Dual-factor identity authentication method and system for railway signaling system

Abstract

The present invention discloses a two-factor identity authentication method and system for a railway signal system. The system includes a center and a business server, wherein the business server includes a business program unit for providing a user with a scenario for executing a business requiring identity authentication; a two-factor authentication unit for monitoring whether the business program unit is in a scenario requiring identity authentication, and if so, shielding the original password authentication, providing the business program unit with a two-factor authentication interface including the original password authentication, and when the user passes the two-factor authentication, the two-factor authentication unit confirms that the user's identity authentication has been passed. The present invention completes the two-factor identity authentication of multiple business systems and multiple system manufacturers without adjusting the signal system business software and affecting the continuous operation of the business system.

Description

Technical Field

[0001] The invention belongs to the technical field of railway signals, and in particular relates to a double-factor identity authentication method and system for railway signal systems. Background Art

[0002] At present, the railway signal systems use the self-maintained "user name + password" as the identity authentication technology. This single "user name + password" method is used for identity authentication when users log in. This method is static data stored in the system, which has the risk of leakage and does not meet the requirements of network security and level protection two-factor identity authentication. Once obtained by others, that is, after the password is leaked, other people can log in to the signal system. Malicious or erroneous operation may cause abnormal system operation and affect driving safety.

[0003] In addition, the entire railway signal system has a variety of business systems of different types and manufacturers. If other identity authentication methods are added to each system to improve security, all signal system programs need to be modified, and the number of modifications required is very large. Moreover, most railway signal systems operate 24 / 7. The entire railway signal system has a variety of business systems of different types and manufacturers. The upgrade and modification work is huge, which has unpredictable problems for railway operation and passenger safety. Therefore, a technical solution is needed to achieve two-factor identity authentication based on cryptographic technology without modifying the railway signal system. Summary of the invention

[0004] The present invention provides a dual-factor identity authentication method and system for a railway signal system, which specifically adopts the following technical solutions:

[0005] A two-factor identity authentication system for a railway signal system, the system comprising: a center, a business server, the business server comprising a business program unit, a two-factor authentication unit;

[0006] The business program unit is used to provide users with scenarios for executing businesses that require identity authentication;

[0007] The two-factor authentication unit is used to monitor whether the business program unit is in a scenario where identity authentication is required. If yes, the original password authentication is shielded, and a two-factor authentication interface including the original password authentication is provided to the business program unit. When the user passes the two-factor authentication, the two-factor authentication unit confirms that the identity authentication of the user has been passed; if not, the two-factor authentication unit continues to monitor;

[0008] The two-factor authentication unit is also used to receive the policy issued by the center and upload log information to the center.

[0009] Furthermore, the services requiring identity authentication include login services and shift handover services.

[0010] Further, the two-factor authentication unit includes an IAS Server business policy processing module, a HOOK monitoring module, and a HOOK processing module;

[0011] The IAS Server business policy processing module is used to receive the identity authentication policy issued by the center, upload log information to the center, and send monitoring notifications to the HOOK monitoring module;

[0012] The HOOK monitoring module is used to monitor the name and / or form feature information of the specified business system program in the business program unit according to the configuration information and the monitoring notification, and trigger the HOOK processing module when the name and / or form feature information of the monitored specified business system program appears;

[0013] The HOOK processing module is used to lock the original password input box of the login interface according to the trigger, and after monitoring the account number input in the original form, confirm whether the account needs secondary authentication, if necessary, start two-factor authentication, and send the authentication record to the IAS Server business policy processing module. If not, unlock the original password input box of the login interface.

[0014] Furthermore, the center automatically identifies the business system and the business system account on the business server based on the business server, and automatically generates an identity authentication policy for the business system account on the business server;

[0015] The center stores the identity authentication policy information in a designated slot of the authentication device according to the automatically identified business system, and the identity authentication policy information of different business system accounts is stored in different slots.

[0016] Furthermore, the authentication device includes a Ukey device and a dynamic password device.

[0017] Furthermore, the IAS Server business policy processing module receives the identity authentication policy stored in the Sqlite library and stores it in ciphertext form.

[0018] The present invention also relates to a two-factor identity authentication method for a railway signal system, the method is applied to the two-factor identity authentication system for a railway signal system as described above, and the method comprises the following steps:

[0019] S1 user logs into the business server business program, the two-factor authentication unit HOOK monitoring module monitors the login action, triggering the two-factor authentication unit HOOK processing module to enter the two-factor authentication mode;

[0020] S2. The HOOK processing module of the two-factor authentication unit locks the original login authentication interface of the business program and pops up a new two-factor authentication interface;

[0021] S3. After the user enters the username and password, the two-factor authentication unit sends the username and password information to the business program and requests authentication; when the user enters a non-existent username, or the username is correct but the password is incorrect, the two-factor authentication unit receives information that the business program has failed authentication, and prompts the two-factor authentication interface with the information that the authentication has failed, and the user will no longer continue authentication, and will not be able to log in to the business program; when the user enters the correct username and password, the two-factor authentication unit receives information that the business program has passed authentication, and requires the user to perform secondary authentication;

[0022] S4. The user uses the authentication device to perform secondary authentication. If the authentication fails, the user cannot log in to the business system. If the authentication passes, the user successfully logs in to the business system.

[0023] Furthermore, when the user is taking over a shift, the content of step S1 is replaced by:

[0024] S1 'user performs handover business procedures, the HOOK monitoring module of the two-factor authentication unit monitors the handover action, triggering the HOOK processing module of the two-factor authentication unit to enter the two-factor authentication mode;

[0025] The content of step S2 is replaced by:

[0026] S2 '. The HOOK processing module of the two-factor authentication unit locks the original handover interface of the business program and pops up a new two-factor identity authentication interface.

[0027] The present invention also relates to a computer program product, which comprises a computer program, and the computer program is executed by a processor to perform the above-mentioned two-factor identity authentication method for a railway signal system.

[0028] The present invention also relates to a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is executed by a processor to execute the above-mentioned two-factor identity authentication method for a railway signal system.

[0029] The technical solution of the present invention can complete the dual-factor identity authentication of multiple business systems and multiple system manufacturers without adjusting the signal system business software and without affecting the continuous operation of the business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1This is a structural block diagram of a dual-factor identity authentication system for a railway signal system according to the present invention. DETAILED DESCRIPTION

[0031] The present invention will be further described below in conjunction with the accompanying drawings. The following examples are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention. It should be pointed out that the following detailed description is exemplary and is intended to provide further explanation of the present invention.

[0032] Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those generally understood by those of ordinary skill in the art to which the present invention belongs. It should be noted that the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0033] As attached Figure 1 As shown, Embodiment 1 of the present invention relates to a two-factor identity authentication system for a railway signal system, wherein the system includes a center and a business server, and the business server includes a business program unit and a two-factor authentication unit.

[0034] The business program unit is used to provide users with scenarios for executing services that require identity authentication. The services that require identity authentication include login services and shift handover services.

[0035] The two-factor authentication unit is used to monitor whether the business program unit is in a scenario where identity authentication is required. If so, the original password authentication is shielded, and a two-factor authentication interface including the original password authentication is provided to the business program unit. When the user passes the two-factor authentication, the two-factor authentication unit confirms that the user's identity authentication has been passed; if not, the two-factor authentication unit continues to monitor.

[0036] The two-factor authentication unit is used to receive the policy issued by the center and upload log information to the center.

[0037] The dual-factor authentication unit includes an IAS Server business policy processing module, a HOOK monitoring module, and a HOOK processing module.

[0038] The IAS Server business policy processing module is used to receive the identity authentication policy issued by the center, upload log information to the center, and send monitoring notifications to the HOOK monitoring module.

[0039] The IAS Server business policy processing module serves as a TCP communication service end and directly receives the identity authentication policy defined and issued by the center.

[0040] There are many types of railway signal systems, and the same signal system is also provided by different manufacturers. In order to improve adaptability and scalability, the center of the present invention maintains a signal business system library internally. The center automatically matches the signal business system library through the identification of the business server to identify the business system of the business server.

[0041] The center automatically identifies the business system and the business system account on the business server based on the business server, and automatically generates an identity authentication strategy for the business system account on the business server.

[0042] The center stores the identity authentication policy information in a designated slot of the authentication device based on the automatically identified business system. The identity authentication policy information of different business system accounts is stored in different slots, thereby enabling one device to be used for identity authentication of multiple business system accounts, avoiding the need for the same user to carry multiple authentication devices in order to maintain multiple business systems.

[0043] The authentication device includes Ukey device and dynamic password device

[0044] The IAS Server business policy processing module receives the identity authentication policy stored in the Sqlite library and stores it in password ciphertext.

[0045] The IAS Server business policy processing module and the center use a national secret communication mechanism. Only when the center issues policies, it needs to communicate with the center. And when the communication connection with the center is disconnected or fails, the business system can still use the locally running HOOK monitoring and HOOK processing modules for secondary identity authentication. Therefore, when a failure occurs, it will not affect the normal use of the business system.

[0046] When user personnel are adjusted, the center can redefine and issue new identity authentication policies.

[0047] The HOOK monitoring module is used to monitor the name and / or form feature information of the specified business system program in the business program unit according to the configuration information and the monitoring notification, and trigger the HOOK processing module when the name and / or form feature information of the monitored specified business system program appears.

[0048] The HOOK processing module is used to lock the original password input box of the login interface according to the trigger, and after monitoring the account number input in the original form, confirm whether the account needs secondary authentication, if necessary, start two-factor authentication, and send the authentication record to the IAS Server business policy processing module. If not, unlock the original password input box of the login interface.

[0049] Based on the complex and diverse operation and usage scenarios of railways, the two-factor authentication of the present invention includes two methods: username and password + dynamic password authentication method, and username and password + Ukey password authentication method.

[0050] The Ukey password authentication method is to write the authentication password directly into the Ukey device. Each time authentication is performed, the Ukey device is inserted into the business server for authentication.

[0051] The use of Ukey devices is limited to the USB interface opened by the business server, and the business server needs to be placed in an environment where personnel can log in directly. However, many business servers in the railway system are installed in computer rooms where personnel cannot enter and exit at will, or their USB interfaces are closed. Based on this environment, the technical solution of the present invention provides another two-factor authentication method, namely, username and password + dynamic password authentication method.

[0052] A dynamic password is a string of random numbers displayed by a dynamic password device, and the numbers change periodically. The dynamic password display device can be used without direct contact with the business server or network.

[0053] Embodiment 2 of the present invention relates to a two-factor identity authentication method for a railway signal system, the method comprising the following steps:

[0054] S1. The user logs into the business program in the business server, and the HOOK monitoring module of the two-factor authentication unit monitors the login action, triggering the HOOK processing module of the two-factor authentication unit to enter the two-factor identity authentication mode.

[0055] S2. The HOOK processing module of the two-factor authentication unit locks the original login authentication interface of the business program and pops up a new two-factor identity authentication interface.

[0056] The two-factor authentication interface includes the user name and password authentication of the original business system, and another identity authentication method.

[0057] The other identity authentication method includes a dynamic password authentication method and a Ukey password authentication method.

[0058] S3. After the user enters the username and password, the two-factor authentication unit sends the username and password information to the business program and requests authentication; when the user enters a non-existent username, or the username is correct but the password is incorrect, the two-factor authentication unit receives information that the business program has failed the authentication, and prompts the two-factor authentication interface with the information that the authentication has failed. The user will no longer continue the authentication and will not be able to log in to the business program; when the user enters the correct username and password, the two-factor authentication unit receives information that the business program has passed the authentication and requires the user to perform a second authentication.

[0059] S4. The user uses the authentication device to perform secondary authentication. If the authentication fails, the user cannot log in to the business system. If the authentication passes, the user successfully logs in to the business system.

[0060] Among them, when the authentication device is a Ukey device, if the Ukey does not match or the entered Ukey password is incorrect, the authentication fails; when the authentication device is a dynamic password device, if the entered dynamic password does not match, the authentication fails.

[0061] When the user is taking over a shift, the content of step S1 is replaced by:

[0062] S1 '. The user executes the shift handover business procedure, and the HOOK monitoring module of the two-factor authentication unit detects the shift handover action, triggering the HOOK processing module of the two-factor authentication unit to enter the two-factor identity authentication mode.

[0063] When the user is taking over a shift, the content of step S2 is replaced by:

[0064] S2 '. The HOOK processing module of the two-factor authentication unit locks the original handover interface of the business program and pops up a new two-factor identity authentication interface.

[0065] Embodiment 3 of the present invention relates to a computer program product, which includes a computer program. The computer program is executed by a processor to execute the two-factor identity authentication method for a railway signal system of embodiment 2.

[0066] Embodiment 4 of the present invention relates to a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is executed by a processor to execute a two-factor identity authentication method for a railway signal system according to embodiment 2.

[0067] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the protection scope of the present invention.

Claims

1. A two-factor identity authentication system for railway signaling system, characterized in that: The system comprises: a center, a business server, and the business server comprises a business program unit and a two-factor authentication unit; The business program unit is used to provide users with scenarios for executing businesses that require identity authentication; The two-factor authentication unit is used to monitor whether the business program unit is in a scenario where identity authentication is required. If yes, the original password authentication is shielded, and a two-factor authentication interface including the original password authentication is provided to the business program unit. When the user passes the two-factor authentication, the two-factor authentication unit confirms that the identity authentication of the user has been passed; if not, the two-factor authentication unit continues to monitor; The two-factor authentication unit is also used to receive the policy issued by the center and upload log information to the center; The dual-factor authentication unit includes an IAS Server business policy processing module, a HOOK monitoring module, and a HOOK processing module; The IAS Server business policy processing module is used to receive the identity authentication policy issued by the center, upload log information to the center, and send monitoring notifications to the HOOK monitoring module; The HOOK monitoring module is used to monitor the name and / or form feature information of the specified business system program in the business program unit according to the configuration information and the monitoring notification, and trigger the HOOK processing module when the name and / or form feature information of the monitored specified business system program appears; The HOOK processing module is used to lock the original password input box on the login interface according to the trigger, and after monitoring the account input in the original form, confirm whether the account needs secondary authentication. If necessary, start two-factor authentication and send the authentication record to the IAS Server business policy processing module; if not necessary, unlock the original password input box on the login interface.

2. A two-factor identity authentication system for a railway signaling system according to claim 1, characterized in that: The services that require identity authentication include login services and shift handover services.

3. A two-factor identity authentication system for a railway signaling system according to claim 1, characterized in that: The center automatically identifies the business system and the business system account on the business server based on the business server, and automatically generates an identity authentication policy for the business system account on the business server; The center stores the identity authentication policy information in a designated slot of the authentication device according to the automatically identified business system, and the identity authentication policy information of different business system accounts is stored in different slots.

4. A two-factor identity authentication system for a railway signaling system according to claim 3, characterized in that: The authentication devices include Ukey devices and dynamic password devices.

5. A two-factor identity authentication system for a railway signaling system according to claim 1, characterized in that: The IAS Server business policy processing module receives the identity authentication policy stored in the Sqlite library and stores it in password ciphertext.

6. A two-factor identity authentication method for a railway signal system, the method being applied to the two-factor identity authentication system for a railway signal system as claimed in any one of claims 1 to 5, characterized in that: The method comprises the following steps: S1 user logs into the business server business program, the two-factor authentication unit HOOK monitoring module monitors the login action, triggering the two-factor authentication unit HOOK processing module to enter the two-factor authentication mode; S2. The HOOK processing module of the two-factor authentication unit locks the original login authentication interface of the business program and pops up a new two-factor authentication interface; S3. After the user enters the username and password, the two-factor authentication unit sends the username and password information to the business program and requests authentication; when the user enters a non-existent username, or the username is correct but the password is incorrect, the two-factor authentication unit receives information that the business program has failed authentication, and prompts the two-factor authentication interface with the information that the authentication has failed, and the user will no longer continue authentication, and will not be able to log in to the business program; when the user enters the correct username and password, the two-factor authentication unit receives information that the business program has passed authentication, and requires the user to perform secondary authentication; S4. The user uses the authentication device to perform secondary authentication. If the authentication fails, the user cannot log in to the business system. If the authentication passes, the user successfully logs in to the business system.

7. A two-factor identity authentication method for a railway signal system according to claim 6, characterized in that: When the user is taking over a shift, the content of step S1 is replaced by: S1 'user performs handover business procedures, the HOOK monitoring module of the two-factor authentication unit monitors the handover action, triggering the HOOK processing module of the two-factor authentication unit to enter the two-factor authentication mode; The content of step S2 is replaced by: S2 '. The HOOK processing module of the two-factor authentication unit locks the original handover interface of the business program and pops up a new two-factor identity authentication interface.

8. A computer program product, characterized in that The computer program product comprises a computer program, which is executed by a processor and is used to perform the two-factor identity authentication method for a railway signaling system as claimed in claim 6 or 7.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is executed by a processor to execute the two-factor identity authentication method for a railway signaling system as described in claim 6 or 7.

Images