Identity authentication method, device and equipment based on USB key, medium and product

Abstract

The invention provides an identity authentication method based on a USB key, which can be applied to the technical field of information security. The identity authentication method based on the USB key comprises the following steps: in response to a login request from a client, forwarding the login request to a third party; receiving a first random string ciphertext from a third party under the condition that the authorized identities are mutually recognized; decrypting the first random string ciphertext to obtain a first random string plaintext; encrypting the first random string plaintext to obtain a second random string ciphertext; based on the second random string ciphertext, client authentication information formed through the USB key is acquired; and sending the client authentication information to a third party. The invention further provides an identity authentication device and equipment based on the USB key, a medium and a product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a U-shield-based identity authentication method, device, equipment, medium and product. Background Art

[0002] In the process of handling financial business, it is often necessary for the same customer to log in to the information systems of multiple partner institutions before handling financial business. The information systems of different partner institutions are independent of each other, and the login methods are also different. When it comes to some special financial operations, although the bank's customers can log in directly through the U shield, in the partner institution, it is often necessary to perform a complex identity authentication process to log in to the information system of the partner institution. This will greatly affect the customer's identity authentication experience. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a USB-based identity authentication method, device, equipment, medium and product that improve the efficiency of identity authentication.

[0004] According to a first aspect of the present disclosure, a U-shield-based identity authentication method is provided, the method is applied to a U-shield mutual recognition system, the U-shield mutual recognition system includes: a first party and a third party, the method is applied to the first party, the method includes: in response to a login request from a customer, forwarding the login request to the third party; in the case of authorized identity mutual recognition, receiving a first random string ciphertext from the third party; decrypting the first random string ciphertext to obtain a first random string plaintext; encrypting the first random string plaintext to obtain a second random string ciphertext; based on the second random string ciphertext, obtaining customer authentication information formed by the U-shield; and sending the customer authentication information to the third party.

[0005] According to an embodiment of the present disclosure, decrypting the first random string ciphertext to obtain the first random string plaintext includes: decrypting the first random string ciphertext based on a first key to obtain the first random string plaintext; encrypting the first random string plaintext to obtain the second random string ciphertext includes: encrypting the first random string plaintext based on a second key to obtain the second random string ciphertext.

[0006] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0007] According to an embodiment of the present disclosure, obtaining customer authentication information formed by U-Shield based on the second random string ciphertext includes: obtaining the second random string ciphertext and customer-related information; transmitting the second random string ciphertext and the customer-related information to U-Shield; and receiving customer authentication information from U-Shield.

[0008] According to a second aspect of the present disclosure, a U-shield-based identity authentication method is provided, the U-shield mutual recognition system comprising: a first party and a third party, the method being applied to the third party, the method comprising: judging whether to authorize identity mutual recognition based on a login request received from the first party; in the case of authorized identity mutual recognition, generating a first random string plaintext; encrypting the first random string plaintext to obtain a first random string ciphertext; sending the first random string ciphertext to the first party; parsing customer authentication information from the first party to obtain a second random string ciphertext and customer-related information; decrypting the second random string ciphertext to obtain a second random string plaintext; judging whether the second random string plaintext and the customer-related information pass a preset verification rule; and judging that the customer login is successful if the second random string plaintext and the customer-related information pass.

[0009] According to an embodiment of the present disclosure, encrypting the first random string plaintext to obtain a first random string ciphertext includes: encrypting the first random string plaintext based on a third key to obtain a first random string ciphertext; decrypting the second random string ciphertext to obtain a second random string plaintext includes: decrypting the second random string ciphertext based on a fourth key to obtain a second random string plaintext.

[0010] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0011] According to an embodiment of the present disclosure, the determination of whether the second random string plaintext and the customer-related information pass a preset verification rule includes: determining whether the second random string plaintext and the first random string plaintext are consistent; determining whether the customer-related information has been tampered with; and determining whether the certificate in the customer-related information is issued by a root certificate.

[0012] According to a third aspect of the present disclosure, a U-shield-based identity authentication method is provided, the method is applied to a U-shield mutual recognition system, the U-shield mutual recognition system includes: a first party and a third party, the method includes: the first party responds to a login request from a customer, forwarding the login request to the third party; the third party determines whether to authorize identity mutual recognition based on the login request received from the first party; the third party generates a first random string plaintext under the condition of authorizing identity mutual recognition; the third party encrypts the first random string plaintext to obtain a first random string ciphertext; the third party sends the first random string ciphertext to the first party; the first party receives the first random string ciphertext from the third party under the condition of authorizing identity mutual recognition; the first party The first party decrypts the first random string ciphertext to obtain the first random string plaintext; the first party encrypts the first random string plaintext to obtain the second random string ciphertext; the first party obtains the customer authentication information formed by the U shield based on the second random string ciphertext; the first party sends the customer authentication information to a third party; the third party parses the customer authentication information from the first party to obtain the second random string ciphertext and customer-related information; the third party decrypts the second random string ciphertext to obtain the second random string plaintext; the third party determines whether the second random string plaintext and the customer-related information pass the preset verification rules; and the third party determines that the customer login is successful if the second random string plaintext and the customer-related information pass.

[0013] The fourth aspect of the present disclosure provides an identity authentication device based on U-Shield, which is applied to the U-Shield mutual recognition system. The U-Shield mutual recognition system includes: a first party and a third party. The device is applied to the first party, and the device includes: a request forwarding module, which is used to respond to a login request from a customer and forward the login request to the third party; a first random string ciphertext receiving module, which is used to receive a first random string ciphertext from a third party in the case of authorized identity mutual recognition; a first random string ciphertext decryption module, which is used to decrypt the first random string ciphertext to obtain a first random string plaintext; a first random string plaintext encryption module, which is used to encrypt the first random string plaintext to obtain a second random string ciphertext; a customer authentication information acquisition module, which is used to obtain customer authentication information formed by U-Shield based on the second random string ciphertext; and a customer authentication information sending module, which is used to send the customer authentication information to a third party.

[0014] According to an embodiment of the present disclosure, the first random string ciphertext decryption module includes: a first random string ciphertext decryption unit, used to decrypt the first random string ciphertext based on a first key to obtain the first random string plaintext; the first random string plaintext encryption module includes: a first random string plaintext encryption unit, used to encrypt the first random string plaintext based on a second key to obtain the second random string ciphertext.

[0015] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0016] According to an embodiment of the present disclosure, the customer authentication information acquisition module includes: a customer authentication information acquisition unit, used to obtain the second random string ciphertext and customer-related information; transmit the second random string ciphertext and the customer-related information to a U-shield; and receive customer authentication information from the U-shield.

[0017] The fifth aspect of the present disclosure provides an identity authentication device based on U shield, the device is applied to the U shield mutual recognition system, the U shield mutual recognition system includes: a first party and a third party, the device is applied to the third party, the device includes: an authorized identity mutual recognition judgment module, which is used to judge whether to authorize identity mutual recognition based on the login request received from the first party; a first random string plaintext generation module, which is used to generate a first random string plaintext in the case of authorized identity mutual recognition; a first random string ciphertext generation module, which is used to encrypt the first random string plaintext to obtain a first random string ciphertext; a first random string ciphertext sending module, which is used to send the first random string ciphertext to the first party; a customer authentication information decryption module, which is used to parse the customer authentication information from the first party to obtain a second random string ciphertext and customer related information; a second random string ciphertext decryption module, which is used to decrypt the second random string ciphertext to obtain a second random string plaintext; a verification module, which is used to judge whether the second random string plaintext and the customer related information pass the preset verification rules; and a login success judgment module, which is used to judge that the customer login is successful when the second random string plaintext and the customer related information pass.

[0018] According to an embodiment of the present disclosure, the first random string ciphertext generation module includes: a first random string ciphertext generation unit, used to encrypt the first random string plaintext based on a third key to obtain a first random string ciphertext; the second random string ciphertext decryption module includes: a second random string ciphertext decryption unit, used to decrypt the second random string ciphertext based on a fourth key to obtain a second random string plaintext.

[0019] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0020] According to an embodiment of the present disclosure, the verification module includes: a verification unit, used to determine whether the second random string plaintext is consistent with the first random string plaintext; determine whether the customer-related information has been tampered with; and determine whether the certificate in the customer-related information is issued by a root certificate.

[0021] The sixth aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned U-shield-based identity authentication method.

[0022] The seventh aspect of the present disclosure also provides a computer-readable storage medium on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the above-mentioned U-shield-based identity authentication method.

[0023] The eighth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above-mentioned U-shield-based identity authentication method when executed by a processor.

[0024] In the embodiments of the present disclosure, in order to solve the technical problem of cumbersome and difficult login to different information systems, the first-party and third-party identity authentication involved in the embodiments of the present disclosure is to directly exchange data and deploy functions of the authentication information between the two parties, without involving a third party or an intermediate transfer processing platform for processing. By reducing the intermediate links and corresponding roles, the potential hidden dangers in the data transmission process are ensured, thereby increasing the security of the identity authentication information. At the same time, on the basis of using the bank U shield authentication, both parties participate in the independent encryption and decryption of random numbers, and the authentication results are individually verified, further enhancing the security of the identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0026] Figure 1A The following schematically shows an application scenario diagram of the identity authentication method based on U-shield according to an embodiment of the present disclosure;

[0027] Figure 1B The system architecture diagram of the U-Shield mutual recognition system according to the embodiment of the present disclosure is schematically shown;

[0028] Figure 2 A flowchart of a U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 3 A flowchart of a U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown;

[0030] Figure 4 The full flow chart of the identity authentication method based on U shield according to the embodiment of the present disclosure is schematically shown;

[0031] Figure 5The full flow chart of a U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown;

[0032] Figure 6 The structure block diagram of the identity authentication device based on U shield according to the embodiment of the present disclosure is schematically shown;

[0033] Figure 7 A schematic diagram of a structure of an identity authentication device based on a USB shield according to an embodiment of the present disclosure is shown; and

[0034] Figure 8 A block diagram of an electronic device suitable for implementing an identity authentication method based on a U-shield according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0035] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0036] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0037] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0038] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0039] In a typical scenario, when corporate customers conduct business through the customs "single window" financial services, they must log in to the financial services with an electronic port identity authentication medium (operator card ukey). Since some financial personnel of small and medium-sized enterprises do not have an electronic port operator card, this makes it impossible for such customers to adopt the more convenient electronic port identity authentication medium solution, and instead need to perform a long process of identity authentication verification, which greatly increases the difficulty of cross-information system financial business handling and affects the development and growth of financial services.

[0040] In order to solve the technical problems existing in the prior art, an embodiment of the present disclosure provides an identity authentication method based on U-Shield, the method is applied to the U-Shield mutual recognition system, the U-Shield mutual recognition system includes: a first party and a third party, the method is applied to the first party, the method includes: in response to a login request from a customer, forwarding the login request to the third party; in the case of authorized identity mutual recognition, receiving a first random string ciphertext from the third party; decrypting the first random string ciphertext to obtain a first random string plaintext; encrypting the first random string plaintext to obtain a second random string ciphertext; based on the second random string ciphertext, obtaining customer authentication information formed by U-Shield; and sending the customer authentication information to the third party.

[0041] In the embodiments of the present disclosure, in order to solve the technical problem of cumbersome and difficult login to different information systems, the first-party and third-party identity authentication involved in the embodiments of the present disclosure is to directly exchange data and deploy functions of the authentication information between the two parties, without involving a third party or an intermediate transfer processing platform for processing. By reducing the intermediate links and corresponding roles, the potential hidden dangers in the data transmission process are ensured, thereby increasing the security of the identity authentication information. At the same time, on the basis of using the bank U shield authentication, both parties participate in the independent encryption and decryption of random numbers, and the authentication results are individually verified, further enhancing the security of the identity authentication.

[0042] Figure 1A The application scenario diagram of the U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown.

[0043] like Figure 1A As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0044] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0045] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0046] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0047] It should be noted that the identity authentication method based on U shield provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the identity authentication device based on U shield provided in the embodiment of the present disclosure can generally be set in the server 105. The identity authentication method based on U shield provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the identity authentication device based on U shield provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0048] It should be understood that Figure 1A The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0049] Figure 1B The system architecture diagram of the U-Shield mutual recognition system according to an embodiment of the present disclosure is schematically shown.

[0050] like Figure 1BAs shown, in the U-Shield mutual recognition system, the first party 110 and the third party 120 are institutions with a mutual cooperative relationship. Furthermore, the first party 110 and the third party 120 are institutions that have signed a U-Shield mutual recognition agreement with each other. When a customer logs in to the information system interface of the first party 110 through a PC, he can use a unified authentication medium (such as a bank U-Shield) for identity authentication to log in to the information system of the third party 120. The authentication results of the identity recognition media of different institutions can be mutually recognized without switching the authentication media.

[0051] It should be noted that the identity authentication between the first party 110 and the third party 120 involved in the embodiments of the present disclosure is a direct data exchange and function deployment of the authentication information between the two parties, and does not involve a third party or an intermediate transfer processing platform for processing. By reducing the intermediate links and corresponding roles, the potential hidden dangers in the data transmission process are ensured, thereby increasing the security of the identity authentication information. For example, in the bank-customs scenario, the data transmitted can be transmitted by dedicated line and / or Internet, and can directly use dedicated network communication or Internet communication without jumping through an intermediate platform.

[0052] Figure 2 The flowchart of the U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown.

[0053] like Figure 2 As shown, the U-shield-based identity authentication method of this embodiment includes operations S210 to S260, and the U-shield-based identity authentication method can be executed by the server 105 configured with the information system of the first party 110.

[0054] In operation S210, in response to a login request from a client, the login request is forwarded to a third party.

[0055] The login request includes basic information that can be used to identify the customer, such as customer ID, customer company information, taxpayer number, etc. When the first party receives the login request that can be used for identity verification, it forwards it to the third party.

[0056] In operation S220, in the case of mutual recognition of the authorized identities, a first random string ciphertext is received from a third party.

[0057] The first random string ciphertext refers to a random string in an encrypted state, which is generated by a third party and sent to the first party after being encrypted. It can be understood that the embodiments of the present disclosure, based on the use of U-Shield authentication, conduct a separate verification of the authentication result by both parties participating in the independent encryption and decryption of random numbers, thereby further enhancing the security of identity authentication.

[0058] In operation S230, the first random string ciphertext is decrypted to obtain a first random string plaintext.

[0059] The first random string ciphertext may be encrypted and decrypted based on a symmetric encryption algorithm, or may be encrypted and decrypted based on an asymmetric encryption algorithm, or may be encrypted in other ways. For example, the first random string ciphertext may be encrypted using a symmetric key, and decrypted using a symmetric key pre-stored by the first party or transmitted in other ways; or, for another example, the first random string ciphertext may be encrypted using an asymmetric key (private key), and decrypted using an asymmetric key pre-stored by the first party or transmitted in other ways (public key).

[0060] According to an embodiment of the present disclosure, decrypting the first random string ciphertext to obtain the first random string plaintext includes: decrypting the first random string ciphertext based on a first key to obtain the first random string plaintext.

[0061] The first key may be a symmetric key or an asymmetric key.

[0062] In operation S240, the first random string plaintext is encrypted to obtain a second random string ciphertext.

[0063] The second random string ciphertext may be encrypted and decrypted based on a symmetric encryption algorithm, the second random string ciphertext may be encrypted and decrypted based on an asymmetric encryption algorithm, or the second random string ciphertext may be encrypted and decrypted using other encryption and decryption methods.

[0064] According to an embodiment of the present disclosure, encrypting the first random string plaintext to obtain the second random string ciphertext includes: encrypting the first random string plaintext based on a second key to obtain the second random string ciphertext.

[0065] Specifically, the first key and the second key are different keys, that is, the encryption and decryption process of the random string by a third party also needs to use the keys corresponding to the first key and the second key, the first key corresponds to the third key, and the second key corresponds to the fourth key.

[0066] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0067] The code book is a carrier for recording passwords or encryption methods, which can convert the information to be protected through specific rules so that only people who know the password or decryption method can read the content. The first party 110 and the third party 120 can use the same code book for encryption and decryption operations. The key or encryption information in the code book is also pre-stored. The code book is synchronized regularly between the first party 110 and the third party 120, and the code book can be synchronized without the need for transmission through the network, which can make up for the shortcomings of the code book (that is, when the code book is lost or stolen by others, the encrypted data may still be leaked).

[0068] In operation S250, based on the second random string ciphertext, customer authentication information formed by the USB shield is obtained.

[0069] Specifically, the U-shield may encrypt the data with the second random string ciphertext to form customer authentication information.

[0070] According to an embodiment of the present disclosure, obtaining customer authentication information formed by U-Shield based on the second random string ciphertext includes: obtaining the second random string ciphertext and customer-related information; transmitting the second random string ciphertext and the customer-related information to U-Shield; and receiving customer authentication information from U-Shield.

[0071] It is understandable that, in addition to the original U-Shield authentication method, a third party generates a random string for separate verification, which is added as verification data to the verification process, and the separately agreed random encryption method is completely different from the traditional U-Shield encryption method. In this way, third parties are also involved in the bank's U-Shield authentication process, enhancing the accuracy and reliability of the verification results.

[0072] In operation S260, the client authentication information is sent to a third party.

[0073] In a typical scenario, after the customer authorizes the bank (first party) U-shield to authenticate the identity in the third-party information system, it does not completely rely on the bank's existing U-shield authentication method and results as the bank and third-party identity authentication results. Instead, the third party also participates in the customer authentication process. That is, the first party will receive a random string plaintext generated by the third party (which can be a string of random numbers associated with this authentication transaction generated according to a certain random algorithm). Encrypt and generate random string ciphertext and send the random string ciphertext to the bank. The bank decrypts the random string ciphertext and then encrypts it, and packages it with the bank U-shield certificate, signature, and customer information required for the transaction as the encryption object. The bank U-shield uses a digest algorithm to encrypt the object, generate a digest value, and then encrypts the digest value using an asymmetric encryption algorithm through the U-shield private key to generate digest encryption information. The encrypted object, digest encryption information, and U-shield public key certificate are packaged to form customer authentication information and sent to the third party.

[0074] Optionally, when the bank encrypts the certificate, signature, customer information and random string, it can add secondary encryption of the customer information content to ensure the security of important customer information.

[0075] In the embodiments of the present disclosure, in order to solve the technical problem of cumbersome and difficult login to different information systems, the first-party and third-party identity authentication involved in the embodiments of the present disclosure is to directly exchange data and deploy functions of the authentication information between the two parties, without involving a third party or an intermediate transfer processing platform for processing. By reducing the intermediate links and corresponding roles, the potential hidden dangers in the data transmission process are ensured, thereby increasing the security of the identity authentication information. At the same time, on the basis of using the bank U shield authentication, both parties participate in the independent encryption and decryption of random numbers, and the authentication results are individually verified, further enhancing the security of the identity authentication.

[0076] Figure 3 The flowchart of the U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown.

[0077] like Figure 3 As shown, the U-shield-based identity authentication method of this embodiment includes operations S310 to S380, and the U-shield-based identity authentication method can be executed by the server 105 of the information system configured with the third party 120.

[0078] In operation S310, based on the login request received from the first party, it is determined whether to authorize mutual identity recognition.

[0079] Specifically, the client has stored the relevant information of the user's identity authority in the information system of the third party 120 in advance. For example, the client authorizes the first party 110 and the third party 120 to use U-shield mutual recognition. For another example, the user authorizes the first party 110 and the third party 120 to use U-shield mutual recognition for certain specific financial services. The third party 120 can query whether the client authorizes the identity mutual recognition mechanism through the login request.

[0080] In operation S320, in the case of mutual recognition of the authorized identities, a first random string plain text is generated.

[0081] Specifically, in the case of an authorized identity mutual recognition mechanism, a third party can generate a random string plaintext, and the random string plaintext can be generated according to any algorithm, which will not be described in detail here.

[0082] In operation S330, the first random string plaintext is encrypted to obtain a first random string ciphertext.

[0083] According to an embodiment of the present disclosure, encrypting the first random string plaintext to obtain the first random string ciphertext includes: encrypting the first random string plaintext based on a third key to obtain the first random string ciphertext.

[0084] The third key may be a symmetric key or an asymmetric key.

[0085] In operation S340, the first random string ciphertext is sent to the first party.

[0086] In operation S350, the customer authentication information from the first party is parsed to obtain a second random string ciphertext and customer related information.

[0087] Specifically, the customer authentication information from the first party is received (the customer authentication information is the information after the random string and the customer related information are packaged), and it is parsed to obtain the second random string ciphertext and the customer related information. The customer related information includes: bank U shield certificate, signature and customer information required for transaction.

[0088] In operation S360, the second random string ciphertext is decrypted to obtain a second random string plaintext.

[0089] The second random string ciphertext may be encrypted and decrypted based on a symmetric encryption algorithm, the second random string ciphertext may be encrypted and decrypted based on an asymmetric encryption algorithm, or the second random string ciphertext may be encrypted and decrypted using other encryption and decryption methods.

[0090] According to an embodiment of the present disclosure, decrypting the second random string ciphertext to obtain the second random string plaintext includes: decrypting the second random string ciphertext based on a fourth key to obtain the second random string plaintext.

[0091] The fourth key may be a symmetric key or an asymmetric key.

[0092] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0093] In a typical scenario, the bank and the third party jointly encrypt the random string separately according to the agreed rules: before the bank encrypts the data including the random string through the U shield. The bank will encrypt and convert the random string provided by the third party according to the encryption rules agreed with the third party (for example, using a code book and other data conversion processing methods). The converted random string and other information are encrypted together with the bank's U shield and transmitted to the third party. After parsing the U shield encrypted information, the third party also needs to reverse decrypt the encrypted random string. Verify the consistency of the decrypted information with the original data provided to the bank to confirm the accuracy of the data.

[0094] In operation S370, it is determined whether the second random string plain text and the customer-related information pass a preset verification rule.

[0095] The preset verification rules include: verification of random strings and verification of customer-related information. The verification of random strings is to determine whether the received second random string plaintext is consistent with the first random string plaintext generated at the beginning; the verification of customer-related information is to determine whether the customer-related information has been tampered with (through the summary); and to determine the validity of the certificate (whether it is issued by the root certificate).

[0096] According to an embodiment of the present disclosure, the determination of whether the second random string plaintext and the customer-related information pass a preset verification rule includes: determining whether the second random string plaintext and the first random string plaintext are consistent; determining whether the customer-related information has been tampered with; and determining whether the certificate in the customer-related information is issued by a root certificate.

[0097] Among them, judging whether the second random string plaintext and the first random string plaintext are consistent is used to further implement separate verification on the basis of U shield to improve security; judging whether the customer-related information has been tampered with is carried out by checking the consistency of the received summary (decrypted summary) and the summary calculated by a third party based on the received customer-related information to implement verification of whether it has been tampered with; judging whether the certificate in the customer-related information is issued by the root certificate is used to prove the validity of the certificate and avoid certificate forgery or damage.

[0098] In a typical scenario, after the customer authentication information is transmitted to a third party, the third party unpacks the information, obtains the plain text of the customer authentication information (i.e. the bank U-shield certificate, signature, and customer information required for the transaction), calculates the summary value based on the summary algorithm, obtains the encrypted information, and uses the public key to calculate the summary value. The two summary values ​​are compared to verify the correctness of the encryption. At the same time, the public key certificate is disassembled and compared with the root certificate to verify whether the certificate is issued by the root certificate. Verify the accuracy of the information, including verifying whether the random string generated by the third party is correct. To confirm the correctness of the identity authentication.

[0099] In operation S380, when the second random string plain text and the customer related information are consistent, it is determined that the customer login is successful.

[0100] Specifically, when the above verification is passed, it is determined that the customer has successfully logged in, and the customer can log in to the third party 120, or the customer can perform specific financial business operations when logged in to the third party 120.

[0101] In the embodiments of the present disclosure, in order to solve the technical problem of cumbersome and difficult login to different information systems, the first-party and third-party identity authentication involved in the embodiments of the present disclosure is to directly exchange data and deploy functions of the authentication information between the two parties, without involving a third party or an intermediate transfer processing platform for processing. By reducing the intermediate links and corresponding roles, the potential hidden dangers in the data transmission process are ensured, thereby increasing the security of the identity authentication information. At the same time, on the basis of using the bank U shield authentication, both parties participate in the independent encryption and decryption of random numbers, and the authentication results are individually verified, further enhancing the security of the identity authentication.

[0102] Figure 4 The full flow chart of the U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown.

[0103] like Figure 4 As shown, the U-shield-based identity authentication method of this embodiment includes operations S401 to S414.

[0104] In operation S401 , the first party responds to a login request from a client by forwarding the login request to a third party.

[0105] In operation S402, the third party determines whether to authorize mutual identity recognition based on the login request received from the first party.

[0106] In operation S403, a third party generates a first random string plain text under the condition of mutual recognition of authorized identities.

[0107] In operation S404, the first random string plaintext is encrypt by a third party to obtain a first random string ciphertext.

[0108] In operation S405, the third party sends the first random string ciphertext to the first party.

[0109] In operation S406, the first party receives a first random string ciphertext from the third party in the case of mutual recognition of the authorized identity.

[0110] In operation S407, the first party decrypts the first random string ciphertext to obtain a first random string plaintext.

[0111] In operation S408, the first party encrypts the first random string plaintext to obtain a second random string ciphertext.

[0112] In operation S409, the first party obtains the customer authentication information formed by the U shield based on the second random string ciphertext.

[0113] In operation S410, the first party sends the client authentication information to a third party.

[0114] In operation S411, a third party parses the customer authentication information from the first party to obtain a second random string ciphertext and customer-related information.

[0115] In operation S412, the second random string ciphertext is decrypted by a third party to obtain a second random string plaintext.

[0116] In operation S413, a third party determines whether the second random string plain text and the customer-related information pass a preset verification rule.

[0117] In operation S414, the third party determines that the client login is successful when the second random string plain text and the client-related information are consistent.

[0118] In the embodiments of the present disclosure, the first party and the third party system are connected using a dedicated line as a network transmission channel. In order to ensure business continuity, two dedicated lines, primary and backup, should be provided. The first party provides a fixed server IP address and port to the third party for configuring firewall policies in a point-to-point manner. The advantage of using a network dedicated line is that it provides a dedicated network connection independent of the public network for the third party. This connection usually involves a physical dedicated line or a virtual private network (VPN) to ensure the reliability, security and high-quality transmission of data. Physical dedicated channel: The user has a dedicated line between the service provider and the destination. This line is only used by a single user and is different from the ordinary line shared by other users. Virtual private channel: A channel with a certain bandwidth is reserved for the user on the basis of the public network, so that the user can exclusively enjoy this part of the bandwidth, and the data transmission is encrypted, which increases security. The advantage of a dedicated line is that it provides higher security, better service quality and stronger predictability than shared lines.

[0119] Figure 5 The full flow chart of a U-shield-based identity authentication method according to an embodiment of the present disclosure is schematically shown.

[0120] like Figure 5 As shown, take the example of a customer logging in to a third party from the bank (first party), as shown below:

[0121] Step S500: The customer uses the bank's U-shield to log in to the bank's corporate online banking.

[0122] Step S501: Select the URL connection of the third-party business function menu on the corporate online banking.

[0123] Step S502: Through a dedicated line, the bank transmits the customer information (including the unique index unified social credit code) to the third-party system. The third party uses the unified social credit code to determine whether the customer information exists in this system and authorizes identity mutual recognition.

[0124] Judgment J0: The third party uses the customer information of the unified social credit code to confirm whether there is authorized identity mutual recognition information.

[0125] Step S503: If the third party confirms that the customer has authorized the mutual recognition of identity information through the unified social credit code, a random string is sent to the bank for information encryption.

[0126] The random string can be encrypted or unencrypted.

[0127] Step S504: The bank sends the third-party random string to the customer and starts the identity authentication interface.

[0128] Among them, for the encrypted random string, it needs to be decrypted and encrypted before being sent to the customer, and for the unencrypted random string, it can be sent directly to the customer.

[0129] Step S505: The customer uses the bank's USB shield to complete identity authentication.

[0130] Step S506: The bank and the third-party institution perform separate data encryption and conversion on the random string provided by the third party according to the random string encryption method separately agreed upon. On this basis, the bank assembles the random string information, certificate information, signature information, and full customer information encrypted by the customer using the U-Shield and sends them to the third party. The bank also performs secondary encryption on sensitive information such as the legal person's ID number.

[0131] Step S507: After receiving the verification information, the third party parses the bank's encrypted information to verify the legitimacy of the requested information, including random string information, digital certificate validity, signature validity, corporate information, etc. The third party uses the agreed random string encryption method to decrypt the random number recalculated by the bank after the U-Shield is decrypted to confirm the accuracy of the data.

[0132] Judgment J1: Third-party judgment and certification results

[0133] Step S508: The third party determines that the authentication result is correct and provides the third party interface link URL that shows the client's identity authentication is passed to the client.

[0134] Step S509: The third party determines that the authentication result has failed, and provides an interface indicating that the client's identity authentication has failed to the client.

[0135] Step S510: For customers who are determined by the third party to have no authorization for identity mutual recognition, the bank will be fed back to generate an electronic identity mutual recognition authorization letter, prompting the customer whether to authorize the bank information and corresponding authentication method to be used by the third-party system.

[0136] Judgment J2: The customer confirms whether it is necessary to sign an identity recognition agreement between the bank and a third party.

[0137] Step S511: The customer completes signing of the identity mutual recognition agreement online.

[0138] Step S512: The third-party registered customer signs an identity mutual recognition agreement, adds customer information to the local system simultaneously, and calls the random string interface to generate random string information.

[0139] Step S513: The customer confirms that he does not authorize and exits the transaction.

[0140] In the embodiments of the present disclosure, the following beneficial effects can be achieved:

[0141] 1. After the customer logs in to the bank's corporate online banking, the bank's U-Shield is used as a unified authentication medium to achieve mutual recognition of customer identity information between different business systems.

[0142] 2. After the login information is mutually recognized, you can link to the third-party interface through the bank's online banking to achieve mutual recognition between different business systems and complete the business functions of each system. Finally, the personal confirmation and transaction information confirmation of the final business are completed through the bank's U terminal.

[0143] 3. Realize mutual recognition of identity authentication results across organizational structures, simplify the information authentication between different organizations, and use different authentication media separately. Simplify business processes, save customer time, and improve customer experience.

[0144] 4. Reduce the repeated processing of physical authentication media and save the authentication media processing costs of the authentication unit.

[0145] 5. In the bank U shield authentication method, add the content of the random string generated by the third party as verification data to supplement the verification process. This allows the third party to participate in the bank U shield authentication process and enhance the accuracy and reliability of the verification results.

[0146] 6. Use a dedicated key for secondary encryption to ensure the security of important customer information. Use the same encryption scheme as the overall message encryption. On the basis of ensuring security through a dedicated key, there is no need to add encryption and decryption methods for banks and third parties, saving the software and hardware deployment costs of the encryption verification link.

[0147] 7. Using dedicated lines provides higher security, better service quality, and greater predictability than shared lines.

[0148] Based on the above-mentioned U-shield-based identity authentication method, the present disclosure also provides an identity authentication device based on U-shield. Figure 6 The device is described in detail.

[0149] Figure 6 The structural block diagram of the U-shield-based identity authentication device according to an embodiment of the present disclosure is schematically shown.

[0150] like Figure 6 As shown, the U-shield-based identity authentication device 600 can be applied to a server 105 of an information system configured with a first party 110. The U-shield-based identity authentication device 600 of this embodiment includes a request forwarding module 610, a first random string ciphertext receiving module 620, a first random string ciphertext decryption module 630, a first random string plaintext encryption module 640, a customer authentication information acquisition module 650 and a customer authentication information sending module 660.

[0151] The request forwarding module 610 is used to respond to the login request from the client and forward the login request to the third party. In one embodiment, the request forwarding module 610 can be used to perform the operation S210 described above, which will not be described in detail here.

[0152] The first random string ciphertext receiving module 620 is used to receive the first random string ciphertext from a third party in the case of mutual recognition of the authorized identity. In one embodiment, the first random string ciphertext receiving module 620 can be used to perform the operation S220 described above, which will not be repeated here.

[0153] The first random string ciphertext decryption module 630 is used to decrypt the first random string ciphertext to obtain the first random string plaintext. In one embodiment, the first random string ciphertext decryption module 630 can be used to perform the operation S230 described above, which will not be repeated here.

[0154] The first random string plaintext encryption module 640 is used to encrypt the first random string plaintext to obtain the second random string ciphertext. In one embodiment, the first random string plaintext encryption module 640 can be used to perform the operation S240 described above, which will not be described in detail here.

[0155] The client authentication information acquisition module 650 is used to acquire the client authentication information formed by the USB shield based on the second random string ciphertext. In one embodiment, the client authentication information acquisition module 650 can be used to perform the operation S250 described above, which will not be repeated here.

[0156] The client authentication information sending module 660 is used to send the client authentication information to a third party. In one embodiment, the client authentication information sending module 660 can be used to perform the operation S260 described above, which will not be described in detail here.

[0157] According to an embodiment of the present disclosure, decrypting the first random string ciphertext to obtain the first random string plaintext includes: decrypting the first random string ciphertext based on a first key to obtain the first random string plaintext; encrypting the first random string plaintext to obtain the second random string ciphertext includes: encrypting the first random string plaintext based on a second key to obtain the second random string ciphertext.

[0158] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0159] According to an embodiment of the present disclosure, obtaining customer authentication information formed by U-Shield based on the second random string ciphertext includes: obtaining the second random string ciphertext and customer-related information; transmitting the second random string ciphertext and the customer-related information to U-Shield; and receiving customer authentication information from U-Shield.

[0160] According to an embodiment of the present disclosure, any multiple modules among the request forwarding module 610, the first random string ciphertext receiving module 620, the first random string ciphertext decryption module 630, the first random string plaintext encryption module 640, the client authentication information acquisition module 650 and the client authentication information sending module 660 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the request forwarding module 610, the first random string ciphertext receiving module 620, the first random string ciphertext decryption module 630, the first random string plaintext encryption module 640, the customer authentication information acquisition module 650 and the customer authentication information sending module 660 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the request forwarding module 610, the first random string ciphertext receiving module 620, the first random string ciphertext decryption module 630, the first random string plaintext encryption module 640, the customer authentication information acquisition module 650 and the customer authentication information sending module 660 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0161] Figure 7 The structural block diagram of the U-shield-based identity authentication device according to an embodiment of the present disclosure is schematically shown.

[0162] like Figure 7 As shown, the U-shield-based identity authentication device 700 can be applied to a server 105 of an information system configured with a third party 120. The U-shield-based identity authentication device 700 of this embodiment includes an authorized identity mutual recognition judgment module 710, a first random string plaintext generation module 720, a first random string ciphertext generation module 730, a first random string ciphertext sending module 740, a customer authentication information decryption module 750, a second random string ciphertext decryption module 760, a verification module 770 and a login success judgment module 780.

[0163] The authorization identity mutual recognition judgment module 710 is used to judge whether the authorization identity mutual recognition is performed based on the login request received from the first party. In one embodiment, the authorization identity mutual recognition judgment module 710 can be used to perform the operation S310 described above, which will not be described in detail here.

[0164] The first random string plaintext generation module 720 is used to generate a first random string plaintext in the case of mutual recognition of the authorized identity. In one embodiment, the first random string plaintext generation module 720 can be used to perform the operation S320 described above, which will not be repeated here.

[0165] The first random string ciphertext generation module 730 is used to encrypt the first random string plaintext to obtain a first random string ciphertext. In one embodiment, the first random string ciphertext generation module 730 can be used to perform the operation S330 described above, which will not be described in detail here.

[0166] The first random string ciphertext sending module 740 is used to send the first random string ciphertext to the first party. In one embodiment, the first random string ciphertext sending module 740 can be used to perform the operation S340 described above, which will not be described in detail here.

[0167] The client authentication information decryption module 750 is used to parse the client authentication information from the first party to obtain the second random string ciphertext and client-related information. In one embodiment, the client authentication information decryption module 750 can be used to perform the operation S350 described above, which will not be repeated here.

[0168] The second random string ciphertext decryption module 760 is used to decrypt the second random string ciphertext to obtain the second random string plaintext. In one embodiment, the second random string ciphertext decryption module 760 can be used to perform the operation S360 described above, which will not be described in detail here.

[0169] The verification module 770 is used to determine whether the second random string plain text and the customer-related information pass the preset verification rules. In one embodiment, the verification module 770 can be used to perform the operation S370 described above, which will not be repeated here.

[0170] The login success determination module 780 is used to determine that the client login is successful when the second random string plain text and the client related information are consistent. In one embodiment, the login success determination module 780 can be used to perform the operation S380 described above, which will not be repeated here.

[0171] According to an embodiment of the present disclosure, the first random string ciphertext generation module includes: a first random string ciphertext generation unit, used to encrypt the first random string plaintext based on a third key to obtain a first random string ciphertext; the second random string ciphertext decryption module includes: a second random string ciphertext decryption unit, used to decrypt the second random string ciphertext based on a fourth key to obtain a second random string plaintext.

[0172] According to an embodiment of the present disclosure, the first key and the second key are pre-stored in a code book, and the code book is updated regularly.

[0173] According to an embodiment of the present disclosure, the verification module includes: a verification unit, used to determine whether the second random string plaintext is consistent with the first random string plaintext; determine whether the customer-related information has been tampered with; and determine whether the certificate in the customer-related information is issued by a root certificate.

[0174] According to the embodiments of the present disclosure, any multiple modules among the authorized identity mutual recognition judgment module 710, the first random string plaintext generation module 720, the first random string ciphertext generation module 730, the first random string ciphertext sending module 740, the customer authentication information decryption module 750, the second random string ciphertext decryption module 760, the verification module 770 and the login success judgment module 780 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the authorized identity mutual recognition judgment module 710, the first random string plaintext generation module 720, the first random string ciphertext generation module 730, the first random string ciphertext sending module 740, the customer authentication information decryption module 750, the second random string ciphertext decryption module 760, the verification module 770 and the login success judgment module 780 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the authorized identity mutual recognition judgment module 710, the first random string plaintext generation module 720, the first random string ciphertext generation module 730, the first random string ciphertext sending module 740, the customer authentication information decryption module 750, the second random string ciphertext decryption module 760, the verification module 770 and the login success judgment module 780 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0175] Figure 8 A block diagram of an electronic device suitable for implementing an identity authentication method based on a U-shield according to an embodiment of the present disclosure is schematically shown.

[0176] like Figure 8As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 to a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include an onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0177] In RAM 803, various programs and data required for the operation of electronic device 800 are stored. Processor 801, ROM 802 and RAM 803 are connected to each other via bus 804. Processor 801 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 802 and / or RAM 803. It should be noted that the program can also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0178] According to an embodiment of the present disclosure, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to the bus 804. The electronic device 800 may further include one or more of the following components connected to the I / O interface 805: an input portion 806 including a keyboard, a mouse, etc.; an output portion 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 808 including a hard disk, etc.; and a communication portion 809 including a network interface card such as a LAN card, a modem, etc. The communication portion 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage portion 808 as needed.

[0179] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0180] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 802 and / or RAM 803 described above and / or one or more memories other than ROM 802 and RAM 803.

[0181] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the item recommendation method provided by the embodiment of the present disclosure.

[0182] The above functions defined in the system / device of the embodiment of the present disclosure are executed when the computer program is executed by the processor 801. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0183] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0184] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0185] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0186] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0187] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0188] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A USB-based identity authentication method, characterized in that: The method is applied to a U-shield mutual recognition system, the U-shield mutual recognition system includes: a first party and a third party, the method is applied to the first party, The method comprises: In response to a login request from a client, forwarding the login request to a third party; In the case of mutual recognition of authorized identities, receiving a first random string ciphertext from a third party; Decrypting the first random string ciphertext to obtain the first random string plaintext; Encrypting the first random string plaintext to obtain a second random string ciphertext; Based on the second random string ciphertext, obtaining customer authentication information formed by the U shield; and The client authentication information is sent to a third party.

2. The method according to claim 1, characterized in that: The decrypting the first random string ciphertext to obtain the first random string plaintext includes: Decrypting the first random string ciphertext based on the first key to obtain the first random string plaintext; The encrypting the first random string plaintext to obtain the second random string ciphertext includes: The first random string plaintext is encrypted based on the second key to obtain a second random string ciphertext.

3. The method according to claim 2, characterized in that The first key and the second key are pre-stored in a code book, and the code book is updated regularly.

4. The method according to any one of claims 1 to 3, characterized in that: The acquiring, based on the second random string ciphertext, the customer authentication information formed by the USB shield includes: Obtain the second random string ciphertext and customer related information; Transmitting the second random string ciphertext and the customer related information to the U shield; and Receive customer authentication information from the USB shield.

5. A U-shield-based identity authentication method, characterized in that: The method is applied to a U-shield mutual recognition system, the U-shield mutual recognition system includes: a first party and a third party, the method is applied to the third party, The method comprises: Determining whether to authorize mutual identity recognition based on the login request received from the first party; In the case of mutual recognition of authorized identities, generating a first random string plain text; Encrypting the first random string plaintext to obtain a first random string ciphertext; Sending the first random string ciphertext to the first party; Parsing the customer authentication information from the first party to obtain a second random string ciphertext and customer related information; Decrypting the second random string ciphertext to obtain a second random string plaintext; Determining whether the second random string plaintext and the customer-related information pass a preset verification rule; and If the second random string plain text and the customer related information are consistent, it is determined that the customer login is successful.

6. The method according to claim 5, characterized in that The encrypting the first random string plaintext to obtain the first random string ciphertext includes: Encrypt the first random string plaintext based on a third key to obtain a first random string ciphertext; The decrypting the second random string ciphertext to obtain the second random string plaintext includes: The second random string ciphertext is decrypted based on the fourth key to obtain a second random string plaintext.

7. The method according to claim 6, characterized in that The first key and the second key are pre-stored in a code book, and the code book is updated regularly.

8. The method according to any one of claims 5 to 7, characterized in that: The determining whether the second random string plaintext and the customer-related information pass a preset verification rule includes: Determine whether the second random string plaintext is consistent with the first random string plaintext; Determine whether the customer-related information has been tampered with; and Determine whether the certificate in the client-related information is issued by a root certificate.

9. A U-shield-based identity authentication method, characterized in that: The method is applied to a U-shield mutual recognition system, which includes: a first party and a third party, The method comprises: The first party forwards the login request to the third party in response to the login request from the client; The third party determines whether to authorize mutual identity recognition based on the login request received from the first party; The third party generates a first random string plain text under the condition of mutual recognition of authorized identities; The third party encrypts the first random string plaintext to obtain a first random string ciphertext; The third party sends the first random string ciphertext to the first party; The first party receives the first random string ciphertext from the third party under the condition of mutual recognition of the authorized identity; The first party decrypts the first random string ciphertext to obtain a first random string plaintext; The first party encrypts the first random string plaintext to obtain a second random string ciphertext; The first party obtains the customer authentication information formed by the USB shield based on the second random string ciphertext; The first party sends the customer authentication information to the third party; The third party parses the customer authentication information from the first party to obtain a second random string ciphertext and customer related information; The third party decrypts the second random string ciphertext to obtain the second random string plaintext; A third party determines whether the second random string plain text and the customer-related information pass a preset verification rule; and The third party determines that the client login is successful when the second random string plain text and the client related information are consistent.

10. An identity authentication device based on U shield, characterized in that: The device is applied to a U-shield mutual recognition system, and the U-shield mutual recognition system includes: a first party and a third party, and the device is applied to the first party, The device comprises: A request forwarding module, for responding to a login request from a client and forwarding the login request to a third party; A first random string ciphertext receiving module, used to receive the first random string ciphertext from a third party in the case of mutual recognition of authorized identities; A first random string ciphertext decryption module, used to decrypt the first random string ciphertext to obtain a first random string plaintext; A first random string plaintext encryption module, used to encrypt the first random string plaintext to obtain a second random string ciphertext; A client authentication information acquisition module, used to acquire client authentication information formed by the U shield based on the second random string ciphertext; and The client authentication information sending module is used to send the client authentication information to a third party.

11. An identity authentication device based on U shield, characterized in that: The device is applied to a U-shield mutual recognition system, the U-shield mutual recognition system includes: a first party and a third party, the device is applied to the third party, The device comprises: An authorized identity mutual recognition judgment module, used to judge whether to authorize identity mutual recognition based on a login request received from the first party; A first random string plaintext generation module, used to generate a first random string plaintext in the case of mutual recognition of authorized identities; A first random string ciphertext generation module, used for encrypting the first random string plaintext to obtain a first random string ciphertext; A first random string ciphertext sending module, used to send the first random string ciphertext to the first party; A customer authentication information decryption module, used to parse the customer authentication information from the first party to obtain a second random string ciphertext and customer related information; A second random string ciphertext decryption module, used to decrypt the second random string ciphertext to obtain a second random string plaintext; A verification module, used to determine whether the second random string plain text and the customer-related information pass a preset verification rule; and The login success determination module is used to determine that the client login is successful when the second random string plain text and the client related information are consistent.

12. An electronic device comprising: one or more processors; a storage device for storing one or more computer programs, The method is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images