Multi-factor identity authentication method and system
By creating a local account on the client and binding it to the cloud service account, and combining it with the cloud service platform for identity authentication, the problem of single authentication methods and insufficient flexibility in traditional identity authentication methods is solved, and the flexibility of multi-factor identity authentication is achieved. Improved safety.
Patent Information
- Application Number
- CN202411249210.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-06
- Publication Date
- 2024-12-27
AI Technical Summary
The traditional identity authentication method has a single authentication method, which only relies on cloud servers for identity authentication, and lacks independent account management to perform real-time identity authentication and authorization processing, resulting in insufficient flexibility.
Using multi-factor identity authentication method, by creating a local account on the client and binding it to the cloud service account, using management modules, interaction modules and authentication modules for identity verification, and combining with cloud service platform for network communication management, realizing local account and cloud Binding and identity authentication of service accounts.
It has realized a more friendly multi-factor identity authentication solution, enhanced the flexibility and security of identity authentication, and supports local account creation, cloud service account registration and multi-factor identity authentication, which is suitable for different operating systems.
Smart Images
Figure CN119203106A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the technical field of identity authentication and proposes a multi-factor identity authentication method and system. Background Art
[0002] Identity authentication is the first line of defense for system security, which can prevent unknown users from accessing system data. Traditional identity authentication methods (such as username and password authentication) have the problem of a single authentication method and are limited to the current device. Existing cloud service identity authentication methods mostly rely solely on cloud servers for identity authentication, lack an independent account management terminal for real-time identity authentication and authorization processing, and lack flexibility. Summary of the invention
[0003] In view of the above problems, the present invention discloses a multi-factor identity authentication method and system, which can be combined with cloud services to implement a more user-friendly multi-factor identity authentication solution.
[0004] To achieve the above objectives, the technical solution of the present invention includes the following contents.
[0005] A multi-factor identity authentication method, the method comprising:
[0006] Create a local account on the client; wherein the client includes: a management module, an interaction module and an authentication module, wherein the interaction module is used to provide an interaction page for the user, the authentication module is used to perform identity authentication, call a user creation system instruction, and perform network communication management with the cloud service platform, and the management module is used to start and manage users, provide a method interface for the interaction module to call, and notify the interaction module of the execution result of the authentication module in the form of an interface callback;
[0007] Use the account binding terminal to register and activate the cloud service account on the cloud service platform;
[0008] Binding the local account to the cloud service account;
[0009] Identity authentication is performed based on the local account or the cloud service account.
[0010] Furthermore, the creating a local account on the client includes:
[0011] Obtain the user name and password entered by the user through the interactive module;
[0012] Use the username and password as input parameters and call the authentication module through the interface provided by the management module to initiate local account creation;
[0013] The authentication module receives the user name and password, calls the system to create a user command, and creates a local account;
[0014] The authentication module notifies the interaction module of the result of creating a local account through the callback interface provided by the management module.
[0015] Further, the use of the account binding terminal to register and activate the cloud service account on the cloud service platform includes:
[0016] The user accesses the cloud service platform, enters the email address, and initiates an account creation application;
[0017] The cloud service platform verifies the email information and, after determining that the email is available, sends a registration email containing a registration QR code to the email; wherein the registration QR code includes: the cloud service platform address, the invitation code and the email address parameters;
[0018] The account binding terminal scans the registration QR code to obtain the cloud service platform address, invitation code, and email address parameters;
[0019] The account binding end generates a unique identifier for the user's device as a device identifier;
[0020] The account binding terminal carries the invitation code and the unique identifier of the user device to access the cloud service address to call the account creation interface of the cloud service platform and generate a cloud service account registration request;
[0021] After receiving the account registration request, the cloud service platform verifies the request parameters and generates cloud service account parameters; wherein the cloud service account parameters include: token and public and private keys;
[0022] The cloud service platform returns the cloud service account parameters to the account binding end.
[0023] Furthermore, binding the local account with the cloud service account includes:
[0024] The user selects the local account to be bound to the cloud service account through the interactive module;
[0025] The interaction module calls the create binding session interface of the cloud service platform and uploads the device information corresponding to the client to the cloud service platform;
[0026] The cloud service platform creates a binding session and returns the session information to the interaction module;
[0027] The interactive module displays the session information in the form of a QR code, and calls the session status query interface of the cloud service platform in a polling manner to query the current session status;
[0028] The account binding terminal scans the QR code displayed in the code interaction module and parses it to obtain the session information;
[0029] The account binding end uses the parsed session information as a parameter to call the session verification interface of the cloud service platform;
[0030] After verifying the session information, the cloud service platform adjusts the session state to the authorization code verification state and generates an authorization code;
[0031] The account binding end calls the authorization code verification result query interface of the cloud service platform in a polling manner, and displays the obtained authorization code in text form;
[0032] The interactive module polls the session status query interface of the cloud service platform, and when the session status returned by the interface is the authorization code verification status, the polling ends and jumps to the authorization code input page;
[0033] After the user enters the authorization code displayed by the account binding terminal on the authorization code input page, the interactive module uses the authorization code as a parameter to call the authorization code verification interface of the cloud service platform;
[0034] The cloud service platform verifies the correctness of the authorization code and returns the verification result to the interaction module; wherein, when the verification passes, the verification result includes the cloud service account information; wherein, the cloud service account information includes: token, public and private keys, and identity authentication key;
[0035] After receiving the cloud service account information, the interaction module calls the cloud service account information saving interface of the authentication module through the management module;
[0036] The authentication module saves the cloud service account data to the corresponding local account specified directory and updates the binding status of the corresponding local account in the user data table;
[0037] The authentication module notifies the interaction module of the cloud service account data saving result through the callback interface provided by the management module;
[0038] The interactive module updates the display of the binding status between the local account and the cloud service account;
[0039] The account binding end polls the interface authorization code verification status, and when the authorization code verification passes, obtains and displays the authorized device information.
[0040] Furthermore, identity authentication is performed based on the cloud service account, including:
[0041] Obtain the account and password required for authentication through the interactive module;
[0042] The interaction module calls the authentication module to initiate authentication through the cloud service authentication interface provided by the management module;
[0043] The authentication module uses the private key to sign the authentication key to obtain the signature value sign, and uses the authentication key and signature value sign as request parameters to call the authentication initiation interface provided by the cloud service platform to initiate a cloud service authentication request to the cloud service platform;
[0044] After receiving the identity authentication request, the cloud service platform parses and obtains the request parameters, verifies the validity of the identity authentication key, and generates an authentication process identifier fid if the verification passes. The authentication process identifier fid is used as a parameter of the successful result of the authentication initiation request response and returned to the authentication module;
[0045] After receiving the successful response result of the authentication initiation request returned by the cloud service platform, the authentication module uses the authentication process identifier fid as the request parameter and calls the authentication result query interface provided by the cloud service platform through polling to query the identity authentication result;
[0046] The cloud service platform uses the identity authentication key to match the corresponding account binding end, and after obtaining the account binding end information, pushes the identity authentication message to the corresponding account binding end; wherein the identity authentication message includes: the identity authentication key and the authentication process identifier fid;
[0047] After receiving the identity authentication message push, the account binding end parses and obtains the identity authentication key authkey and the authentication process identifier fid parameter, and the user performs the confirmation operation;
[0048] After the user performs the confirmation operation, the account binding end uses the user confirmation operation type operateType, identity authentication key authKey, and authentication process identifier fid as parameters, calls the identity authentication authorization confirmation interface provided by the cloud service platform, and initiates an authorization confirmation request;
[0049] After receiving the authorization confirmation request from the account binding end, the cloud service platform parses and obtains the authorization result, and associates the authorization result with the authentication process identifier fid, so that the authentication module obtains the authorization result corresponding to the authentication process identifier fid through the polling interface;
[0050] The authentication module notifies the interaction module of the authorization result through the callback interface provided by the management module;
[0051] The interactive module generates corresponding prompt information based on the authorization result to feed back to the user and trigger the subsequent process.
[0052] Furthermore, identity authentication is performed based on the local account, including:
[0053] Obtain the account and password required for authentication through the interactive module;
[0054] Use the username and password that need to be authenticated as input parameters, and call the authentication module through the interface provided by the management module to initiate authentication;
[0055] The authentication module verifies the correctness of the account and password required for authentication, and generates an authorization result;
[0056] The authentication module notifies the interaction module of the authorization result through the callback interface provided by the management module;
[0057] The interactive module generates corresponding prompt information based on the authorization result to feed back to the user and trigger the subsequent process.
[0058] A multi-factor identity authentication system, the system comprising:
[0059] The client is used to create a local account; perform identity authentication based on the local account; cooperate with the cloud service platform and the account binding terminal to bind the local account with the cloud service account, and perform identity authentication based on the cloud service account;
[0060] An account binding terminal, used to register and activate a cloud service account on the cloud service platform; to collaborate with the cloud service platform and the client to bind the local account to the cloud service account, and to perform identity authentication based on the cloud service account;
[0061] Cloud service platform, used to provide backend management of cloud accounts;
[0062] Among them, the client includes: a management module, an interaction module and an authentication module. The interaction module is used to provide an interaction page for users, the authentication module is used to perform identity authentication, call the user creation system instruction, and manage network communications with the cloud service platform. The management module is used to start and manage users, provide a method interface for the interaction module to call, and notify the interaction module of the execution result of the authentication module in the form of an interface callback.
[0063] Furthermore, registering and activating a cloud service account on the cloud service platform includes:
[0064] The user accesses the cloud service platform, enters the email address, and initiates an account creation application;
[0065] The cloud service platform verifies the email information and, after determining that the email is available, sends a registration email containing a registration QR code to the email; wherein the registration QR code includes: the cloud service platform address, the invitation code and the email address parameters;
[0066] The account binding terminal scans the registration QR code to obtain the cloud service platform address, invitation code, and email address parameters;
[0067] The account binding end generates a unique identifier for the user's device as a device identifier;
[0068] The account binding terminal carries the invitation code and the unique identifier of the user device to access the cloud service address to call the account creation interface of the cloud service platform and generate a cloud service account registration request;
[0069] After receiving the account registration request, the cloud service platform verifies the request parameters and generates cloud service account parameters; wherein the cloud service account parameters include: token and public and private keys;
[0070] The cloud service platform returns the cloud service account parameters to the account binding end.
[0071] Furthermore, the binding of the local account with the cloud service account includes:
[0072] The user selects the local account to be bound to the cloud service account through the interactive module;
[0073] The interaction module calls the create binding session interface of the cloud service platform and uploads the device information corresponding to the client to the cloud service platform;
[0074] The cloud service platform creates a binding session and returns the session information to the interaction module;
[0075] The interactive module displays the session information in the form of a QR code, and calls the session status query interface of the cloud service platform in a polling manner to query the current session status;
[0076] The account binding terminal scans the QR code displayed in the code interaction module and parses it to obtain the session information;
[0077] The account binding end uses the parsed session information as a parameter to call the session verification interface of the cloud service platform;
[0078] After verifying the session information, the cloud service platform adjusts the session state to the authorization code verification state and generates an authorization code;
[0079] The account binding end calls the authorization code verification result query interface of the cloud service platform in a polling manner, and displays the obtained authorization code in text form;
[0080] The interactive module polls the session status query interface of the cloud service platform, and when the session status returned by the interface is the authorization code verification status, the polling ends and jumps to the authorization code input page;
[0081] After the user enters the authorization code displayed by the account binding terminal on the authorization code input page, the interactive module uses the authorization code as a parameter to call the authorization code verification interface of the cloud service platform;
[0082] The cloud service platform verifies the correctness of the authorization code and returns the verification result to the interaction module; wherein, when the verification passes, the verification result includes the cloud service account information; wherein, the cloud service account information includes: token, public and private keys, and identity authentication key;
[0083] After receiving the cloud service account information, the interaction module calls the cloud service account information saving interface of the authentication module through the management module;
[0084] The authentication module saves the cloud service account data to the corresponding local account specified directory and updates the binding status of the corresponding local account in the user data table;
[0085] The authentication module notifies the interaction module of the cloud service account data saving result through the callback interface provided by the management module;
[0086] The interactive module updates the display of the binding status between the local account and the cloud service account;
[0087] The account binding end polls the interface authorization code verification status, and when the authorization code verification passes, obtains and displays the authorized device information.
[0088] Furthermore, identity authentication is performed based on the cloud service account, including:
[0089] Obtain the account and password required for authentication through the interactive module;
[0090] The interaction module calls the authentication module to initiate authentication through the cloud service authentication interface provided by the management module;
[0091] The authentication module uses the private key to sign the authentication key to obtain the signature value sign, and uses the authentication key and signature value sign as request parameters to call the authentication initiation interface provided by the cloud service platform to initiate a cloud service authentication request to the cloud service platform;
[0092] After receiving the identity authentication request, the cloud service platform parses and obtains the request parameters, verifies the validity of the identity authentication key, and generates an authentication process identifier fid if the verification passes. The authentication process identifier fid is used as a parameter of the successful result of the authentication initiation request response and returned to the authentication module;
[0093] After receiving the successful response result of the authentication initiation request returned by the cloud service platform, the authentication module uses the authentication process identifier fid as the request parameter and calls the authentication result query interface provided by the cloud service platform through polling to query the identity authentication result;
[0094] The cloud service platform uses the identity authentication key to match the corresponding account binding end, and after obtaining the account binding end information, pushes the identity authentication message to the corresponding account binding end; wherein the identity authentication message includes: the identity authentication key and the authentication process identifier fid;
[0095] After receiving the identity authentication message push, the account binding end parses and obtains the identity authentication key authkey and the authentication process identifier fid parameter, and the user performs the confirmation operation;
[0096] After the user performs the confirmation operation, the account binding end uses the user confirmation operation type operateType, identity authentication key authKey, and authentication process identifier fid as parameters, calls the identity authentication authorization confirmation interface provided by the cloud service platform, and initiates an authorization confirmation request;
[0097] After receiving the authorization confirmation request from the account binding end, the cloud service platform parses and obtains the authorization result, and associates the authorization result with the authentication process identifier fid, so that the authentication module obtains the authorization result corresponding to the authentication process identifier fid through the polling interface;
[0098] The authentication module notifies the interaction module of the authorization result through the callback interface provided by the management module;
[0099] The interactive module generates corresponding prompt information based on the authorization result to feed back to the user and trigger the subsequent process.
[0100] Compared with the prior art, the present invention combines cloud services to achieve a more friendly multi-factor identity authentication solution, which is applicable to Linux, Windows and other systems. The present invention can also support local account creation, cloud service account registration, local account and cloud service account binding and multi-factor identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS
[0101] Figure 1 A preview of the modules of the multi-factor authentication system.
[0102] Figure 2 Flowchart of local account creation.
[0103] Figure 3 Flowchart of cloud service account registration and activation.
[0104] Figure 4 Flowchart of binding local account and cloud service account.
[0105] Figure 5 Flowchart of username and password authentication.
[0106] Figure 6 Flowchart of cloud service authentication. DETAILED DESCRIPTION
[0107] The present invention is further described in detail below in conjunction with specific embodiments. The given examples are only for illustrating the present invention, but not for limiting the scope of the present invention.
[0108] The present invention provides a multi-factor identity authentication system, such as Figure 1 As shown, the system is composed of a client, a cloud service platform, and an account binding terminal, etc. Among them, the client also includes a management module, an interaction module, and an authentication module.
[0109] 1) Management module. Used to start and manage users, responsible for loading the authentication module and calling its function code, providing a method interface for the interaction module to call, and notifying the interaction module of the execution result of the authentication module in the form of interface callback. Optionally, if this module is on the Linux platform, a tool similar to LightDM can be selected.
[0110] 2) Interaction module. Provides interactive pages for users, responsible for user login interface display, user name and password input, QR code display and other functions, and provides user interaction capabilities. Optionally, graphical user interaction tools such as Greeter can be implemented.
[0111] 3) Authentication module. It is used to perform identity authentication, is responsible for calling the system command to create a user, and is responsible for network communication with the cloud service module. Optionally, a shared library such as PAM pluggable authentication modules can complete the task.
[0112] 4) Cloud service: A platform service deployed in the cloud that provides cloud account backend management related functions.
[0113] 5) Account binding terminal. An application used to bind a cloud service account, which can be used to register and activate a cloud service account, obtain cloud service account information, view the list of logged-in devices for a cloud service account, and receive and process push messages from the cloud service platform.
[0114] The present invention also provides a multi-factor identity authentication method, which includes four parts: local account creation, cloud service account registration and activation, local account and cloud service account binding, and multi-factor identity authentication.
[0115] 1. Create a local account.
[0116] The process of creating a local account is as follows: Figure 2 As shown, including:
[0117] 1) Enter the user name and password through the interactive module;
[0118] 2) Use the username and password as input parameters and call the authentication module through the interface provided by the management module to initiate local account creation;
[0119] 3) The authentication module receives the username and password, calls the system to create a user instruction, and creates a local account;
[0120] 4) The authentication module notifies the interaction module of the result of creating the local account through the callback interface provided by the management module, thereby completing the creation of the local account.
[0121] 2. The process of cloud service account registration and activation.
[0122] The process of cloud service account registration and activation, such as Figure 3 As shown, including:
[0123] 1) The user accesses the cloud service platform, enters his / her personal email address, and initiates an application to create an account;
[0124] 2) The cloud service platform verifies the email information and sends a registration email (the content is a registration QR code, including: cloud service platform address, invitation code, email address parameters) to the corresponding email address after determining that it is available;
[0125] 3) The account binding terminal scans the QR code in the registration email to obtain the cloud service platform address, invitation code, and email address parameters;
[0126] 4) The account binding end generates a unique identifier for the user device (clientUUID) as the device identifier;
[0127] 5) The account binding end carries the invitation code, user device unique identifier (clientUUID) and other parameters, uses the cloud service address, and calls the account creation interface of the cloud service platform;
[0128] 6) After receiving the account registration request, the cloud service platform verifies the request parameters and generates cloud service account related parameters (including token, public and private keys, etc.);
[0129] 7) The cloud service platform returns account parameters including (token, public and private keys, and other parameter information) to the account binding end.
[0130] 3. Bind the local account to the cloud service account.
[0131] The process of binding a local account with a cloud service account, such as Figure 4 As shown, including:
[0132] 1) The user selects the local account to be bound to the cloud service account through the interactive module, triggering the cloud service account binding process;
[0133] 2) The interaction module calls the create binding session interface of the cloud service module and uploads the device information to the cloud service module;
[0134] 3) The cloud service module creates a binding session and returns the session information to the interaction module;
[0135] 4) The interactive module displays the session information in the form of a QR code, and calls the cloud service module session status query interface in a polling manner to query the current session status;
[0136] 5) Scan the QR code displayed in the interactive module on the account binding terminal (where the above cloud service account registration and activation has been completed) and parse it to obtain the session information;
[0137] 6) The account binding end uses the parsed session information as a parameter to call the initiate session verification interface of the cloud service module;
[0138] 7) The cloud service adjusts the session status to the authorization code verification status and generates an authorization code and returns it to the account binding end;
[0139] 8) The account binding end displays the obtained authorization code in text format and calls the authorization code verification result query interface provided by the cloud service module in a polling manner;
[0140] 9) The interactive module polls the cloud service module session status query interface in step 4), and when the session status returned by the interface is "authorization code verification status", the polling ends and jumps to the authorization code input page;
[0141] 10) The user enters the authorization code displayed by the account binding terminal in the interactive module, uses the input content as a parameter, and calls the authorization code verification interface provided by the cloud service module;
[0142] 11) The cloud service module verifies the correctness of the authorization code and returns the verification result to the interaction module. When the verification passes, the returned data includes the cloud service account information (including token, public and private keys, and identity authentication key authKey);
[0143] 12) After receiving the cloud service account information, the interaction module calls the cloud service account information saving interface of the authentication module through the management module;
[0144] 13) The authentication module saves the cloud service account data to the corresponding local account designated directory and updates the binding status of the corresponding local account in the user data table;
[0145] 14) The authentication module notifies the interaction module of the cloud service account data saving result through the callback interface provided by the management module;
[0146] 15) The interactive module updates the binding status display of the local account and the cloud service account;
[0147] 16) The account binding end polls the interface authorization code verification status in step 8). When the authorization code verification is successful, the authorized device information is obtained through the interface return data, the polling ends, the authorization is successful, and the authorized device information is displayed.
[0148] 4. Multi-factor identity authentication.
[0149] Multi-factor authentication includes username and password authentication and cloud service authentication. Users can choose the authentication method independently. Among them, cloud service authentication does not require password input, and cloud service account holders can achieve authentication through remote authorization. Cloud service accounts support multi-device binding, which allows the same account to be used for authentication on different devices. By extension, multiple devices can be bound to the same cloud service account, and cloud service account information can be used to implement business functions such as file data synchronization.
[0150] The process of username and password authentication is as follows: Figure 5 As shown, including:
[0151] 1) Select the account that needs to be authenticated through the interactive module and enter the password;
[0152] 2) Use the username and password as input parameters and call the authentication module through the interface provided by the management module to initiate authentication;
[0153] 3) The authentication module verifies the correctness of the user name and password;
[0154] 4) The authentication module notifies the interaction module of the authorization result through the callback interface provided by the management module;
[0155] 5) The interactive module receives the authorization result, determines whether the authentication is successful based on the result, gives corresponding prompts, and completes the identity authentication process.
[0156] The cloud service authentication process, such as Figure 6 As shown, including:
[0157] 1) Select the account that needs to be authenticated through the interactive module, select cloud service authentication as the authentication method, and trigger the cloud service authentication process;
[0158] 2) The interaction module calls the authentication module to initiate authentication through the cloud service authentication interface provided by the management module;
[0159] 3) The authentication module uses the private key obtained in the "binding local account to cloud service account" stage to sign the authentication key authKey to obtain the signature value sign, and uses the authentication key authKey and the signature value sign as request parameters to call the authentication initiation interface provided by the cloud service platform to initiate a cloud service authentication request to the cloud service platform;
[0160] 4) After receiving the authentication request, the cloud service platform parses the request parameters and verifies the validity of the authentication key authKey parameter. If the verification is successful, the authentication process identifier fid is generated and used as a parameter to return a successful request response to the authentication module; if the verification is recognized, a request failure response is returned to the authentication module, ending the authentication process;
[0161] 5) After the authentication module receives the successful response result of the authentication initiation request returned by the cloud service platform, it uses the authentication process identifier fid as the request parameter and calls the authentication result query interface provided by the cloud service platform through polling to query the identity authentication result;
[0162] 6) The cloud service platform uses the identity authentication key authKey to match the corresponding account binding end, obtains the account binding end information, and pushes the identity authentication key authKey and the authentication process identifier fid to the corresponding account binding end in the form of message push;
[0163] 7) After receiving the identity authentication message push, the account binding end parses and obtains the identity authentication key authkey and the authentication process identifier fid parameter, and the user performs the confirmation operation;
[0164] 8) After the user performs the confirmation operation, the account binding end uses the user confirmation operation type operateType, identity authentication key authKey, and authentication process identifier fid as parameters, calls the identity authentication authorization confirmation interface provided by the cloud service platform, and initiates an authorization confirmation request;
[0165] 9) After receiving the authorization confirmation request from the account binding end, the cloud service platform parses the authorization result and associates the data with the authentication process identifier fid. At this time, the authentication module in step 5) can obtain the authorization result corresponding to the authentication process identifier fid through the polling interface;
[0166] 10) After the authentication module obtains the authorization result, it notifies the interaction module of the authorization result through the callback interface provided by the management module;
[0167] 11) After receiving the authorization result, the interactive module determines whether the authentication is passed according to the result, gives corresponding prompts, and ends the authentication process. If the authentication is passed, the subsequent process (such as starting the desktop) is triggered.
[0168] The above embodiments are only for illustrating the technical concept and features of the present invention, and their purpose is to enable people familiar with the technology in this field to understand the content of the present invention and implement it, and they cannot be used to limit the protection scope of the present invention. Any equivalent changes or modifications made according to the spirit of the present invention should be included in the protection scope of the present invention.
Claims
1. A multi-factor identity authentication method, characterized in that: The method comprises: Create a local account on the client; wherein the client includes: a management module, an interaction module and an authentication module, wherein the interaction module is used to provide an interaction page for the user, the authentication module is used to perform identity authentication, call a user creation system instruction, and perform network communication management with the cloud service platform, and the management module is used to start and manage users, provide a method interface for the interaction module to call, and notify the interaction module of the execution result of the authentication module in the form of an interface callback; Use the account binding terminal to register and activate the cloud service account on the cloud service platform; Binding the local account to the cloud service account; Identity authentication is performed based on the local account or the cloud service account.
2. The method according to claim 1, characterized in that: The step of creating a local account on the client includes: Obtain the user name and password entered by the user through the interactive module; Use the username and password as input parameters and call the authentication module through the interface provided by the management module to initiate local account creation; The authentication module receives the user name and password, calls the system to create a user command, and creates a local account; The authentication module notifies the interaction module of the result of creating a local account through the callback interface provided by the management module.
3. The method according to claim 1, characterized in that The use of the account binding terminal to register and activate the cloud service account on the cloud service platform includes: The user accesses the cloud service platform, enters the email address, and initiates an account creation application; The cloud service platform verifies the email information and, after determining that the email is available, sends a registration email containing a registration QR code to the email; wherein the registration QR code includes: the cloud service platform address, the invitation code and the email address parameters; The account binding terminal scans the registration QR code to obtain the cloud service platform address, invitation code, and email address parameters; The account binding end generates a unique identifier for the user's device as a device identifier; The account binding terminal carries the invitation code and the unique identifier of the user device to access the cloud service address to call the account creation interface of the cloud service platform and generate a cloud service account registration request; After receiving the account registration request, the cloud service platform verifies the request parameters and generates cloud service account parameters; wherein the cloud service account parameters include: token and public and private keys; The cloud service platform returns the cloud service account parameters to the account binding end.
4. The method according to claim 1, characterized in that: Binding the local account with the cloud service account includes: The user selects the local account to be bound to the cloud service account through the interactive module; The interaction module calls the create binding session interface of the cloud service platform and uploads the device information corresponding to the client to the cloud service platform; The cloud service platform creates a binding session and returns the session information to the interaction module; The interactive module displays the session information in the form of a QR code, and calls the session status query interface of the cloud service platform in a polling manner to query the current session status; The account binding terminal scans the QR code displayed in the code interaction module and parses it to obtain the session information; The account binding end uses the parsed session information as a parameter to call the session verification interface of the cloud service platform; After verifying the session information, the cloud service platform adjusts the session state to the authorization code verification state and generates an authorization code; The account binding end calls the authorization code verification result query interface of the cloud service platform in a polling manner, and displays the obtained authorization code in text form; The interactive module polls the session status query interface of the cloud service platform, and when the session status returned by the interface is the authorization code verification status, the polling ends and jumps to the authorization code input page; After the user enters the authorization code displayed by the account binding terminal on the authorization code input page, the interactive module uses the authorization code as a parameter to call the authorization code verification interface of the cloud service platform; The cloud service platform verifies the correctness of the authorization code and returns the verification result to the interaction module; wherein, when the verification passes, the verification result includes the cloud service account information; wherein, the cloud service account information includes: token, public and private keys, and identity authentication key; After receiving the cloud service account information, the interaction module calls the cloud service account information saving interface of the authentication module through the management module; The authentication module saves the cloud service account data to the corresponding local account specified directory and updates the binding status of the corresponding local account in the user data table; The authentication module notifies the interaction module of the cloud service account data saving result through the callback interface provided by the management module; The interactive module updates the display of the binding status between the local account and the cloud service account; The account binding end polls the interface authorization code verification status, and when the authorization code verification passes, obtains and displays the authorized device information.
5. The method according to claim 4, characterized in that Performing identity authentication based on the cloud service account includes: Obtain the account and password required for authentication through the interactive module; The interaction module calls the authentication module to initiate authentication through the cloud service authentication interface provided by the management module; The authentication module uses the private key to sign the authentication key to obtain the signature value sign, and uses the authentication key and signature value sign as request parameters to call the authentication initiation interface provided by the cloud service platform to initiate a cloud service authentication request to the cloud service platform; After receiving the identity authentication request, the cloud service platform parses and obtains the request parameters, verifies the validity of the identity authentication key, and generates an authentication process identifier fid if the verification passes. The authentication process identifier fid is used as a parameter of the successful result of the authentication initiation request response and returned to the authentication module; After receiving the successful response result of the authentication initiation request returned by the cloud service platform, the authentication module uses the authentication process identifier fid as the request parameter and calls the authentication result query interface provided by the cloud service platform through polling to query the identity authentication result; The cloud service platform uses the identity authentication key to match the corresponding account binding end, and after obtaining the account binding end information, pushes the identity authentication message to the corresponding account binding end; wherein the identity authentication message includes: the identity authentication key and the authentication process identifier fid; After receiving the identity authentication message push, the account binding end parses and obtains the identity authentication key authkey and the authentication process identifier fid parameter, and the user performs the confirmation operation; After the user performs the confirmation operation, the account binding end uses the user confirmation operation type operateType, identity authentication key authKey, and authentication process identifier fid as parameters, calls the identity authentication authorization confirmation interface provided by the cloud service platform, and initiates an authorization confirmation request; After receiving the authorization confirmation request from the account binding end, the cloud service platform parses and obtains the authorization result, and associates the authorization result with the authentication process identifier fid, so that the authentication module obtains the authorization result corresponding to the authentication process identifier fid through the polling interface; The authentication module notifies the interaction module of the authorization result through the callback interface provided by the management module; The interactive module generates corresponding prompt information based on the authorization result to feed back to the user and trigger the subsequent process.
6. The method according to claim 1, characterized in that Performing identity authentication based on the local account includes: Obtain the account and password required for authentication through the interactive module; Use the username and password that need to be authenticated as input parameters, and call the authentication module through the interface provided by the management module to initiate authentication; The authentication module verifies the correctness of the account and password required for authentication, and generates an authorization result; The authentication module notifies the interaction module of the authorization result through the callback interface provided by the management module; The interactive module generates corresponding prompt information based on the authorization result to feed back to the user and trigger the subsequent process.
7. A multi-factor identity authentication system, characterized in that: The system comprises: The client is used to create a local account; perform identity authentication based on the local account; cooperate with the cloud service platform and the account binding terminal to bind the local account with the cloud service account, and perform identity authentication based on the cloud service account; An account binding terminal, used to register and activate a cloud service account on the cloud service platform; to collaborate with the cloud service platform and the client to bind the local account to the cloud service account, and to perform identity authentication based on the cloud service account; Cloud service platform, used to provide backend management of cloud accounts; Among them, the client includes: a management module, an interaction module and an authentication module. The interaction module is used to provide an interaction page for users, the authentication module is used to perform identity authentication, call the user creation system instruction, and manage network communications with the cloud service platform. The management module is used to start and manage users, provide a method interface for the interaction module to call, and notify the interaction module of the execution result of the authentication module in the form of an interface callback.
8. The system according to claim 7, characterized in that Register and activate a cloud service account on the cloud service platform, including: The user accesses the cloud service platform, enters the email address, and initiates an account creation application; The cloud service platform verifies the email information and, after determining that the email is available, sends a registration email containing a registration QR code to the email; wherein the registration QR code includes: the cloud service platform address, the invitation code and the email address parameters; The account binding terminal scans the registration QR code to obtain the cloud service platform address, invitation code, and email address parameters; The account binding end generates a unique identifier for the user's device as a device identifier; The account binding terminal carries the invitation code and the unique identifier of the user device to access the cloud service address to call the account creation interface of the cloud service platform and generate a cloud service account registration request; After receiving the account registration request, the cloud service platform verifies the request parameters and generates cloud service account parameters; wherein the cloud service account parameters include: token and public and private keys; The cloud service platform returns the cloud service account parameters to the account binding end.
9. The method according to claim 7, characterized in that: The binding of the local account and the cloud service account includes: The user selects the local account to be bound to the cloud service account through the interactive module; The interaction module calls the create binding session interface of the cloud service platform and uploads the device information corresponding to the client to the cloud service platform; The cloud service platform creates a binding session and returns the session information to the interaction module; The interactive module displays the session information in the form of a QR code, and calls the session status query interface of the cloud service platform in a polling manner to query the current session status; The account binding terminal scans the QR code displayed in the code interaction module and parses it to obtain the session information; The account binding end uses the parsed session information as a parameter to call the session verification interface of the cloud service platform; After verifying the session information, the cloud service platform adjusts the session state to the authorization code verification state and generates an authorization code; The account binding end calls the authorization code verification result query interface of the cloud service platform in a polling manner, and displays the obtained authorization code in text form; The interactive module polls the session status query interface of the cloud service platform, and when the session status returned by the interface is the authorization code verification status, the polling ends and jumps to the authorization code input page; After the user enters the authorization code displayed by the account binding terminal on the authorization code input page, the interactive module uses the authorization code as a parameter to call the authorization code verification interface of the cloud service platform; The cloud service platform verifies the correctness of the authorization code and returns the verification result to the interaction module; wherein, when the verification passes, the verification result includes the cloud service account information; wherein, the cloud service account information includes: token, public and private keys, and identity authentication key; After receiving the cloud service account information, the interaction module calls the cloud service account information saving interface of the authentication module through the management module; The authentication module saves the cloud service account data to the corresponding local account specified directory and updates the binding status of the corresponding local account in the user data table; The authentication module notifies the interaction module of the cloud service account data saving result through the callback interface provided by the management module; The interactive module updates the display of the binding status between the local account and the cloud service account; The account binding end polls the interface authorization code verification status, and when the authorization code verification passes, obtains and displays the authorized device information.
10. The system according to claim 9, characterized in that Performing identity authentication based on the cloud service account includes: Obtain the account and password required for authentication through the interactive module; The interaction module calls the authentication module to initiate authentication through the cloud service authentication interface provided by the management module; The authentication module uses the private key to sign the authentication key to obtain the signature value sign, and uses the authentication key and signature value sign as request parameters to call the authentication initiation interface provided by the cloud service platform to initiate a cloud service authentication request to the cloud service platform; After receiving the identity authentication request, the cloud service platform parses and obtains the request parameters, verifies the validity of the identity authentication key, and generates an authentication process identifier fid if the verification passes. The authentication process identifier fid is used as a parameter of the successful result of the authentication initiation request response and returned to the authentication module; After receiving the successful response result of the authentication initiation request returned by the cloud service platform, the authentication module uses the authentication process identifier fid as the request parameter and calls the authentication result query interface provided by the cloud service platform through polling to query the identity authentication result; The cloud service platform uses the identity authentication key to match the corresponding account binding end, and after obtaining the account binding end information, pushes the identity authentication message to the corresponding account binding end; wherein the identity authentication message includes: the identity authentication key and the authentication process identifier fid; After receiving the identity authentication message push, the account binding end parses and obtains the identity authentication key authkey and the authentication process identifier fid parameter, and the user performs the confirmation operation; After the user performs the confirmation operation, the account binding end uses the user confirmation operation type operateType, identity authentication key authKey, and authentication process identifier fid as parameters, calls the identity authentication authorization confirmation interface provided by the cloud service platform, and initiates an authorization confirmation request; After receiving the authorization confirmation request from the account binding end, the cloud service platform parses and obtains the authorization result, and associates the authorization result with the authentication process identifier fid, so that the authentication module obtains the authorization result corresponding to the authentication process identifier fid through the polling interface; The authentication module notifies the interaction module of the authorization result through the callback interface provided by the management module; The interactive module generates corresponding prompt information based on the authorization result to feed back to the user and trigger the subsequent process.