An identity authentication method and system based on eToken and 2FA verification

Abstract

The application discloses an identity authentication method and system based on eToken and 2FA verification and belongs to the technical field of identity authentication. The method comprises the following steps: installing an eToken plug-in on a client of a target system; acquiring hardware information of the eToken hardware through the eToken plug-in on a server of the target system, and binding a user account for logging into the target system, a webpage of the target system and a program of the target system with the hardware information of the eToken hardware acquired by the eToken plug-in; performing primary verification on the user account and password input by the user into the target system, the webpage and the program; if the primary verification is passed, performing 2FA verification on the user account based on the eToken hardware; and after the 2FA verification is passed, allowing the user to log into the target system. The 2FA verification can be used for secondary identity authentication on the user account for logging into the target system, the webpage and the program, so that the security of the system and the like is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of identity authentication, and more particularly, to an identity authentication method and system based on eToken and 2FA verification. BACKGROUND

[0002] Since the advent of the computer age, passwords have been an important part of our daily personal protection. However, password protection alone may no longer be suitable for the current digital age.

[0003] Today, it is not enough to simply change passwords periodically. According to the 2021 Data Breach Investigations Report, login credentials were the primary risk factor in 61% of breaches.

[0004] Relying solely on passwords is equivalent to leaving the key to access sensitive data under the doormat, like leaving the door unlocked. You need additional security protection to prevent the key from falling into the hands of bad people.

[0005] This is the origin of two-factor authentication (2FA). In addition to traditional, password-based identity verification, identity verification is also based on a second factor, using 2 lines of defense to improve security. SUMMARY

[0006] To solve the above problems, the present application provides an identity authentication method based on eToken and 2FA verification, comprising:

[0007] installing an eToken plug-in on the client side of the target system;

[0008] the eToken plug-in connects the eToken hardware through a preset protocol, and the eToken plug-in is used to provide a WebSocket interface to establish a communication connection with the web page program of the target system;

[0009] on the server side of the target system, the eToken hardware information is obtained through the eToken plug-in, and the user account used for logging into the target system, the web page of the target system and the program of the target system is bound with the eToken hardware information obtained by the eToken plug-in;

[0010] when the user logs into the target system, web page or program, the user account and password input by the user to the target system, web page and program are verified once, if the one-time verification is passed, the 2FA verification of the user account based on the eToken hardware is performed, and after the 2FA verification is passed, the user is allowed to log into the target system.

[0011] Optionally, the preset protocol comprises a PKCS#11 protocol.

[0012] Optionally, the target program comprises a browser webpage program or a desktop program.

[0013] Optionally, the hardware information of the eToken hardware comprises certificate serial number information and public key information of the eToken hardware.

[0014] Optionally, the user account and password input by the user to the target system, webpage and program are verified by the webpage program of the target system.

[0015] Optionally, the user account is verified by the eToken hardware based on 2FA, comprising:

[0016] After the first verification passes, the 2FA verification process is triggered by the webpage program of the target system, and when the 2FA verification process is triggered by the webpage program of the target system, the server of the target system queries the configuration parameters of the 2FA according to the input user account, generates a random verification code according to the configuration parameters, constructs a first return value according to the verification code, and returns the first return value to the webpage program of the target system.

[0017] The return value is checked by the webpage program of the target system to obtain a first check result, and if the first check result meets a first preset requirement, the eToken hardware certificate is obtained by calling the eToken plug-in, and the eToken hardware certificate is signed to generate a second return value according to the eToken plug-in signature verification code, and the second return value is returned to the webpage program of the target system.

[0018] The second return value is checked by the webpage program of the target system to obtain a second check result, and if the second check result meets a second preset requirement, the verification information of the eToken hardware certificate is obtained, the verification information is uploaded to the server of the target system, the verification information is verified by the server of the target system, if the verification passes, the eToken hardware public key is used to verify the signature of the eToken plug-in signature verification code to obtain a verification result, and a third return value is constructed based on the verification result, and the third return value is returned to the webpage program of the target system, and whether the 2FA verification passes is determined by the webpage program of the target system according to the third return value.

[0019] Optionally, the first return value is a value for describing whether the 2FA interface is bound to the user account.

[0020] Optionally, the first return value is a value for describing that the 2FA interface binds the user account, and the first preset requirement is met.

[0021] Optionally, the second return value is a value for describing whether the eToken plug-in successfully acquires the eToken hardware certificate.

[0022] Optionally, the second return value is a value for describing that the eToken plug-in successfully acquires the eToken hardware certificate, and the second preset requirement is met.

[0023] Optionally, the verification information includes certificate serial number information, certificate validity period information and certificate signature information.

[0024] Optionally, the verification information is checked, and when the certificate serial number information, the certificate validity period information and the certificate signature information included in the verification information all pass the check, the verification information is checked.

[0025] Optionally, the third return value is a value for describing whether the 2FA verification is passed.

[0026] In still another aspect, the present application also provides an identity authentication system based on eToken and 2FA verification, comprising:

[0027] An initial unit is configured to install an eToken plug-in on a client of a target system.

[0028] The eToken plug-in is connected to an eToken hardware through a preset protocol, and the eToken plug-in is configured to provide a WebSocket interface and establish a communication connection with a web page program of the target system through the WebSocket interface.

[0029] An information binding unit is configured to acquire hardware information of the eToken hardware through the eToken plug-in on a server of the target system, and bind a user account for logging into the target system, a web page of the target system and a program of the target system with the hardware information of the eToken hardware acquired by the eToken plug-in.

[0030] A verification unit is configured to perform one-time verification on a user account and a password input by a user to the target system, the web page or the program when the user logs in, and if the one-time verification is passed, perform 2FA verification on the user account based on the eToken hardware, and allow the user to log in to the target system after the 2FA verification is passed.

[0031] Optionally, the preset protocol includes a PKCS#11 protocol.

[0032] Optionally, the target program includes a browser webpage program or a desktop program.

[0033] Optionally, the hardware information of the eToken hardware includes certificate serial number information and public key information of the eToken hardware.

[0034] Optionally, the user account and password input by the user to the target system, webpage, and program are verified by the webpage program of the target system.

[0035] Optionally, the 2FA verification of the user account based on the eToken hardware includes:

[0036] After the first verification passes, the 2FA verification process is triggered by the webpage program of the target system, and when the webpage program of the target system triggers the 2FA verification process, the server of the target system queries the configuration parameters of the 2FA according to the input user account, generates a random verification code according to the configuration parameters, constructs a first return value according to the verification code, and returns the first return value to the webpage program of the target system.

[0037] The return value is checked by the webpage program of the target system to obtain a first check result, and if the first check result meets a first preset requirement, the eToken hardware certificate is obtained by calling the eToken plug-in, the eToken hardware certificate is signed to generate a random verification code, the second return value is constructed according to the eToken plug-in signature verification code, and the second return value is returned to the webpage program of the target system.

[0038] The second return value is checked by the webpage program of the target system to obtain a second check result, and if the second check result meets a second preset requirement, the verification information of the eToken hardware certificate is obtained, the verification information is uploaded to the server of the target system, the verification information is verified by the server of the target system, if the verification passes, the eToken hardware public key is used to verify the signature of the eToken plug-in signature verification code to obtain a verification result, the third return value is constructed based on the verification result, and the third return value is returned to the webpage program of the target system. The webpage program of the target system determines whether the 2FA verification passes according to the third return value.

[0039] Optionally, the first return value is a value for describing whether the 2FA interface binds the user account.

[0040] Optionally, when the first return value is a value describing that the 2FA interface binds the user account, the first preset requirement is met.

[0041] Optionally, the second return value is a value for describing whether the eToken plug-in successfully acquires the eToken hardware certificate.

[0042] Optionally, when the second return value is a value for describing that the eToken plug-in successfully acquires the eToken hardware certificate, the second preset requirement is met.

[0043] Optionally, the verification information includes certificate serial number information, certificate validity period information and certificate signature information.

[0044] Optionally, when the certificate serial number information, the certificate validity period information and the certificate signature information included in the verification information all pass the check, it is considered that the verification information passes the check.

[0045] Optionally, the third return value is a value for describing whether the 2FA verification passes.

[0046] In still another aspect, the present application also provides a computing device, comprising: one or more processors;

[0047] the processor is configured to execute one or more programs;

[0048] when the one or more programs are executed by the one or more processors, the method as described above is implemented.

[0049] In still another aspect, the present application also provides a computer readable storage medium, which has a computer program stored thereon, and when the computer program is executed, the method as described above is implemented.

[0050] Compared with the prior art, the present application has the following beneficial effects:

[0051] The application provides an identity authentication method based on eToken and 2FA verification, comprising: installing an eToken plug-in on a client of a target system; the eToken plug-in connects an eToken hardware through a preset protocol, the eToken plug-in is used for providing a WebSocket interface, and a communication connection is established between the eToken plug-in and a webpage program of the target system through the WebSocket interface; on a server of the target system, hardware information of the eToken hardware is acquired through the eToken plug-in, and a user account used for logging in the target system, a webpage of the target system and a program of the target system is bound with the hardware information of the eToken hardware acquired by the eToken plug-in; when a user logs in the target system, the webpage or the program, the user account and password input by the user to the target system, the webpage and the program are subjected to one-time verification, if the one-time verification is passed, the user account is subjected to 2FA verification based on the eToken hardware, and after the 2FA verification is passed, the user is allowed to log in the target system. Based on the 2FA verification, the user account logging in the target system, the webpage and the program can be subjected to secondary identity authentication, and the security of the system and the like is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 The flow chart of the method of the application;

[0053] Figure 2 The environment graph of the specific case implementation of the method of the application;

[0054] Figure 3 The flow chart of the specific case of the method of the application;

[0055] Figure 4 The structure diagram of the system of the application. DETAILED DESCRIPTION

[0056] Reference will now be made to the drawings, wherein the exemplary embodiments of the present application will be illustrated in detail. The application may, however, be practiced in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and fully convey the scope of the application to those skilled in the art. Like reference numerals refer to like elements throughout the specification.

[0057] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and the present disclosure and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0058] Embodiment 1

[0059] The present application provides an identity authentication method based on eToken and 2FA verification, as shown in the figure, comprising: Figure 1

[0060] Step 1, install eToken plug-in on the client side of the target system;

[0061] The eToken plug-in connects the eToken hardware through a preset protocol, and the eToken plug-in is used to provide a WebSocket interface to establish a communication connection with the web page program of the target system.

[0062] Step 2, on the server side of the target system, obtain the hardware information of the eToken hardware through the eToken plug-in, and bind the user account used for user login of the target system, the web page of the target system and the program of the target system with the hardware information of the eToken hardware obtained by the eToken plug-in.

[0063] Step 3, when the user logs in the target system, web page or program, perform one-time verification on the user account and password input by the user to the target system, web page and program, if the one-time verification is passed, perform 2FA verification on the user account based on the eToken hardware, and after the 2FA verification is passed, allow the user to log in the target system.

[0064] Wherein, the preset protocol includes: PKCS#11 protocol.

[0065] Wherein, the target program includes: browser web page program or desktop program.

[0066] Wherein, the hardware information of the eToken hardware includes: certificate serial number information and public key information of the eToken hardware.

[0067] Wherein, the one-time verification on the user account and password input by the user to the target system, web page and program is performed through the web page program of the target system.

[0068] Wherein, the 2FA verification on the user account based on the eToken hardware includes:

[0069] ​After a verification passes, a 2FA verification process is triggered by a webpage program of a target system, when the webpage program of the target system triggers the 2FA verification process, a server of the target system queries configuration parameters of the 2FA according to an input user account, generates a random verification code according to the configuration parameters, constructs a first return value according to the verification code, and returns the first return value to the webpage program of the target system;

[0070] The webpage program of the target system checks the return value to obtain a first check result, if the first check result meets a first preset requirement, an eToken plug-in is called to obtain an eToken hardware certificate, the server of the target system generates a random verification code and signs the verification code, a second return value is constructed according to the verification code signed by the eToken plug-in, and the second return value is returned to the webpage program of the target system;

[0071] The webpage program of the target system checks the second return value to obtain a second check result, if the second check result meets a second preset requirement, verification information of the eToken hardware certificate is obtained, the verification information is uploaded to the server of the target system, the server of the target system verifies the verification information, if the verification passes, the eToken hardware public key is used to verify the verification code signed by the eToken plug-in to obtain a verification result, a third return value is constructed based on the verification result, and the third return value is returned to the webpage program of the target system, and the webpage program of the target system determines whether the 2FA verification passes according to the third return value.

[0072] The first return value is a value for describing whether a 2FA interface is bound to a user account.

[0073] If the first return value is a value for describing that the 2FA interface is bound to the user account, the first preset requirement is met.

[0074] The second return value is a value for describing whether an eToken plug-in successfully obtains an eToken hardware certificate.

[0075] If the second return value is a value for describing that the eToken plug-in successfully obtains the eToken hardware certificate, the second preset requirement is met.

[0076] The verification information includes certificate serial number information, certificate validity period information, and certificate signature information.

[0077] Wherein, the verification information is checked, when the certificate serial number information, the certificate validity period information and the certificate signature information included in the verification information all pass the check, it is considered that the verification information passes the check.

[0078] Wherein, the third return value is a value for describing whether the 2FA verification passes.

[0079] The application will be further described below in combination with specific implementation cases:

[0080] The implementation case is implemented in a system as shown in Figure 2 , and the specific implementation process is as shown in Figure 3 , which comprises:

[0081] The webpage program in the browser can be connected to the "eToken plug-in" through the WebSocket technology, and then the "eToken plug-in" is connected to the eToken hardware through the PKCS#11 protocol, so that the webpage can use the eToken, and the application can not only be used for the webpage, but also can be used for the desktop program.

[0082] The example case has two key processes: eToken binding and eToken login verification.

[0083] The following will be described in detail:

[0084] eToken binding:

[0085] In order to use the eToken login verification, the eToken binding needs to be performed first, so that the user account and the eToken information are bound, and thus the eToken can be verified according to the binding information during the login verification.

[0086] The user can perform the eToken binding operation in the "user information maintenance" page, and the administrator can reset the eToken binding in the "user management" page.

[0087] When the eToken binding is performed, the webpage program reads the information of the current eToken through the "eToken plug-in". Then the certificate serial number and the public key in the eToken are sent to the server, and the server binds these information with the user account.

[0088] eToken login verification:

[0089] When the user logs in, the first step of the account and password verification is performed first. After the password verification passes, the second step of the eToken login verification is entered. After the eToken login verification also passes, the user is allowed to enter the system.

[0090] In order to guarantee security, the scheme uses the method of "private key signature and public key verification" to do verification.

[0091] eToken login verification, in particular, includes:

[0092] 1、

Web Page

[0093] 2、

Web server

[0094] 3、

Web Page

[0095] 4、

Web Page

[0096] 5、

eToken plug-in

[0097] 6、

eToken plug-in

[0098] 7、

User

[0099] 8、

eToken plug-in

[0100] 9、

eToken plug-in

[0101] 10、

eToken plug-in

[0102] 11、

eToken plug-in

[0103] 12、

Web Page

[0104] 13. [Web Page] The web page calls the "2FA Verification" interface of the server and transmits information such as the certificate serial number, certificate validity period, and signature.

[0105] 14. The Web server first verifies the basic certificate information. For example, it verifies whether the serial number matches the account number, whether the certificate is valid, and whether the certificate has been revoked by the CRL (Certificate Revocation List). If any of these verifications fail, an error message is generated and the process skips to step 16.

[0106] 15. The [Web server] performs a public key verification on the verification code and signature using the public key associated with the account. If verification fails, an error message is generated and the process proceeds to step ?.

[0107] 16. [Web server] The server constructs the return value and returns it to the web page.

[0108] 17. [Web Page] The web page determines whether 2FA verification is successful. If successful, the user enters the system; if unsuccessful, an error message is displayed.

[0109] The present invention makes user identity authentication more secure, and in a specific solution, the operations of "private key signature" and "obtaining certificate interface" are merged, which reduces the number of interactions, reduces the delay time, and improves the user experience.

[0110] Example 2:

[0111] The present invention also proposes an identity authentication system 200 based on eToken and 2FA verification, such as Figure 4 Shown, including:

[0112] Initial unit 201 is used to install the eToken plug-in on the client of the target system;

[0113] The eToken plug-in connects to the eToken hardware via a preset protocol, and the eToken plug-in is used to provide a WebSocket interface and establish a communication connection with the web application of the target system via the WebSocket interface;

[0114] The information binding unit 202 is configured to acquire the hardware information of the eToken hardware through the eToken plug-in on the service end of the target system, and bind the user account for logging into the target system, the webpage of the target system, and the program of the target system with the hardware information of the eToken hardware acquired by the eToken plug-in.

[0115] The verification unit 203 is configured to perform one-time verification on the user account and password input by the user into the target system, the webpage, and the program when the user logs into the target system, the webpage, or the program, and if the one-time verification is passed, perform 2FA verification on the user account based on the eToken hardware, and if the 2FA verification is passed, allow the user to log into the target system.

[0116] The preset protocol includes a PKCS#11 protocol.

[0117] The target program includes a browser webpage program or a desktop program.

[0118] The hardware information of the eToken hardware includes certificate serial number information and public key information of the eToken hardware.

[0119] The one-time verification on the user account and password input by the user into the target system, the webpage, and the program is performed through the webpage program of the target system.

[0120] The 2FA verification on the user account based on the eToken hardware includes:

[0121] After the one-time verification is passed, the 2FA verification process is triggered through the webpage program of the target system, and after the 2FA verification process is triggered by the webpage program of the target system, the service end of the target system queries the configuration parameters of the 2FA according to the input user account, generates a random verification code according to the configuration parameters, constructs a first return value according to the verification code, and returns the first return value to the webpage program of the target system.

[0122] The return value is checked through the webpage program of the target system to obtain a first checking result, if the first checking result meets a first preset requirement, the eToken plug-in is called to acquire the eToken hardware certificate, and the service end of the target system generates a random verification code is signed, to construct a second return value according to the verification code signed by the eToken plug-in, and return the second return value to the webpage program of the target system.

[0123] The second return value is checked through a webpage program of the target system to obtain a second checking result, and if the second checking result meets second preset requirements, verification information of the eToken hardware certificate is obtained, the verification information is uploaded to a server of the target system, the verification information is checked through the server of the target system, if the checking is passed, the verification code signed by the eToken plug-in is verified by using a public key of the eToken hardware to obtain a verification result, a third return value is constructed based on the verification result, and the third return value is returned to the webpage program of the target system, and whether the 2FA verification is passed is determined through the webpage program of the target system according to the third return value.

[0124] The first return value is a value for describing whether the 2FA interface binds a user account.

[0125] The first return value is a value for describing that the 2FA interface binds a user account, and the first preset requirements are met.

[0126] The second return value is a value for describing whether the eToken plug-in successfully obtains the eToken hardware certificate.

[0127] The second return value is a value for describing that the eToken plug-in successfully obtains the eToken hardware certificate, and the second preset requirements are met.

[0128] The verification information includes certificate serial number information, certificate validity period information and certificate signature information.

[0129] The verification information is checked, and when the certificate serial number information, the certificate validity period information and the certificate signature information included in the verification information all pass the checking, the verification information is passed.

[0130] The third return value is a value for describing whether the 2FA verification is passed.

[0131] The application can perform secondary identity verification on a user account logging into a target system, a webpage and a program based on 2FA verification, and ensures the security of the system.

[0132] Embodiment 3:

[0133] Based on the same inventive concept, the present application further provides a computer device, which comprises a processor and a memory, the memory is used to store a computer program, the computer program comprises program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal, and are suitable for implementing one or more instructions, and are specifically suitable for loading and executing one or more instructions in the computer storage medium to implement a corresponding method flow or a corresponding function, so as to implement the steps of the method in the above embodiments.

[0134] Embodiment 4:

[0135] Based on the same inventive concept, the present application further provides a storage medium, specifically a computer readable storage medium (Memory), which is a memory device in the computer device, and is used to store programs and data. It can be understood that the computer readable storage medium herein can include the built-in storage medium in the computer device, and of course can also include the expansion storage medium supported by the computer device. The computer readable storage medium provides a storage space, and the storage space stores the operating system of the terminal. Moreover, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and the instructions can be one or more computer programs (including program codes). It should be noted that the computer readable storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory. One or more instructions stored in the computer readable storage medium can be loaded and executed by the processor to implement the steps of the method in the above embodiments.

[0136] Those skilled in the art will appreciate that embodiments of the present application can be readily used as software, hardware, or a combination of software and hardware. In a software embodiment, the methods can be tangibly embodied in a machine-readable storage medium having stored thereon instructions that can be used to program a computer to perform any of the methods. The software implementation can be initialized by loading and executing a set of instructions arranged to perform one of the methods into the computer's memory. Alternatively, hard-wired circuitry can be used in place of, or in combination with, software instructions. Thus, the

[0137] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing the functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0138] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing the functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0139] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing the functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0140] While preferred embodiments of the application have been described, modifications and variations can be apparent to those skilled in the art once aware of the general underlying concepts. Accordingly, the appended claims are intended to encompass all modifications and variations as falling within the scope of the application.

[0141] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. An identity verification method based on eToken and 2FA verification, characterized in that, The identity authentication method comprises: installing an eToken plug-in on a client of a target system; the eToken plug-in is connected to an eToken hardware through a preset protocol, the eToken plug-in is used to provide a WebSocket interface, and a communication connection is established between the eToken plug-in and a webpage program of the target system through the WebSocket interface; on a server of the target system, hardware information of the eToken hardware is acquired through the eToken plug-in, and a user account used for logging into the target system, a webpage of the target system and a program of the target system is bound to the hardware information of the eToken hardware acquired by the eToken plug-in; when a user logs into the target system, the webpage or the program, the user account and password input by the user into the target system, the webpage and the program are verified once, if the verification is passed, the user account is subjected to 2FA verification based on the eToken hardware, and after the 2FA verification is passed, the user is allowed to log into the target system; the 2FA verification based on the eToken hardware on the user account comprises: after the verification is passed once, a 2FA verification process is triggered through a webpage program of the target system, when the 2FA verification process is triggered through the webpage program of the target system, the server of the target system queries configuration parameters of the 2FA according to the input user account, generates a random verification code according to the configuration parameters, constructs a first return value according to the verification code, and returns the first return value to the webpage program of the target system; the return value is checked through the webpage program of the target system to obtain a first checking result, if the first checking result meets a first preset requirement, an eToken plug-in is called to acquire an eToken hardware certificate, and a random verification code generated by the server of the target system is signed, a second return value is constructed according to the verification code signed by the eToken plug-in, and the second return value is returned to the webpage program of the target system; the second return value is checked through the webpage program of the target system to obtain a second checking result, if the second checking result meets a second preset requirement, verification information of the eToken hardware certificate is acquired, the verification information is uploaded to the server of the target system, the verification information is verified through the server of the target system, if the verification is passed, the verification code signed by the eToken plug-in is verified using a public key of the eToken hardware to obtain a verification result, a third return value is constructed based on the verification result, and the third return value is returned to the webpage program of the target system, and whether the 2FA verification is passed is determined according to the third return value through the webpage program of the target system.

2. The identity verification method of claim 1, wherein, the preset protocol comprises a PKCS#11 protocol.

3. The identity verification method of claim 1, wherein, the program of the target system comprises a browser webpage program or a desktop program.

4. The identity verification method of claim 1, wherein, The hardware information of the eToken hardware includes certificate serial number information and public key information of the eToken hardware.

5. The identity verification method of claim 1, wherein, The user account and password input by the user to the target system, webpage and program are verified by a webpage program of the target system.

6. The identity verification method of claim 1, wherein, The first return value is a value for describing whether the 2FA interface binds the user account.

7. The identity verification method of claim 1, wherein, When the first return value is a value for describing that the 2FA interface binds the user account, the first preset requirement is met.

8. The identity verification method of claim 1, wherein, The second return value is a value for describing whether the eToken plug-in successfully obtains the eToken hardware certificate.

9. The identity verification method of claim 1, wherein, When the second return value is a value for describing that the eToken plug-in successfully obtains the eToken hardware certificate, the second preset requirement is met.

10. The identity verification method of claim 1, wherein, The verification information includes certificate serial number information, certificate validity period information and certificate signature information.

11. The identity verification method of claim 1, wherein, When the certificate serial number information, certificate validity period information and certificate signature information included in the verification information all pass the verification, the verification of the verification information is passed.

12. The identity verification method of claim 1, wherein, The third return value is a value for describing whether the 2FA verification is passed.

13. An identity verification system based on eToken and 2FA verification, characterized in that, The identity verification system comprises: An initial unit for installing an eToken plug-in on a client of a target system; The eToken plug-in connects the eToken hardware through a preset protocol, and the eToken plug-in provides a WebSocket interface to establish a communication connection with a webpage program of the target system through the WebSocket interface; An information binding unit for obtaining hardware information of the eToken hardware through the eToken plug-in on a server of the target system, and binding a user account for logging into the target system, a webpage of the target system and a program of the target system with the hardware information of the eToken hardware obtained by the eToken plug-in; A verification unit for verifying the user account and password input by the user to the target system, webpage and program when the user logs into the target system, webpage or program, and performing 2FA verification on the user account based on the eToken hardware if the one-time verification is passed, and allowing the user to log into the target system after the 2FA verification is passed. The 2FA verification based on the eToken hardware on the user account comprises: After the one-time verification is passed, a 2FA verification process is triggered by a webpage program of the target system, and after the 2FA verification process is triggered by the webpage program of the target system, the server of the target system queries configuration parameters of the 2FA according to the input user account, generates a random verification code according to the configuration parameters, constructs a first return value according to the verification code, and returns the first return value to the webpage program of the target system. The return value is checked by a webpage program of the target system to obtain a first checking result, and if the first checking result meets first preset requirements, an eToken plug-in is called to obtain an eToken hardware certificate, and a random verification code is signed for a server of the target system to construct a second return value according to the verification code signed by the eToken plug-in, and the second return value is returned to the webpage program of the target system; The second return value is checked by the webpage program of the target system to obtain a second checking result, and if the second checking result meets second preset requirements, verification information of the eToken hardware certificate is obtained, the verification information is uploaded to the server of the target system, the verification information is verified by the server of the target system, if the verification is passed, the verification code signed by the eToken plug-in is verified by a public key of the eToken hardware to obtain a verification result, a third return value is constructed based on the verification result, and the third return value is returned to the webpage program of the target system, and whether the 2FA verification is passed is determined by the webpage program of the target system according to the third return value.

14. The identity verification system of claim 13, wherein, The preset protocol includes a PKCS#11 protocol.

15. The identity verification system of claim 13, wherein, The program of the target system includes a browser webpage program or a desktop program.

16. The identity verification system of claim 13, wherein, The hardware information of the eToken hardware includes certificate serial number information and public key information of the eToken hardware.

17. The identity verification system of claim 13, wherein, The user account and password input by a user to a webpage and a program of the target system are verified by a webpage program of the target system.

18. The identity verification system of claim 13, wherein, The first return value is a value for describing whether a 2FA interface binds a user account.

19. The identity verification system of claim 13, wherein, When the first return value is a value for describing that the 2FA interface binds the user account, the first preset requirements are met.

20. The identity verification system of claim 13, wherein, The second return value is a value for describing whether an eToken plug-in successfully obtains an eToken hardware certificate.

21. The identity verification system of claim 13, wherein, When the second return value is a value for describing that the eToken plug-in successfully obtains the eToken hardware certificate, the second preset requirements are met.

22. The identity verification system of claim 13, wherein, The verification information includes certificate serial number information, certificate validity period information and certificate signature information.

23. The identity verification system of claim 13, wherein, When the certificate serial number information, the certificate validity period information and the certificate signature information included in the verification information all pass the verification, the verification information passes the verification.

24. The identity verification system of claim 13, wherein, The third return value is a value for describing whether the 2FA verification is passed.

25. A computer device, comprising: Comprise: One or more processors; The processor is used for executing one or more programs; When the one or more programs are executed by the one or more processors, the method in any one of claims 1-12 is implemented.

26. A computer readable storage medium, characterized in that, The computer program is stored thereon, and when the computer program is executed, the method in any one of claims 1-12 is implemented.

Images