A cross-platform identity authentication and authorization method, system, device and medium

Abstract

The present invention discloses a cross-platform identity authentication and authorization method, comprising the following steps: S01: logging in on an application on a mobile terminal; S02: the user authorizes a PC client on the mobile device, and the PC client registers a temporary AK / SK with the identity authentication and authorization service through the mobile device; S03: the PC client uses the AK / SK to generate a JWS as a resource access token to initiate a service request to a business service; S04: after receiving the service request, the business service takes the JWS in the request and verifies with the identity authentication and authorization service whether the token is valid and the association is correct, and records the JWS in the current request; S05: after the verification is successful, the business service performs business processing and records the resource access status of the current AK. By dynamically generating a JWS token and verifying it in real time, the present invention effectively prevents token theft and reuse, ensures highly secure cross-platform authorized access, and improves transaction security.

Description

Technical Field

[0001] The present invention relates to the field of information management security technology, and in particular to a cross-platform identity authentication and authorization method, system, device and medium. Background Art

[0002] In the fields of information security, network security, and identity and resource access management, the method commonly used in cross-platform identity authentication and authorization is: the user uses the logged-in application (APP or mini-program) on the mobile device to scan the code. Once the user completes the authorization confirmation on the application interface, the authorization server will immediately issue an authorized access token. During the validity period of the access token, the user can use this token to seamlessly access the authorized resources.

[0003] Although this authentication method is convenient for scanning and authorizing via a logged-in application on a mobile device, it has several significant drawbacks:

[0004] First, this authentication model relies primarily on single-factor authentication, namely the act of scanning a QR code (usually considered to indicate that the user owns and controls the device), while ignoring the importance of multi-factor authentication. This can lead to security deficiencies. In complex or high-security environments, relying solely on single-factor authentication may not be sufficient to fully ensure the security of resource access.

[0005] Secondly, some authorization servers use the JWT (JSON Web Tokens) format when issuing resource access tokens. Once a token in this format is generated and issued to a user by the authorization server, it is generally considered to be tamper-proof and the authorization server no longer directly manages it. This means that once the token is leaked or improperly used, it will be difficult for the user to directly revoke the access rights granted based on the scan code through the authorization server, thereby increasing potential security risks.

[0006] To this end, this application specifically proposes a cross-platform identity authentication and authorization method to solve the above technical problems. Summary of the Invention

[0007] The main purpose of the present invention is to provide a cross-platform identity authentication and authorization method to solve the technical problems raised in the background technology.

[0008] The present invention adopts the following technical solutions to solve the above technical problems:

[0009] A cross-platform identity authentication and authorization method, based on PC clients, mobile terminals, identity authentication and authorization services, and business services, includes the following specific steps:

[0010] Step S01: The user logs in on the application program of the mobile terminal;

[0011] Step S02: The user authorizes the PC client on the mobile device. The PC client registers a temporary AK / SK with the identity authentication and authorization service through the mobile device. Subsequent service calls use the temporary AK / SK to generate a JWS as a resource access token.

[0012] Step S03: The PC client uses the AK / SK to generate a JWS as a resource access token to initiate a service request to the business service;

[0013] Step S04: After receiving the business request, the business service takes out the JWS in the request and verifies the validity of the token request and the correctness of the association relationship with the identity authentication and authorization service, and records the JWS in the current request to prevent the reuse of the JWS.

[0014] Step S05: After the verification is passed, the business service will perform business processing and record the current resource access status of the AK.

[0015] Preferably, the login authentication method in step S01 is not limited to account password SMS verification, fingerprint recognition, and face recognition.

[0016] Preferably, the specific operation process of the PC client registering a temporary AK / SK with the identity authentication and authorization service in step S02 includes:

[0017] Step S21: The PC client obtains the network MAC address of the machine, generates a random number R, and calculates the SM3 hash value R-SM3 of R. The first 16 bytes of R-SM3 are recorded as R-SM3-Front, and the last 16 bytes are recorded as R-SM3-Back.

[0018] Step S22: The PC client sends MAC||R-SM3-Front and the MAC address to the identity authentication and authorization service, submitting a resource access permission request, where || represents data splicing;

[0019] Step S23: After receiving the request, the identity authentication and authorization service temporarily stores the PC client information, generates a 16-byte random number R2, and returns R2 and related service information to the PC client.

[0020] Step S24: The PC client receives the relevant business information and generates a QR code with R-SM3-Back, and the user scans the QR code using the scanning function of the mobile terminal application.

[0021] Step S25: The user performs authorization confirmation for the application on the mobile terminal that has passed personal identity login authentication. After confirming the relevant service information and R-SM3-Back, the relevant service information and R-SM3-Back are sent to the identity authentication and authorization service. After the identity authentication and authorization service confirms that the user information is correct, it registers MAC||R-SM3-Front as AK and R2⊕R-SM3-Back as SK, where ⊕ represents an exclusive OR operation.

[0022] Step S26: The PC client queries the identity authentication and authorization service for the user authentication result using the service ID in a polling request. After receiving the query request, the identity authentication and authorization service returns the relevant authentication information. After the authentication is successful, the PC client and the identity authentication and authorization service agree that AK is MAC||R-SM3-Front and SK is R2⊕R-SM3-Back.

[0023] Preferably, in step S03, when JWS is used as a resource access token, the signature value is generated using the HMAC algorithm, and the request time, request header, and request content in the request body need to be signed.

[0024] Preferably, when the identity authentication and authorization service verifies the JWS in step S04, it is necessary to perform HMAC operation on the request time, request header, and request content and compare them with the signature value in the JWS for consistency. After the comparison is successful, the current JWS is recorded to solve the problem of multiple uses of JWS.

[0025] Preferably, the method further includes step S06: when the number of resource accesses reaches an upper limit or the identity authentication and authorization service returns AK expiration or the user revokes authorization to the PC client on the mobile terminal, the PC client needs to re-perform the above-mentioned process of S21 to S26 to register the PC client.

[0026] A cross-platform identity authentication and authorization system, for executing any of the above-mentioned cross-platform identity authentication and authorization methods, comprising:

[0027] PC client: used to initiate service requests and receive processing results;

[0028] Mobile terminal: used to initiate requests for user identity authentication and resource access authorization;

[0029] Identity authentication and authorization service: used to handle user identity authentication and access rights management for PC clients;

[0030] Business service: It is called according to business requests and used to process actual business data;

[0031] When the PC client initiates a service request to call a service, it must carry a JWS generated based on the registered and verified AK / SK as an authorization access token;

[0032] The JWS ensures that the authorized usage times of the current PC client are still within the valid access period and that the current request is legal and valid.

[0033] Preferably, the system includes the following specific application methods:

[0034] L1. The user logs in using the mobile application.

[0035] L2. The user initiates a service request using a PC client. If the current PC client has not been authorized, a QR code will pop up on the PC client screen, requiring the user to perform a secondary identity authentication.

[0036] L3. If a QR code appears, the user scans it using the app and completes facial recognition authentication.

[0037] L4. After the user completes facial recognition, the identity authentication and authorization service will register the AK / SK for the PC client;

[0038] L5. After the PC client is authorized, it will use the AK / SK to generate a JWS locally and submit a service request to the service with the JWS.

[0039] L6. After receiving the business request, the business service verifies the JWS contained in the request with the identity authentication and authorization service.

[0040] L7. Only after verification is passed will the business service complete the corresponding operation according to the business request and return the business processing result.

[0041] In another aspect, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0042] On the other hand, the present invention further discloses a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0043] As can be seen from the above technical solution, the present invention provides a cross-platform identity authentication and authorization method. Compared with the existing technology, the present invention has the following advantages:

[0044] 1. This invention generates a new JWS as an access token for each service request, and uses the HMAC algorithm to sign and verify the key information of the request, which can effectively defend against token interception and replay attacks, ensure the authenticity and uniqueness of each request, and maintain the integrity of authorized communications.

[0045] 2. This invention implements dynamic management of access credentials by setting usage limits and validity period limits for AK / SK, forcing regular re-verification, thereby significantly reducing the risk of long-term valid credentials being misused and enhancing the security continuity of the system.

[0046] 3. This invention implements centralized management of AK / SK of PC clients by identity authentication and authorization services, allowing immediate revocation of access rights of suspicious or untrusted clients, and even adding their MAC addresses to blacklists, greatly enhancing the controllability and security management capabilities of client access.

[0047] 4. The present invention sets a temporary AK / SK mechanism during the interaction between the PC client and the business service, and uses these credentials to generate JWS as a resource access token, which can play a role in dynamic, one-time authorized access control, ensuring that each request carries a strictly encrypted and signed information package, effectively preventing unauthorized access and token reuse attacks.

[0048] 5. This invention uses business services to perform real-time verification of received JWS and to verify their validity and relevance with the identity authentication and authorization service. This not only strengthens the authenticity and timeliness of requests, but also tracks and records AK usage, helping to monitor and prevent potential abuse. This greatly enhances the security and reliability of the cross-platform identity authentication and authorization system, protects user resources from illegal intrusion, and ensures the efficiency and legitimacy of business processing.

[0049] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become easy to understand through the following description. Of course, it is not necessary to achieve all of the above-mentioned advantages simultaneously in order to implement any product of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are intended to explain the present invention and do not constitute an undue limitation of the present invention. In the accompanying drawings:

[0051] Figure 1 Schematic diagram of the overall timing of the method of the present invention;

[0052] Figure 2Schematic diagram of the interaction of the system of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. In the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0054] In the embodiment, see Figures 1 to 2 .

[0055] like Figure 1 As shown, a cross-platform identity authentication and authorization method proposed in an embodiment of the present invention performs operations based on a PC client, a mobile terminal, an identity authentication and authorization service, and a business service, including the following specific steps:

[0056] Step S01: The user logs in on the application program of the mobile terminal;

[0057] The login authentication method is not limited to account password SMS verification, fingerprint recognition, and face recognition. Generally, face recognition is used more frequently. From the perspective of the security of authorized and trusted PC clients, the user's face recognition method is used as part of multi-factor authentication. Since facial recognition relies on the user's physical presence, it is equivalent to adding a biometric layer, which reduces the risk of authorization through stolen devices, thereby improving user security. Therefore, by integrating face recognition into the user authorization process, a strong identity authentication method of biometrics is added, which effectively ensures the physical presence of the operation, greatly reduces the risk of unauthorized access, improves the account protection level, and ensures the security of user resource access.

[0058] Step S02: The user authorizes the PC client on the mobile device. The PC client registers a temporary AK / SK with the identity authentication and authorization service through the mobile device. Subsequent service calls use the temporary AK / SK to generate a JWS (JSON Web Signature) as a resource access token.

[0059] The specific operation process of the PC client registering a temporary AK / SK with the identity authentication and authorization service includes:

[0060] Step S21: The PC client obtains the network MAC address of the machine, generates a random number R, and calculates the SM3 hash value R-SM3 of R. The first 16 bytes of R-SM3 are recorded as R-SM3-Front, and the last 16 bytes are recorded as R-SM3-Back.

[0061] Step S22: The PC client sends MAC||R-SM3-Front and the MAC address to the identity authentication and authorization service, submitting a resource access permission request, where || represents data splicing;

[0062] Step S23: After receiving the request, the identity authentication and authorization service temporarily stores the PC client information, generates a 16-byte random number R2, and returns R2 and related service information (such as service ID) to the PC client.

[0063] Step S24: The PC client generates a QR code with the received relevant business information (except R2) and R-SM3-Back, and the user scans the QR code using the scanning function of the mobile terminal application.

[0064] Step S25: The user performs authorization confirmation for the application on the mobile terminal that has passed personal identity login authentication. After confirming the relevant service information and R-SM3-Back, the relevant service information and R-SM3-Back are sent to the identity authentication and authorization service. After the identity authentication and authorization service confirms that the user information is correct, it registers MAC||R-SM3-Front as AK and R2⊕R-SM3-Back as SK, where ⊕ represents an exclusive OR operation.

[0065] Step S26: The PC client queries the identity authentication and authorization service for the user authentication result using the service ID in a polling request mode. After receiving the query request, the identity authentication and authorization service returns the relevant authentication information. After the authentication is successful, the PC client and the identity authentication and authorization service agree that AK is MAC||R-SM3-Front and SK is R2⊕R-SM3-Back.

[0066] Step S03: The PC client uses the AK / SK to generate a JWS as a resource access token to initiate a service request to the business service;

[0067] From the perspective of the security of authorization tokens, each time a PC client initiates a service request, it needs to generate a new JWS as a resource access token. When JWS is used as a resource access token, the signature value is generated using the HMAC algorithm, and the request time, request header, and request content in the request body need to be signed.

[0068] Step S04: After receiving the business request, the business service takes out the JWS in the request and verifies the validity of the token request and the correctness of the association relationship with the identity authentication and authorization service, and records the JWS in the current request to prevent the reuse of the JWS.

[0069] When the identity authentication and authorization service verifies the JWS, it needs to perform HMAC calculations on the request time, request header, and request content and compare them with the signature value in the JWS for consistency. After the comparison is successful, the current JWS is recorded to solve the problem of multiple uses of JWS. The JWS generation and verification operations of the token can reduce the risk of misappropriation by intercepting the authorization code or token;

[0070] Therefore, by generating a new JWS as an access token for each business request and signing and verifying the key information of the request with the HMAC algorithm, it is possible to effectively defend against token interception and replay attacks, ensure the authenticity and uniqueness of each request, and maintain the integrity of authorized communications. At the same time, by setting a temporary AK / SK mechanism during the interaction between the PC client and the business service, and using these credentials to generate JWS as a resource access token, it can play a role in dynamic, one-time authorized access control, ensuring that each request carries a strictly encrypted and signed information package, effectively preventing unauthorized access and token reuse attacks;

[0071] Step S05: After the verification is passed, the business service will perform business processing and record the current AK's resource access status;

[0072] At this point, the received JWS is verified in real time through the business service and its validity and relevance are verified with the identity authentication and authorization service. This not only strengthens the authenticity and timeliness of the request, but also tracks and records the use of AK, helping to monitor and prevent potential abuse. This greatly enhances the security and reliability of the cross-platform identity authentication and authorization system, protects user resources from illegal intrusion, and ensures the efficiency and legitimacy of business processing.

[0073] Step S06: When the resource access times reach the upper limit or the identity authentication and authorization service returns that the AK has expired, or the user revokes the authorization of the PC client on the mobile terminal, the PC client needs to re-register the PC client by performing the above steps S21 to S26;

[0074] At this time, the number of times and time that AK / SK is used have upper limits. When either of them exceeds the threshold, re-registration is required. Therefore, by setting the number of times AK / SK is used and the validity period limit, dynamic management of access credentials is achieved, forcing regular re-verification, thereby significantly reducing the risk of long-term valid credentials being stolen and enhancing the security continuity of the system.

[0075] In summary, this application can effectively prevent token theft and reuse by dynamically generating JWS tokens and verifying them in real time, ensuring highly secure cross-platform authorized access and improving system protection capabilities and transaction security.

[0076] On the other hand, Figure 2 As shown, the present invention further discloses a cross-platform identity authentication and authorization system, which is used to execute any of the above cross-platform identity authentication and authorization methods as an operating principle. The system structure includes:

[0077] PC client: used to initiate service requests and receive processing results;

[0078] Mobile terminal: used to initiate requests for user identity authentication and resource access authorization;

[0079] Identity authentication and authorization service: used to handle user identity authentication and access rights management for PC clients;

[0080] Business service: It is called according to business requests and used to process actual business data;

[0081] When a PC client initiates a business request to call a business service, it must carry a JWS generated based on the registered and verified AK / SK as an authorized access token;

[0082] JWS ensures that the authorized usage count of the current PC client is still within the valid access period and that the current request is legal and valid.

[0083] At this time, the AK / SK of the PC client is centrally managed by the identity authentication and authorization service. When a PC client is considered untrustworthy, its AK can be deregistered and its network MAC address can be added to the blacklist, which improves the manageability of the PC client.

[0084] In addition, after the user completes the business, he can revoke the authorization of the PC client on the mobile terminal. This solves the problem that the authorization cannot be revoked after the PC client is authorized, and the risk that the subsequent user of the PC client can steal the previous user's identity to complete the business.

[0085] Therefore, in summary, this application implements AK / SK of PC clients centrally managed by identity authentication and authorization services, allowing the immediate revocation of access rights of suspicious or no longer trusted clients, and even adding their MAC addresses to the blacklist, greatly enhancing the controllability and security management capabilities of client access.

[0086] Furthermore, the identity authentication and authorization system includes the following specific usage methods during use:

[0087] L1. Users log in using an application on a mobile device. Login authentication methods are not limited to SMS verification of account and password, fingerprint recognition, or facial recognition.

[0088] L2. The user initiates a service request using a PC client. If the current PC client has not been authorized, a QR code will pop up on the PC client screen, requiring the user to perform a secondary identity authentication.

[0089] L3. If a QR code appears, the user scans it using the app and completes facial recognition authentication.

[0090] L4. After the user completes facial recognition, the identity authentication and authorization service will register the AK / SK for the PC client;

[0091] L5. After the PC client is authorized, it will use the AK / SK to generate a JWS locally and submit a service request to the service with the JWS.

[0092] L6. After receiving the business request, the business service verifies the JWS contained in the request with the identity authentication and authorization service.

[0093] L7. Only after verification is passed will the business service complete the corresponding operation according to the business request and return the business processing result.

[0094] In another aspect, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0095] On the other hand, the present invention further discloses a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0096] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any cross-platform identity authentication and authorization method in the above embodiments.

[0097] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts of the above method.

[0098] The embodiment of the present application further provides an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus.

[0099] Memory for storing computer programs;

[0100] The processor is used to implement the above-mentioned cross-platform identity authentication and authorization method when executing the program stored in the memory.

[0101] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0102] The communication interface is used for communication between the above electronic device and other devices.

[0103] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage. Alternatively, the memory may be at least one storage device located remote from the processor.

[0104] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0105] It should also be noted that electronic devices also include terminal devices, which may also be referred to as terminals, user equipment (UE), mobile stations (MS), mobile terminals (MT), etc. Terminal devices may be mobile phones, smart TVs, wearable devices, tablet computers, computers with wireless transceiver functions, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

[0106] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0107] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0108] In addition, it should be noted that if the embodiments of the present invention involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture. If the specific posture changes, the directional indications will also change accordingly.

[0109] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present invention, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, the meaning of "and / or" appearing throughout the text includes three parallel schemes. Taking "A and / or B" as an example, it includes scheme A, or scheme B, or schemes in which A and B are satisfied at the same time. In addition, in the embodiments of the present invention, "multiple" refers to more than two. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

Claims

1. A cross-platform identity authentication and authorization method, based on PC client, mobile terminal, identity authentication and authorization service and business service execution operation, characterized in that: The specific steps include: Step S01: The user logs in on the application program of the mobile terminal; Step S02: The user authorizes the PC client on the mobile device. The PC client registers a temporary AK / SK with the identity authentication and authorization service through the mobile device. Subsequent service calls use the temporary AK / SK to generate a JWS as a resource access token. Step S03: The PC client uses the AK / SK to generate a JWS as a resource access token to initiate a service request to the business service; Step S04: After receiving the business request, the business service takes out the JWS in the request and verifies the validity of the token request and the correctness of the association relationship with the identity authentication and authorization service, and records the JWS in the current request to prevent the reuse of the JWS. Step S05: After the verification is passed, the business service will perform business processing and record the current AK's resource access status; The specific operation process of the PC client registering a temporary AK / SK with the identity authentication and authorization service in step S02 includes: Step S21: The PC client obtains the network MAC address of the machine, generates a random number R, and calculates the SM3 hash value R-SM3 of R. The first 16 bytes of R-SM3 are recorded as R-SM3-Front, and the last 16 bytes are recorded as R-SM3-Back. Step S22: The PC client sends MAC||R-SM3-Front and the MAC address to the identity authentication and authorization service, submitting a resource access permission request, where || represents data splicing; Step S23: After receiving the request, the identity authentication and authorization service temporarily stores the PC client information, generates a 16-byte random number R2, and returns R2 and related service information to the PC client; Step S24: The PC client receives the relevant business information and generates a QR code with R-SM3-Back, and the user scans the QR code using the scanning function of the mobile terminal application; Step S25: The user performs authorization confirmation for the application on the mobile terminal that has passed personal identity login authentication. After confirming the relevant service information and R-SM3-Back, the relevant service information and R-SM3-Back are sent to the identity authentication and authorization service. After the identity authentication and authorization service confirms that the user information is correct, it registers MAC||R-SM3-Front as AK and R2⊕R-SM3-Back as SK, where ⊕ represents an exclusive OR operation. Step S26: The PC client queries the identity authentication and authorization service for the user authentication result using the service ID in a polling request. After receiving the query request, the identity authentication and authorization service returns the relevant authentication information. After the authentication is successful, the PC client and the identity authentication and authorization service agree that AK is MAC||R-SM3-Front and SK is R2⊕R-SM3-Back.

2. The cross-platform identity authentication and authorization method according to claim 1, wherein: The login authentication method in step S01 is not limited to account password SMS verification, fingerprint recognition, and face recognition.

3. The cross-platform identity authentication and authorization method according to claim 1, wherein: The method further includes step S06: when the number of resource accesses reaches an upper limit or the identity authentication and authorization service returns AK expiration or the user revokes authorization to the PC client on the mobile terminal, the PC client needs to re-perform the process of steps S21 to S26 to register the PC client.

4. The cross-platform identity authentication and authorization method according to claim 1, wherein: In step S03, when JWS is in the resource access token state, the signature value is generated using the HMAC algorithm, and the request time, request header, and request content in the request body need to be signed.

5. The cross-platform identity authentication and authorization method according to claim 4, wherein: In step S04, when the identity authentication and authorization service verifies the JWS, it needs to perform HMAC operation on the request time, request header, and request content and compare them with the signature value in the JWS for consistency. After the comparison is successful, the current JWS is recorded to solve the problem of multiple uses of JWS.

6. A cross-platform identity authentication and authorization system, characterized in that: The cross-platform identity authentication and authorization method for executing any one of claims 1 to 5 above comprises: PC client: used to initiate service requests and receive processing results; Mobile terminal: used to initiate requests for user identity authentication and resource access authorization; Identity authentication and authorization service: used to handle user identity authentication and access rights management for PC clients; Business service: It is called according to business requests and used to process actual business data; When the PC client initiates a service request to call a service, it must carry a JWS generated based on the registered and verified AK / SK as an authorization access token; The JWS ensures that the authorized usage times of the current PC client are still within the valid access period and that the current request is legal and valid.

7. The cross-platform identity authentication and authorization system according to claim 6, wherein: Including the following specific usage methods: L1. The user logs in using the application on the mobile terminal; L2. The user initiates a service request using a PC client. If the current PC client has not been authorized, a QR code will pop up on the PC client screen, requiring the user to perform a secondary identity authentication. L3. If a QR code appears, the user scans it using the app and completes facial recognition authentication. L4. After the user completes facial recognition, the identity authentication and authorization service will register the AK / SK for the PC client; L5. After the PC client is authorized, it will use the AK / SK to generate a JWS locally and submit a service request to the service with the JWS. L6. After receiving the business request, the business service verifies the JWS contained in the request with the identity authentication and authorization service; L7. Only after verification is passed will the business service complete the corresponding operation according to the business request and return the business processing result.

8. A computer-readable storage medium, characterized in that A computer program is stored, and when the computer program is executed by a processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 5.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 5.

Images