Cross-application unified identity authentication system, method and server based on wide gap

Abstract

The invention discloses a cross-application unified identity authentication system, method and server based on the wide gap, the system comprises a plurality of applications running to the wide gap system, a unified identity authentication module is integrated in the applications, and the unified identity authentication module comprises an authentication processing module, a token management module and a user information database, the server is used for calling an authentication interface for verification, generating a unique user identity identifier and recording a plurality of applications associated with a user; the token management module is used for generating tokens and managing the tokens according to the user identity identifiers and the associated applications, performing token verification when token verification requests of a plurality of applications are received, and logging in after the verification is passed; and the user information database is used for storing the basic information of the user, the associated information of the user and the application and the security audit log. According to the system, the security, convenience and cross-platform property of identity authentication can be improved, and safer and more efficient identity authentication service is provided for users.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a cross-application unified identity authentication system, method and server based on Hongmeng. Background Art

[0002] The one-click login function mainly relies on the operator's mobile data network, using the "communication gateway number acquisition" capability and SIM card identification technology. The user side only needs to authorize the service provider application to obtain the local mobile phone number and upload it through the operator's network to complete the user identity verification. To a certain extent, one-click login provides users with a convenient and fast login method, eliminating the trouble of entering a password every time you log in, and improving login efficiency.

[0003] The above one-key login solution has major security issues, including the following: Risk of information leakage from operators: If the operator's system is attacked, the user's mobile phone number and other related information may be leaked. Once the attacker obtains the user's mobile phone number, he or she may use social engineering methods or other vulnerabilities to conduct further attacks. For example, by disguising as an operator's customer service to obtain other private information of the user. In addition, during the real-time one-click login authentication process, the user needs to send information such as mobile phone number to the operator every time he or she logs in, which increases the number of times the information is exposed during network transmission.

[0004] Risk of device loss or theft: If a user's device is lost or stolen, someone else can unbind the device by flashing the device, and then access related applications through the one-click login function on the device, resulting in information or financial theft.

[0005] In current information systems, there are many problems with identity authentication management. Different application systems often use independent authentication methods, and users need to remember multiple accounts and passwords, which is inconvenient and easy to forget. At the same time, the security of traditional authentication methods varies and is vulnerable to threats such as password cracking and network attacks.

[0006] In addition, cross-platform identity authentication also faces challenges. With the widespread use of mobile devices and IoT devices, users need to perform identity authentication on different devices and platforms. The lack of a unified authentication management mechanism results in a poor user experience and increases security risks.

[0007] Therefore, a unified identity authentication management solution is needed to solve the above problems. Summary of the invention

[0008] In order to address the deficiencies of the prior art, the present application provides a cross-application unified identity authentication system, method and server based on Hongmeng, which improves the security, convenience and cross-platform nature of identity authentication and provides users with safer and more efficient identity authentication services.

[0009] The technical effects to be achieved by this application are achieved through the following solutions: According to a first aspect of the present application, a cross-application unified identity authentication system based on Hongmeng is provided, including several applications running in the Hongmeng system, wherein a unified identity authentication module is integrated in the application, and the unified identity authentication module includes an authentication processing module, a token management module, and a user information database, wherein: The authentication processing module is used to call the authentication interface for verification, generate a unique user identity, and record the several applications associated with the user; The token management module is used to generate a token according to the user identity and the associated application and manage the token, perform token verification when receiving token verification requests from the applications, and log in after passing the verification; The user information database is used to store basic user information, association information between users and applications, and security audit logs.

[0010] Preferably, the authentication processing module displays supported login methods on the application side, and selects a corresponding authentication interface for authentication according to the login request type selected by the user. The login methods include one-click login and FIDO biometric authentication.

[0011] Preferably, in the token management module, after successful user authentication, a token with a validity period is generated according to the user identity and associated application information, and the token is sent to the application for storage; token verification includes verifying the validity, integrity and relevance of the token; When a user logs out of an account, logs in from another device, or a security anomaly occurs, the token can be revoked, making the issued token invalid.

[0012] According to a second aspect of the present application, there is provided an identity authentication method using the above-mentioned cross-application unified identity authentication system based on Hongmeng, comprising the following steps: Step 1: When a user logs in to the current application for the first time, the unified identity authentication module interacts with the operator system to complete the verification. After the verification is passed, the application prompts the user to perform FIDO biometric authentication, and the user logs in successfully after the authentication is passed; Step 2: After successful login, the unified identity authentication module generates a token for the user and sends it to the application. The application stores the token in the local trusted environment (TEE) or the Hongmeng secure storage environment, which is used for the unified identity authentication module to verify whether the corresponding service can be provided when logging in again; Step 3: When the user logs in to other applications, the other applications check whether there is a valid token in the local trusted environment (TEE) or the Hongmeng secure storage environment. If so, a token application request is sent to the unified identity authentication module; Step 4: The unified identity authentication module receives the token application request, and after verifying the applied token, the other application uses the token to request resources and services from the application server.

[0013] Preferably, in step 1, when the user logs in to the current application for the first time and the unified identity authentication module interacts with the operator system, the operator system verifies the authenticity and validity of the current user's mobile phone number, returns the user's basic information after the verification, and prompts the user to perform FIDO biometric authentication; The user authenticates his / her identity through the biometric authentication component on the device side. The device side generates a pair of public and private keys. The private key is stored in a local trusted environment or the Hongmeng secure storage environment. The public key is sent to the authentication service provider for registration and storage to complete the user login.

[0014] Preferably, in step 2, the token generated by the unified identity authentication module for the user includes the user identity, application information and validity period, and records the user's authentication information and the association relationship with the application. The token is signed by an encryption algorithm and sent to the application; When the current application logs in again, it uses the token stored in the local trusted environment or the Hongmeng secure storage environment to request resources and services from the application server. The application server calls the unified identity authentication module to verify the token and provides corresponding services after the verification is passed.

[0015] Preferably, in step 3, the user logging in to other applications includes logging in to other applications on the same device and logging in to other applications on different devices; when logging in to other applications on the same device, the following steps are included: The other application queries the local trusted environment or the Hongmeng secure storage environment for a valid token, and the device returns the token to the other application after verifying that the other application has permission; The other application sends a request message to the unified identity authentication module to request login authentication, wherein the request message includes the token, application identifier and device information; The unified identity authentication module verifies the request information, including the authenticity and validity of the token, whether the application is trustworthy, and its relevance to the application, and returns confirmation information after the verification is passed; The other applications receive the confirmation information and request resources and services from the application server. The application server calls the unified identity authentication module to verify the validity of the token. After the verification is passed, the application server provides corresponding resources and services.

[0016] Preferably, when logging into other applications on different devices, the following steps are included: The devices are connected and networked through the soft bus of Hongmeng system, and data transmission and sharing are realized; When an application on a device is logged in, it queries whether there is a valid token in the shared data, and the device returns the token to the other application after verifying that the other application has permission; The other application sends a request message to the unified identity authentication module to request login authentication, wherein the request message includes the token, application identifier and device information; The unified identity authentication module verifies the request information, including the authenticity and validity of the token, whether the application is trustworthy, and its relevance to the application, and returns confirmation information after the verification is passed; The other applications receive the confirmation information and request resources and services from the application server. The application server calls the unified identity authentication module to verify the validity of the token. After the verification is passed, the application server provides corresponding resources and services.

[0017] Preferably, in step 3, if abnormal behavior occurs or the login device is changed, re-login authentication is required, including the following steps: The application sends a request to the unified identity authentication module with authentication data, and the unified identity authentication module sends a one-key login authentication request to the operator gateway with the data to be authenticated; After the operator gateway authentication is passed, the one-click login authentication result is returned, and the authentication result is returned to the application through the unified identity authentication module; If FIDO biometric authentication is required, the application authenticates itself to the biometric authentication component on the device. After the authentication is successful, the application uses the private key to digitally sign the authentication request and sends the signed login request to the application or authentication service provider through the unified identity authentication module. The application or authentication service provider verifies the signature using the previously stored public key. After the verification is passed, the unified identity authentication module generates a new token for the user and returns it to the application. The application uses the token for subsequent operations and updates the token stored in the local trusted environment or the Hongmeng secure storage environment.

[0018] According to a third aspect of the present application, there is provided a server, comprising: a memory and at least one processor; The memory stores a computer program, and the at least one processor executes the computer program stored in the memory to implement the above-mentioned identity authentication method.

[0019] According to an embodiment of the present application, the beneficial effect of adopting the cross-application unified identity authentication system based on Hongmeng of the present application is that after a user successfully authenticates in one application for the first time through one-click login or other methods (such as biometric authentication, etc.), within the validity period, the user can quickly log in to other applications with the token issued by the platform, which greatly saves user time, provides a standardized login mode, and realizes seamless identity switching across applications; Integrate multiple authentication methods (such as one-click login, biometric authentication, password authentication, etc.), flexibly configure different authentication strengths according to the security requirements of the application, and centrally monitor and audit user authentication activities; After the initial authentication, the user's identity is mainly authenticated through a token. The token itself does not contain the user's sensitive information (such as mobile phone number), which reduces the frequency of transmission of sensitive information in the network and reduces the risk of being intercepted and stolen; Realize cross-platform identity authentication management. Whether on mobile devices such as mobile phones, tablets, smart watches, or on IoT devices such as smart homes and smart cars, unified identity authentication services can be implemented to provide users with a more convenient and secure cross-platform experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the existing technical solutions, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0021] Figure 1 This is a structural block diagram of a cross-application unified identity authentication system based on Hongmeng in one embodiment of the present application; Figure 2 This is a flowchart of a cross-application unified identity authentication method based on Hongmeng in one embodiment of the present application; Figure 3 This is a flow chart of a unified identity authentication method across applications in the same device in one embodiment of the present application; Figure 4 This is a flow chart of a unified identity authentication method for cross-device applications in one embodiment of the present application; Figure 5 This is a structural block diagram of a server in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0023] like Figure 1 As shown, a cross-application unified identity authentication system based on Hongmeng in an embodiment of the present application includes several applications running in the Hongmeng system, and a unified identity authentication module is integrated in the application. The unified identity authentication module includes an authentication processing module, a token management module, and a user information database, wherein: The authentication processing module is used to call the authentication interface for verification, generate a unique user identity, and record several applications associated with the user; Specifically: According to the user's login request type (one-click login, FIDO biometric authentication, etc.), call the corresponding authentication interface for verification. After the user successfully logs in for the first time, generate a unique user identity, and record the user's authentication method, associated applications and other information.

[0024] The token management module is used to generate tokens based on user identities and associated applications and manage tokens. It performs token verification when receiving token verification requests from several applications and logs in after passing the verification. The specific functions are: Token generation and issuance: After the user is successfully authenticated, an authentication token with a certain validity period is generated based on the user identity and related application information. The token is generated using an encryption algorithm to ensure its security and unforgeability.

[0025] Token verification and update: Receive token verification requests from applications and verify the validity, integrity, and relevance of tokens. If the token is valid and has not expired, return verification success information; if the token is about to expire or has expired, generate a new token based on the policy and return it to the application, and update the token storage record.

[0026] Token revocation: When a user logs out of an account, logs in from another device, or encounters a security anomaly, the token revocation operation is supported to invalidate the issued token and ensure the security of the user account.

[0027] The user information database is used to store basic user information, information about the association between users and applications, and security audit logs. Its specific functions include: User basic information storage: storage of user identification information, etc. (encrypted storage must comply with relevant privacy regulations).

[0028] Authentication method record: records the authentication method used by the user, such as whether one-click login, FIDO biometric authentication, and other methods are enabled.

[0029] Application association information: Maintains the association between users and various applications, including which applications integrated with the unified identity authentication module the user has logged in and authenticated, as well as the corresponding token information and permission settings.

[0030] Security audit log: records user login, authentication, token operation and other related security audit information for security analysis and tracking.

[0031] By building a unified identity authentication management system, the security, convenience and cross-platform nature of identity authentication can be improved, providing users with safer and more efficient identity authentication services. After a user successfully completes registration and login authentication in one application through one-click login and FIDO biometric authentication, within the validity period, the user can quickly complete login in other applications with the token issued by the platform without performing other operations, realizing seamless identity switching across applications. At the same time, based on the Hongmeng soft bus, login authentication across applications between different devices can be completed. For applications with high security requirements or users and devices with abnormal behavior, multiple authentication methods (such as one-click login, biometric authentication, password authentication, etc.) can be combined to flexibly configure different authentication strengths according to the security requirements of the application.

[0032] like Figure 2 As shown, the identity authentication method using the above-mentioned cross-application unified identity authentication system based on Hongmeng includes the following steps: Step 1: When a user logs in to the current application for the first time, the unified identity authentication module interacts with the operator system to complete the verification. After the verification is passed, the application prompts the user to perform FIDO biometric authentication, and the user logs in successfully after the authentication is passed; In this step, when the user logs in for the first time, the application displays the supported login methods (one-click login and FIDO biometric authentication, etc.). After the user selects one-click login, the application sends a one-click login request to the unified identity authentication module, including the user's device information and other required information.

[0033] The unified identity authentication module interacts with the operator system to verify the authenticity and validity of the mobile phone number. If the verification is successful, the operator system returns the user's basic information (optional, user authorization required).

[0034] The app prompts the user to perform FIDO biometric authentication (this method is used for subsequent re-authentication of abnormal behavior and authentication of applications with high security requirements). The user authenticates the identity through the device's biometric authentication component, such as entering a fingerprint or performing facial recognition.

[0035] A pair of public and private keys is generated on the device side. The private key is stored in a secure area of ​​the user's device, and the public key is sent to the authentication service provider for registration and storage.

[0036] Step 2: After successful login, the unified identity authentication module generates a token for the user and sends it to the application. The application stores the token in the local trusted environment (TEE) or the Hongmeng secure storage environment. The unified identity authentication module verifies whether the corresponding service can be provided when logging in again. In this step, after the user successfully logs in, the unified identity authentication module generates a token for the user. The token contains information such as user identity, application information, and validity period, and records the association between the user's authentication information (including one-click login and FIDO biometric authentication methods) and the application. The token is signed using an encryption algorithm to ensure its integrity and non-tamperability.

[0037] The association relationship is the association relationship between the user and each application, including the applications in which the user has performed login authentication and the corresponding token information and permission settings.

[0038] The application stores the received token in a local trusted environment or the Hongmeng secure storage environment. When logging in again, the application server can use the token to request resources and services. After receiving the request, the application server calls the token verification interface of the unified identity authentication module for verification. If the token verification passes, the user is provided with the corresponding service.

[0039] Step 3: When the user logs in to other applications, other applications check whether there is a valid token in the local trusted environment or the Hongmeng secure storage environment. If so, a token application request is sent to the unified identity authentication module; In this step, if Figure 3 As shown, when a user opens other applications on the same device that have integrated a unified identity authentication module, it first checks whether there is a valid authentication token in the local trusted environment or the Hongmeng secure storage environment.

[0040] If it exists, the application sends a token application request to the unified identity authentication module, which includes the token, application identifier, device information, etc. The token is generated and bound for the authenticated user. Possessing the token means that the user has passed the authentication of other related applications.

[0041] When an application integrates the unified identity authentication module, an application identifier will be generated for it after registration. When querying whether a token exists in the local trusted environment or the Hongmeng secure storage environment, it can be verified whether the requested application has permission to access specific resources. After a subsequent successful login, the association between the token and the application can be updated.

[0042] Application identification and device information are mainly used for security verification to prevent illegal applications from accessing the platform and stealing user information. Device information can be used to determine whether it is a commonly used device and other security risk assessments.

[0043] This step also includes logging in to other applications on different devices. Based on the device discovery mechanism of the Hongmeng distributed soft bus, different devices can automatically discover and establish connections. When a user completes the identity authentication of the application login on one device, the device will send the user's identity authentication information to other connected devices through the distributed soft bus.

[0044] Information synchronization and verification: The device that receives the authentication information will store the received information in a local trusted environment or the HarmonyOS secure storage environment, and send an authentication request to the unified authentication management module when the user uses the application on the device.

[0045] like Figure 4 As shown, the specific steps for cross-device applications to apply for login are: Based on the Hongmeng soft bus, it supports multiple device discovery methods, including active discovery and passive discovery. Active discovery means that the device actively searches for other devices around it; passive discovery means that the device waits for other devices to discover itself. During the discovery process, the devices will exchange some necessary information, such as the type, name, and capabilities of the device, for subsequent connection and networking operations. The exchange of this information is based on certain communication protocols and data formats to ensure that the devices can correctly understand and process the information sent by each other.

[0046] When a device finds other devices, it will connect if communication and data transmission are needed. The connection process is based on the communication protocol and security mechanism of the soft bus to ensure the security and reliability of the connection.

[0047] After the devices are successfully connected, they will automatically form a logical network, i.e. networking. The networking devices can communicate with each other and share data to achieve distributed functions and services. During the data transmission process, the soft bus will process and manage the data to ensure the accuracy and integrity of the data.

[0048] After connecting across devices and obtaining the authentication token issued by the unified identity authentication module, a token application request is sent to the unified identity authentication module based on the token.

[0049] Step 4: The unified identity authentication module receives the token application request. After the applied token is verified, other applications use the token to request resources and services from the application server.

[0050] After receiving the request, the unified identity authentication module verifies the token, including the authenticity and validity of the token (whether it is within the validity period), whether the application is trustworthy, and its relevance to the application. If the token is verified, the unified identity authentication module returns confirmation information to the application and updates the relevant information of the token (such as the last use time, etc.) as needed.

[0051] After receiving the confirmation information, the application uses the token to request resources and services from the application server. The application server calls the token verification interface provided by the unified identity authentication module to verify the validity of the token submitted by the user; after the verification is successful, the verification information is returned to the application server; The application server provides the user with corresponding service and resource access rights based on the user's permissions, and the user does not need to perform one-click login and FIDO biometric authentication again. If the verification fails, the user needs to re-login and authenticate.

[0052] In the above steps, for devices that detect changes in the SIM card status (such as when the SIM card is pulled out or the default traffic card is changed), or when the device is flashed, the user is prompted to re-perform the one-click login authentication operation when logging in to confirm the user's identity. You can choose one of the one-click login or biometric authentication, or you can perform both authentication methods. When performing FIDO biometric authentication, the mobile phone system compares the temporarily collected biometric information (such as fingerprints) with the previously stored user template. The application sends the results of the fingerprint verification in the local trusted environment or the Hongmeng secure storage environment and some necessary user information (such as user identification, device information, application information, etc.) to the unified authentication module. The unified identity authentication module generates a new authentication token for the user (you can choose whether to update the token validity period according to the policy) and returns it to the application. The application uses the new token for subsequent operations and updates the token stored in the local trusted environment or the Hongmeng secure storage environment.

[0053] The specific steps for recertification include: Step 51: For devices where the SIM card status is detected to have changed (such as when the SIM card is removed or the default data card is changed), or there are abnormal behaviors such as flashing, or changes in the login device, the application prompts the user to re-authenticate and log in; Step 521: If one-key login authentication is required, the application carries the required authentication information data packet to request the unified identity authentication module; Step 522: The unified identity authentication module uses the cellular network and carries the data to be authenticated to send a one-key login authentication request to the operator's data gateway; Step 523: After the operator gateway authenticates, the one-key login authentication result is returned; Step 524: The unified identity authentication module returns the authentication result data packet to the application side; Step 531: If FIDO biometric authentication is required, the application sends a login authentication request to FIDO authentication through the unified identity authentication module. The user provides biometric information again, and the device collects it and compares it with the biometric template stored during the previous registration. If the verification is successful, it means that the user's identity is legal. The authentication request is digitally signed using the private key stored in the device, and the signed information is sent to the application or authentication service provider through the unified identity authentication module. The application or authentication service provider verifies the signature using the previously stored public key.

[0054] Step 532: The unified identity authentication module returns the FIDO authentication result to the application; Step 54: The result of application verification and some necessary user information (such as user identification, device information, application information, etc.) are sent to the unified authentication module; Step 55: The unified identity authentication module generates a new authentication token for the user (the token validity period can be updated based on the policy) and returns it to the application; the application uses the new token for subsequent operations and updates the token stored in the local trusted environment or the Hongmeng secure storage environment.

[0055] If re-authentication is performed across devices, perform the following steps before the above steps: Devices are connected based on Hongmeng soft bus to complete the networking; Device B where the application to be logged in is located sends a request for assisting one-key login authentication to device A; After the user authorizes on device A and performs steps 521 to 523, device A transmits and shares the one-key login authentication result data packet to device B; device B sends a request to assist in FIDO biometric authentication to device A, and then completes the re-login through steps 531 to 55.

[0056] In another embodiment of the present application, for applications with high security requirements, when a user attempts to access sensitive functions or perform important operations (such as conducting large financial transactions, modifying important account information, etc.), the application can prompt the user to re-authenticate to enhance security. Specifically: The user is prompted to re-authenticate in the application, and the application sends a re-authentication request to the unified identity authentication module. After receiving the request, the unified identity authentication module requires the user to perform the combined authentication process of one-click login and FIDO biometric authentication again, that is, repeat the steps in the initial registration and login process.

[0057] If the user re-authenticates successfully, the unified identity authentication module generates a new authentication token for the user (you can choose whether to update the token validity period based on the policy) and returns it to the application. The application uses the new token for subsequent operations and updates the token stored in the local trusted environment or the Hongmeng secure storage environment.

[0058] If the user fails to re-authenticate, the application prompts the user to take corresponding actions based on the error information returned by the platform, such as checking the network connection, re-entering biometrics, etc.

[0059] For situations with high security requirements or requiring authentication with the help of other devices, when a user initiates an operation on one device, the application can simultaneously request other trusted devices for collaborative authentication as needed, and determine whether to allow the operation based on the authentication results of multiple devices.

[0060] When users operate on different devices, the application automatically selects the appropriate verification method based on the characteristics of the device and the user's settings, improving the security and convenience of identity authentication.

[0061] A server according to an embodiment of the present application includes: a memory and at least one processor; The memory stores a computer program, and at least one processor executes the computer program stored in the memory to implement the above-mentioned identity authentication method.

[0062] According to the above embodiments, the beneficial effect of adopting the cross-application unified identity authentication system based on Hongmeng of the present application is that after the user successfully authenticates in one application for the first time through one-click login or other methods (such as biometric authentication, etc.), within the validity period, the user can quickly log in to other applications with the token issued by the platform, which greatly saves user time, provides a standardized login mode, and realizes seamless identity switching across applications; Integrate multiple authentication methods (such as one-click login, biometric authentication, password authentication, etc.), flexibly configure different authentication strengths according to the security requirements of the application, and centrally monitor and audit user authentication activities; After the initial authentication, the user's identity is mainly authenticated through a token. The token itself does not contain the user's sensitive information (such as mobile phone number), which reduces the frequency of transmission of sensitive information in the network and reduces the risk of being intercepted and stolen; Achieve cross-platform identity authentication management. Whether on mobile devices such as mobile phones, tablets, smart watches, or IoT devices such as smart homes and smart cars, unified identity authentication services can be implemented to provide users with a more convenient and secure cross-platform experience. If the device is stolen, after accessing the device binding through flashing or other methods, the token will be lost or invalidated due to the flashing, and re-authentication will be required, avoiding the risk of information or financial theft.

[0063] It should be noted that the above detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present application belongs.

[0064] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should also be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0065] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0066] In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0067] For ease of description, spatially relative terms, such as "above", "above", "on the upper surface of", "above", etc., may be used herein to describe the spatial positional relationship between a device or feature and other devices or features as shown in the figure. It should be understood that spatially relative terms are intended to include different orientations of the device in use or operation in addition to the orientation described in the figure. For example, if the device in the accompanying drawings is inverted, the device described as "above other devices or structures" or "above other devices or structures" will be positioned as "below other devices or structures" or "below other devices or structures". Thus, the exemplary term "above" may include both "above" and "below". The device may also be positioned in other different ways, such as rotated 90 degrees or in other orientations, and the spatially relative descriptions used herein are interpreted accordingly.

[0068] In the above detailed description, reference is made to the accompanying drawings, which form a part of this document. In the accompanying drawings, similar symbols typically identify similar components unless the context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be used, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.

[0069] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. The cross-application unified identity authentication system based on Hongmeng is characterized by: Including running several applications in the Hongmeng system, wherein a unified identity authentication module is integrated in the application, and the unified identity authentication module includes an authentication processing module, a token management module and a user information database, wherein: The authentication processing module is used to call the authentication interface for verification, generate a unique user identity, and record the several applications associated with the user; The token management module is used to generate a token according to the user identity and the associated application and manage the token, perform token verification when receiving token verification requests from the applications, and log in after passing the verification; The user information database is used to store basic user information, association information between users and applications, and security audit logs.

2. According to claim 1, the cross-application unified identity authentication system based on Hongmeng is characterized in that: The authentication processing module displays supported login methods on the application side, and selects a corresponding authentication interface for authentication according to the login request type selected by the user. The login methods include one-click login and FIDO biometric authentication.

3. According to claim 1, the cross-application unified identity authentication system based on Hongmeng is characterized in that: In the token management module, after the user authentication is successful, a token with a validity period is generated according to the user identity and the associated application information, and the token is sent to the application for storage; Performing token verification includes verifying the validity, integrity, and relevance of the token; When a user logs out of an account, logs in from another device, or a security anomaly occurs, the token can be revoked, making the issued token invalid.

4. An identity authentication method using the cross-application unified identity authentication system based on Hongmeng according to any one of claims 1 to 3, characterized in that: The steps include: Step 1: When a user logs in to the current application for the first time, the unified identity authentication module interacts with the operator system to complete the verification. After the verification is passed, the application prompts the user to perform FIDO biometric authentication, and the user logs in successfully after the authentication is passed; Step 2: After successful login, the unified identity authentication module generates a token for the user and sends it to the application. The application stores the token in a local trusted environment or Hongmeng secure storage environment, which is used for the unified identity authentication module to verify whether the corresponding service can be provided when logging in again; Step 3: When the user logs in to other applications, the other applications check whether there is a valid token in the local trusted environment or the Hongmeng secure storage environment. If so, a token application request is sent to the unified identity authentication module; Step 4: The unified identity authentication module receives the token application request, and after verifying the applied token, the other application uses the token to request resources and services from the application server.

5. The identity authentication method according to claim 4, characterized in that: In step 1, when the user logs in to the current application for the first time, the unified identity authentication module interacts with the operator system. The operator system verifies the authenticity and validity of the current user's mobile phone number. After the verification is passed, the user's basic information is returned and the user is prompted to perform FIDO biometric authentication. The user authenticates his / her identity through the biometric authentication component on the device side. The device side generates a pair of public and private keys. The private key is stored in a local trusted environment or the Hongmeng secure storage environment. The public key is sent to the authentication service provider for registration and storage to complete the user login.

6. The identity authentication method according to claim 5, characterized in that: In step 2, the token generated by the unified identity authentication module for the user includes the user identity, application information and validity period, and records the user's authentication information and the association relationship with the application. The token is signed by an encryption algorithm and sent to the application; When the current application logs in again, it uses the token stored in the local trusted environment or the Hongmeng secure storage environment to request resources and services from the application server. The application server calls the unified identity authentication module to verify the token and provides corresponding services after the verification is passed.

7. The identity authentication method according to claim 6, characterized in that: In step 3, the user logging in to other applications includes logging in to other applications on the same device and logging in to other applications on different devices. When logging in to other applications on the same device, the following steps are included: The other application queries the local trusted environment or the Hongmeng secure storage environment for a valid token, and the device returns the token to the other application after verifying that the other application has permission; The other application sends a request message to the unified identity authentication module to request login authentication, wherein the request message includes the token, application identifier and device information; The unified identity authentication module verifies the request information, including the authenticity and validity of the token, whether the application is trustworthy, and its relevance to the application, and returns confirmation information after the verification is passed; The other applications receive the confirmation information and request resources and services from the application server. The application server calls the unified identity authentication module to verify the validity of the token. After the verification is passed, the application server provides corresponding resources and services.

8. The identity authentication method according to claim 7, characterized in that: When logging into other applications on different devices, the following steps are included: The devices are connected and networked through the soft bus of Hongmeng system, and data transmission and sharing are realized; When an application on a device is logging in, it queries whether there is a valid token in the shared data, and the device returns the token to the other application after verifying that the other application has permission; The other application sends a request message to the unified identity authentication module to request login authentication, wherein the request message includes the token, application identifier and device information; The unified identity authentication module verifies the request information, including the authenticity and validity of the token, whether the application is trustworthy, and its relevance to the application, and returns confirmation information after the verification is passed; The other applications receive the confirmation information and request resources and services from the application server. The application server calls the unified identity authentication module to verify the validity of the token. After the verification is passed, the application server provides corresponding resources and services.

9. The identity authentication method according to claim 7, characterized in that: In step 3, if abnormal behavior occurs or the login device is changed, you need to re-login and authenticate, including the following steps: The application sends a request to the unified identity authentication module with authentication data, and the unified identity authentication module sends a one-key login authentication request to the operator gateway with the data to be authenticated; After the operator gateway authentication is passed, the one-click login authentication result is returned, and the authentication result is returned to the application through the unified identity authentication module; If FIDO biometric authentication is required, the application authenticates itself to the biometric authentication component on the device. After the authentication is successful, the application uses the private key to digitally sign the authentication request and sends the signed login request to the application or authentication service provider through the unified identity authentication module. The application or authentication service provider verifies the signature using the previously stored public key. After the verification is passed, the unified identity authentication module generates a new token for the user and returns it to the application. The application uses the token for subsequent operations and updates the token stored in the local trusted environment or the Hongmeng secure storage environment.

10. A server, characterized in that: include: memory and at least one processor; The memory stores a computer program, and the at least one processor executes the computer program stored in the memory to implement the identity authentication method described in any one of claims 4 to 9.

Images