present invention is implemented.

[0050] Example 4:

[0051] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method described in any embodiment of the present invention is implemented.

[0052] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c or a and b and c, where a, b, c can be single or multiple.

[0053] Those skilled in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented using a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0054] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0055] In the several embodiments provided in this application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of this application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), magnetic disk or optical disk, and other media that can store program code.

[0056] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention's description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for implementing a trust boundary based on client identity, characterized in that: The following steps are involved: The client collects device information and signs it, then sends it to the Trusted Access Security Control Center. The Trusted Access Security Control Center verifies that the device information and signature are trustworthy. Upon successful verification, the device is registered with the server and a unique device token is assigned to the device. The client uses the device token to obtain an access token from the Trusted Access Security Control Center. Each time the client on the device accesses the server, the client generates a one-time token based on the device's access token and sends it to the trusted access gateway. The trusted access gateway authorizes the trusted access security control center to verify the one-time token. If the verification is successful, the client on the device is allowed to access the server. The client decrypts the saved device token to generate a request code and a request code signature. The client requests an access token from the trusted access security control center using the device token, request code, and request code signature. The trusted access security control center verifies whether the request code is credible using the request code signature. After successful verification, the request code is verified by the server. After successful verification by the server, the trusted access security control center generates an access token, encrypts it, and saves it to the corresponding client.

2. A method for implementing a trust boundary based on client identity according to claim 1, characterized in that: The trusted access security control center generates a device token for the corresponding device, encrypts it, and saves it to the corresponding client.

3. The method for implementing a trust boundary based on client identity according to claim 1, characterized in that: The access token has an expiration time, and the client needs to regularly update the access token through the trusted access security control center.

4. The method for implementing a trust boundary based on client identity according to claim 1, characterized in that: The administrator creates user information and grants user permissions through the server. When the user logs in to the server through the client, the server verifies and binds the device information of the logged-in device with the corresponding user information on the server.

5. A client identity-based trust boundary system, characterized in that: The method according to any one of claims 1 to 4, comprising a client and a server; The client is provided in a local device, the server is provided in a remote server, and a trusted access security control center is also provided in the remote server; The client collects device information and signs it, then sends it to the Trusted Access Security Control Center. The Trusted Access Security Control Center verifies that the device information and signature are trustworthy. Upon successful verification, the device is registered with the server and a unique device token is assigned to the device. The client uses the device token to obtain an access token from the Trusted Access Security Control Center. When accessing the server through the client, the client generates a one-time token based on the access token of the device and sends it to the trusted access gateway. The trusted access gateway authorizes the trusted access security control center to verify the one-time token. After successful verification, the client on the device is allowed to access the server.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images