Unified identity authentication device for urban railway dispatching command system

Abstract

The invention relates to a unified identity authentication device for a city railway dispatching command system, which comprises a unified identity authentication system, a unified identity authentication interface machine, a communication server, a dispatching database, a communication front-end processor and a plurality of CTC terminals, the CTC terminal comprises a dispatching center CTC terminal and a vehicle service CTC terminal, the unified identity authentication system is connected with the communication server through the unified identity authentication interface machine, the communication server is connected with the dispatching database and the communication front-end processor, the dispatching database is connected with the dispatching center CTC terminal, and the communication front-end processor is connected with the vehicle service CTC terminal; wherein in the docking process of the unified identity authentication system and the CTC terminal, an authentication mode is switched to a basic authentication mode, a multi-factor authentication mode, a super user authentication mode or a local backup authentication mode according to the communication connection condition and the user account type. Compared with the prior art, the system has the advantages of high security level, high management efficiency and high response reliability.

Description

Technical Field

[0001] The invention relates to the field of railway dispatching, and in particular to a unified identity authentication device for an urban railway dispatching command system. Background Art

[0002] As an important transportation infrastructure, the safety and efficiency of the urban rail dispatching and command system directly affect the smoothness and safety of railway transportation. With the development of information technology and the increasing complexity of network attacks, ensuring system security has become a challenge that needs to be solved urgently. Among them, information security level protection, as a key strategy, is crucial to ensure the security, integrity and availability of information systems.

[0003] Information security level protection requirements refer to a series of security measures and requirements formulated according to the importance and risk level of information systems. These requirements are usually stipulated by national or industry standards, and are intended to ensure that information systems can meet certain security standards during design, implementation and operation, and effectively prevent various internal and external security threats and risks. Therefore, the identity authentication device of the new generation of urban rail dispatching and command system needs to meet high security level protection requirements and introduce more advanced authentication methods to improve security and anti-attack capabilities.

[0004] At present, the identity authentication system of the dispatching and command system has the problem of insufficient permission management granularity in practical applications. Traditional identity authentication systems usually adopt role-based permission management (RBAC), but the accuracy of permission control is limited. This makes it difficult to achieve precise control of different user roles in complex operating environments, and the problem of excessive or insufficient permissions may occur, affecting system security and management efficiency.

[0005] At the same time, most existing identity authentication devices still rely on single verification or simple passwords, which are vulnerable to security threats such as password guessing and man-in-the-middle attacks. Especially in the urban rail dispatching system with high real-time requirements, account theft or password leakage may lead to serious security vulnerabilities and service interruptions.

[0006] After searching, the Chinese invention patent application CN117473531A provides a user access method and device based on unified identity authentication, which provides an intermediate platform to help users flexibly perform business system interface access control based on pre-set user role permissions, focusing on access initial authentication and user identity authentication information generation. When the communication connection is abnormal, it is difficult to perform user authentication safely and efficiently, and it is difficult to meet the complexity and real-time requirements of the urban rail dispatching system without considering real-time data synchronization.

[0007] The complexity and real-time requirements of the urban rail dispatching system require that its identity authentication device must be able to process a large number of authentication requests in a very short time. Rapid response and high reliability are not only related to operational efficiency, but also directly affect the continued safety of dispatching and command work and the overall stability of the system. Summary of the invention

[0008] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a unified identity authentication device for the urban railway dispatching and command system with high security level, high efficiency management and high reliability response.

[0009] The purpose of the present invention can be achieved by the following technical solutions:

[0010] A unified identity authentication device for an urban rail dispatching and command system, comprising:

[0011] Multiple CTC terminals, including a dispatch center CTC terminal for providing a user login interactive interface, and a train service CTC terminal storing user information local files for managing station internal user authentication and access control;

[0012] Unified identity authentication system, used to centrally manage user authentication and permission configuration of all dispatch centers and stations;

[0013] The unified identity authentication interface machine communicates with the unified identity authentication system and the communication server respectively, and is used to process the data sent by the communication server and feed back the authentication result to the CTC terminal of the dispatch center;

[0014] Communication server, used to forward authentication data and user information;

[0015] The dispatch database is deployed in the dispatch center to store user information and communicate with the unified identity authentication system and CTC terminals in each dispatch center through the communication server;

[0016] Communication front-end, used to process communication requests with train CTC terminals and communication servers;

[0017] During the docking process between the unified identity authentication system and the CTC terminal, the authentication mode is switched to basic authentication, multi-factor authentication, super user authentication or local backup authentication mode according to the communication connection status and the user account type; if the communication connection is abnormal, it is switched to the local backup authentication mode; if the communication connection is normal and the user account type is a super user, it is directly switched to the super user authentication mode; if the communication connection is normal and the user account type is an ordinary user, it is switched to the basic authentication or multi-factor authentication mode according to the user authority.

[0018] Preferably, the unified identity authentication system is independently set up in the CTC network, isolated by a firewall, and is reachable by routes to all stations and central equipment of the CTC.

[0019] Preferably, the unified identity authentication interface machine is provided with a socket interface supporting the TCP protocol and a restful interface supporting the https protocol.

[0020] Preferably, the unified identity authentication system adopts a two-level management mechanism to manage user accounts, including:

[0021] Level 1 administrators are responsible for managing user accounts in the entire unified identity authentication system, and for establishing accounts and configuring account permissions for level 2 administrators based on business needs; and

[0022] Secondary administrators, including station administrators and center administrators, are responsible for establishing and managing business accounts within their jurisdiction.

[0023] Preferably, after the unified identity authentication system establishes a connection with the CTC terminal or disconnects and reconnects, the unified identity authentication system actively refreshes regularly and actively updates all user information to the CTC terminal interface in units of user ID; when the user information corresponding to the user ID changes, the unified identity authentication system actively updates all user information of the corresponding user ID.

[0024] Preferably, when the user information corresponding to the user ID changes, the unified identity authentication system actively updates all user information corresponding to the user ID, specifically:

[0025] The unified identity authentication system sends the user entity ID to the communication server deployed in the dispatching center through the unified identity authentication interface machine, and the data flow is sent to the communication server deployed in the dispatching center and the communication front-end deployed in the station through the communication server;

[0026] After receiving the user entity ID, the communication server updates the user password. The user entity ID involved includes the users of the current dispatch center. After receiving the user entity ID, the communication front-end deployed at the station transmits it to the train service CTC terminal and saves the updated user password. The user entity ID involved includes the users of the entire station.

[0027] After the communication server and the vehicle service CTC terminal complete the user information update, the receipt information is transmitted to the unified identity authentication interface machine through the communication server and then returned to the unified identity authentication system to complete the update.

[0028] Preferably, the super user authentication mode is enabled when there is no account information in the dispatch database or the local file storing user information in the vehicle service CTC terminal is empty;

[0029] The super user authentication mode completes the login by verifying the password information of the dispatch database connection database and the super user identity information in the local file of the train service CTC terminal.

[0030] Preferably, the communication connection abnormality determination standard satisfies at least one of the following conditions:

[0031] The communication between the unified identity authentication interface machine and the unified identity authentication system is interrupted or the connection times out;

[0032] The communication between the dispatch database and the unified identity authentication interface machine is interrupted or the connection times out;

[0033] The communication between the communication front-end and the unified identity authentication interface machine is interrupted or the connection times out;

[0034] The communication between the train service CTC terminal and the unified identity authentication interface machine is interrupted or the connection times out.

[0035] Preferably, the authentication process in the local backup authentication mode is:

[0036] Central user login authentication: The dispatch database calls the user information in the terminal database it maintains for verification. The connection between the dispatch database and the terminal database must be normal, otherwise the local backup login will fail.

[0037] Station user login authentication: Check the user information file maintained locally on the train service CTC terminal. If the interface authentication is passed, the login is completed. Otherwise, the authentication will time out and return to the original login page.

[0038] Preferably, the authentication process in the basic authentication mode is specifically as follows:

[0039] The user initiates a login request at the CTC terminal, and the CTC terminal sends the user's login request to the communication server;

[0040] The communication server receives the request from the CTC terminal, and after the communication connection is verified normally, determines that the authentication method is the basic authentication method;

[0041] The communication server routes the authentication request to the unified identity authentication system through the unified identity authentication system interface according to the selected basic authentication. The unified identity authentication system processes the authentication request, verifies whether the basic authentication is passed, generates a login receipt message, and sends the login receipt message back to the communication server.

[0042] The communication server receives the authentication result from the unified identity authentication system and sends a receipt message back to the CTC terminal.

[0043] Preferably, the authentication process under the multi-factor authentication mode includes two cyclic authentications. The first cyclic authentication is the receipt information sent to the terminal by the unified identity authentication system agreeing to enable multi-factor authentication. The second cyclic authentication is that after the user receives the receipt message, he enters the multi-factor authentication data and sends it to the unified identity authentication interface machine for verification again through the communication server. After the authentication is successful, the second receipt information is sent to the user to indicate that the login is successful.

[0044] Preferably, the method further includes: when the receipt information is received for a timeout, switching to a local backup authentication mode.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] (1) During the connection between the unified identity authentication system and the CTC terminal, the authentication mode is switched to basic authentication, multi-factor authentication, super user authentication or local backup authentication mode according to the communication connection status and user account type. When the system fails or fails, it can ensure that users can log in to the system through local backup authentication or super user authentication methods, thereby ensuring business continuity and meeting information security level protection requirements.

[0047] (2) A two-level management mechanism is used to manage user accounts and configure and require account permissions. By setting up first-level and second-level administrators, effective management of different levels and business units can be achieved. As the business expands, new administrators and users can be flexibly added without large-scale system reconstruction, thus maintaining system stability.

[0048] (3) The present invention allows the main administrator to configure account permissions for station administrators and center administrators according to project requirements, ensuring the reasonable allocation and use of permissions. At the same time, it can record all login attempts and administrator operations to facilitate post-audit and monitoring, thereby enhancing the traceability of the system.

[0049] (4) The multi-factor authentication mechanism can effectively prevent security risks caused by password leakage. Through time verification, illegal login attempts can be more accurately identified and blocked, thereby reducing the impact and pressure on the normal login process. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic diagram of the overall architecture of a unified identity authentication device for the urban rail dispatching and command system;

[0051] Figure 2 It is the information flow diagram of the authentication system updating user information;

[0052] Figure 3 It is a basic authentication information flow diagram;

[0053] Figure 4It is a multi-factor authentication information flow diagram;

[0054] Figure 5 It is a basic authentication flow chart;

[0055] Figure 6 It is a multi-factor authentication flow chart. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0057] Example

[0058] This embodiment provides a unified identity authentication device for the urban rail dispatching command system. The system architecture is as follows: Figure 1 As shown, including:

[0059] Multiple CTC terminals, including a dispatch center CTC terminal for providing a user login interaction interface, and a train service CTC terminal that stores local user information files for managing user authentication and access control within the station; the dispatch center CTC terminal includes an operation diagram terminal, a station yard diagram terminal, a TPMS terminal, an EMUS terminal, and a CPMS terminal, etc., which are used to provide a user interaction interface, allow users to log in, and display necessary operation information; the train service CTC terminal (STPC) stores local user information files and is used to manage user authentication and access control within the station.

[0060] The unified identity authentication system IAM is used to centrally manage user authentication and permission configuration of all dispatch centers and stations. It is independently set up in the CTC network and isolated by a firewall. All CTC stations and central equipment are reachable by routing. It communicates with the dispatch center CTC terminal, dispatch database SDB, communication front-end BL and train CTC terminal through the communication server to realize user login authentication, permission management and user information update.

[0061] The unified identity authentication interface machine IAMi serves as an intermediate interface in the user authentication process, communicating with the unified identity authentication system and the communication server respectively. It has a socket interface that supports the TCP protocol and a restful interface that supports the https protocol. It is used to process the data sent from the communication server and feed back the authentication results to the CTC terminal of the dispatch center, thereby realizing efficient communication with the unified identity authentication system.

[0062] The communication server Commsvr is used to forward authentication data and user information between the unified identity authentication system IAM, the dispatch database SDB, and the dispatch center CTC terminal, supporting real-time data synchronization and abnormal status processing of the system.

[0063] The dispatch database SDB is deployed in the dispatch center to store user information and communicate with the unified identity authentication system and CTC terminals in each dispatch center through the communication server;

[0064] Communication front-end BL, used to process communication requests with train service CTC terminals and communication servers;

[0065] During the connection between the unified identity authentication system and the CTC terminal, the authentication mode is switched to basic authentication, multi-factor authentication, super user authentication or local backup authentication mode according to the communication connection status and user account type; among them, if the communication connection is abnormal, it is switched to local backup authentication mode; if the communication connection is normal and the user account type is a super user, it is directly switched to super user authentication mode; if the communication connection is normal and the user account type is an ordinary user, it is switched to basic authentication or multi-factor authentication mode according to user authority.

[0066] Specifically, the unified identity authentication system IAM adopts a multi-level management mechanism to configure and require account permissions, meet the requirements of information security level protection, and further ensure the information security protection capabilities of the urban rail dispatching and command system. This embodiment is described in detail with a two-level management mechanism, specifically including: a first-level administrator (main administrator), used for the management and maintenance of the entire system, can manage the second-level administrator; the second-level administrator is used to manage business users of different business units. According to project needs, the main administrator of the system establishes accounts for each station administrator and center administrator and configures account permissions. Each station administrator and center administrator establishes the authentication accounts required within their jurisdiction, and the business users of each station and center are isolated from each other. The unified identity authentication system IAM controls and verifies the legitimacy of user names and passwords. When station administrators and center administrators add, modify, and delete business users due to business needs, the unified identity authentication system IAM actively pushes user information to the corresponding application software.

[0067] After the connection is established or disconnected, the unified identity authentication system IAM will be refreshed regularly (every 24 hours, configurable). The unified identity authentication system IAM will actively update all user information to the CTC terminal interface in units of user ID (client id). When the user information corresponding to the client id changes, the authentication system will actively update all user information corresponding to the client id, such as Figure 2 As shown, the specific implementation process includes:

[0068] The unified identity authentication system IAM first sends the user entity ID to the communication server Commsvr deployed in the dispatching center through the authentication interface machine IAMi. The data stream is sent to the dispatching center dispatching database SDB and the station communication front-end BL through the communication server Commsvr. After receiving the user entity ID, the central dispatching database SDB manages the user password and saves the updated user password, including the entire dispatching center user. After receiving the user entity number, the station communication front-end BL transmits it to the train service CTC terminal to save the updated user password, fill in the corresponding software entity number, including the entire station user. After completing the user information update, the central dispatching database SDB and the train service CTC terminal transmit the receipt information to IAMi through the unified identity authentication interface machine of the central communication server Commsvr, and then return it to the unified identity authentication system IAM to complete the update closed loop.

[0069] By setting up account login functions such as basic authentication, multi-factor authentication, super user authentication, and backup authentication, the security of dispatching and command work is guaranteed.

[0070] CTC terminal login authentication includes the following steps:

[0071] Step S1: A user initiates a login request at a CTC terminal. The CTC terminal sends the user's login request (including a user name and possible password, and a multi-factor verification code) to a communication server via an established TCP connection.

[0072] Step S2: After receiving the request from the CTC terminal, the communication server decides the authentication method based on the current state of the system and the user's account settings. This decision is based on user permissions, the availability of the IAM system, and any previous failed login attempts. The optional authentication methods can be basic authentication, multi-factor authentication, super user authentication, or backup authentication. Specifically, it includes the following sub-steps:

[0073] Step S201, the communication server confirms the connection status with the unified identity authentication system IAM. If it is abnormal, the login status is switched to the local backup authentication mode and the process goes to S5.

[0074] Step S202: The communication server confirms that the connection status with the unified identity authentication system IAM is normal, and performs remote user information verification to determine the user type. When the front end logs in as the casco super user, if it determines that there is no user information in the database, it returns a successful login, otherwise it returns a failed login. Log in as a normal user, and determine whether it is basic authentication or multi-factor authentication according to user permissions, and enter step S3.

[0075] Step S3: The communication server routes the request to the unified identity authentication system IAM through the unified identity authentication system interface IAMi according to the selected authentication method. The unified identity authentication system IAM processes the authentication request, verifies whether the login information of the basic authentication or multi-factor authentication is passed, generates a login receipt message including the successful or failed authentication result and a possible token identifier, and sends the login receipt message back to the communication server.

[0076] Step S4, the communication server receives the authentication result from the unified identity authentication system IAM and sends a receipt message back to the CTC terminal, which specifically includes the following sub-steps:

[0077] Step S401: The communication server waits to receive the authentication result from the unified identity authentication system IAM within a specified time. If the reception times out, the backup authentication method is activated. Go to step S201.

[0078] Step S402: The communication server receives the authentication result from the unified identity authentication system IAM within the specified time and sends a receipt message back to the CTC terminal.

[0079] Step S5: The CTC terminal displays the login status according to the result of the communication server or local backup logic. If the login is successful, the user obtains the corresponding system access rights. If the login fails, the user is prompted with an error message and may be provided with a retry or recovery option. The specific steps include the following:

[0080] Step S501, the CTC terminal receives the authentication result from the unified identity authentication system IAM, and the authentication is successful. It is determined that multi-factor authentication is not required or has passed the multi-factor authentication, and the user obtains the corresponding system access rights.

[0081] Step S502: The authentication result is successful. It is determined that multi-factor authentication is required and has yet to be passed. The interactive interface is updated to a new multi-factor authentication style. After the user enters login information, the process proceeds to step S1.

[0082] Step S503: If the authentication fails, the interactive interface prompts the user to re-enter the login information and then proceeds to step S1.

[0083] The user selects the corresponding login method (basic authentication and multi-factor authentication) according to his / her authority. When the unified identity authentication system IAM fails and the terminal cannot get a response within the specified time, the backup authentication account login function is enabled. The super user authentication login function is only enabled when there is no account information in the dispatch database SDB / the local file storing user information in the vehicle service CTC terminal is empty. The basic login information flow diagram is as follows: Figure 3 shown.

[0084] When logging in with basic authentication: Figure 3In the process, the central user transmits the message containing the verification identification, user name, user code and password to the SDB through the station map, TPMS terminal, EMUS terminal and CPMS terminal via the central Commsvr. After the SDB confirms that the connection status with the unified identity authentication system IAM is normal, it will perform remote user information verification.

[0085] When logging in with basic authentication: Figure 3 In the process, the station user confirms the connection status with IAMi through STPC. If the connection is normal, IAMi further confirms the connection status with IAM. If both achieve normal communication, remote login verification is performed.

[0086] When logging in with basic authentication: Figure 3 In the remote verification, SDB determines that IAMi communication is normal and sends messages 3 and 4 to IAMi. IAMi determines that IAM status is normal (maintaining heartbeat messages) and sends message 5 to IAM. The station user sends message 1 to BL through STPC and then sends and receives user information through the central Commsvr and IAM.

[0087] When logging in with basic authentication: Figure 3 In the figure, after receiving the remote verification request from SDB, IAM sends a receipt to the login message (including source entity number, type, station number / station number and user code), which is sent to SDB through the authentication interface machine IAMi and finally returned to the user terminal message 10. The IAM receipt message received by STPC is the red message 5, 6, 7, and 8 in the figure. After the station receives the normal receipt message, the user terminal shows that the login authentication is successful.

[0088] When logging in with basic authentication: Figure 5 In the three-tier login process formed by user, client, and IAM, the closed-loop login process of user-client-IAM-client-user complies with Figure 3 The flow of basic authentication information.

[0089] When logging in with basic authentication: Figure 5 When a user logs in using an account and password on the client, the application terminal server accesses the centralized authentication interface for identity authentication in the form of TCP or https.

[0090] When logging in with basic authentication: Figure 5 When the login verification is successful, the CTC software exits the login interface and completes the user login; when the verification fails, the CTC software interface prompts the user according to the receipt; when the verification returns timeout (timeout 1 time), or the communication is interrupted (IAMi determines that it is interrupted with IAM, receives the login message, returns directly, and uses the local method), the interface prompts the user to use other local login methods.

[0091] When logging in with multi-factor authentication: Figure 4 In the process, the center user needs to first send the user password information to IAMi through Commsvr via message 2 for authentication, and then enter the multi-factor authentication process after passing the authentication.

[0092] When logging in with multi-factor authentication: Figure 4 In the process, the central user messages 3, 4, and 5 (black numbers) need to be cycled twice. The first time is the receipt information sent to the terminal by IAM after agreeing to enable multi-factor authentication. The second time is when the user receives the receipt message and enters the multi-factor authentication data, which is then sent to IAMi for verification again through Commsvr. After the authentication is successful, the second receipt information is sent to the user to indicate that the login is successful.

[0093] When logging in with multi-factor authentication: Figure 4 In the process of station user login, it is also necessary to cycle twice in messages 1-8 (red numbers). The first cycle is the same as the basic authentication, and the second cycle requires adding secondary verification data (verification code) to the receipt message. Other processes remain unchanged.

[0094] When logging in with multi-factor authentication: Figure 6 In the process, center users and station users need to add multi-factor authentication data input between the first and second layers on the basis of the basic authentication process (in addition to the verification identifier, user name, user code and password entered for the first time, it also includes the user verification code token as the second user input data). At this time, a new password input box is added to the login interface for entering the token.

[0095] When logging in with multi-factor authentication: Figure 6 In the case of a second token input error and verification failure, the interface prompts the user to re-enter the second-level verification code to log in. If the verification is successful, the user exits the login interface and completes the user login; if the verification returns a timeout (more than once), or the communication between IAM and IAMi is interrupted, the interface prompts the user to use other local login methods.

[0096] When logging in with backup authentication: Figure 3 and Figure 4 In the backup authentication, the entry conditions can meet one of the following conditions:

[0097] (1) The communication between IAMi and IAM is interrupted or the connection times out;

[0098] (2) Communication between SDB and IAMi is interrupted or the connection times out;

[0099] (3) Communication between BL and IAMi is interrupted or the connection times out;

[0100] (4) The communication between STPC and IAMi is interrupted or the connection times out.

[0101] When logging in with backup authentication: Figure 3 and Figure 4 When the information flow between SDB and STPC to send or receive IAM is interrupted ( Figure 3 In the middle, black digital messages are 4, 5, 6, 7 and red digital messages are 3, 4, 5, 6 or Figure 4 In the black digital messages 2, 3 and the red digital messages 3, 4, 5, 6), the backup authentication process is enabled.

[0102] When logging in with backup authentication: Figure 3 and Figure 4 In the process, the central user identity login requires SDB to call the user information in the terminal database it maintains for verification (the database connection must be normal, otherwise the backup login fails); the station user login needs to check the user information file maintained locally by STPC. If the user passes the interface authentication, the login is completed, otherwise the authentication times out and returns to the original login process.

[0103] When logging in with backup authentication: the user first enters the password on the client for verification. At this time, the user information is sent to IAMi and returned to the client after the authentication times out. Subsequently, the center user and station user use their own local login process to log in respectively. After successful authentication, the login success is displayed.

[0104] When logging in with super user authentication: If the local SDB database is empty or the STPC local user information file is empty, the CASCO super user login mode is enabled. Login is completed by verifying the password information of the SDB connection database and the super user identity information in the STPC local file. It is generally used in scenarios such as system pre-debugging and functional testing.

[0105] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A unified identity authentication device for an urban rail dispatching and command system, characterized in that: include: Multiple CTC terminals, including a dispatch center CTC terminal for providing a user login interactive interface, and a train service CTC terminal storing user information local files for managing station internal user authentication and access control; Unified identity authentication system, used to centrally manage user authentication and permission configuration of all dispatch centers and stations; The unified identity authentication interface machine communicates with the unified identity authentication system and the communication server respectively, and is used to process the data sent by the communication server and feed back the authentication result to the CTC terminal of the dispatch center; Communication server, used to forward authentication data and user information; The dispatch database is deployed in the dispatch center to store user information and communicate with the unified identity authentication system and CTC terminals in each dispatch center through the communication server; Communication front-end, used to process communication requests with train CTC terminals and communication servers; During the docking process between the unified identity authentication system and the CTC terminal, the authentication mode is switched to basic authentication, multi-factor authentication, super user authentication or local backup authentication mode according to the communication connection status and the user account type; if the communication connection is abnormal, it is switched to the local backup authentication mode; if the communication connection is normal and the user account type is a super user, it is directly switched to the super user authentication mode; if the communication connection is normal and the user account type is an ordinary user, it is switched to the basic authentication or multi-factor authentication mode according to the user authority.

2. A unified identity authentication device for an urban rail dispatching and command system according to claim 1, characterized in that: The unified identity authentication system is independently set up in the CTC network, isolated by a firewall, and is reachable by routes to all stations and central equipment of CTC.

3. A unified identity authentication device for an urban rail dispatching and command system according to claim 1, characterized in that: The unified identity authentication interface machine is provided with a socket interface supporting the TCP protocol and a restful interface supporting the https protocol.

4. A unified identity authentication device for an urban rail dispatching and commanding system according to claim 1, characterized in that: The unified identity authentication system adopts a two-level management mechanism to manage user accounts, including: Level 1 administrators are responsible for managing user accounts in the entire unified identity authentication system, and for establishing accounts and configuring account permissions for level 2 administrators based on business needs; and Secondary administrators, including station administrators and center administrators, are responsible for establishing and managing business accounts within their jurisdiction.

5. A unified identity authentication device for an urban rail dispatching and command system according to claim 4, characterized in that: After the unified identity authentication system establishes a connection with the CTC terminal or disconnects and reconnects, the unified identity authentication system actively refreshes regularly and actively updates all user information to the CTC terminal interface in units of user ID; when the user information corresponding to the user ID changes, the unified identity authentication system actively updates all user information of the corresponding user ID.

6. A unified identity authentication device for an urban rail dispatching command system according to claim 5, characterized in that: When the user information corresponding to the user ID changes, the unified identity authentication system actively updates all user information corresponding to the user ID, specifically: The unified identity authentication system sends the user entity ID to the communication server deployed in the dispatching center through the unified identity authentication interface machine, and the data flow is sent to the communication server deployed in the dispatching center and the communication front-end deployed in the station through the communication server; After receiving the user entity ID, the communication server updates the user password, and the user entity ID involved includes the user of the current dispatch center; The communication front-end deployed at the station receives the user entity ID and transmits it to the train CTC terminal to save the updated user password. The user entity ID involved includes users of the entire station. After the communication server and the vehicle service CTC terminal complete the user information update, the receipt information is transmitted to the unified identity authentication interface machine through the communication server and then returned to the unified identity authentication system to complete the update.

7. A unified identity authentication device for an urban rail dispatching and command system according to claim 1, characterized in that: The super user authentication mode is enabled when there is no account information in the dispatch database or the local file storing user information in the train service CTC terminal is empty; The super user authentication mode completes the login by verifying the password information of the dispatch database connection database and the super user identity information in the local file of the train service CTC terminal.

8. The unified identity authentication device for the urban rail dispatching command system according to claim 1 is characterized in that: The communication connection abnormality judgment standard is to meet at least one of the following conditions: The communication between the unified identity authentication interface machine and the unified identity authentication system is interrupted or the connection times out; The communication between the dispatch database and the unified identity authentication interface machine is interrupted or the connection times out; The communication between the communication front-end and the unified identity authentication interface machine is interrupted or the connection times out; The communication between the train service CTC terminal and the unified identity authentication interface machine is interrupted or the connection times out.

9. A unified identity authentication device for an urban rail dispatching and commanding system according to claim 1, characterized in that: The authentication process in the local backup authentication mode is as follows: Central user login authentication: The dispatch database calls the user information in the terminal database it maintains for verification. The connection between the dispatch database and the terminal database must be normal, otherwise the local backup login will fail. Station user login authentication: Check the user information file maintained locally on the train service CTC terminal. If the interface authentication is passed, the login is completed. Otherwise, the authentication will time out and return to the original login page.

10. A unified identity authentication device for an urban rail dispatching and commanding system according to claim 1, characterized in that: The authentication process in the basic authentication mode is as follows: The user initiates a login request at the CTC terminal, and the CTC terminal sends the user's login request to the communication server; The communication server receives the request from the CTC terminal, and after the communication connection is verified normally, determines that the authentication method is the basic authentication method; The communication server routes the authentication request to the unified identity authentication system through the unified identity authentication system interface according to the selected basic authentication. The unified identity authentication system processes the authentication request, verifies whether the basic authentication is passed, generates a login receipt message, and sends the login receipt message back to the communication server. The communication server receives the authentication result from the unified identity authentication system and sends a receipt message back to the CTC terminal.

11. A unified identity authentication device for an urban rail dispatching and commanding system according to claim 10, characterized in that: The authentication process in the multi-factor authentication mode includes two cyclic authentications. The first cyclic authentication is the receipt information sent to the terminal by the unified identity authentication system agreeing to enable multi-factor authentication. The second cyclic authentication is that the user enters the multi-factor authentication data after receiving the receipt message and the communication server sends it to the unified identity authentication interface machine for verification again. After the authentication is successful, the second receipt information is sent to the user to indicate that the login is successful.

12. A unified identity authentication device for an urban rail dispatching command system according to any one of claims 10 or 11, characterized in that: Also includes: When the receipt information is received for a timeout, switch to local backup authentication mode.

Images