User authentication method, intelligent business system, equipment, medium and program

Abstract

The disclosed embodiment discloses a user authentication method, intelligent business system, device, medium and program, and the method includes: the client uses the business identifier of the intelligent device to obtain the public key information registered by the intelligent device from the resolution service device; uses the public key information of the intelligent device to encrypt the user data of the client to obtain the encrypted data; sends the encrypted data and the signature data obtained by using the private key information of the client to the intelligent device; the intelligent device uses the private key information of the intelligent device to decrypt the encrypted data to obtain the user data; uses the user identifier in the user data to obtain the public key information registered by the client from the resolution service device; uses the public key information of the client to verify the signature data, and after the verification is passed, the user identifier and the shared key information are stored and processed. The disclosed embodiment can realize the secure exchange of the shared key information of MFA through the PKI information carried by the identity identifier.

Description

Technical Field

[0001] The present disclosure relates to the field of user authentication of industrial Internet business systems, and specifically to One-Time Password (OTP) technology, especially a user authentication method, intelligent business system, equipment, medium and program. Background Art

[0002] With the development of the Internet and the Industrial Internet, traditional password-based authentication methods are vulnerable to threats such as brute force cracking and have low security. Multi-factor authentication (MFA) can improve security by combining dynamic passwords, smart cards and other authentication methods.

[0003] However, the above authentication methods rely on centralized services in key distribution and identity management, and the operation and implementation processes are complex and vulnerable to attacks. Summary of the invention

[0004] The present disclosure provides a user authentication method, an intelligent business system, a device, a medium and a program.

[0005] According to one aspect of the present disclosure, a user authentication method is provided, which is applied to an intelligent business system, wherein the intelligent business system includes a client, a parsing service device, and an intelligent device, and the method includes:

[0006] The client uses the business identifier of the smart device to obtain the public key information of the smart device registered by the smart device from the resolution service device, and the business identifier is an industrial Internet identifier;

[0007] The client uses the public key information of the smart device to encrypt the user data of the client to obtain encrypted data; wherein the user data includes shared key information and a user identifier of the client, and the user identifier is an industrial Internet identifier;

[0008] The client sends the encrypted data and the signature data obtained by using the private key information of the client to the smart device;

[0009] The smart device uses the private key information of the smart device to decrypt the encrypted data to obtain the user data;

[0010] The smart device uses the user identifier in the user data to obtain the public key information of the client registered by the client from the resolution service device;

[0011] The smart device verifies the signature data using the public key information of the client;

[0012] If the verification process is passed, the smart device stores and processes the user identification and the shared key information in the user data, so that the smart device can use the user identification and the shared key information to perform user authentication on the client based on a one-time password.

[0013] According to another aspect of the present disclosure, there is provided an intelligent business system, including a client, a parsing service device and an intelligent device; wherein:

[0014] The client is used to obtain the public key information of the smart device registered by the smart device from the resolution service device using the business identifier of the smart device, wherein the business identifier is the industrial Internet identifier; encrypt the user data of the client using the public key information of the smart device to obtain encrypted data; wherein the user data includes shared key information and the user identifier of the client, wherein the user identifier is the industrial Internet identifier; and send the encrypted data and the signature data obtained using the private key information of the client to the smart device;

[0015] The resolution service device is used to return the public key information of the smart device registered by the smart device to the client according to the service identifier of the smart device provided by the client; and return the public key information of the client registered by the client to the smart device according to the user identifier of the client provided by the smart device;

[0016] The smart device is used to use the private key information of the smart device to decrypt the encrypted data to obtain the user data; use the user identifier in the user data to obtain the public key information of the client registered by the client from the resolution service device; use the public key information of the client to verify the signature data; and if the verification process passes, store the user identifier and the shared key information in the user data, so that the smart device can use the user identifier and the shared key information to perform user authentication on the client based on a one-time password.

[0017] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0018] a memory for storing a computer program product;

[0019] The processor is used to execute the computer program product stored in the memory, and when the computer program product is executed, the method of the aspects and any possible implementation manner as described above is implemented.

[0020] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored, characterized in that when the computer program instructions are executed by a processor, the method of implementing the above-mentioned aspects and any possible implementation manner is implemented.

[0021] According to another aspect of the present disclosure, a computer program product is provided, including computer program instructions, characterized in that when the computer program instructions are executed by a processor, the method implements the above-mentioned aspects and any possible implementation manner.

[0022] It can be seen from the above technical solution that the embodiment of the present disclosure realizes the identity management of industrial Internet identities across systems through the uniqueness of identity identification, and combines public key infrastructure (PKI) information, that is, a pair of public key information and private key information, to perform secure exchange of MFA shared key information, thereby solving the security problem of key distribution being easily intercepted and cracked in traditional one-time password (OTP) authentication, thereby improving the security and reliability of shared key information transmission.

[0023] In addition, by adopting the technical solution provided by the present disclosure and adding a signature verification mechanism, the credibility of identity authentication can be further enhanced.

[0024] In addition, by adopting the technical solution provided by the present invention, the identity resolution service of the distributed industrial Internet identity provided by the resolution service device can avoid users from repeated registration and management operations in multiple smart business systems, thereby improving the compatibility of the smart business systems.

[0025] In addition, the technical solution provided by the present disclosure can effectively improve the user experience.

[0026] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description.

[0027] The technical solution of the present disclosure is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0029] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0030] Figure 1is a schematic diagram according to a first embodiment of the present disclosure;

[0031] Figure 2 is a schematic diagram according to a second embodiment of the present disclosure;

[0032] Figure 3 yes Figure 2 A schematic diagram of the corresponding embodiment;

[0033] Figure 4 yes Figure 2 Another schematic diagram of the corresponding embodiment;

[0034] Figure 5 yes Figure 2 Another schematic diagram of the corresponding embodiment;

[0035] Figure 6 yes Figure 2 Another schematic diagram of the corresponding embodiment;

[0036] Figure 7 is a schematic diagram according to a third embodiment of the present disclosure;

[0037] Figure 8 is a block diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0039] Obviously, the described embodiments are only part of the embodiments of the present disclosure, but not all of them. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present disclosure.

[0040] It should be noted that the terminals involved in the embodiments of the present disclosure may include but are not limited to computers (Personal Computer, PC), mobile phones, personal digital assistants (Personal Digital Assistant, PDA), wireless handheld devices, tablet computers and other smart devices; display devices may include but are not limited to personal computers, televisions and other devices with display functions.

[0041] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0042] In information systems, passwords are a widely used user access control technology that protects system data through user authorization access. With the continuous upgrading of network attack methods, relying solely on traditional passwords is no longer safe, and passwords are easily leaked. Using 2FA or MFA authentication methods is one of the effective means to solve the security problems caused by password leaks.

[0043] However, the traditional MFA authentication method is vulnerable to man-in-the-middle attacks during key transmission, and when used across systems or scenarios, users need to repeatedly register and manage their identities in different systems, increasing the complexity of operations. In addition, existing technologies rely too much on centralized trust institutions, which poses a single point of failure risk.

[0044] The embodiments of the present disclosure are intended to solve the problems of insufficient key distribution security, complex authentication operations, and repeated user identity management in existing MFA authentication methods.

[0045] Figure 1 is a schematic diagram according to the first embodiment of the present disclosure, such as Figure 1 A user authentication method is applied to an intelligent business system, wherein the intelligent business system may include but is not limited to a client, a resolution service device, and an intelligent device.

[0046] 101. The client uses the service identifier of the smart device to obtain the public key information of the smart device registered by the smart device from the resolution service device.

[0047] Among them, the business identifier of the smart device is the industrial Internet identifier.

[0048] 102. The client encrypts the user data of the client using the public key information of the smart device to obtain encrypted data.

[0049] Among them, the user data may include but is not limited to shared key information and the user identifier of the client. The user identifier of the client is an industrial Internet identifier, which is not limited in this embodiment.

[0050] 103. The client sends the encrypted data and the signature data obtained using the private key information of the client to the smart device.

[0051] 104. The smart device decrypts the encrypted data using the private key information of the smart device to obtain the user data.

[0052] 105. The smart device uses the user identifier in the user data to obtain the public key information of the client registered by the client from the resolution service device.

[0053] 106. The smart device uses the public key information of the client to verify the signature data.

[0054] 107. If the verification process is successful, the smart device stores the user identifier and the shared key information in the user data, so that the smart device can use the user identifier and the shared key information to perform a one-time password-based user authentication on the client.

[0055] At this point, the secure exchange of MFA shared key information is achieved through the public key infrastructure (PKI) information carried by the identity (i.e. the user ID of the client and the business ID of the smart device).

[0056] It is understandable that the client may be a local program (nativeApp) installed on the local terminal, or may also be a webpage program (webApp) of a browser on the local terminal, which is not limited in this embodiment.

[0057] In this way, the identity management of industrial Internet identities across systems is achieved through the uniqueness of the identity identifier, and the secure exchange of MFA shared key information is carried out in combination with PKI information, that is, a pair of public key information and private key information. This solves the security problem of key distribution in traditional OTP authentication that is easily intercepted and cracked, thereby improving the security and reliability of shared key information transmission.

[0058] The technical solution provided in this embodiment, through the uniqueness of the industrial Internet identifier, allows users to use the same identity identifier, i.e., the client's user identifier, in multiple systems and scenarios, avoiding repeated registration and management, and simplifying the identity authentication process. At the same time, the identity resolution service and PKI information provided by the resolution service device are used to achieve the secure exchange of shared key information, solving the security problem of key distribution being easily intercepted in the traditional OTP algorithm, ensuring the security and integrity of key transmission, and adding a signature and verification mechanism to further enhance the credibility of identity authentication and reduce the risk of identity fraud. In addition, this embodiment can be applied across systems and platforms based on the industrial Internet identity resolution technology, which improves the versatility and scalability of multi-factor authentication technology.

[0059] Optionally, in a possible implementation of this embodiment, before 101, the client and the smart device may further register their respective identities with the resolution service device.

[0060] Specifically, the client may further register the user identification of the client and the public key information of the client with the resolution service device, and the smart device may further register the service identification of the smart device and the public key information of the smart device with the resolution service device.

[0061] Optionally, in a possible implementation of this embodiment, after 107, the smart device may use the stored user identification and the shared key information to perform a one-time password-based user authentication on the client.

[0062] Specifically, the client can use the user identification and the dynamic password generated based on the shared key information to send a service access request to the smart device. The smart device can use the user identification to obtain the stored shared key information corresponding to the user identification, and use the dynamic password generated based on the shared key information to authenticate the dynamic password from the client. If the authentication process is successful, the smart device authorizes the client to operate the smart device.

[0063] In this embodiment, the one-time password-based user authentication adopted may include but is not limited to time-based one-time password (TOTP) user authentication or event-based one-time password, i.e., key-related hash message authentication code (HMAC) one-time password (HOTP) user authentication, and this embodiment does not specifically limit this.

[0064] The smart device disclosed in the embodiments of the present disclosure can be various types of smart terminals, such as smart containers, smart door locks, unmanned vending machines, etc., which can effectively ensure the safety and reliability of the smart devices during use. The following will take the smart container as an example of the use scenario of the smart device to explain in detail the technical solution provided by the embodiments of the present disclosure. Figure 2 This is a schematic diagram of the second embodiment of the present disclosure, which is applied to an intelligent business system. The intelligent business system may include but is not limited to a client, a resolution service device and an intelligent container. The resolution service device can provide an industrial Internet-based identity resolution service to ensure the uniqueness of the identity of any intelligent device. Figure 2 shown.

[0065] 201. The client registers the client's user ID 88.1.1 / wxj and the client's public key information with the resolution service device.

[0066] 202. The resolution service device returns a registration result to the client to confirm that the client's user ID 88.1.1 / wxj is allocated to the client.

[0067] The resolution service device receives the information sent by the client, returns a registration result indicating successful registration to the client, and stores and processes the client's user ID 88.1.1 / wxj and the client's public key information.

[0068] 201 and 202 are steps in which the client registers the user identification of the client and the public key information of the client with the resolution service device.

[0069] 203. The smart container registers the business identifier 88.1 of the smart container and the public key information of the smart container with the resolution service device.

[0070] 204. The resolution service device returns the registration result to the smart container to confirm that the smart container service identifier 88.1 is allocated to the smart container.

[0071] The parsing service device receives the information sent by the smart container, returns a registration result indicating successful registration to the smart container, and stores and processes the business identifier 88.1 of the smart container and the public key information of the smart container.

[0072] 203 and 204 are steps in which the smart device registers the service identification of the smart device and the public key information of the smart device with the resolution service device.

[0073] Before using the smart container, both the user and the container must first register their identities with the resolution service device, see 201-204 above. Figure 3 As shown. In this process, the user needs to register a unique identity with the resolution service device through the identity registration component in the client (for example, the application corresponding to the smart device installed on the smartphone) and submit the corresponding PKI public key information. The identity registration component in the smart cabinet also needs to register a unique identity and PKI public key information with the resolution service device. The resolution service device stores this registration information in the database for subsequent use. Through this process, both the user (customer order) and the smart cabinet have a unique and secure identity, laying the foundation for subsequent encrypted communication and identity authentication. This decentralized identity management method ensures that each entity in the smart business system is unique and can be used across systems.

[0074] 205. The client sends a request to the resolution service device to resolve the business identifier 88.1 of the smart container.

[0075] 206. The parsing service device returns the public key information of the smart container corresponding to the business identifier 88.1 of the smart container to the client.

[0076] 207. The client uses the public key information of the smart device corresponding to the business identifier 88.1 of the smart container to encrypt the shared key information and the client's user identifier 88.1.1 / wxj to obtain encrypted data, and signs the shared key information and the client's user identifier 88.1.1 / wxj using the client's private key information corresponding to the client's user identifier 88.1.1 / wxj to obtain signed data.

[0077] 208. The client sends a request for smart container usage permission to the smart device, and the request carries encrypted data and signature data.

[0078] When a user needs to use a container, he first applies for container use rights through the terminal, see 205-208 above. Figure 4 As shown. In this process, the identity resolution component in the user's client first obtains the PKI public key information of the smart container from the resolution service device, and then the permission application component uses the PKI public key information of the smart device to encrypt the shared key information and the user identity of the client. The encrypted data after encryption can prevent interception or tampering during network transmission. In order to further ensure the integrity of the data and the credibility of the source, the permission application component of the client can further sign the encrypted data or other content. Then, the permission application component of the client sends the request for the smart container use permission application carrying the signed data and the encrypted encrypted data to the permission application component of the smart container. This encryption and signing mechanism ensures the security and authenticity of the request data, allowing the smart container to accurately identify and process user applications from the client.

[0079] 209. The smart device decrypts the encrypted data using the private key information of the smart device corresponding to the business identification 88.1 of the smart container to obtain the shared key information and the user identification 88.1.1 / wxj of the client.

[0080] 210. The smart device sends a request to the resolution service device to resolve the client's user ID 88.1.1 / wxj.

[0081] 211. The resolution service device returns the public key information of the client corresponding to the user identification 88.1.1 / wxj of the client to the smart device.

[0082] 212. The smart device uses the public key information of the client corresponding to the user identification 88.1.1 / wxj of the client to verify the signature data to determine that the identity of the sender is authentic. If the verification process passes, the shared key information and the user identification 88.1.1 / wxj of the client are stored.

[0083] After the permission application component of the smart container receives the request for permission application for the smart container sent by the permission application component of the client, the identity authentication component verifies and stores the data, see 209-212 above, such as Figure 5 As shown. In this process, after the permission application component of the smart cabinet receives the request for the permission application of the smart cabinet sent by the permission application component of the client, the identity authentication component first uses the PKI private key information of the client to decrypt the encrypted data carried in the request to obtain the shared key information and the user ID of the client. After decryption, the identity authentication component obtains the PKI public key information of the client from the resolution service device, and uses the PKI public key information of the client to verify the signature data carried in the request to ensure that the data is indeed sent by the client and has not been tampered with. If the signature verification is successful, the identity authentication component of the smart cabinet will consider the user identity of the client to be credible. Then, the identity authentication component of the smart cabinet can securely store the shared key information and the user ID of the client in the database for future identity authentication, or submit the shared key information and the user ID of the client to the remote background system of the smart cabinet for further manual review. After the manual review is passed, the shared key information and the user ID of the client are securely stored in the database for future identity authentication. The purpose of this process is to perform comprehensive user identity authentication when the client first requests the permission to use the smart cabinet to ensure that only legitimate users can obtain access rights.

[0084] 213. In response to the user identification 88.1.1 / wxj and shared key information of the client input by the user, the client generates a one-time password according to the current timestamp and the shared key information using the OTP algorithm.

[0085] 214. The client sends an access service request to the smart container. The access service request carries the client's user ID 88.1.1 / wxj and a one-time password generated by the client.

[0086] 215. The smart container obtains the shared key information corresponding to the user ID 88.1.1 / wxj of the client according to the user ID 88.1.1 / wxj of the client, adopts the OTP algorithm, generates a one-time password according to the current timestamp and the shared key information, and compares the generated one-time password with the one-time password generated by the client. If the two are consistent, the user of the client is authorized to use the operation.

[0087] 216. The smart container returns the access result to the client.

[0088] After the client successfully registers and passes the review, each subsequent visit to the smart container will become more convenient and efficient, see 213-216 above. Figure 6 As shown. When the client needs to use the smart cabinet again, the client's smart cabinet access component only needs to input the user ID through the user, and based on the shared key information, use the OTP algorithm such as the TOTP algorithm or the HOTP algorithm to generate a one-time password, i.e., a dynamic password. The TOTP algorithm or the HOTP algorithm and other OTP algorithms generate a dynamic password that is valid for a short time by combining the shared key information and the current timestamp. These dynamic passwords are usually valid for 30 seconds to 1 minute and automatically become invalid after expiration. The client's smart cabinet access component sends the generated dynamic password and the client's user ID to the smart cabinet access component. The smart cabinet access component reads the client's shared key from the database, and based on the shared key information, uses the TOTP algorithm or the HOTP algorithm and other OTP algorithms to generate a one-time password, i.e., a dynamic password, and compares it with the dynamic password sent by the client's access component. If the two dynamic passwords are consistent, the smart cabinet will authorize the client's user to perform the use operation, such as unlocking or locking the lock. This user authentication mechanism based on OTP algorithms such as TOTP algorithm or HOTP algorithm greatly improves the security of the system, because the dynamic password is different each time and cannot be reused even if it is intercepted during network transmission.

[0089] So far, through the above implementation steps, a decentralized identity registration and management has been realized. Through this implementation method, after the identity trust is completed between the user's client and the smart container, even if the remote acquired system of the smart container fails, the user's client and the smart container can still achieve normal point-to-point use, thereby eliminating the single point failure risk brought by the centralized trust agency during the use of the smart container. It provides higher flexibility and security, making the use of smart containers more efficient and reliable.

[0090] The technical solution provided in this embodiment mainly has the following technical effects:

[0091] 1. Secure distribution and exchange mechanism of shared key information

[0092] The shared key information is encrypted and transmitted through PKI information, i.e., public and private key pair information. The client's identity and shared key information are encrypted using the public key information of the smart device, thus avoiding the security loopholes of the shared key information in the traditional OTP algorithm during network transmission. The encryption and signature processing performed by pairing the PKI public key information and private key information can effectively ensure the security and integrity of the transmitted data.

[0093] 2. Decentralized identity management based on industrial Internet identity resolution

[0094] By providing a resolution service device based on the Industrial Internet identity resolution service to achieve decentralized user identity management, the assigned identity is unique and can be used seamlessly across different business systems, avoiding the trouble of repeated registration of users in multiple business systems. This decentralized architecture greatly improves the flexibility and versatility of the authentication process.

[0095] 3. Cross-system application scalability

[0096] Through decentralized industrial Internet-based identity resolution services, a unified identity authentication mechanism can be implemented across systems and platforms, improving interoperability and authentication efficiency between systems.

[0097] In this embodiment, the identity management of industrial Internet identities across systems is achieved through the uniqueness of the identity identifier, and the PKI information, i.e. a pair of public key information and private key information, is combined to perform secure exchange of MFA shared key information, thereby solving the security problem of key distribution being easily intercepted and cracked in traditional OTP authentication, thereby improving the security and reliability of shared key information transmission.

[0098] In addition, by adopting the technical solution provided by the present disclosure and adding a signature verification mechanism, the credibility of identity authentication can be further enhanced.

[0099] In addition, by adopting the technical solution provided by the present invention, the identity resolution service of the distributed industrial Internet identity provided by the resolution service device can avoid users from repeated registration and management operations in multiple smart business systems, thereby improving the compatibility of the smart business systems.

[0100] In addition, the technical solution provided by the present disclosure can effectively improve the user experience.

[0101] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0102] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0103] Figure 7 is a schematic diagram according to a third embodiment of the present disclosure, Figure 7 The intelligent business system device 700 of this embodiment may include a client 701, a resolution service device 702 and an intelligent device 703;

[0104] The client 701 is used to obtain the public key information of the smart device 703 registered by the smart device 703 from the resolution service device 702 by using the business identifier of the smart device 703, and the business identifier of the smart device 703 is the industrial Internet identifier; encrypt the user data of the client 701 by using the public key information of the smart device 703 to obtain encrypted data; wherein the user data includes shared key information and the user identifier of the client 701, and the user identifier of the client 701 is the industrial Internet identifier; and send the encrypted data and the signature data obtained by using the private key information of the client 701 to the smart device 703;

[0105] The resolution service device 702 is used to return the public key information of the smart device 703 registered by the smart device 703 to the client 701 according to the service identifier of the smart device 703 provided by the client 701; and return the public key information of the client 701 registered by the client 701 to the smart device 703 according to the user identifier of the client 701 provided by the smart device 703;

[0106] The smart device 703 is used to use the private key information of the smart device 703 to decrypt the encrypted data to obtain the user data; use the user identifier in the user data to obtain the public key information of the client 701 registered by the client 701 from the resolution service device 702; use the public key information of the client 701 to verify the signature data; and if the verification process passes, store the user identifier and the shared key information in the user data, so that the smart device 703 can use the user identifier and the shared key information to perform user authentication on the client 701 based on a one-time password.

[0107] It is understandable that the client may be a local program (nativeApp) installed on the local terminal, or may also be a webpage program (webApp) of a browser on the local terminal, which is not limited in this embodiment.

[0108] Optionally, in a possible implementation of this embodiment, the client 701 is also used to register the user identifier of the client 701 and the public key information of the client 701 to the resolution service device 702; the smart device 703 is also used to register the business identifier of the smart device 703 and the public key information of the smart device 703 to the resolution service device 702; the resolution service device 702 is also used to register the user identifier of the client 701 and the public key information of the client 701 for the client 701; and to register the business identifier of the smart device 703 and the public key information of the smart device 703 for the smart device 703.

[0109] Optionally, in a possible implementation of this embodiment, the client 701 is also used to send a service access request to the smart device 703 using the user identifier and a dynamic password generated based on the shared key information; the smart device 703 is also used to use the user identifier to obtain the stored shared key information corresponding to the user identifier; use the dynamic password generated based on the shared key information to authenticate the dynamic password from the client 701; and if the authentication process passes, the smart device 703 authorizes the client 701 to operate the smart device 703.

[0110] In this embodiment, the one-time password-based user authentication adopted may include but is not limited to time-based one-time password (TOTP) user authentication or event-based one-time password, i.e., key-related hash-based message authentication code (HMAC) one-time password (HOTP) user authentication, and this embodiment does not specifically limit this.

[0111] It should be noted that Figure 1-Figure 6 The method in the embodiment corresponding to any of the figures can be implemented by the intelligent business system device provided in this embodiment. Figure 1-Figure 6 The relevant contents in the embodiments corresponding to any of the accompanying drawings will not be repeated here.

[0112] In this embodiment, the identity management of industrial Internet identities across systems is achieved through the uniqueness of the identity identifier, and the PKI information, i.e. a pair of public key information and private key information, is combined to perform secure exchange of MFA shared key information, thereby solving the security problem of key distribution being easily intercepted and cracked in traditional OTP authentication, thereby improving the security and reliability of shared key information transmission.

[0113] In addition, by adopting the technical solution provided by the present disclosure and adding a signature verification mechanism, the credibility of identity authentication can be further enhanced.

[0114] In addition, by adopting the technical solution provided by the present invention, the identity resolution service of the distributed industrial Internet identity provided by the resolution service device can avoid users from repeated registration and management operations in multiple smart business systems, thereby improving the compatibility of the smart business systems.

[0115] In addition, the technical solution provided by the present disclosure can effectively improve the user experience.

[0116] In the technical solution disclosed herein, the user identification of the client and the public key information of the client, the business identification of the smart device and the public key information of the smart device, as well as the acquisition, storage and application of shared key information, all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0117] Below, reference Figure 8 The electronic device according to the embodiment of the present disclosure is described. The electronic device may be any one or both of the first device and the second device, or a stand-alone device independent of them, and the stand-alone device may communicate with the first device and the second device to receive the collected input signals from them.

[0118] Figure 8 A block diagram of an electronic device according to an embodiment of the present disclosure is illustrated.

[0119] like Figure 8 As shown, the electronic device includes one or more processors and memory.

[0120] The processor may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0121] The memory may store one or more computer program products, and the memory may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. One or more computer program products may be stored on the computer-readable storage medium, and the processor may run the computer program product to implement the user authentication method of each embodiment of the present disclosure described above and / or other desired functions.

[0122] In one example, the electronic device may further include: an input device and an output device, and these components are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0123] In addition, the input device may also include, for example, a keyboard, a mouse, and the like.

[0124] The output device can output various information to the outside, including determined distance information, direction information, etc. The output device can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0125] Of course, to simplify, Figure 8 Only some of the components related to the present disclosure in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, according to specific application situations, the electronic device may further include any other appropriate components.

[0126] In addition to the above-mentioned methods and devices, an embodiment of the present disclosure may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps in the user authentication method according to various embodiments of the present disclosure described in the above part of this specification.

[0127] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0128] In addition, an embodiment of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, causes the processor to execute the steps of the user authentication method according to various embodiments of the present disclosure described in the above part of this specification.

[0129] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0130] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0131] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0132] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0133] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0134] It should also be noted that in the apparatus, device and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0135] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0136] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A user authentication method is applied to an intelligent business system, wherein the intelligent business system includes a client, a resolution service device and an intelligent device, and is characterized in that: The method comprises: The client uses the business identifier of the smart device to obtain the public key information of the smart device registered by the smart device from the resolution service device, and the business identifier is an industrial Internet identifier; The client uses the public key information of the smart device to encrypt the user data of the client to obtain encrypted data; wherein the user data includes shared key information and a user identifier of the client, and the user identifier is an industrial Internet identifier; The client sends the encrypted data and the signature data obtained by using the private key information of the client to the smart device; The smart device uses the private key information of the smart device to decrypt the encrypted data to obtain the user data; The smart device uses the user identifier in the user data to obtain the public key information of the client registered by the client from the resolution service device; The smart device verifies the signature data using the public key information of the client; If the verification process is passed, the smart device stores and processes the user identification and the shared key information in the user data, so that the smart device can use the user identification and the shared key information to perform user authentication on the client based on a one-time password.

2. The method according to claim 1, characterized in that Before the client uses the service identifier of the smart device to obtain the public key information of the smart device registered by the smart device from the resolution service device, the method further includes: The client registers the user identification of the client and the public key information of the client with the resolution service device; The smart device registers the service identification of the smart device and the public key information of the smart device with the resolution service device.

3. The method according to claim 1, characterized in that: If the verification process is passed, after the smart device stores the user identification and the shared key information in the user data, the method further includes: The client sends a service access request to the smart device using the user identifier and a dynamic password generated based on the shared key information; The smart device uses the user identifier to obtain the stored shared key information corresponding to the user identifier; The smart device authenticates the dynamic password from the client using the dynamic password generated based on the shared key information; If the authentication process is successful, the smart device authorizes the client to operate the smart device.

4. The method according to any one of claims 1 to 3, characterized in that: The one-time password-based user authentication includes time-based one-time password user authentication or event-based one-time password user authentication.

5. An intelligent business system, characterized in that: Including client, analysis service equipment and smart devices; among them, The client is used to obtain the public key information of the smart device registered by the smart device from the resolution service device using the business identifier of the smart device, wherein the business identifier is the industrial Internet identifier; encrypt the user data of the client using the public key information of the smart device to obtain encrypted data; wherein the user data includes shared key information and the user identifier of the client, wherein the user identifier is the industrial Internet identifier; and send the encrypted data and the signature data obtained using the private key information of the client to the smart device; The resolution service device is used to return the public key information of the smart device registered by the smart device to the client according to the service identifier of the smart device provided by the client; and return the public key information of the client registered by the client to the smart device according to the user identifier of the client provided by the smart device; The smart device is used to use the private key information of the smart device to decrypt the encrypted data to obtain the user data; use the user identifier in the user data to obtain the public key information of the client registered by the client from the resolution service device; use the public key information of the client to verify the signature data; and if the verification process passes, store the user identifier and the shared key information in the user data, so that the smart device can use the user identifier and the shared key information to perform user authentication on the client based on a one-time password.

6. The intelligent business system according to claim 5, characterized in that: The client is further used to register the user identification of the client and the public key information of the client with the resolution service device; The smart device is further used to register the service identifier of the smart device and the public key information of the smart device with the resolution service device; The resolution service device is further used to register the user identification of the client and the public key information of the client for the client; and to register the service identification of the smart device and the public key information of the smart device for the smart device.

7. The intelligent business system according to claim 5, characterized in that: The client is further used to send a service access request to the smart device using the user identifier and a dynamic password generated based on the shared key information; The smart device is further used to use the user identifier to obtain the stored shared key information corresponding to the user identifier; and use the dynamic password generated based on the shared key information to authenticate the dynamic password from the client; And if the authentication process is passed, the smart device authorizes the client to operate the smart device.

8. The intelligent business system according to any one of claims 5 to 7, characterized in that: The one-time password-based user authentication includes time-based one-time password user authentication or event-based one-time password user authentication.

9. An electronic device, characterized in that: include: a memory for storing a computer program product; A processor is used to execute the computer program product stored in the memory, and when the computer program product is executed, it implements the method described in any one of claims 1 to 4 above.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method described in any one of claims 1 to 4 is implemented.

11. A computer program product comprising computer program instructions, characterized in that When the computer program instructions are executed by a processor, the method described in any one of claims 1 to 4 is implemented.

Images