A unified identity authentication method and system

Abstract

The present invention provides a unified identity authentication method and system in the field of identity authentication technology, the method comprising: step S1, collecting and integrating user field attributes of different personnel types, obtaining common field attributes and personalized field attributes, integrating each common field attribute into a basic identity database, integrating each personalized field attribute into a business identity database, and associating each basic identity database and business identity database to generate an identity authentication database; step S2, setting a calling interface and calling authority of a shared authentication database; step S3, receiving an input identity authentication request and verifying it; step S4, obtaining identity authentication data from the identity authentication database based on the calling authority through the calling interface and the identity authentication request; step S5, encrypting the identity authentication data into encrypted authentication data for feedback to perform an identity authentication operation. The advantages of the present invention are: greatly improving the convenience and security of identity authentication.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and in particular to a unified identity authentication method and system. Background Art

[0002] Identity authentication refers to the confirmation of user identity through certain means. Only users with confirmed identities can obtain the authority to perform preset operations. At present, there is a corresponding unified identity authentication platform for the identity authentication of natural persons, legal persons and civil servants. These unified identity authentication platforms are independent in design and operation, and each forms a complete system.

[0003] However, with the deepening of informatization construction and the needs of certain special business scenarios, services for natural persons, legal persons and clerical service personnel have generated business intersections. Some business systems need to perform identity authentication for different types of personnel at the same time. Under the current technical framework and system, due to the dispersion and independence of various unified identity authentication platforms, it is impossible to directly meet this cross-scenario identity authentication demand. It is necessary to connect to the corresponding unified identity authentication platform one by one for identity authentication, which makes identity authentication inconvenient. In addition, during the identity authentication process, no corresponding security measures are taken for the transmitted authentication data, and there are certain security risks.

[0004] Therefore, how to provide a unified identity authentication method and system to improve the convenience and security of identity authentication has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a unified identity authentication method and system to improve the convenience and security of identity authentication.

[0006] In a first aspect, the present invention provides a unified identity authentication method, comprising the following steps:

[0007] Step S1, the server collects and integrates user field attributes of different personnel types, obtains common field attributes and personalized field attributes, integrates each of the common field attributes into a pre-created basic identity database, integrates each of the personalized field attributes into each pre-created business identity database, and associates each of the basic identity databases with the business identity database to generate an identity authentication database;

[0008] Step S2: The server sets the calling interface and calling authority of the identity authentication database;

[0009] Step S3, the server receives the identity authentication request input by the client, verifies the identity authentication request, displays a verification window containing a mathematical formula through a visual interface, and verifies the verification result input in the verification window;

[0010] Step S4: The server obtains corresponding identity authentication data from the identity authentication database based on the calling authority through the calling interface and the identity authentication request;

[0011] Step S5: The server encrypts the identity authentication data into encrypted authentication data, and feeds the encrypted authentication data back to the client;

[0012] Step S6: The client decrypts the received encrypted authentication data to obtain identity authentication data, and performs an identity authentication operation based on the identity authentication data;

[0013] The step S3 is specifically as follows:

[0014] The server receives the authentication request input by the client, which carries the ciphertext data and the HMAC value;

[0015] The encryption process of the ciphertext data is as follows: the user unique identifier, personnel type, device serial number, timestamp and account password are encrypted by the Serpent algorithm to obtain first encrypted data, each character of the first encrypted data is controlled to shift rightward by a preset displacement amount to obtain second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm to obtain ciphertext data;

[0016] The HMAC value is obtained by performing HMAC calculation on the ciphertext data;

[0017] The server parses the identity authentication request to obtain ciphertext data and an HMAC value, performs integrity check on the ciphertext data using the HMAC value, decrypts the ciphertext data using the RC6 algorithm to obtain second encrypted data, controls each character of the second encrypted data to shift leftward using a preset displacement amount to obtain first encrypted data, decrypts the first encrypted data using the Serpent algorithm to obtain a user unique identifier, personnel type, device serial number, timestamp, and account password; performs time validity check on the timestamp, performs matching check on the account password using a preset password table, and then performs legitimacy check on the device serial number using a preset device management table;

[0018] The server creates a mathematical formula, sets a calculation result of the mathematical formula, loads the mathematical formula in the form of an image into a verification window, divides and hides the mathematical formula in the verification window based on a blinds effect, adds random stripes into the verification window, displays the verification window through a visual interface, and verifies the verification result input into the verification window through the calculation result;

[0019] The step S5 is specifically as follows:

[0020] The server encrypts the authentication data into first-level encrypted data through the CAST-128 algorithm, divides the first-level encrypted data according to a preset division ratio and swaps the order to obtain second-level encrypted data, encrypts the second-level encrypted data through the XTEA algorithm to obtain third-level encrypted data, converts the third-level encrypted data into hexadecimal, swaps the number 9 and the letter F to obtain fourth-level encrypted data, encrypts the fourth-level encrypted data into encrypted authentication data through the 3DES algorithm, and feeds back the encrypted authentication data to the client through the IPsec protocol.

[0021] Furthermore, in step S1, the personnel type is a natural person, a legal person or a civilian service staff;

[0022] The business identity database includes a natural person business identity database, a legal person business identity database and a civilian service staff business identity database.

[0023] Furthermore, in step S2, the calling interface is an API or SDK;

[0024] The calling authority is the authority to add, delete, modify or query the basic identity database and the business identity database.

[0025] Furthermore, the step S4 is specifically as follows:

[0026] The server obtains the corresponding common field attributes and personalized field attributes from the identity authentication database based on the calling authority through the calling interface and the user unique identification type carried in the identity authentication request, and generates identity authentication data based on the common field attributes and personalized field attributes.

[0027] Furthermore, the step S6 is specifically as follows:

[0028] The client receives the encrypted authentication data in real time, decrypts the encrypted authentication data into level-four encrypted data through the 3DES algorithm, swaps the number 9 and the letter F in the level-four encrypted data, performs a hexadecimal inverse conversion to obtain level-three encrypted data, decrypts the level-three encrypted data through the XTEA algorithm to obtain level-two encrypted data, divides the level-two encrypted data by the inverse of a preset division ratio and swaps the order to obtain level-one encrypted data, decrypts the level-one encrypted data into identity authentication data through the CAST-128 algorithm, and performs an identity authentication operation based on the identity authentication data.

[0029] In a second aspect, the present invention provides a unified identity authentication system, comprising the following modules:

[0030] An identity authentication database generation module is used for the server to collect and integrate user field attributes of different personnel types, obtain common field attributes and personalized field attributes, integrate each of the common field attributes into a pre-created basic identity database, integrate each of the personalized field attributes into each pre-created business identity database, and associate each of the basic identity databases with the business identity database to generate an identity authentication database;

[0031] A calling interface and authority setting module, used for the server to set the calling interface and calling authority of the identity authentication database;

[0032] The identity authentication request verification module is used for the server to receive the identity authentication request input by the client, and after verifying the identity authentication request, a verification window containing a mathematical formula is displayed through a visual interface to verify the verification result input in the verification window;

[0033] An identity authentication data acquisition module is used for the server to obtain corresponding identity authentication data from the identity authentication database based on the calling authority through the calling interface and the identity authentication request;

[0034] An encrypted authentication data feedback module is used for the server to encrypt the identity authentication data into encrypted authentication data and feed the encrypted authentication data back to the client;

[0035] An identity authentication operation module, used for the client to decrypt the received encrypted authentication data to obtain identity authentication data, and perform an identity authentication operation based on the identity authentication data;

[0036] The identity authentication request verification module is specifically used for:

[0037] The server receives the authentication request input by the client, which carries the ciphertext data and the HMAC value;

[0038] The encryption process of the ciphertext data is as follows: the user unique identifier, personnel type, device serial number, timestamp and account password are encrypted by the Serpent algorithm to obtain first encrypted data, each character of the first encrypted data is controlled to shift rightward by a preset displacement amount to obtain second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm to obtain ciphertext data;

[0039] The HMAC value is obtained by performing HMAC calculation on the ciphertext data;

[0040] The server parses the identity authentication request to obtain ciphertext data and an HMAC value, performs integrity check on the ciphertext data using the HMAC value, decrypts the ciphertext data using the RC6 algorithm to obtain second encrypted data, controls each character of the second encrypted data to shift leftward using a preset displacement amount to obtain first encrypted data, decrypts the first encrypted data using the Serpent algorithm to obtain a user unique identifier, personnel type, device serial number, timestamp, and account password; performs time validity check on the timestamp, performs matching check on the account password using a preset password table, and then performs legitimacy check on the device serial number using a preset device management table;

[0041] The server creates a mathematical formula, sets a calculation result of the mathematical formula, loads the mathematical formula in the form of an image into a verification window, divides and hides the mathematical formula in the verification window based on a blinds effect, adds random stripes into the verification window, displays the verification window through a visual interface, and verifies the verification result input into the verification window through the calculation result;

[0042] The encrypted authentication data feedback module is specifically used for:

[0043] The server encrypts the authentication data into first-level encrypted data through the CAST-128 algorithm, divides the first-level encrypted data according to a preset division ratio and swaps the order to obtain second-level encrypted data, encrypts the second-level encrypted data through the XTEA algorithm to obtain third-level encrypted data, converts the third-level encrypted data into hexadecimal, swaps the number 9 and the letter F to obtain fourth-level encrypted data, encrypts the fourth-level encrypted data into encrypted authentication data through the 3DES algorithm, and feeds back the encrypted authentication data to the client through the IPsec protocol.

[0044] Furthermore, in the identity authentication database generation module, the personnel type is a natural person, a legal person or a civilian service staff;

[0045] The business identity database includes a natural person business identity database, a legal person business identity database and a civilian service staff business identity database.

[0046] Furthermore, in the calling interface and permission setting module, the calling interface is an API or SDK;

[0047] The calling authority is the authority to add, delete, modify or query the basic identity database and the business identity database.

[0048] Furthermore, the identity authentication data acquisition module is specifically used to:

[0049] The server obtains the corresponding common field attributes and personalized field attributes from the identity authentication database based on the calling authority through the calling interface and the user unique identification type carried in the identity authentication request, and generates identity authentication data based on the common field attributes and personalized field attributes.

[0050] Furthermore, the identity authentication operation module is specifically used to:

[0051] The client receives the encrypted authentication data in real time, decrypts the encrypted authentication data into level-four encrypted data through the 3DES algorithm, swaps the number 9 and the letter F in the level-four encrypted data, performs a hexadecimal inverse conversion to obtain level-three encrypted data, decrypts the level-three encrypted data through the XTEA algorithm to obtain level-two encrypted data, divides the level-two encrypted data by the inverse of a preset division ratio and swaps the order to obtain level-one encrypted data, decrypts the level-one encrypted data into identity authentication data through the CAST-128 algorithm, and performs an identity authentication operation based on the identity authentication data.

[0052] The advantages of the present invention are:

[0053] 1. Collect and integrate user field attributes of different types of personnel through the server, obtain common field attributes and personalized field attributes, integrate each common field attribute into the pre-created basic identity database, integrate each personalized field attribute into each pre-created business identity database, associate each basic identity database with the business identity database to generate an identity authentication database, set the calling interface and calling authority of the identity authentication database; then the server receives the identity authentication request input by the client, verifies the identity authentication request, displays the verification window containing the mathematical formula through the visual interface, verifies the verification result input in the verification window, and then verifies the verification result through the calling interface and the identity authentication request. The authentication data is obtained from the authentication database based on the calling authority, the authentication data is encrypted into encrypted authentication data and fed back to the client, and finally the client decrypts the encrypted authentication data to obtain the authentication data, and performs the authentication operation based on the authentication data; that is, the authentication data of natural persons, legal persons and civil servants are integrated into the authentication database to form a unified authentication system to meet the authentication needs of different types of personnel, without the need to connect to the corresponding unified authentication platform one by one as in the traditional way, and the authentication data fed back to the client is encrypted, combined with the identity authentication request verification and the verification window verification, which ultimately greatly improves the convenience and security of identity authentication.

[0054] 2. The identity authentication request is set to carry ciphertext data and HMAC value; the HMAC value is obtained by performing HMAC calculation on the ciphertext data; the ciphertext data is the first encrypted data obtained by encrypting the user's unique identification, personnel type, device serial number, timestamp and account password through the Serpent algorithm, and the characters of the first encrypted data are controlled to shift rightward by a preset displacement to obtain the second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm; subsequently, the integrity can be checked by the HMAC value, the timeliness can be checked by the timestamp, and the legitimacy can be checked by the account password and the device serial number. In addition, multiple encryption methods are combined, and at least 8 security measures are taken before and after (Serpent algorithm, displacement, displacement direction, RC6 algorithm, HMAC calculation, device serial number, timestamp, account password) to prevent illegal identity authentication requests from obtaining identity authentication data, which greatly improves the security of identity authentication.

[0055] 3. Create a mathematical formula, set the calculation result of the mathematical formula, load the mathematical formula in the verification window in the form of a picture, divide and hide the mathematical formula in the verification window based on the blinds effect, add random stripes in the verification window, display the verification window through a visual interface, and verify the verification result entered in the verification window through the calculation result; that is, randomly transform the mathematical formula in the verification window, and avoid AI automatic recognition and calculation of the mathematical formula while ensuring that the human eye can recognize it normally. That is, after verifying the identity authentication request, it is further verified whether a real person is operating, which further improves the security of identity authentication.

[0056] 4. Encrypt the authentication data into first-level encrypted data through the CAST-128 algorithm, divide the first-level encrypted data into two-level encrypted data by a preset division ratio and swap the order to obtain second-level encrypted data, encrypt the second-level encrypted data into three-level encrypted data by the XTEA algorithm, convert the three-level encrypted data into hexadecimal, and swap the number 9 and the letter F to obtain the fourth-level encrypted data, encrypt the fourth-level encrypted data into encrypted authentication data by the 3DES algorithm, and feed the encrypted authentication data back to the client through the IPsec protocol; if the corresponding encryption algorithm or data transformation rule is not known, the encrypted authentication data cannot be cracked, and the IPsec protocol is a secure transmission protocol, and at least 7 security measures are taken before and after (CAST-128 algorithm, division ratio, XTEA algorithm, hexadecimal conversion, character swap, 3DES algorithm, IPsec protocol), which greatly improves the security of identity authentication data transmission, and thus greatly improves the security of identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The present invention will be further described below in conjunction with embodiments with reference to the accompanying drawings.

[0058] Figure 1 The present invention is a flowchart of a unified identity authentication method.

[0059] Figure 2 It is a structural schematic diagram of a unified identity authentication system of the present invention. DETAILED DESCRIPTION

[0060] The overall idea of ​​the technical solution in the embodiments of the present application is as follows: the identity authentication data of natural persons, legal persons and civil servants are integrated into the identity authentication database to form a unified identity authentication system to meet the identity authentication needs of different types of personnel. There is no need for a unified identity authentication platform that corresponds to each other as in the traditional way. The identity authentication data fed back to the client is encrypted, combined with the identity authentication request verification and the verification window verification, thereby improving the convenience and security of identity authentication.

[0061] Please refer to Figure 1 to Figure 2As shown, a preferred embodiment of a unified identity authentication method of the present invention includes the following steps:

[0062] Step S1, the server collects and integrates user field attributes of different personnel types, obtains common field attributes and personalized field attributes, integrates each of the common field attributes into a pre-created basic identity database, integrates each of the personalized field attributes into each pre-created business identity database, and associates each of the basic identity databases with the business identity database to generate an identity authentication database;

[0063] By generating the identity authentication database, it is possible to reduce duplicate construction, optimize the identity authentication service system, and improve the management efficiency of identity authentication;

[0064] Step S2: The server sets the calling interface and calling authority of the identity authentication database;

[0065] Step S3, the server receives the identity authentication request input by the client, verifies the identity authentication request, displays a verification window containing a mathematical formula through a visual interface, and verifies the verification result input in the verification window;

[0066] Step S4: The server obtains corresponding identity authentication data from the identity authentication database based on the calling authority through the calling interface and the identity authentication request;

[0067] Step S5: The server encrypts the identity authentication data into encrypted authentication data, and feeds the encrypted authentication data back to the client;

[0068] Step S6: The client decrypts the received encrypted authentication data to obtain identity authentication data, and performs an identity authentication operation based on the identity authentication data;

[0069] The present invention starts with the underlying data architecture model, abstractly integrates the identity authentication data of natural persons, legal persons, and civil servants, builds a unified identity authentication data base (identity authentication database), and integrates rich authentication methods, providing multiple authentication methods, while satisfying the authentication of natural persons, legal persons, and civil servants, solving the identity authentication problem across scenarios on the public and government sides.

[0070] The step S3 is specifically as follows:

[0071] The server receives the authentication request input by the client, which carries the ciphertext data and the HMAC value;

[0072] The encryption process of the ciphertext data is as follows: the user unique identifier, personnel type, device serial number, timestamp and account password are encrypted by the Serpent algorithm to obtain first encrypted data, each character of the first encrypted data is controlled to shift rightward by a preset displacement amount to obtain second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm to obtain ciphertext data;

[0073] The HMAC value is obtained by performing HMAC calculation on the ciphertext data;

[0074] The identity authentication request is set to carry ciphertext data and HMAC value; the HMAC value is obtained by performing HMAC calculation on the ciphertext data; the ciphertext data is the first encrypted data obtained by encrypting the user's unique identification, personnel type, device serial number, timestamp and account password through the Serpent algorithm, and the second encrypted data is obtained by controlling the right shift of each character of the first encrypted data through a preset displacement amount, and the second encrypted data is encrypted through the RC6 algorithm; subsequently, the integrity can be checked through the HMAC value, the timeliness can be checked through the timestamp, and the legitimacy can be checked through the account password and device serial number. In addition, multiple encryption methods are combined, and at least 8 security measures are taken before and after (Serpent algorithm, displacement amount, displacement direction, RC6 algorithm, HMAC calculation, device serial number, timestamp, account password) to prevent illegal identity authentication requests from obtaining identity authentication data, which greatly improves the security of identity authentication.

[0075] The server parses the identity authentication request to obtain ciphertext data and an HMAC value, performs integrity check on the ciphertext data using the HMAC value, decrypts the ciphertext data using the RC6 algorithm to obtain second encrypted data, controls each character of the second encrypted data to shift leftward using a preset displacement amount to obtain first encrypted data, decrypts the first encrypted data using the Serpent algorithm to obtain a user unique identifier, personnel type, device serial number, timestamp, and account password; performs time validity check on the timestamp, performs matching check on the account password using a preset password table, and then performs legitimacy check on the device serial number using a preset device management table;

[0076] The server creates a mathematical formula, sets a calculation result of the mathematical formula, loads the mathematical formula in the form of an image into a verification window, divides and hides the mathematical formula in the verification window based on a blinds effect, adds random stripes into the verification window, displays the verification window through a visual interface, and verifies the verification result input into the verification window through the calculation result;

[0077] By creating a mathematical formula, setting the calculation result of the mathematical formula, loading the mathematical formula in the verification window in the form of a picture, dividing and hiding the mathematical formula in the verification window based on the blinds effect, adding random stripes in the verification window, displaying the verification window through a visual interface, and verifying the verification result input in the verification window through the calculation result; that is, randomly transforming the mathematical formula in the verification window, while ensuring that the human eye can recognize it normally, avoiding AI automatic recognition and calculation of the mathematical formula, that is, after verifying the identity authentication request, further verifying whether a real person is operating, further improving the security of identity authentication.

[0078] The step S5 is specifically as follows:

[0079] The server encrypts the authentication data into first-level encrypted data through the CAST-128 algorithm, divides the first-level encrypted data according to a preset division ratio and swaps the order to obtain second-level encrypted data, encrypts the second-level encrypted data through the XTEA algorithm to obtain third-level encrypted data, converts the third-level encrypted data into hexadecimal, swaps the number 9 and the letter F to obtain fourth-level encrypted data, encrypts the fourth-level encrypted data into encrypted authentication data through the 3DES algorithm, and feeds back the encrypted authentication data to the client through the IPsec protocol.

[0080] The authentication data is encrypted into first-level encrypted data through the CAST-128 algorithm, the first-level encrypted data is divided according to a preset division ratio and the order is swapped to obtain second-level encrypted data, the second-level encrypted data is encrypted through the XTEA algorithm to obtain third-level encrypted data, the third-level encrypted data is converted into hexadecimal, and the number 9 and the letter F are swapped to obtain fourth-level encrypted data, the fourth-level encrypted data is encrypted into encrypted authentication data through the 3DES algorithm, and the encrypted authentication data is fed back to the client through the IPsec protocol; if the corresponding encryption algorithm or data transformation rule is not known, the encrypted authentication data cannot be cracked, and the IPsec protocol is a secure transmission protocol, and at least 7 security measures are taken before and after (CAST-128 algorithm, division ratio, XTEA algorithm, hexadecimal conversion, character swap, 3DES algorithm, IPsec protocol), which greatly improves the security of identity authentication data transmission, and thus greatly improves the security of identity authentication.

[0081] In step S1, the personnel type is a natural person, a legal person or a civilian service staff; in specific implementation, different identity authentication methods can be set for different personnel types, and multi-factor authentication is supported;

[0082] The business identity database includes a natural person business identity database, a legal person business identity database and a civilian service staff business identity database.

[0083] In the step S2, the calling interface is an API or SDK;

[0084] The calling authority is the authority to add, delete, modify or query the basic identity database and the business identity database.

[0085] The step S4 is specifically as follows:

[0086] The server obtains the corresponding common field attributes and personalized field attributes from the identity authentication database based on the calling authority through the calling interface and the user unique identification type carried in the identity authentication request, and generates identity authentication data based on the common field attributes and personalized field attributes.

[0087] The step S6 is specifically as follows:

[0088] The client receives the encrypted authentication data in real time, decrypts the encrypted authentication data into level-four encrypted data through the 3DES algorithm, swaps the number 9 and the letter F in the level-four encrypted data, performs a hexadecimal inverse conversion to obtain level-three encrypted data, decrypts the level-three encrypted data through the XTEA algorithm to obtain level-two encrypted data, divides the level-two encrypted data by the inverse of a preset division ratio and swaps the order to obtain level-one encrypted data, decrypts the level-one encrypted data into identity authentication data through the CAST-128 algorithm, and performs an identity authentication operation based on the identity authentication data.

[0089] A preferred embodiment of a unified identity authentication system of the present invention includes the following modules:

[0090] An identity authentication database generation module is used for the server to collect and integrate user field attributes of different personnel types, obtain common field attributes and personalized field attributes, integrate each of the common field attributes into a pre-created basic identity database, integrate each of the personalized field attributes into each pre-created business identity database, and associate each of the basic identity databases with the business identity database to generate an identity authentication database;

[0091] By generating the identity authentication database, it is possible to reduce duplicate construction, optimize the identity authentication service system, and improve the management efficiency of identity authentication;

[0092] A calling interface and authority setting module, used for the server to set the calling interface and calling authority of the identity authentication database;

[0093] The identity authentication request verification module is used for the server to receive the identity authentication request input by the client, and after verifying the identity authentication request, a verification window containing a mathematical formula is displayed through a visual interface to verify the verification result input in the verification window;

[0094] An identity authentication data acquisition module is used for the server to obtain corresponding identity authentication data from the identity authentication database based on the calling authority through the calling interface and the identity authentication request;

[0095] An encrypted authentication data feedback module is used for the server to encrypt the identity authentication data into encrypted authentication data and feed the encrypted authentication data back to the client;

[0096] An identity authentication operation module, used for the client to decrypt the received encrypted authentication data to obtain identity authentication data, and perform an identity authentication operation based on the identity authentication data;

[0097] The present invention starts with the underlying data architecture model, abstractly integrates the identity authentication data of natural persons, legal persons, and civil servants, builds a unified identity authentication data base (identity authentication database), and integrates rich authentication methods, providing multiple authentication methods, while satisfying the authentication of natural persons, legal persons, and civil servants, solving the identity authentication problem across scenarios on the public and government sides.

[0098] The identity authentication request verification module is specifically used for:

[0099] The server receives the authentication request input by the client, which carries the ciphertext data and the HMAC value;

[0100] The encryption process of the ciphertext data is as follows: the user unique identifier, personnel type, device serial number, timestamp and account password are encrypted by the Serpent algorithm to obtain first encrypted data, each character of the first encrypted data is controlled to shift rightward by a preset displacement amount to obtain second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm to obtain ciphertext data;

[0101] The HMAC value is obtained by performing HMAC calculation on the ciphertext data;

[0102] The identity authentication request is set to carry ciphertext data and HMAC value; the HMAC value is obtained by performing HMAC calculation on the ciphertext data; the ciphertext data is the first encrypted data obtained by encrypting the user's unique identification, personnel type, device serial number, timestamp and account password through the Serpent algorithm, and the second encrypted data is obtained by controlling the right shift of each character of the first encrypted data through a preset displacement amount, and the second encrypted data is encrypted through the RC6 algorithm; subsequently, the integrity can be checked through the HMAC value, the timeliness can be checked through the timestamp, and the legitimacy can be checked through the account password and device serial number. In addition, multiple encryption methods are combined, and at least 8 security measures are taken before and after (Serpent algorithm, displacement amount, displacement direction, RC6 algorithm, HMAC calculation, device serial number, timestamp, account password) to prevent illegal identity authentication requests from obtaining identity authentication data, which greatly improves the security of identity authentication.

[0103] The server parses the identity authentication request to obtain ciphertext data and an HMAC value, performs integrity check on the ciphertext data using the HMAC value, decrypts the ciphertext data using the RC6 algorithm to obtain second encrypted data, controls each character of the second encrypted data to shift leftward using a preset displacement amount to obtain first encrypted data, decrypts the first encrypted data using the Serpent algorithm to obtain a user unique identifier, personnel type, device serial number, timestamp, and account password; performs time validity check on the timestamp, performs matching check on the account password using a preset password table, and then performs legitimacy check on the device serial number using a preset device management table;

[0104] The server creates a mathematical formula, sets a calculation result of the mathematical formula, loads the mathematical formula in the form of an image into a verification window, divides and hides the mathematical formula in the verification window based on a blinds effect, adds random stripes into the verification window, displays the verification window through a visual interface, and verifies the verification result input into the verification window through the calculation result;

[0105] By creating a mathematical formula, setting the calculation result of the mathematical formula, loading the mathematical formula in the verification window in the form of a picture, dividing and hiding the mathematical formula in the verification window based on the blinds effect, adding random stripes in the verification window, displaying the verification window through a visual interface, and verifying the verification result input in the verification window through the calculation result; that is, randomly transforming the mathematical formula in the verification window, while ensuring that the human eye can recognize it normally, avoiding AI automatic recognition and calculation of the mathematical formula, that is, after verifying the identity authentication request, further verifying whether a real person is operating, further improving the security of identity authentication.

[0106] The encrypted authentication data feedback module is specifically used for:

[0107] The server encrypts the authentication data into first-level encrypted data through the CAST-128 algorithm, divides the first-level encrypted data according to a preset division ratio and swaps the order to obtain second-level encrypted data, encrypts the second-level encrypted data through the XTEA algorithm to obtain third-level encrypted data, converts the third-level encrypted data into hexadecimal, swaps the number 9 and the letter F to obtain fourth-level encrypted data, encrypts the fourth-level encrypted data into encrypted authentication data through the 3DES algorithm, and feeds back the encrypted authentication data to the client through the IPsec protocol.

[0108] The authentication data is encrypted into first-level encrypted data through the CAST-128 algorithm, the first-level encrypted data is divided according to a preset division ratio and the order is swapped to obtain second-level encrypted data, the second-level encrypted data is encrypted through the XTEA algorithm to obtain third-level encrypted data, the third-level encrypted data is converted into hexadecimal, and the number 9 and the letter F are swapped to obtain fourth-level encrypted data, the fourth-level encrypted data is encrypted into encrypted authentication data through the 3DES algorithm, and the encrypted authentication data is fed back to the client through the IPsec protocol; if the corresponding encryption algorithm or data transformation rule is not known, the encrypted authentication data cannot be cracked, and the IPsec protocol is a secure transmission protocol, and at least 7 security measures are taken before and after (CAST-128 algorithm, division ratio, XTEA algorithm, hexadecimal conversion, character swap, 3DES algorithm, IPsec protocol), which greatly improves the security of identity authentication data transmission, and thus greatly improves the security of identity authentication.

[0109] In the identity authentication database generation module, the personnel type is a natural person, a legal person or a civilian service staff; in specific implementation, different identity authentication methods can be set for different personnel types, supporting multi-factor authentication;

[0110] The business identity database includes a natural person business identity database, a legal person business identity database and a civilian service staff business identity database.

[0111] In the calling interface and permission setting module, the calling interface is an API or SDK;

[0112] The calling authority is the authority to add, delete, modify or query the basic identity database and the business identity database.

[0113] The identity authentication data acquisition module is specifically used for:

[0114] The server obtains the corresponding common field attributes and personalized field attributes from the identity authentication database based on the calling authority through the calling interface and the user unique identification type carried in the identity authentication request, and generates identity authentication data based on the common field attributes and personalized field attributes.

[0115] The identity authentication operation module is specifically used for:

[0116] The client receives the encrypted authentication data in real time, decrypts the encrypted authentication data into level-four encrypted data through the 3DES algorithm, swaps the number 9 and the letter F in the level-four encrypted data, performs a hexadecimal inverse conversion to obtain level-three encrypted data, decrypts the level-three encrypted data through the XTEA algorithm to obtain level-two encrypted data, divides the level-two encrypted data by the inverse of a preset division ratio and swaps the order to obtain level-one encrypted data, decrypts the level-one encrypted data into identity authentication data through the CAST-128 algorithm, and performs an identity authentication operation based on the identity authentication data.

[0117] In summary, the advantages of the present invention are:

[0118] 1. Collect and integrate user field attributes of different types of personnel through the server, obtain common field attributes and personalized field attributes, integrate each common field attribute into the pre-created basic identity database, integrate each personalized field attribute into each pre-created business identity database, associate each basic identity database with the business identity database to generate an identity authentication database, set the calling interface and calling authority of the identity authentication database; then the server receives the identity authentication request input by the client, verifies the identity authentication request, displays the verification window containing the mathematical formula through the visual interface, verifies the verification result input in the verification window, and then verifies the verification result through the calling interface and the identity authentication request. The authentication data is obtained from the authentication database based on the calling authority, the authentication data is encrypted into encrypted authentication data and fed back to the client, and finally the client decrypts the encrypted authentication data to obtain the authentication data, and performs the authentication operation based on the authentication data; that is, the authentication data of natural persons, legal persons and civil servants are integrated into the authentication database to form a unified authentication system to meet the authentication needs of different types of personnel, without the need to connect to the corresponding unified authentication platform one by one as in the traditional way, and the authentication data fed back to the client is encrypted, combined with the identity authentication request verification and the verification window verification, which ultimately greatly improves the convenience and security of identity authentication.

[0119] 2. The identity authentication request is set to carry ciphertext data and HMAC value; the HMAC value is obtained by performing HMAC calculation on the ciphertext data; the ciphertext data is the first encrypted data obtained by encrypting the user's unique identification, personnel type, device serial number, timestamp and account password through the Serpent algorithm, and the characters of the first encrypted data are controlled to shift rightward by a preset displacement to obtain the second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm; subsequently, the integrity can be checked by the HMAC value, the timeliness can be checked by the timestamp, and the legitimacy can be checked by the account password and the device serial number. In addition, multiple encryption methods are combined, and at least 8 security measures are taken before and after (Serpent algorithm, displacement, displacement direction, RC6 algorithm, HMAC calculation, device serial number, timestamp, account password) to prevent illegal identity authentication requests from obtaining identity authentication data, which greatly improves the security of identity authentication.

[0120] 3. Create a mathematical formula, set the calculation result of the mathematical formula, load the mathematical formula in the verification window in the form of a picture, divide and hide the mathematical formula in the verification window based on the blinds effect, add random stripes in the verification window, display the verification window through a visual interface, and verify the verification result entered in the verification window through the calculation result; that is, randomly transform the mathematical formula in the verification window, and avoid AI automatic recognition and calculation of the mathematical formula while ensuring that the human eye can recognize it normally. That is, after verifying the identity authentication request, it is further verified whether a real person is operating, which further improves the security of identity authentication.

[0121] 4. Encrypt the authentication data into first-level encrypted data through the CAST-128 algorithm, divide the first-level encrypted data into two-level encrypted data by a preset division ratio and swap the order to obtain second-level encrypted data, encrypt the second-level encrypted data into three-level encrypted data by the XTEA algorithm, convert the three-level encrypted data into hexadecimal, and swap the number 9 and the letter F to obtain the fourth-level encrypted data, encrypt the fourth-level encrypted data into encrypted authentication data by the 3DES algorithm, and feed the encrypted authentication data back to the client through the IPsec protocol; if the corresponding encryption algorithm or data transformation rule is not known, the encrypted authentication data cannot be cracked, and the IPsec protocol is a secure transmission protocol, and at least 7 security measures are taken before and after (CAST-128 algorithm, division ratio, XTEA algorithm, hexadecimal conversion, character swap, 3DES algorithm, IPsec protocol), which greatly improves the security of identity authentication data transmission, and thus greatly improves the security of identity authentication.

[0122] Although the specific implementation modes of the present invention are described above, those skilled in the art should understand that the specific implementation modes described are only illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A unified identity authentication method, characterized in that: The steps include: Step S1, the server collects and integrates user field attributes of different personnel types, obtains common field attributes and personalized field attributes, integrates each of the common field attributes into a pre-created basic identity database, integrates each of the personalized field attributes into each pre-created business identity database, and associates each of the basic identity databases with the business identity database to generate an identity authentication database; Step S2: The server sets the calling interface and calling authority of the identity authentication database; Step S3, the server receives the identity authentication request input by the client, verifies the identity authentication request, displays a verification window containing a mathematical formula through a visual interface, and verifies the verification result input in the verification window; Step S4: The server obtains corresponding identity authentication data from the identity authentication database based on the calling authority through the calling interface and the identity authentication request; Step S5: The server encrypts the identity authentication data into encrypted authentication data, and feeds the encrypted authentication data back to the client; Step S6: The client decrypts the received encrypted authentication data to obtain identity authentication data, and performs an identity authentication operation based on the identity authentication data; The step S3 is specifically as follows: The server receives the authentication request input by the client, which carries the ciphertext data and the HMAC value; The encryption process of the ciphertext data is as follows: the user unique identifier, personnel type, device serial number, timestamp and account password are encrypted by the Serpent algorithm to obtain first encrypted data, each character of the first encrypted data is controlled to shift rightward by a preset displacement amount to obtain second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm to obtain ciphertext data; The HMAC value is obtained by performing HMAC calculation on the ciphertext data; The server parses the identity authentication request to obtain ciphertext data and an HMAC value, performs integrity check on the ciphertext data using the HMAC value, decrypts the ciphertext data using the RC6 algorithm to obtain second encrypted data, controls each character of the second encrypted data to shift leftwards using a preset shift amount to obtain first encrypted data, and decrypts the first encrypted data using the Serpent algorithm to obtain a user unique identifier, personnel type, device serial number, timestamp, and account password; After the time stamp is used for time validity verification, the account password is matched and verified through the preset password table, and then the legitimacy of the device serial number is verified through the preset device management table; The server creates a mathematical formula, sets a calculation result of the mathematical formula, loads the mathematical formula in the form of an image into a verification window, divides and hides the mathematical formula in the verification window based on a blinds effect, adds random stripes into the verification window, displays the verification window through a visual interface, and verifies the verification result input into the verification window through the calculation result; The step S5 is specifically as follows: The server encrypts the authentication data into first-level encrypted data through the CAST-128 algorithm, divides the first-level encrypted data according to a preset division ratio and swaps the order to obtain second-level encrypted data, encrypts the second-level encrypted data through the XTEA algorithm to obtain third-level encrypted data, converts the third-level encrypted data into hexadecimal, swaps the number 9 and the letter F to obtain fourth-level encrypted data, encrypts the fourth-level encrypted data into encrypted authentication data through the 3DES algorithm, and feeds back the encrypted authentication data to the client through the IPsec protocol.

2. A unified identity authentication method as claimed in claim 1, characterized in that: In step S1, the personnel type is a natural person, a legal person or a civilian service staff; The business identity database includes a natural person business identity database, a legal person business identity database and a civilian service staff business identity database.

3. A unified identity authentication method as claimed in claim 1, characterized in that: In the step S2, the calling interface is an API or SDK; The calling authority is the authority to add, delete, modify or query the basic identity database and the business identity database.

4. A unified identity authentication method as claimed in claim 1, characterized in that: The step S4 is specifically as follows: The server obtains the corresponding common field attributes and personalized field attributes from the identity authentication database based on the calling authority through the calling interface and the user unique identification type carried in the identity authentication request, and generates identity authentication data based on the common field attributes and personalized field attributes.

5. A unified identity authentication method as claimed in claim 1, characterized in that: The step S6 is specifically as follows: The client receives the encrypted authentication data in real time, decrypts the encrypted authentication data into level-four encrypted data through the 3DES algorithm, swaps the number 9 and the letter F in the level-four encrypted data, performs a hexadecimal inverse conversion to obtain level-three encrypted data, decrypts the level-three encrypted data through the XTEA algorithm to obtain level-two encrypted data, divides the level-two encrypted data by the inverse of a preset division ratio and swaps the order to obtain level-one encrypted data, decrypts the level-one encrypted data into identity authentication data through the CAST-128 algorithm, and performs an identity authentication operation based on the identity authentication data.

6. A unified identity authentication system, characterized in that: Includes the following modules: An identity authentication database generation module is used for the server to collect and integrate user field attributes of different personnel types, obtain common field attributes and personalized field attributes, integrate each of the common field attributes into a pre-created basic identity database, integrate each of the personalized field attributes into each pre-created business identity database, and associate each of the basic identity databases with the business identity database to generate an identity authentication database; A calling interface and authority setting module, used for the server to set the calling interface and calling authority of the identity authentication database; The identity authentication request verification module is used for the server to receive the identity authentication request input by the client, and after verifying the identity authentication request, a verification window containing a mathematical formula is displayed through a visual interface to verify the verification result input in the verification window; An identity authentication data acquisition module is used for the server to obtain corresponding identity authentication data from the identity authentication database based on the calling authority through the calling interface and the identity authentication request; An encrypted authentication data feedback module is used for the server to encrypt the identity authentication data into encrypted authentication data and feed the encrypted authentication data back to the client; An identity authentication operation module, used for the client to decrypt the received encrypted authentication data to obtain identity authentication data, and perform an identity authentication operation based on the identity authentication data; The identity authentication request verification module is specifically used for: The server receives the authentication request input by the client, which carries the ciphertext data and the HMAC value; The encryption process of the ciphertext data is as follows: the user unique identifier, personnel type, device serial number, timestamp and account password are encrypted by the Serpent algorithm to obtain first encrypted data, each character of the first encrypted data is controlled to shift rightward by a preset displacement amount to obtain second encrypted data, and the second encrypted data is encrypted by the RC6 algorithm to obtain ciphertext data; The HMAC value is obtained by performing HMAC calculation on the ciphertext data; The server parses the identity authentication request to obtain ciphertext data and an HMAC value, performs integrity check on the ciphertext data using the HMAC value, decrypts the ciphertext data using the RC6 algorithm to obtain second encrypted data, controls each character of the second encrypted data to shift leftwards using a preset shift amount to obtain first encrypted data, and decrypts the first encrypted data using the Serpent algorithm to obtain a user unique identifier, personnel type, device serial number, timestamp, and account password; After the time stamp is used for time validity verification, the account password is matched and verified through the preset password table, and then the legitimacy of the device serial number is verified through the preset device management table; The server creates a mathematical formula, sets a calculation result of the mathematical formula, loads the mathematical formula in the form of an image into a verification window, divides and hides the mathematical formula in the verification window based on a blinds effect, adds random stripes into the verification window, displays the verification window through a visual interface, and verifies the verification result input into the verification window through the calculation result; The encrypted authentication data feedback module is specifically used for: The server encrypts the authentication data into first-level encrypted data through the CAST-128 algorithm, divides the first-level encrypted data according to a preset division ratio and swaps the order to obtain second-level encrypted data, encrypts the second-level encrypted data through the XTEA algorithm to obtain third-level encrypted data, converts the third-level encrypted data into hexadecimal, swaps the number 9 and the letter F to obtain fourth-level encrypted data, encrypts the fourth-level encrypted data into encrypted authentication data through the 3DES algorithm, and feeds back the encrypted authentication data to the client through the IPsec protocol.

7. A unified identity authentication system as claimed in claim 6, characterized in that: In the identity authentication database generation module, the personnel type is a natural person, a legal person or a civilian service staff; The business identity database includes a natural person business identity database, a legal person business identity database and a civilian service staff business identity database.

8. A unified identity authentication system as claimed in claim 6, characterized in that: In the calling interface and permission setting module, the calling interface is an API or SDK; The calling authority is the authority to add, delete, modify or query the basic identity database and the business identity database.

9. A unified identity authentication system as claimed in claim 6, characterized in that: The identity authentication data acquisition module is specifically used for: The server obtains the corresponding common field attributes and personalized field attributes from the identity authentication database based on the calling authority through the calling interface and the user unique identification type carried in the identity authentication request, and generates identity authentication data based on the common field attributes and personalized field attributes.

10. A unified identity authentication system as claimed in claim 6, characterized in that: The identity authentication operation module is specifically used for: The client receives the encrypted authentication data in real time, decrypts the encrypted authentication data into level-four encrypted data through the 3DES algorithm, swaps the number 9 and the letter F in the level-four encrypted data, performs a hexadecimal inverse conversion to obtain level-three encrypted data, decrypts the level-three encrypted data through the XTEA algorithm to obtain level-two encrypted data, divides the level-two encrypted data by the inverse of a preset division ratio and swaps the order to obtain level-one encrypted data, decrypts the level-one encrypted data into identity authentication data through the CAST-128 algorithm, and performs an identity authentication operation based on the identity authentication data.

Images