A Ukey authentication method, apparatus, device, and storage medium

Abstract

The application discloses a Ukey authentication method and device, equipment and storage medium, and relates to the field of information technology security, and comprises the following steps: receiving a login request of a user through a preset universal login page, and obtaining user information and a personal identification code; sending a verification request corresponding to the personal identification code to a preset universal desktop application through the preset universal login page, and verifying the personal identification code by using the preset universal desktop application after the preset universal desktop application receives the verification request; and if the verification is successful, sending the user information, a Ukey certificate and a preset signature to a preset server through the preset universal login page, so as to verify the user. By constructing the universal desktop application and the universal login page, and by connecting the Ukey drivers of multiple manufacturers through the universal login application, the Ukey can be interacted with through a unified middleware, and the adaptation of Ukeys of different manufacturers can be realized.

Description

Technical Field

[0001] This invention relates to the field of information technology security, and in particular to a Ukey authentication method, apparatus, device, and storage medium. Background Technology

[0002] With the widespread application of cloud computing technology, cloud platforms have become an important carrier for critical information infrastructure and digital platforms. To ensure information security on cloud platforms and prevent risks such as leakage and tampering of important data, the government has issued a series of policy documents that set forth clear requirements for the application of cryptography on cloud platforms.

[0003] In cloud platform cryptographic application security assessments, integrating national cryptographic U-keys has become a common practice to improve login security. However, with numerous cloud platforms, different cloud centers purchase different national cryptographic equipment (such as U-keys, signature verification servers, and cryptographic machines) for national cryptographic evaluations. This necessitates that cloud platforms be able to adapt to and support U-keys from multiple vendors. Typically, each U-key vendor provides desktop applications and integration sample code for their U-keys. These sample codes usually interact with the desktop application by calling its RESTful API or directly via WebSocket. Due to the lack of a corresponding standard, desktop applications from different vendors only support interfaces with their own vendor's U-keys, and the parameters and return values ​​of the RESTful APIs exposed by the desktop applications also differ significantly. This necessitates the development of multiple login pages for cloud platforms to adapt to different vendors' U-keys, increasing development costs and reducing system maintainability and flexibility. Therefore, developing a universal U-key adaptation and integration solution has become a pressing issue for current cloud platforms. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a Ukey authentication method, apparatus, device, and storage medium. By constructing a universal desktop application and a universal login page, and by connecting the universal login application to Ukey drivers from multiple vendors, it is possible to interact with multiple Ukeys through a unified middleware, achieving compatibility with Ukeys from different vendors. The specific solution is as follows:

[0005] Firstly, this application provides a Ukey authentication method, including:

[0006] The system receives user login requests through a preset general login page and obtains user information and corresponding personal identification codes entered by the user through the preset general login page based on the login request.

[0007] The preset general login page sends a first verification request corresponding to the personal identification code to the preset general desktop application using a preset client program, and after the preset general desktop application receives the first verification request, it verifies the personal identification code using the preset general desktop application.

[0008] If the personal identification code is successfully verified, a second verification request is sent to the preset general desktop application through the preset general login page. The preset general desktop application then sends the user information, the Ukey certificate pre-obtained by the preset general desktop application, and the preset signature to the preset server based on the second verification request. The preset server is then used to verify the user, and the user is deemed to have successfully logged in after successful verification. The preset signature is signature data obtained based on the user information.

[0009] Optionally, obtaining the user information and corresponding personal identification code entered by the user through the preset general login page includes:

[0010] The system interacts with the preset standard RESTful interface of the preset universal login page and the preset universal desktop application to obtain the user information and personal identification code input by the user.

[0011] Accordingly, before sending the user information, the Ukey certificate pre-obtained by the preset universal desktop application, and the preset signature to the preset server, the process further includes:

[0012] The system interacts with the preset standard RESTful interface of the preset universal login page and the preset universal desktop application, and obtains the Ukey certificate sent by the Ukey driver.

[0013] Optionally, before obtaining the Ukey certificate sent by the Ukey driver, the method further includes:

[0014] According to the preset interface specification, the preset general desktop application and several Ukey drivers are connected to obtain the Ukey certificate sent by the Ukey driver through the preset general desktop application.

[0015] Optionally, the step of connecting the preset general desktop application and several Ukey drivers according to the preset interface specification includes:

[0016] Obtain the interface functions from the preset dynamic link library, and interface with the preset general desktop application and several Ukey drivers according to the interface functions and the preset interface specifications.

[0017] Optionally, verifying the personal identification code using the preset general desktop application includes:

[0018] The preset general desktop application calls the library files of each of the Ukey drivers, and verifies the personal identification code based on preset verification rules according to the library files.

[0019] Optionally, the Ukey authentication method further includes:

[0020] The system calls a random number from the preset server and uses the preset general desktop application to call the preset signature interface of the corresponding Ukey driver to generate the preset signature based on the username in the user information and the random number, and sends the preset signature to the preset server; the preset signature is obtained by signing the username and the random number using the Ukey's built-in private key;

[0021] Accordingly, the step of verifying the user using the preset server includes:

[0022] The user is verified using the preset server based on the preset signature, the user information, and the Ukey certificate.

[0023] Optionally, the step of verifying the user using the preset server based on the preset signature, the user information, and the Ukey certificate includes:

[0024] The preset server is used to determine whether the user information and the Ukey certificate match.

[0025] If the user information matches the Ukey certificate, the user is verified using the preset signature verification server in the preset server based on the preset signature.

[0026] Secondly, this application provides a Ukey authentication device, comprising:

[0027] The information acquisition module is used to receive a user's login request through a preset general login page, and to acquire the user information and corresponding personal identification code entered by the user through the preset general login page based on the login request;

[0028] The identity verification module is used to send a first verification request corresponding to the personal identification code to a preset general desktop application through the preset general login page using a preset client program, and to verify the personal identification code using the preset general desktop application after the preset general desktop application receives the first verification request.

[0029] The user verification module is used to send a second verification request to the preset general desktop application through the preset general login page if the personal identification code verification is successful. The preset general desktop application then sends the user information, the Ukey certificate pre-obtained by the preset general desktop application, and the preset signature to the preset server based on the second verification request, so that the preset server can verify the user and determine that the user has successfully logged in after the user verification is successful. The preset signature is signature data obtained based on the user information.

[0030] Thirdly, this application provides an electronic device, which includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the aforementioned Ukey authentication method.

[0031] Fourthly, this application provides a computer-readable storage medium for storing a computer program that, when executed by a processor, implements the aforementioned Ukey authentication method.

[0032] In this application, the user's login request is first received through a preset general login page. Based on the login request, the user information and corresponding personal identification code entered by the user through the preset general login page are obtained. Then, a first verification request corresponding to the personal identification code is sent to a preset general desktop application through a preset client program via the preset general login page. After receiving the first verification request, the preset general desktop application verifies the personal identification code. If the verification is successful, a second verification request is sent to the preset general desktop application through the preset general login page. Based on the second verification request, the preset general desktop application sends the user information, Ukey certificate, and preset signature to a preset server so that the preset server can verify the user. After the user's verification is successful, the user is deemed to have logged in successfully. In this way, by building a universal desktop application and a universal login page, and by connecting the universal login application to the Ukey drivers of multiple vendors, this application enables developers to interact with multiple Ukeys through a unified middleware, achieving adaptation for Ukeys from different vendors. This eliminates the need to develop adaptation code separately for each Ukey vendor, effectively solving the problem that when integrating web application login authentication with Ukeys, it is necessary to develop adaptation code separately for each vendor's Ukey, and the adaptation program cannot be reused. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0034] Figure 1 A flowchart of a Ukey authentication method provided in this application;

[0035] Figure 2 A schematic diagram of a general login page provided for this application;

[0036] Figure 3 A schematic diagram of a general Ukey adapter connection scheme provided in this application;

[0037] Figure 4 A flowchart of a specific Ukey authentication method provided in this application;

[0038] Figure 5 This application provides a flowchart of a login verification process that integrates Ukey authentication.

[0039] Figure 6 This application provides a schematic diagram of the structure of a Ukey authentication device;

[0040] Figure 7 This application provides a structural diagram of an electronic device. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Currently, with numerous cloud platforms, different cloud centers purchase different national cryptographic equipment during national cryptographic evaluation. Furthermore, since desktop applications from different vendors only support interface with their own vendor's Ukey, cloud platforms need to develop multiple login pages to adapt to interface with different vendors' Ukeys, reducing system maintainability and flexibility. This application addresses this by constructing a universal desktop application and a universal login page, and by using the universal login application to interface with Ukey drivers from multiple vendors. This allows developers to interact with multiple Ukeys through a unified middleware, achieving compatibility with Ukeys from different vendors.

[0043] See Figure 1As shown, this embodiment of the invention discloses a Ukey authentication method, including:

[0044] Step S11: Receive the user's login request through a preset general login page, and obtain the user information and corresponding personal identification code entered by the user through the preset general login page based on the login request.

[0045] In this embodiment, as Figure 2 The default universal login page shown, upon receiving a user's login request, can retrieve the user information and corresponding Personal Identification Number (PIN) entered by the user through the default universal login page. It can be understood that the aforementioned user information may include the username and corresponding password entered by the user. Specifically, as shown... Figure 3 As shown, when the user enters their login account, login password, Ukey PIN code, and clicks... Figure 2 After clicking the login button, interaction with the universal desktop application is triggered. This involves using the default universal login page and the default standard RESTful interface of the universal desktop application to obtain the user's input information and personal identification code. It can be understood that the web application can be integrated with Ukey authentication, primarily through the integration of the web login page (default universal login page) with the Ukey. The universal login page interacts with the standard RESTful interface exposed by the universal desktop application to enable subsequent operations such as PIN verification, certificate reading, and signing via the Ukey.

[0046] Step S12: Send the first verification request corresponding to the personal identification code to the preset general desktop application through the preset general login page using the preset client program, and verify the personal identification code using the preset general desktop application after the preset general desktop application receives the first verification request.

[0047] In this embodiment, after the general login page obtains the user's information and PIN code, it sends a first verification request corresponding to the personal identification code to the preset general desktop application through the preset general login page and the preset general desktop application. After receiving the first verification request, the preset general desktop application verifies the personal identification code.

[0048] Based on the above technical solutions, such as Figure 3As shown, this embodiment mainly involves four parts: a general login page, a general desktop application, a Ukey driver library, and a Ukey. The general desktop application interfaces upwards with the general login page, providing a standard RESTful interface. Downwards, it interfaces with the Ukey vendor's driver according to the cryptographic industry standard GM / T 0016-2012 "Smart Cryptographic Key Cryptographic Application Interface Specification". Therefore, since Ukey drivers from different vendors all conform to the cryptographic industry standard GM / T0016-2012, the general desktop application only needs to develop one set of adaptation code according to the standard specification, without needing to perform separate adaptation development for different vendors. The aforementioned general desktop application can provide standard RESTful interfaces, which can be implemented in various programming languages ​​such as Java and Go through mature frameworks and interface with the Ukey driver (DLL). It is understood that different programming languages ​​have different interface methods; during development, the corresponding development language and interface method can be selected according to actual needs. In a specific embodiment, the general desktop application listens on port 8222 by default and only accepts POST requests. The standard RESTful interfaces provided to the general login page include:

[0049] PIN code verification interface:

[0050] Request URI: http: / / 127.0.0.1:8222

[0051] Request Method: POST

[0052] Request parameters:

[0053] {

[0054] "Function" : "SOF_Login",

[0055] "PassWd" : "PIN code"

[0056] };

[0057] Export signing certificate interface:

[0058] Request URI: http: / / 127.0.0.1:8222

[0059] Request Method: POST

[0060] Request parameters:

[0061] {

[0062] "Function" : "SOF_ExportUserCert"

[0063] };

[0064] Signature calculation interface:

[0065] Request URI: http: / / 127.0.0.1:8222

[0066] Request Method: POST

[0067] Request parameters:

[0068] {

[0069] "Function" : "SOF_SignData",

[0070] "InData": "Original data that needs to be signed"

[0071] }

[0072] When general-purpose desktop applications interface with Ukey vendor drivers, they can call the interface functions defined in the cryptographic industry standard GM / T 0016-2012. These functions are typically exposed by dynamic link libraries (DLLs) provided by the Ukey vendor, and different programming languages ​​use different methods to call these DLL files. For example, in Go, `syscall.LoadDLL` (located in the `golang.org / x / sys / windows / syscall` package) loads the underlying functions of Windows DLL files, and then uses the handle returned after successful loading to call functions such as PIN verification and signature calculation within the DLL. It is understandable that when implementing general-purpose desktop applications using multiple programming languages, different methods can be used to interface with the Ukey driver library.

[0073] This embodiment also includes a set of Ukey driver libraries provided by different Ukey manufacturers, conforming to the cryptographic industry standard GM / T 0016-2012, used to realize physical interaction with the Ukey. The Ukey drivers from different manufacturers include the driver provided by each Ukey manufacturer for the corresponding Ukey, and these drivers all conform to the cryptographic industry standard GM / T 0016-2012 "Intelligent Cryptographic Key Cryptographic Application Interface Specification". Therefore, general desktop applications can call according to the interface specifications defined in GM / T 0016-2012, thereby ensuring the compatibility of Ukeys from different manufacturers at the interface level. This allows developers to develop unified middleware to interact with these Ukeys. Compared with the solution of deploying newly adapted code to the production environment, this embodiment only requires the client computer to update the new Ukey driver to the local driver directory, without involving changes to the production environment, saving operation and maintenance costs and helping to improve operation and maintenance deployment efficiency. The aforementioned GM / T 0016-2012 "Smart Cryptographic Key Cryptographic Application Interface Specification" defines the cryptographic application interface for smart cryptographic keys based on PKI (Public Key Infrastructure) cryptography. It describes the functions, data types, parameter definitions, and device security requirements of the cryptographic application interface. Based on the above technical solution, this embodiment proposes a new adaptation and connection method based on the GM / T 0016-2012 Smart Cryptographic Key Cryptographic Application Interface Specification to achieve universal authentication integration and connection of Ukeys. The standard RESTful interfaces defined by this specification include PIN code verification interfaces, signature certificate export interfaces, and signature calculation interfaces implemented by various programming languages ​​through mature frameworks. Specific interface specifications include:

[0074] 1. Verify PIN:

[0075] Function prototype:

[0076] ULONG DEVAPI SKF_VerifyPIN (HAPPLICATION hApplication, ULONGulPINType, LPSTR szPIN, ULONG *pulRetryCount);

[0077] Function Description:

[0078] Verify the PIN code. If the verification is successful, you will be granted the corresponding permissions. If the PIN code is incorrect, the number of retries will be returned. When the number of retries is 0, it means that the PIN code is locked.

[0079] parameter:

[0080] hApplication [IN] Application handle;

[0081] ulPINType [IN] PIN type;

[0082] szPIN [IN] PIN value;

[0083] pulRetryCount [OUT] The number of retries returned after an error.

[0084] 2. Export digital certificate:

[0085] Function prototype:

[0086] ULONG DEVAPI SKF_ExportCertificate(HCONTAINER hContainer, BOOLbSignFlag, BYTE* pbCert, ULONG *pulCertLen);

[0087] Function Description:

[0088] Export the digital certificate from the container;

[0089] parameter:

[0090] hContainer [IN] Container handle;

[0091] bSignFlag [IN] TRUE indicates a signing certificate, FALSE indicates an encryption certificate;

[0092] pbCert [OUT] points to the certificate content buffer. If this parameter is not NULL, it returns the digital certificate content.

[0093] pulCertLen [IN / OUT] indicates the length of the pbCert buffer when inputting and the length of the certificate content when outputting.

[0094] 3. ECC Signature (Elliptic Curve Cryptography, a digital signature technology based on elliptic curve cryptography):

[0095] Function prototype:

[0096] ULONG DEVAPI SKF_ECCSignData (HCONTAINER hContainer, BYTE *pbData,ULONG ulDataLen, PECCSIGNATUREBLOB pSignature);

[0097] Function Description:

[0098] ECC digital signature uses the ECC algorithm and a specified private key hKey to digitally sign the specified data pbData, and the signed result is stored in pSignature;

[0099] parameter:

[0100] hContainer [IN] Handle to the key container;

[0101] pbData [IN] is the data to be signed;

[0102] ulDataLen [IN] The length of the data to be signed, which must be less than the key modulus;

[0103] pSignature [OUT] Signature value.

[0104] Understandably, the Ukeys from the aforementioned different manufacturers, namely USBKey (Universal Serial Bus Key), are small, reliable, and high-speed storage devices that connect directly to a computer via USB (Universal Serial Bus) and have password verification capabilities. They can enable identity authentication, electronic signatures / seals, secure emails, file encryption / decryption, data encryption / decryption, transmission encryption, establishment of transaction trust relationships, and encryption of transaction information.

[0105] Step S13: If the personal identification code is successfully verified, a second verification request is sent to the preset general desktop application through the preset general login page. The preset general desktop application then sends the user information, the Ukey certificate pre-obtained by the preset general desktop application, and the preset signature to the preset server based on the second verification request. The preset server is used to verify the user, and the user is deemed to have successfully logged in after successful verification. The preset signature is signature data obtained based on the user information.

[0106] In this embodiment, if the personal identification code verification is successful, a second verification request is sent to a preset general desktop application through a preset general login page. The preset general desktop application then sends the user information, Ukey certificate, and preset signature to a preset server based on the second verification request. This allows the preset server to verify the user, and upon successful verification, the user is deemed to have successfully logged in. The preset signature is signature data obtained based on the user information. Before sending the user information, Ukey certificate, and preset signature to the preset server, the preset general login page interacts with the preset standard RESTful interface of the preset general desktop application. The preset interface specification connects the preset general desktop application and several Ukey drivers to obtain the Ukey certificate sent by the Ukey drivers through the preset general desktop application. Furthermore, when connecting the preset general desktop application and several Ukey drivers according to the preset interface specification, the interface functions in the preset dynamic link library can be obtained first, and the interface functions and preset interface specification are used to connect the preset general desktop application and several Ukey drivers.

[0107] This embodiment can receive user login requests through a preset universal login page, and obtain user information and corresponding personal identification codes entered by the user through the preset universal login page based on the login request. Then, through the preset universal login page, a preset client program sends a first verification request corresponding to the personal identification code to a preset universal desktop application. After receiving the first verification request, the preset universal desktop application verifies the personal identification code using a pre-obtained Ukey certificate. If the verification is successful, a second verification request is sent to the preset universal desktop application through the preset universal login page, and the preset universal desktop application sends the user information, Ukey certificate, and preset signature to a preset server based on the second verification request, so that the preset server can verify the user, and the user is deemed to have successfully logged in after successful verification. In this way, by building a universal desktop application and a universal login page, and connecting to the Ukey drivers of multiple vendors through the universal login application, developers can interact with multiple Ukeys through a unified middleware, achieving adaptation for Ukeys from different vendors. This eliminates the need to develop separate adaptation code for each Ukey vendor, effectively solving the problem of having to perform adaptation and integration for each Ukey separately and the inability to reuse code when the same product needs to adapt and integrate with different national cryptographic Ukeys. When there is a new Ukey vendor adaptation requirement, the workload of adaptation and integration can be greatly reduced.

[0108] As can be seen from the previous embodiment, this application can build a universal desktop application and a universal login page, and connect to the Ukey drivers of multiple vendors through the universal login application to achieve adaptation to Ukeys from different vendors. Next, this embodiment will describe in detail the process of user authentication via Ukey. See [link to documentation]. Figure 4 As shown in the embodiment of this application, a Ukey authentication method is disclosed, including:

[0109] Step S21: Send the first verification request corresponding to the personal identification code to the preset general desktop application through the preset general login page and the preset client program.

[0110] Step S22: After the preset general desktop application receives the first verification request, it uses the preset general desktop application to call the library files of each Ukey driver, and verifies the personal identification code according to the preset verification rules based on the library files.

[0111] In this embodiment, as shown Figure 5 As shown, after the preset general desktop application receives the first verification request, it calls the library files of each Ukey driver and verifies the personal identification code according to the preset verification rules based on the library files. In other words, the login page can send a RESTful request to the general desktop application via a web client program (such as JavaScript). After receiving the request, the general desktop application can verify the provided PIN code. Specifically, the verification process can be implemented by calling the internally integrated multi-vendor Ukey drivers (DLL files) and follows the cryptographic industry standard GM / T 0016-2012 "Smart Cryptographic Key Cryptographic Application Interface Specification". It is understood that the PIN code typically contains 6 digits, and the RESTful request sent by the general login page to the general desktop application via the web client program can include a PIN code verification request, a Ukey signature interface call request, and a certificate export request. This allows the general desktop application to perform PIN code verification, signature data calculation, and certificate export functions for the Ukey by calling the interface functions defined in the cryptographic industry standard GM / T 0016-2012.

[0112] Step S23: If the personal identification code is successfully verified, a second verification request is sent to the preset general desktop application through the preset general login page. The preset general desktop application then sends the user information, the Ukey certificate obtained in advance by the preset general desktop application, and the preset signature to the preset server based on the second verification request, so as to use the preset server to verify the user. After the user is successfully verified, the user is determined to have logged in successfully.

[0113] In this embodiment, as shown Figure 5 As shown, if the personal identification code verification is successful, a random number in the preset server is called, and the preset signature interface of the corresponding Ukey driver is called through the preset general desktop application to generate a preset signature based on the username and random number in the user information. The preset signature is then sent to the preset server so that the server can verify the user based on the preset signature, user information and Ukey certificate after receiving the signature. The preset signature can be obtained by signing the username and random number with the built-in private key of the Ukey.

[0114] Furthermore, during user verification, a preset server can be used to determine if the user information matches the Ukey certificate. If the user information and Ukey certificate match, the preset signature verification server in the preset server verifies the user based on the preset signature. In other words, in this embodiment, after the PIN code verification is successful, the web client program sends a RESTful request to the general desktop application again. Then, the general desktop application, according to the standard specification, calls the Ukey driver's signature interface so that the Ukey can sign the original data based on its built-in private key, ensuring data integrity. It is understood that typically, only the original data to be signed needs to be provided to the aforementioned signature interface to complete the signing process. In this embodiment, before submitting the login request, the web client program sends a RESTful request to the general desktop application so that the general desktop application can call the Ukey driver's certificate export interface to export the Ukey certificate according to the standard specification. The obtained certificate is a base64 encoded string. Then, by combining the login username, password, signature data, and certificate, the web client program submits the complete login information to the backend. The business system backend then verifies the submitted username and password, and verifies the signature data to ensure the integrity and authenticity of the data. Once the verification is successful, the user is confirmed to have logged in successfully.

[0115] For a more detailed description of the process of step S21, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0116] In this embodiment, a first verification request corresponding to a personal identification code is first sent to a preset general desktop application via a preset general login page using a preset client program. Upon receiving the first verification request, the preset general desktop application calls the library files of each Ukey driver and verifies the personal identification code based on preset verification rules according to the library files. If the personal identification code verification is successful, a second verification request is sent to the preset general desktop application via the preset general login page. The preset general desktop application then sends the user information, Ukey certificate, and preset signature to a preset server based on the second verification request, so that the preset server can verify the user. After successful user verification, the user is deemed to have successfully logged in. Combined with the previous embodiment, this effectively solves the problem that when integrating application login authentication with Ukey, separate adaptation development is required for each vendor's Ukey, and the adaptation program cannot be reused. Furthermore, by verifying the data, the integrity and authenticity of the data can be further ensured.

[0117] See Figure 6 As shown in the embodiments, this application also discloses a Ukey authentication device, including:

[0118] The information acquisition module 11 is used to receive a user's login request through a preset general login page, and to acquire the user information and corresponding personal identification code entered by the user through the preset general login page based on the login request;

[0119] The identity verification module 12 is used to send a first verification request corresponding to the personal identification code to a preset general desktop application through the preset general login page using a preset client program, and to verify the personal identification code using the preset general desktop application after the preset general desktop application receives the first verification request.

[0120] User verification module 13 is used to send a second verification request to the preset general desktop application through the preset general login page if the personal identification code verification is successful, and send the user information, the Ukey certificate obtained in advance by the preset general desktop application and the preset general desktop application to the preset server based on the second verification request, so as to use the preset server to verify the user, and determine that the user has successfully logged in after the user verification is successful; the preset signature is the signature data obtained based on the user information.

[0121] This embodiment can receive user login requests through a preset universal login page, and obtain user information and corresponding personal identification codes entered by the user through the preset universal login page based on the login request. Then, through the preset universal login page, a preset client program sends a first verification request corresponding to the personal identification code to a preset universal desktop application. After receiving the first verification request, the preset universal desktop application verifies the personal identification code. If the verification is successful, a second verification request is sent to the preset universal desktop application through the preset universal login page. Based on the second verification request, the preset universal desktop application sends user information, Ukey certificate, and preset signature to a preset server so that the preset server can verify the user. After successful user verification, the user is considered to have logged in successfully. In this way, by building a universal desktop application and a universal login page, and by connecting the universal login application to Ukey drivers from multiple vendors, developers can interact with multiple Ukeys through a unified middleware, achieving adaptation for Ukeys from different vendors. This eliminates the need to develop adaptation code separately for each Ukey vendor, effectively solving the problem that when integrating web application login authentication with Ukeys, it is necessary to develop adaptation code separately for each vendor's Ukey, and the adaptation program cannot be reused.

[0122] In some specific embodiments, the information acquisition module 11 specifically includes:

[0123] The information acquisition unit is used to interact with the preset standard RESTful interface of the preset universal login page and the preset universal desktop application to acquire the user information and the personal identification code input by the user.

[0124] Accordingly, the user verification module 13 further includes:

[0125] The certificate acquisition unit is used to interact with the preset standard RESTful interface of the preset universal login page and the preset universal desktop application, and to obtain the Ukey certificate sent by the Ukey driver.

[0126] In some specific embodiments, the authentication module 12 further includes:

[0127] The driver interface submodule is used to interface with the preset general desktop application and several of the Ukey drivers according to the preset interface specifications, so as to obtain the Ukey certificate sent by the Ukey driver through the preset general desktop application.

[0128] In some specific embodiments, the driver docking submodule specifically includes:

[0129] The driver docking unit is used to obtain interface functions from a preset dynamic link library, and dock the preset general desktop application and several Ukey drivers according to the interface functions and the preset interface specifications.

[0130] In some specific embodiments, the authentication module 12 specifically includes:

[0131] The authentication unit is used to call the library files of each of the Ukey drivers using the preset general desktop application, and to verify the personal identification code according to the preset verification rules based on the library files.

[0132] In some specific embodiments, the Ukey authentication device further includes:

[0133] The signature generation module is used to call the random number in the preset server, and through the preset general desktop application, call the preset signature interface of the corresponding Ukey driver to generate the preset signature based on the username in the user information and the random number, and send the preset signature to the preset server; the preset signature is obtained by signing the username and the random number with the built-in private key of the Ukey;

[0134] Accordingly, the user verification module 13 specifically includes:

[0135] The first user verification unit is used to verify the user using the preset server based on the preset signature, the user information, and the Ukey certificate.

[0136] In some specific embodiments, the user verification module 13 specifically includes:

[0137] The certificate verification unit is used to determine whether the user information and the Ukey certificate match using the preset server.

[0138] The second user verification unit is used to verify the user based on the preset signature using the preset signature verification server in the preset server if the user information matches the Ukey certificate.

[0139] Furthermore, embodiments of this application also disclose an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0140] Figure 7This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the Ukey authentication method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0141] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0142] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0143] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the Ukey authentication method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0144] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed Ukey authentication method. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0145] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0146] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0147] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0148] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0149] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A Ukey authentication method, characterized by, The application comprises the following steps: Receiving a login request of a user through a preset general login page, and obtaining user information and a corresponding personal identification number input by the user through the preset general login page based on the login request; Sending a first verification request corresponding to the personal identification number to a preset general desktop application through a preset client program using the preset general login page, and verifying the personal identification number using the preset general desktop application after the preset general desktop application receives the first verification request; If the personal identification number is verified successfully, sending a second verification request to the preset general desktop application through the preset general login page, and sending the user information, a Ukey certificate and a preset signature pre-obtained by the preset general desktop application to a preset service end based on the second verification request through the preset general desktop application, so as to verify the user using the preset service end, and determining that the user logs in successfully after the user is verified successfully; The preset signature is signature data obtained based on the user information.

2. The Ukey authentication method of claim 1, wherein, The method further comprises the following steps: Interacting with a preset standard Restful interface of the preset general desktop application using the preset general login page to obtain the user information and the personal identification number input by the user; Correspondingly, before the user information, the Ukey certificate and the preset signature are sent to the preset service end, the method further comprises the following steps: Interacting with the preset standard Restful interface of the preset general desktop application using the preset general login page, and obtaining the Ukey certificate sent by the Ukey driver.

3. The Ukey authentication method of claim 2, wherein, Before the Ukey certificate sent by the Ukey driver is obtained, the method further comprises the following steps: According to a preset interface specification, the preset general desktop application and a plurality of Ukey drivers are connected, so that the Ukey certificate sent by the Ukey driver is obtained through the preset general desktop application.

4. The Ukey authentication method of claim 3, wherein, The method further comprises the following steps: Obtaining an interface function in a preset dynamic link library, and connecting the preset general desktop application and a plurality of Ukey drivers according to the interface function and the preset interface specification.

5. The Ukey authentication method of claim 1, wherein, The method further comprises the following steps: Calling a library file of each Ukey driver using the preset general desktop application, and verifying the personal identification number based on a preset verification rule according to the library file.

6. The Ukey authentication method according to any one of claims 1 to 5, characterized by, The method further comprises the following steps: Calling a random number in the preset service end, and generating the preset signature according to a username in the user information and the random number through a preset signature interface of a corresponding Ukey driver using the preset general desktop application, and sending the preset signature to the preset service end; The preset signature is obtained by signing the username and the random number through a built-in private key of a Ukey. Correspondingly, the user verification by the preset server includes: The user is verified by the preset server based on the preset signature, the user information and the Ukey certificate.

7. The Ukey authentication method of claim 6, wherein, The user is verified by the preset server based on the preset signature, the user information and the Ukey certificate. The user is verified by the preset server based on the preset signature, the user information and the Ukey certificate. The user is verified by the preset server based on the preset signature, the user information and the Ukey certificate.

8. A Ukey authentication apparatus characterized by comprising: The user is verified by the preset server based on the preset signature, the user information and the Ukey certificate. The information acquisition module is configured to receive a login request of a user through a preset universal login page, and acquire user information and a corresponding personal identification number input by the user through the preset universal login page based on the login request. The identity verification module is configured to send a first verification request corresponding to the personal identification number to a preset universal desktop application through the preset universal login page by using a preset client program, and verify the personal identification number by using the preset universal desktop application after the first verification request is received by the preset universal desktop application. The user verification module is configured to send a second verification request to the preset universal desktop application through the preset universal login page if the personal identification number is verified successfully, and send the user information, a Ukey certificate and a preset signature pre-acquired by the preset universal desktop application to a preset server based on the second verification request by using the preset universal desktop application, so as to verify the user by using the preset server, and determine that the user logs in successfully after the user is verified successfully. The preset signature is signature data obtained based on the user information.

9. An electronic device, comprising: The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, the computer program is loaded and executed by the processor to realize the Ukey authentication method as claimed in any one of claims 1 to 7.

10. A computer readable storage medium characterized by, A computer program is stored, and the computer program is executed by a processor to realize the Ukey authentication method as claimed in any one of claims 1 to 7.

Images