Authority authentication system

Abstract

The embodiment of the invention discloses a permission authentication system. Comprising a user information receiving module, a certificate generation module and a certificate storage module, the user information receiving module is used for acquiring a user request and user information of a user, encrypting the user request and the user information to obtain a user ciphertext, and sending the user ciphertext to the certificate generation module; the user information comprises identity information, operation authority information, an effective time limit, a target system and a key file; the certificate generation module is used for responding to an application request in the user request, decrypting the received user ciphertext to obtain user information, generating a permission certificate according to the user information, and sending the permission certificate to the certificate storage module; and the certificate storage module is used for storing the authority certificate, so that the user can authenticate the operation authority of the user through the authority certificate when the user authenticates the client where the target system is located. According to the embodiment of the invention, the convenience and safety of authority authentication are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to industrial control technology, and in particular, to an authority authentication system. Background Art

[0002] In the use of power grid automation systems in the industrial control industry, personnel are often assigned different permissions to correspond to different role functions.

[0003] In the prior art, different accounts and passwords are needed to manage user rights. When there are multiple power grid systems, users need to apply for different accounts and passwords, which are independent, so the management of accounts and passwords is very complicated. Summary of the invention

[0004] The present application provides a permission authentication system to improve the convenience and security of permission authentication.

[0005] In a first aspect, an embodiment of the present application provides an authority authentication system, the authority authentication system comprising:

[0006] User information receiving module, certificate generating module and certificate storing module;

[0007] The user information receiving module, the certificate generating module and the certificate storing module are sequentially connected in communication;

[0008] The user information receiving module is used to obtain the user's user request and user information, encrypt the user request and user information to obtain the user ciphertext, and send the user ciphertext to the certificate generating module; the user information includes identity information, operation authority information, validity period, target system and key file;

[0009] The certificate generation module is used to respond to the application request in the user request, decrypt the received user ciphertext to obtain the user information, generate the authority certificate according to the user information, and send it to the certificate storage module;

[0010] The certificate storage module is used to store the authority certificate so that when the user authenticates the client where the target system is located, the user's operation authority can be authenticated through the authority certificate.

[0011] The present application uses a user information receiving module to obtain the user's user request and user information, encrypts the user request and user information to obtain the user ciphertext, and sends the user ciphertext to the certificate generation module; the user information includes identity information, operation authority information, validity period, target system and key file; the certificate generation module is used to respond to the application request in the user request, decrypt the received user ciphertext to obtain user information, generate an authority certificate according to the user information, and send it to the certificate storage module; the certificate storage module is used to store the authority certificate, so that when the user authenticates the client where the target system is located, the user's operation authority is authenticated through the authority certificate, and the user's operation authority is managed through the authority certificate. There is no need to manage the account and password of each user in different target systems separately. The operation authority is managed through the authority certificate, the convenience of authority authentication is improved, and the security of authority authentication is improved by encrypting during transmission. Therefore, through the technical solution of the present application, the problem that users need to apply for independent accounts and passwords for different systems and the management of accounts and passwords is very complicated is solved, and the convenience and security of authority authentication are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a schematic diagram of the structure of a permission authentication system in Embodiment 1 of the present application;

[0013] Figure 2 It is a structural diagram of a user information receiving module in Embodiment 2 of the present application;

[0014] Figure 3 This is a schematic diagram of the structure of a certificate generation module in Embodiment 3 of the present application;

[0015] Figure 4 It is a structural diagram of a certificate storage module in the fourth embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0017] It should be noted that the terms "first" and "second" etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0018] Embodiment 1

[0019] Figure 1 This is a structural diagram of an authority authentication system provided in Example 1 of the present application. This embodiment can be applicable to situations where a user applies for operating permissions when using a power grid automation system. The system can be executed by an authority authentication system. The device can be implemented in software and / or hardware and applied to authority authentication in a power grid automation system.

[0020] See also Figure 1 The structural diagram of the permission authentication system shown in the figure specifically includes:

[0021] The user information receiving module 100, the certificate generating module 200 and the certificate storing module 300; the user information receiving module 100, the certificate generating module 200 and the certificate storing module 300 are sequentially connected in communication.

[0022] The user information receiving module 100 is used to obtain the user request and user information of the user, encrypt the user request and user information to obtain the user ciphertext, and send the user ciphertext to the certificate generating module 200.

[0023] The user request may be a request sent by the user through the client. For example, the user request may include an application request, a login request, and a revocation request, etc., which are not specifically limited in this application. The user information may be relevant information of the user, used to provide authentication information for the application of the authority certificate file, so that subsequent users can obtain the authority certificate through the user information. For example, the user information includes identity information, operation authority information, validity period, target system, and key file.

[0024] The user information receiving module 100 may be a client where the target system is located, and the certificate generating module 200 may be located at the server. To ensure the security of information, the user information receiving module 100 encrypts the user request and the user information to obtain a user ciphertext, and sends the user ciphertext to the certificate generating module 200. The encryption algorithm may be at least one of asymmetric encryption and symmetric encryption. Exemplarily, the user information may be encrypted in a mixed manner of asymmetric encryption and symmetric encryption to ensure the security of user information transmission.

[0025] The user's public key and other identification information (such as name, email address, and ID number, etc.) can be combined through a third-party trusted organization, the Certificate Authority (CA), to generate and transmit user ciphertext for use in verifying the user's identity on the target system's website and applying for an authority certificate.

[0026] Among them, the certification authority CA is the core part of the Public Key Infrastructure (PKI) system. PKI is an infrastructure that provides security services using public key theory and technology, and is the core of information security. The CA certification system is the core link in the public key infrastructure (PKI). It is a third-party authoritative certification party in the public key encryption process. It is responsible for the generation, release, management, storage and revocation of keys, and is widely used in information transmission scenarios that require asymmetric encryption. All parties that transmit information through CA must unconditionally trust the fairness of CA. During the message transmission process, CA can provide a public and private key encryption environment for both parties of the information transmission, and provide functions such as identity authentication, secure transmission, non-repudiation and data integrity.

[0027] The information transmission between the user information receiving module 100 and the certificate generating module 200 can be based on PKI, using a digital certificate based on PKI. By encrypting and signing digital information such as user requests and user information to be transmitted, the confidentiality, authenticity, integrity and non-repudiation of the information transmission can be guaranteed, thereby ensuring the secure transmission of information.

[0028] The certificate generation module 200 is used to respond to the application request in the user request, decrypt the received user ciphertext to obtain the user information, and generate an authority certificate according to the user information.

[0029] The authority certificate file may be a digital certificate for authenticating the authority of the user. Exemplarily, the authority certificate file may be a .mycer (professional term, a file format) certificate file in a fixed format. When the user request is an application request, the certificate generation module 200 receives the application request, decrypts the received user ciphertext through the corresponding decryption algorithm according to the encryption algorithm adopted by the user information receiving module 100 to obtain the user information, and generates the authority certificate file according to the user information.

[0030] The authorization certificate may include fixed fields, and the corresponding fields in the authorization certificate may be filled according to the user information to obtain the authorization certificate. For example, if the user information includes a validity period of 1 year, and the relevant field in the authorization certificate is an expiration date, the expiration date is determined according to the current date and the validity period, and filled into the corresponding field.

[0031] The certificate storage module 300 is used to store the authority certificate so that when the user authenticates at the client where the target system is located, the user's operation authority can be authenticated through the authority certificate.

[0032] The certificate storage module 300 is located in the server and is used to store the authority certificate. The authority certificate is stored in the certificate storage module 300 in the form of a file. Exemplarily, when the certificate storage module 300 stores the authority certificate, it may include fields such as serial number, signature algorithm, signature hash algorithm, issuer, validity start date, validity end date, user, public key and signature, etc., which are not specifically limited in this application.

[0033] The serial number (Serial Number) can be a hexadecimal md5 (professional term, a hash value) hash value of the organization name with the current time as the prefix, which is used to provide an index for the retrieval of the authority certificate. For example, the serial number can be 20191222091200HIT. The signature algorithm (Sign Algorithm) can be a user signature determination algorithm, for example, sha1RSA (professional term, a signature algorithm). For example, the signature hash algorithm (Encrypt Algorithm) can be sha256. For example, the issuer can be GothamCityTrust RSA CA 2019, www.tofushen.com, GothamCity Trust, CN. The validity period start date (Valid Time From) can be the current date, such as 21:32:00 on December 21, 2019. The validity period end date (Valid Time To) can be a date after the validity period is delayed from the current date, such as 21:32:00 on December 21, 2022. The user (User) can be the name of the organization. The public key can be a public key file string. The signature can be a signature value of the public key file string. For example, the signature can be obtained by using the sha1RSA algorithm to perform hash calculation to obtain a hash value, encrypting the obtained hash value using the RSA algorithm, and then encrypting it using the CA private key.

[0034] In the use of power grid automation systems in the industrial control industry, personnel are often assigned different permissions to correspond to different role functions. For example, senior engineers can be assigned permissions to add or delete the system's overall program, and engineers can be assigned permissions to download and modify programs for smart devices at key industrial control nodes, while operators can only be assigned permissions to operate and execute. When assigning permissions, different accounts and passwords must be used for personnel management. Often, each person has to use multiple power grid automation systems, and the accounts and passwords of these systems are independent. Account and password management for multiple systems is also a headache.

[0035] The technical solution of this embodiment is used to obtain the user's user request and user information through the user information receiving module, encrypt the user request and user information to obtain the user ciphertext, and send the user ciphertext to the certificate generation module; the user information includes identity information, operation authority information, validity period, target system and key file; the certificate generation module is used to respond to the application request in the user request, decrypt the received user ciphertext to obtain user information, generate an authority certificate according to the user information, and send it to the certificate storage module; the certificate storage module is used to store the authority certificate, so that when the user authenticates the client where the target system is located, the user's operation authority is authenticated through the authority certificate, and the user's operation authority is managed through the authority certificate. There is no need to manage the account and password of each user in different target systems separately. The operation authority is managed through the authority certificate, the convenience of authority authentication is improved, and the security of authority authentication is improved by encrypting during transmission. Therefore, through the technical solution of this application, the problem that users need to apply for independent accounts and passwords for different systems and the management of accounts and passwords is very complicated is solved, and the convenience and security of authority authentication are improved.

[0036] Embodiment 2

[0037] Figure 2 This is a structural diagram of a user information receiving module provided in Example 2 of the present application. The technical solution of this embodiment is further refined on the basis of the above technical solution.

[0038] Furthermore, the user information receiving module 100 includes: a signature generation unit 110, an encryption unit 120 and an information sending unit 130; the signature generation unit 110 and the encryption unit 120 are communicatively connected with the information sending unit 130; the signature generation unit 110 is used to encrypt the hash value of the user information by the user private key to obtain the user signature when the user request is an application request, and send the user signature to the information sending unit 130; the encryption unit 120 is used to encrypt the user information by a random key pair to obtain the user ciphertext, encrypt the random key by the user public key to obtain the transmission key, and send the user ciphertext and the transmission key to the information sending unit 130; the information sending unit 130 is used to send the user signature, the user ciphertext and the transmission key to the certificate generation module 200 when the user request is an application request.

[0039] See also Figure 2 The structural diagram of a user information receiving module shown in FIG. 1 , the user information receiving module 100 includes:

[0040] The signature generation unit 110 , the encryption unit 120 and the information sending unit 130 ; the signature generation unit 110 , the encryption unit 120 and the information sending unit 130 are communicatively connected.

[0041] The signature generating unit 110 is used to encrypt the hash value of the user information by using the user private key to obtain the user signature when the user request is an application request, and send the user signature to the information sending unit 130 .

[0042] The user private key can be the private key in the key file uploaded by the user, which is used to encrypt the signature. Exemplarily, the user can obtain a genkey.exe file (a professional term, a key file including a public-private key pair) from the CA certification system, and use the private key in the genkey.exe file as the user private key. When the user request is an application request, the signature generation unit 110 processes the user information through a hash algorithm to obtain a hash value, encrypts the hash value through the user private key, obtains the user signature, and sends the user signature to the information sending unit 130. When the user request is an application request, the signature generated by the signature generation unit 110 can be used to judge the security of the transmission.

[0043] The encryption unit 120 is used to encrypt the user information by using a random key pair to obtain a user ciphertext, encrypt the random key by using a user public key to obtain a transmission key, and send the user ciphertext and the transmission key to the information sending unit 130.

[0044] The random key can be a symmetric encryption key randomly generated by an algorithm, and is used to symmetrically encrypt the original user information. The user public key can be a public key for decryption by the recipient. The encryption unit 120 encrypts the user information through a random key pair to obtain the user ciphertext, thereby ensuring the security of the user information; the random key is encrypted through the user public key to obtain the transmission key, thereby ensuring the security of the random key. The receiving end needs to use the user private key paired with the user public key to decrypt the transmission key to obtain the random key, and then decrypt the user ciphertext through the random key, and encrypt the user information through the double-layer key to ensure the security of the user information during transmission. The encryption unit 120 sends the user ciphertext and the transmission key to the information sending unit 130.

[0045] When the user request is an application request, the information sending unit 130 sends the user signature, the user ciphertext and the transmission key to the certificate generating module 200 .

[0046] In an optional embodiment, the authority authentication system also includes: a key file acquisition module 400, which is used to obtain a key file from the authentication center in response to the key file acquisition request of the user information receiving module 100 when the user request is an application request, and send the key file to the key file acquisition module 400; the key file includes a user public key and a user private key.

[0047] When the user request is an application request, the user information receiving module 100 sends a key file acquisition request to the key file acquisition module 400. The key file acquisition module 400 responds to the key file acquisition request of the user information receiving module 100, acquires a key file from the authentication center, and sends the key file to the key file acquisition module 400. The key file acquisition module 400 can improve the security of the user signature, user ciphertext and transmission key after subsequent encryption.

[0048] Exemplarily, the key file acquisition module 400 can obtain a genkey.exe file from the CA certification system. Running the executable program will generate two files pk.key (professional term, a public key file) and sk.key (professional term, a private key file) in the directory at the same level as the path where the file is located. The former is a public key file and the latter is a private key file. The two together form a pair of 1024-bit RSA (professional term, an encryption algorithm) public-private key pairs. The public key is uploaded and the private key is retained.

[0049] The technical solution of this embodiment is that the user information receiving module 100 includes: a signature generation unit 110, an encryption unit 120 and an information sending unit 130; the signature generation unit 110 is used to encrypt the hash value of the user information by using the user private key to obtain the user signature, and send the user signature to the information sending unit, and the security of the transmission process can be verified by the signature; the encryption unit 120 is used to encrypt the user information by using a random key pair to obtain the user ciphertext, encrypt the random key by using the user public key to obtain the transmission key, and send the user ciphertext and the transmission key to the information sending unit, and perform two-layer encryption on the user information by using the random key and the user public key to improve the security of the user information; the information sending unit 130 is used to send the user signature, the user ciphertext and the transmission key to the certificate generation module 200 when the user request is an application request, so that the certificate generation module 200 can obtain the user information.

[0050] Embodiment 3

[0051] Figure 3 This is a structural diagram of a certificate generation module provided in Example 3 of the present application. The technical solution of this embodiment is further refined on the basis of the above technical solution.

[0052] Furthermore, the certificate generation module 200 includes: a decryption unit 210, a signature verification unit 220 and a certificate generation unit 230; the decryption unit 210, the signature verification unit 220 and the certificate generation unit 230 are communicatively connected in sequence; the decryption unit 210 is used to decrypt the user signature by the user public key to obtain the summary to be verified, decrypt the transmission key by the user private key to obtain the random key, and decrypt the user ciphertext by the random key to obtain the user information, and send the summary to be verified and the user information to the signature verification unit 220; the signature verification unit 220 is used to perform a hash calculation on the received user information to obtain a received summary, and compare the received summary with the summary to be verified. If the received summary is the same as the summary to be verified, the user information is sent to the certificate generation unit 230; the certificate generation unit 230 is used to generate an authority certificate file according to the user information.

[0053] See also Figure 3 The structure diagram of a certificate generation module shown is a certificate generation module 200, which includes: a decryption unit 210, a signature verification unit 220 and a certificate generation unit 230; the decryption unit 210, the signature verification unit 220 and the certificate generation unit 230 are communicatively connected in sequence.

[0054] The decryption unit 210 is used to decrypt the user signature by using the user public key to obtain the summary to be verified, decrypt the transmission key by using the user private key to obtain the random key, and decrypt the user ciphertext by using the random key to obtain the user information, and send the summary to be verified and the user information to the signature verification unit 220.

[0055] After receiving the user signature, the decryption unit 210 decrypts the user signature by the user public key to obtain the summary to be verified. After receiving the transmission key, the decryption unit 210 decrypts the transmission key by the user private key to obtain the random key, and then decrypts the user ciphertext by the random key to obtain the user information. The decryption unit 210 sends the summary to be verified and the user information to the signature verification unit 220. The key pair for encrypting and decrypting the signature and the key pair for encrypting and decrypting the random symmetric key can be the same or different, and this application does not make specific restrictions on this.

[0056] The signature verification unit 220 is used to perform hash calculation on the received user information to obtain a received digest, and compare the received digest with the digest to be verified. If the received digest is the same as the digest to be verified, the user information is sent to the certificate generation unit 230. If the received digest is the same as the digest to be verified, it can be considered that the user information is not missing during the transmission process, so it can be considered that the integrity of the information transmission is guaranteed.

[0057] The certificate generation unit 230 is used to generate an authority certificate file according to the user information. The certificate generation unit 230 archives the user information and generates an authority certificate file.

[0058] In an optional embodiment, the signature verification unit 220 is further configured to: if the received digest is different from the digest to be verified, return the instruction to the user information receiving module 100 to resend the instruction.

[0059] If the received digest is different from the digest to be verified, the user signature, user ciphertext and transmission key are lost during the transmission process, so a resend instruction is returned to the user information receiving module 100, so that the user information receiving module 100 resends the user signature, user ciphertext and transmission key. Specifically, the resend instruction is returned to the information sending unit 130, and the information sending unit 130 resends the user signature, user ciphertext and transmission key to the decryption unit 210.

[0060] In an optional embodiment, the certificate generation module 200 further includes: a salt value mixing unit 240, which is used to generate a salt value, and hash the mixed value obtained by mixing the salt value with the account information to obtain a login verification code for verifying the user's login information.

[0061] The salt value can be a random value, which is usually used in combination with the user password when the user registers to increase the security of the password. The salt value mixing unit 240 randomly generates a strong random string as the salt value, mixes the salt value with at least one of the account name and password in the account information, performs sha256 (professional term, a hash algorithm) hash processing, obtains the login verification code, and stores the login verification code in the database. The login verification code can be used for subsequent login verification. For example, when a user logs in, the salt value in the database can be obtained according to the user name, and then the user name and the salt value are mixed, and the sha256 hash processing is performed, and then compared with the login verification code stored in the database. If they match, the login is successful; otherwise, the login fails.

[0062] Embodiment 4

[0063] Figure 4 This is a structural diagram of a certificate storage module provided in Example 4 of the present application. The technical solution of this embodiment is further refined on the basis of the above technical solution.

[0064] Furthermore, the certificate storage module 300 includes: a certificate storage unit 310 and a certificate issuing unit 320; the certificate issuing unit 310 is communicatively connected to the certificate storage unit 320; the certificate storage unit 310 is used to store the authority certificate and use the serial number of the certificate as the index of the authority certificate; the certificate issuing unit 320 is used to respond to the user's download request, obtain the corresponding authority certificate from the certificate storage unit and send it to the user.

[0065] See also Figure 4 The structure diagram of a certificate storage module shown is a certificate storage module 300, comprising:

[0066] The certificate storage unit 310 and the certificate issuing unit 320 ; the certificate issuing unit 320 is communicatively connected with the certificate storage unit 310 .

[0067] The certificate storage unit 310 is used to store the authority certificate and use the serial number of the certificate as the index of the authority certificate. The certificate storage unit 310 stores the authority certificate in the form of a field. The index of the authority certificate is used as an identifier for searching the authority certificate. Using the serial number of the certificate as the index of the authority certificate facilitates subsequent retrieval, viewing or revocation operations.

[0068] The certificate issuing unit 320 is used to obtain the corresponding authority certificate from the certificate storage unit 310 in response to the user's download request and send it to the user. After receiving the user's download request, the certificate issuing unit 320 obtains the corresponding authority certificate from the certificate storage unit 310 and sends it to the user. Exemplarily, after the user completes the login, he can input a download request including a serial number. After obtaining the download request, the certificate issuing unit 320 obtains the corresponding authority certificate from the certificate storage unit 310 according to the serial number and sends it to the user. The user can store the authority certificate in the form of a file on the client.

[0069] In an optional embodiment, the authority authentication system further includes: a certificate revocation module 500; the certificate revocation module 500 is used to respond to the user's active revocation request and add the authority certificate in the active revocation request to the invalidation list.

[0070] When the certificate revocation module 500 obtains the user's active revocation request, it adds the serial number of the authority certificate in the active revocation request to the invalidation list. The authority certificate corresponding to the serial number stored in the invalidation list is a certificate that has not reached its validity period. The active revocation request includes the serial number of the certificate to be revoked, the corresponding revocation account name and password.

[0071] The user only needs to enter the serial number of the certificate to be revoked, and the corresponding revocation account name and password to successfully revoke the corresponding authority certificate. After the authority certificate is revoked, it will not be deleted from the certificate library, but will be added to the invalid list. Since the certificate serial number is visible to everyone, the requester can only revoke it successfully if he knows the login password when applying for the certificate, so as to avoid the authority certificate being accidentally revoked by users other than the certificate owner, affecting the operation of the certificate owner.

[0072] In an optional embodiment, the authority authentication system also includes: a certificate verification module 600; the certificate verification module is in communication with the salt value mixing unit 240; the corresponding salt value and login verification code are obtained from the salt value mixing unit 240 through the account information, and the login code to be verified is determined based on the salt value and the account information, and the login code to be verified is compared with the login verification code. If they are the same, the login is successful.

[0073] When a user logs in, he / she is verified by the certificate verification module 600, and obtains the corresponding operation authority after passing the verification. When a user logs in, he / she enters the account name and password, and the certificate verification module 600 obtains the user's account name and password, obtains the corresponding salt value in the salt value mixing unit 240 through the account name, and performs a hash calculation based on at least one of the account name and password and the salt value, determines the login code to be verified, and compares the login code to be verified with the login verification code. If they are the same, the login is successful.

[0074] In an optional embodiment, the authority authentication system further includes: a certificate viewing module 700; the certificate viewing module 700 is used to respond to a user's viewing request, obtain a corresponding authority certificate, and display it on a web page.

[0075] After the certificate viewing module 700 obtains the user's viewing request, it obtains the corresponding viewing content according to the serial number input by the user. After the certificate viewing module 700 responds to the viewing request, the authority certificate can be displayed in pages on the front-end web page. The front-end display can provide the certificate serial number, organization, business registration number, certificate validity start and certificate validity end information, etc., and provides a download link. Clicking the link can directly obtain the certificate file, which is convenient for users to download after viewing.

[0076] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A permission authentication system, characterized in that: include: User information receiving module, certificate generating module and certificate storing module; The user information receiving module, the certificate generating module and the certificate storing module are sequentially connected in communication; The user information receiving module is used to obtain a user request and user information of a user, encrypt the user request and the user information to obtain a user ciphertext, and send the user ciphertext to the certificate generating module; The user information includes identity information, operation authority information, validity period, target system and key file; The certificate generation module is used to respond to the application request in the user request, decrypt the received user ciphertext to obtain the user information, generate an authority certificate according to the user information, and send it to the certificate storage module; The certificate storage module is used to store the authority certificate so that when the user authenticates the client where the target system is located, the user's operation authority can be authenticated through the authority certificate.

2. The system according to claim 1, characterized in that The user information receiving module includes: a signature generating unit, an encryption unit and an information sending unit; The signature generation unit and the encryption unit are communicatively connected with the information sending unit; The signature generating unit is used for encrypting the hash value of the user information by using the user private key to obtain the user signature when the user request is an application request, and sending the user signature to the information sending unit; The encryption unit is used to encrypt the user information by using a random key pair to obtain a user ciphertext, encrypt the random key by using a user public key to obtain a transmission key, and send the user ciphertext and the transmission key to the information sending unit; The information sending unit is used to send the user signature, the user ciphertext and the transmission key to the certificate generating module when the user request is an application request.

3. The system according to claim 2, characterized in that The certificate generation module includes: a decryption unit, a signature verification unit and a certificate generation unit; The decryption unit, the signature verification unit and the certificate generation unit are sequentially communicatively connected; The decryption unit is used to decrypt the user signature by using the user public key to obtain the summary to be verified, decrypt the transmission key by using the user private key to obtain the random key, and decrypt the user ciphertext by using the random key to obtain the user information, and send the summary to be verified and the user information to the signature verification unit; The signature verification unit is used to perform hash calculation on the received user information to obtain a received digest, and compare the received digest with the digest to be verified. If the received digest is the same as the digest to be verified, the user information is sent to the certificate generation unit; The certificate generation unit is used to generate an authority certificate file according to user information.

4. The system according to claim 3, characterized in that The certificate generation module further includes: The salt value mixing unit is used to generate a salt value, and perform hash processing on the mixed value obtained by mixing the salt value with the account information to obtain a login verification code, which is used to verify the user's login information.

5. The system according to claim 3, characterized in that The signature verification unit further includes: If the received digest is not the same as the digest to be verified, the instruction is returned to the user information receiving module to resend.

6. The system according to claim 1, characterized in that The certificate storage module includes: A certificate storage unit and a certificate issuing unit; the certificate issuing unit is communicatively connected with the certificate storage unit The certificate storage unit is used to store the authority certificate and use the serial number of the certificate as an index of the authority certificate; The certificate issuing unit is used to obtain the corresponding authority certificate from the certificate storage unit and send it to the user in response to a download request from the user.

7. The system according to claim 1, characterized in that The system further includes: a key file acquisition module; The user information receiving module is in communication connection with the key file obtaining module; The key file acquisition module is used to respond to the key file acquisition request of the user information receiving module when the user request is an application request, obtain the key file from the authentication center, and send the key file to the key file acquisition module; the key file includes a user public key and a user private key.

8. The system according to claim 1, characterized in that The system further comprises: a certificate revocation module; The certificate revocation module is used to respond to the active revocation request of the user and add the authority certificate in the active revocation request to the invalidation list.

9. The system according to claim 4, characterized in that The system further includes: a certificate verification module; the certificate verification module is communicatively connected with the salt value mixing unit; The certificate verification module is used to obtain the user's account information, obtain the corresponding salt value and the login verification code from the salt value mixing unit through the account information, and determine the login code to be verified based on the salt value and the account information, and compare the login code to be verified with the login verification code. If they are the same, the login is successful.

10. The system according to claim 1, characterized in that The system further includes: a certificate viewing module; The certificate viewing module is used to respond to a user's viewing request, obtain a corresponding authority certificate, and display it on a web page.

Images