Identity authentication system and method based on quantity shield software development kit

Abstract

The embodiment of the invention provides an identity authentication system and method based on a quantity shield software development kit, and the method comprises the steps: obtaining an account password inputted by a user through a to-be-accessed application through the quantity shield software development kit, applying to a national shield secret service platform for obtaining a quantum key, and carrying out the quantum encryption of the account password, thereby obtaining quantum encryption information; the quantity shield software development kit carries out login authentication on an identity authentication platform according to the access token and the quantum encryption information; when determining that the access token is legal, the identity authentication platform applies for a quantum key from a national shield secret service platform, and the quantum key is used for decrypting the quantum encryption information to obtain an account password; if the identity authentication platform successfully authenticates the account password, the vector shield software development kit issues a bill and token set; and the quantity shield software development kit sends the bill and token set to the to-be-accessed application to complete identity authentication of the to-be-accessed application. According to the embodiment of the invention, the reusability and expandability of quantum identity authentication are improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of network security authentication, and in particular, to an identity authentication system based on the Quantum Shield software development toolkit, an identity authentication system method based on the Quantum Shield software development toolkit, an electronic device, and a computer-readable storage medium. Background Art

[0002] Identity authentication refers to the process of confirming the identity of an operator in a computer and computer network system, thereby determining whether the user has access to and use rights to a certain resource, thereby enabling the access policies of the computer and network system to be reliably and effectively implemented, preventing attackers from impersonating legitimate users to gain access to resources, ensuring the security of the system and data, and the legitimate interests of authorized visitors.

[0003] Currently, the market can protect information during the identity authentication process based on quantum keys. However, this method only realizes the basic combination of quantum keys and identity authentication. If multiple applications want to protect information during the identity authentication process based on quantum keys, a cumbersome access process needs to be implemented on the client side of each application, resulting in poor usability and convenience of information protection solutions based on quantum key identity authentication. Summary of the invention

[0004] The purpose of the embodiment of the present invention is to provide an identity authentication system and method based on the Quantum Shield software development kit to solve the problem of poor usability and convenience of information protection solutions based on quantum key identity authentication. The specific technical solution is as follows:

[0005] In the first aspect of the implementation of the present invention, an identity authentication system based on the Quantum Shield software development kit is first provided, comprising the Quantum Shield software development kit of the application to be accessed, an identity authentication platform and the National Shield secret service platform, wherein the Quantum Shield software development kit has an access token allocated by the identity authentication platform, wherein:

[0006] The Quantum Shield software development kit obtains identity authentication information; the identity authentication information at least includes the account password entered by the user through the application to be accessed;

[0007] The Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information;

[0008] The Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information;

[0009] When the identity authentication platform determines that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password;

[0010] If the identity authentication platform successfully authenticates the account and password, it issues a ticket and token set to the Quantum Shield software development kit;

[0011] The Quantum Shield software development kit sends the ticket and the token set to the application to be accessed to complete the identity authentication of the application to be accessed.

[0012] Optionally, the identity authentication platform applies to the National Shield Secret Service Platform for a first token; the first token is used by the identity authentication platform to apply to the National Shield Secret Service Platform for a quantum key;

[0013] The Quantum Shield software development tool applies for a second token from the National Shield secret service platform; the first token is used by the Quantum Shield software development tool to apply for a quantum key from the National Shield secret service platform.

[0014] Optionally, the Quantitative Shield software development tool applies for an access token from the identity authentication platform based on a secure medium according to the user information of the user; wherein the user information includes at least the user's mobile phone number and an integrated circuit card identifier.

[0015] Optionally, the Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information, including:

[0016] The Liangdun software development kit applies for a challenge code from the identity authentication platform;

[0017] The Quantum Shield software development kit uses a specified cryptographic algorithm and the challenge code to encrypt the account password to obtain encrypted information;

[0018] The Quantum Shield software development toolkit applies to the National Shield secret service platform to obtain the quantum key;

[0019] The Quantum Shield software development toolkit uses the quantum key to quantum encrypt the encrypted information to obtain quantum encrypted information.

[0020] Optionally, when determining that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password, including:

[0021] When the identity authentication platform determines that the access token is legitimate, it applies to the National Shield Secret Service Platform for a quantum key;

[0022] The identity authentication platform uses the quantum key to decrypt the quantum encrypted information to obtain encrypted information, and uses a specified cryptographic algorithm and a challenge code to decrypt the encrypted information to obtain the account password.

[0023] Optionally, the identity authentication platform obtains a first password summary value; the first password summary value is generated by the Quantity Shield SDK or the application to be connected according to the account password using a specified message digest algorithm;

[0024] The identity authentication platform generates a second password digest value according to the account password using a specified message digest algorithm;

[0025] The identity authentication platform matches the first password summary value and the second password summary value. If the match is successful, the account password authentication is successful.

[0026] Optionally, if the identity authentication platform successfully authenticates the account and password, a ticket and token set are issued to the QuantumShield software development kit, including:

[0027] If the identity authentication platform successfully authenticates the account and password, it will issue a ticket and token set;

[0028] The identity authentication platform uses interference factors to splice the token set to obtain a spliced ​​token set, and encrypts the spliced ​​token set using the quantum key through the Guodun secret service platform to obtain a quantum spliced ​​token set;

[0029] The identity authentication platform sends the ticket, the quantum splicing token set and the interference factor to the Quantum Shield software development kit;

[0030] The Quantum Shield software development kit uses the quantum key to decrypt the quantum splicing token set through the National Shield secret service platform to obtain a splicing token set;

[0031] The Quantum Shield software development kit compares the interference factors in the spliced ​​token set with the interference factors returned by the identity authentication platform, and if the comparison is successful, caches the ticket and the spliced ​​token set.

[0032] The embodiment of the present invention also discloses an identity authentication method based on the Quantum Shield software development toolkit, which is applied to an identity authentication system. The identity authentication system includes the Quantum Shield software development toolkit of the application to be accessed, an identity authentication platform and the National Shield secret service platform. The Quantum Shield software development toolkit has an access token allocated by the identity authentication platform. The method includes:

[0033] The Quantum Shield software development kit obtains identity authentication information; the identity authentication information at least includes the account password entered by the user through the application to be accessed;

[0034] The Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information;

[0035] The Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information;

[0036] When the identity authentication platform determines that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password;

[0037] If the identity authentication platform successfully authenticates the account and password, it issues a ticket and token set to the Quantum Shield software development kit;

[0038] The Quantum Shield software development kit sends the ticket and the token set to the application to be accessed, completing the identity authentication of the application to be accessed

[0039] In another aspect of the present invention, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer executes any of the above-mentioned identity authentication methods based on the Quantum Shield software development kit.

[0040] In another aspect of the present invention, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute any of the above-mentioned identity authentication methods based on the Quantum Shield software development kit.

[0041] Compared with the related art, the embodiments of the present invention have at least the following advantages:

[0042] The identity authentication system based on the Quantum Shield software development kit of the embodiment of the present invention may include the Quantum Shield software development kit of the application to be accessed, the identity authentication platform and the National Shield secret service platform, wherein the Quantum Shield software development kit has an access token allocated by the identity authentication platform, the Quantum Shield software development kit obtains identity authentication information, such as the account and password entered by the user through the application to be accessed, the Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account and password to obtain quantum encryption information, the Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information, the identity authentication platform applies to the National Shield secret service platform for a quantum key when determining that the access token is legal, and uses the quantum key to decrypt the quantum encryption information to obtain the account and password, if the identity authentication platform successfully authenticates the account and password, the Quantum Shield software development kit issues a ticket and a token set, the Quantum Shield software development kit sends the ticket and the token set to the application to be accessed, and completes the identity authentication of the application to be accessed. The embodiments of the present invention can protect information (such as account passwords) in the identity authentication process based on quantum keys based on the Quantum Shield software development kit. Therefore, there is no need for each application client to implement a cumbersome access process. It is only necessary to call the Quantum Shield software development kit when the information in the identity authentication process needs to be protected. This improves the ease of use and convenience of the information protection solution based on quantum key identity authentication, and further improves the reusability and scalability of quantum key-based identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art.

[0044] Figure 1 A structural block diagram of an identity authentication system based on the Quantum Shield software development kit provided in an embodiment of the present invention;

[0045] Figure 2(a)-Figure 2(b) A flowchart of identity authentication based on the Quantity Shield SDK provided in an embodiment of the present invention;

[0046] Figure 3 A flowchart of a method for authenticating an identity based on a quantum shield software development kit provided in an embodiment of the present invention;

[0047] Figure 4 The present invention is a block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0049] At present, most quantum identity authentication systems (identity authentication systems based on quantum keys) can already protect information in the identity authentication process based on quantum keys. This method realizes the combination of basic quantum keys and identity authentication. However, the following problems may exist in the actual application process:

[0050] 1. Poor usability and convenience: If multiple applications want to integrate the quantum identity authentication system, a cumbersome access process needs to be implemented on the client side of each application.

[0051] 2. High coupling: The quantum identity authentication system to be connected does not actually care about the process of quantum key protection information. At the same time, the quantum identity authentication system is hard-coded into the application, which brings unassessable risks to the application to be connected and reduces its own business stability and reliability.

[0052] 3. Poor maintainability: When the quantum identity authentication system undergoes functional modifications or expansions, the access process of the application to be connected also needs to be modified, which will affect the original business logic code.

[0053] 4. High system integration cost: The application to be connected is hard-coded into the quantum identity authentication system. It will be very difficult to switch to a third-party identity authentication system.

[0054] In response to the above problems, an embodiment of the present invention provides an identity authentication solution based on the Quantum Shield SDK, which can at least solve the problem of simplifying the cumbersome adaptation process between business applications (applications to be accessed) and quantum identity authentication, thereby improving the reusability and scalability of identity authentication based on quantum keys.

[0055] Reference Figure 1 , is a structural block diagram of an identity authentication system based on the Quantum Shield software development kit provided in an embodiment of the present invention, which may include the Quantum Shield software development kit of the application to be accessed, the identity authentication platform and the National Shield secret service platform, wherein the Quantum Shield software development kit has an access token allocated by the identity authentication platform, wherein:

[0056] The Quantum Shield software development kit obtains identity authentication information; the identity authentication information at least includes the account password entered by the user through the application to be accessed;

[0057] The Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information;

[0058] The Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information;

[0059] When the identity authentication platform determines that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password;

[0060] If the identity authentication platform successfully authenticates the account and password, it issues a ticket and token set to the Quantum Shield software development kit;

[0061] The Quantum Shield software development kit sends the ticket and the token set to the application to be accessed to complete the identity authentication of the application to be accessed.

[0062] In the relevant technical scheme, identity authentication is usually implemented based on c / s (client / server) architecture. In the c / s architecture, data transmission is based on HTTP (Hypertext Transfer Protocol). Since HTTP transmits data in plain text, there is a security risk in the data. Most of them are converted to HTTPS (Hypertext Transfer Protocol Secure), but if the client and the server do not implement two-way authentication, there is a possibility of being captured to obtain data. Therefore, it is necessary to encrypt the transmitted data itself to avoid being directly intercepted by three parties to obtain the original data, resulting in the user's sensitive information (such as user name, password, credit card information, personal identity information, etc.) being maliciously used, causing economic losses, privacy infringement and many other problems, and bringing a bad experience to users. At present, various encryption algorithms have the possibility of being cracked, so it is necessary to select an algorithm with as high security as possible. Specifically, in the embodiment of the present invention, a quantum encryption algorithm based on quantum key is selected to encrypt the identity authentication information, so as to avoid being directly intercepted by three parties to obtain the original data.

[0063] In an embodiment of the present invention, a structural block diagram of an identity authentication system based on the Quantum Shield software development kit is provided, which may include the Quantum Shield software development kit of the application to be accessed, an identity authentication platform and a National Shield secret service platform, wherein the Quantum Shield software development kit, i.e., the Quantum Shield SDK (Software Development Kit), provides a set of quantum key-based security encryption algorithms to improve the security of transmitted data. The identity authentication platform and the National Shield secret service platform can be combined with the Quantum Shield SDK to avoid three parties from obtaining the original data during the data transmission process to the greatest extent.

[0064] Specifically, SDK is a collection of relevant documents, examples and tools that assist in the development of application programs. In the developer toolkit, developers can introduce various functions according to actual needs. For example, the Quantum Shield SDK of the embodiment of the present invention encapsulates the logic and security mechanism for implementing identity authentication. During the identity authentication process, if the identity authentication information in the identity authentication process is required, such as the account password (user password) entered by the user through the application to be accessed, it is only necessary to call the Quantum Shield SDK to perform the identity authentication based on the quantum key, and it can also ensure the data security of the identity authentication information and prevent the third party from obtaining the original data during the data transmission process. The identity authentication platform is a platform for verifying user identity and authorizing users to access system resources. The identity authentication platform can implement various functions such as user identity authentication, authorization management, and login. The National Shield Secret Service Platform is a platform for providing quantum encryption and secure communication services. The National Shield Secret Service Platform can implement various services such as quantum key generation and quantum key distribution.

[0065] In some specific embodiments, the identity authentication system based on Quantum Shield SDK in the embodiment of the present invention can be applied to quantum identity authentication, including but not limited to the following scenarios: 1. Account password login; 2. Verification code login; 3. Secure media login; 4. Three-party authentication login; 5. Certificate login; 6. Change password; 7. Forgot password; 8. Log out; 9... In addition, while providing relevant scenario interfaces, the identity authentication system based on Quantum Shield SDK in the embodiment of the present invention also provides the following functional module capabilities: 1. Cryptographic operation / key management; 2. Digital certificate management, etc.

[0066] It should be noted that the embodiments of the present invention may involve the use of user data. In actual applications, user-specific personal data can be used in the scheme described herein within the scope permitted by applicable laws and regulations, subject to the requirements of applicable laws and regulations of the country where the user is located (for example, with the user's explicit consent, effective notification to the user, etc.).

[0067] In an embodiment of the present invention, the Quantun SDK has an access token (accessToken) allocated by the identity authentication platform. Specifically, the access Token is a specific type of token used to identify the identity and authority of a user in a specific application or service. The access Token can be used to access protected resources or perform specific operations.

[0068] The identity authentication system based on the Quantum Shield software development kit of the embodiment of the present invention may include the Quantum Shield software development kit of the application to be accessed, the identity authentication platform and the National Shield secret service platform, wherein the Quantum Shield software development kit has an access token allocated by the identity authentication platform, the Quantum Shield software development kit obtains identity authentication information, such as the account and password entered by the user through the application to be accessed, the Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account and password to obtain quantum encryption information, the Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information, the identity authentication platform applies to the National Shield secret service platform for a quantum key when determining that the access token is legal, and uses the quantum key to decrypt the quantum encryption information to obtain the account and password, if the identity authentication platform successfully authenticates the account and password, the Quantum Shield software development kit issues a ticket and a token set, the Quantum Shield software development kit sends the ticket and the token set to the application to be accessed, and completes the identity authentication of the application to be accessed. The embodiments of the present invention can protect information (such as account passwords) in the identity authentication process based on quantum keys based on the Quantum Shield software development kit. Therefore, there is no need for each application client to implement a cumbersome access process. It is only necessary to call the Quantum Shield software development kit when the information in the identity authentication process needs to be protected. This improves the ease of use and convenience of the information protection solution based on quantum key identity authentication, and further improves the reusability and scalability of quantum key-based identity authentication.

[0069] In one embodiment of the present invention, the identity authentication platform applies to the National Shield Secret Service Platform for a first token; the first token is used by the identity authentication platform to apply for a quantum key from the National Shield Secret Service Platform; the Quantum Shield software development tool applies to the National Shield Secret Service Platform for a second token; the first token is used by the Quantum Shield software development tool to apply for a quantum key from the National Shield Secret Service Platform; the Quantum Shield software development tool applies to the identity authentication platform for an access token based on a secure medium according to the user information of the user; wherein the user information includes at least the user's mobile phone number and an integrated circuit card identifier. The integrated circuit card identifier is iccid (Integrated Circuit Card Identifier), which can be used to uniquely identify a SIM card or an eSIM card.

[0070] In an embodiment of the present invention, before using the Quantum Shield SDK to protect identity authentication information, it is necessary to initialize the National Shield Secret Service Platform. Specifically, the Quantum Shield SDK verifies whether the current device where the application to be accessed is located is a quantum card or quantum u-shield, and initializes the National Shield Secret Service Platform. After successful initialization, the token of the National Shield Secret Service Platform is obtained. In actual applications, the Quantum Shield SDK needs to carry a token to verify the legitimacy of the identity when applying for a quantum key.

[0071] In addition, the identity authentication platform needs to be initialized. Specifically, the Quantum Shield SDK initializes the identity authentication platform and obtains the Quantum Shield SDK token. The Quantum Shield SDK logs in to the identity authentication platform based on a secure medium based on identity information, such as phone (user phone number) + iccid (integrated circuit card identifier). Then, the identity authentication platform issues the Quantum Shield SDK token, namely accessToken. When the user logs in by entering the account and password, he needs to carry the Quantum Shield SDK token. The identity authentication will verify the legitimacy of the Quantum Shield SDK token, and only after the verification is passed will the account and password authentication be allowed.

[0072] In one embodiment of the present invention, the Quantum Shield software development toolkit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information, including:

[0073] The Liangdun software development kit applies for a challenge code from the identity authentication platform;

[0074] The Quantum Shield software development kit uses a specified cryptographic algorithm and the challenge code to encrypt the account password to obtain encrypted information;

[0075] The Quantum Shield software development toolkit applies to the National Shield secret service platform to obtain the quantum key;

[0076] The Quantum Shield software development toolkit uses the quantum key to quantum encrypt the encrypted information to obtain quantum encrypted information.

[0077] Exemplarily, the specified cryptographic algorithm may be a cryptographic algorithm such as the SM4 algorithm, where the SM4 algorithm is a block cipher algorithm issued by the National Cryptography Administration and is used for data encryption and decryption.

[0078] In an embodiment of the present invention, the Quantum Shield SDK obtains a challenge code from the identity authentication platform and uses it as a key, encrypts the account password using the SM4 algorithm to obtain encrypted information, and then, the Quantum Shield SDK applies for an encryption key (quantum key) from the Guodun secret service platform. Specifically, the Quantum Shield SDK applies for a keyHandle (keyHandle is a handle used to identify and manage keys) from the Guodun quantum middleware based on information such as sessionId, user mobile phone number, and a second token, and derives and caches the quantum key based on the keyHandle. Subsequently, the encrypted information can be quantum encrypted according to the quantum key to obtain quantum encrypted information, thereby achieving multiple encryption of the account password, thereby better protecting the account password. Subsequently, the Quantum Shield SDK sends the quantum encrypted information and the Quantum Shield SDK's token (access token) to the identity authentication platform for login authentication.

[0079] In one embodiment of the present invention, when determining that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password, including:

[0080] When the identity authentication platform determines that the access token is legitimate, it applies to the National Shield Secret Service Platform for a quantum key;

[0081] The identity authentication platform uses the quantum key to decrypt the quantum encrypted information to obtain encrypted information, and uses a specified cryptographic algorithm and a challenge code to decrypt the encrypted information to obtain the account password.

[0082] In an embodiment of the present invention, when the Quantum Shield SDK sends the quantum encryption information and the token (access token) of the Quantum Shield SDK to the identity authentication platform for login authentication, the identity authentication platform first needs to determine whether the access token is legal. If the identity authentication platform determines that the access token is legal, it can apply to the National Shield Secret Service Platform for a quantum key through the first token. Then, the identity authentication platform can use the quantum key to perform quantum decryption on the quantum encrypted information to obtain encrypted information. Then, it can also use the specified cryptographic algorithm and challenge code (key) to decrypt the encrypted information to obtain the decryption result, that is, the account password.

[0083] In one embodiment of the present invention, the identity authentication platform obtains a first password digest value; the first password digest value is generated by the Quantity Shield SDK or the application to be connected according to the account password using a specified message digest algorithm;

[0084] The identity authentication platform generates a second password digest value according to the account password using a specified message digest algorithm;

[0085] The identity authentication platform matches the first password summary value and the second password summary value. If the match is successful, the account password authentication is successful.

[0086] Exemplarily, the specified message digest algorithm may be the SM3 algorithm, which is a cryptographic hash algorithm used to generate a message digest value. For example, the Quantity Shield SDK or the application to be connected in the embodiment of the present invention may convert the account password into a first password digest value based on the SM3 algorithm, and then, after decrypting the account password, the identity authentication platform may also convert the account password into a second password digest value based on the SM3 algorithm, and then, the identity authentication platform matches the first password digest value with the second password digest value, and if the match is successful, it can be determined that the account password authentication is successful.

[0087] In one embodiment of the present invention, if the identity authentication platform successfully authenticates the account password, a ticket and a token set are issued to the Quantum Shield software development kit, including:

[0088] If the identity authentication platform successfully authenticates the account and password, it will issue a ticket and token set;

[0089] The identity authentication platform uses interference factors to splice the token set to obtain a spliced ​​token set, and encrypts the spliced ​​token set using the quantum key through the Guodun secret service platform to obtain a quantum spliced ​​token set;

[0090] The identity authentication platform sends the ticket, the quantum splicing token set and the interference factor to the Quantum Shield software development kit;

[0091] The Quantum Shield software development kit uses the quantum key to decrypt the quantum splicing token set through the National Shield secret service platform to obtain a splicing token set;

[0092] The Quantum Shield software development kit compares the interference factors in the spliced ​​token set with the interference factors returned by the identity authentication platform, and if the comparison is successful, caches the ticket and the spliced ​​token set.

[0093] In the embodiment of the present invention, if the identity authentication platform successfully authenticates the account and password, it can issue a ticket and a token set, wherein the token set may include access tokens, refresh tokens, etc. Specifically, the ticket is used to transfer the user's identity and permission information between multiple applications or services, thereby ensuring the legality of the user's operations in different applications; the access token is used to authorize the user to access protected resources or perform specific operations, thereby ensuring the legality of the user's operations in the application; the refresh token is used to extend the user's session time to avoid frequent logins by the user. After the access token assigned to the Quantum Shield SDK by the identity authentication platform expires, the Quantum Shield SDK can use the refresh token to obtain a new access token so that the user can continue to access the protected resources.

[0094] Specifically, the identity authentication platform will use the quantum key to perform quantum encryption on the access Token and refresh Token to obtain the quantum encrypted access Token and quantum encrypted refresh Token, and then return them to the Quantum Shield SDK, and also return the ticket and interference factor to the Quantum Shield SDK. Specifically, the identity authentication platform uses a random number as an interference factor, and splices the interference factor with the access Token and refresh Token to obtain a quantum splicing token set, and then uses the quantum key to perform quantum encryption on the quantum splicing token set to obtain a quantum splicing token set (including quantum encrypted access Token and quantum encrypted refresh Token). At this point, the identity authentication account password authentication is successful, and the identity authentication platform Vector Shield SDK returns the ticket and quantum encrypted accessToken, quantum encrypted refreshToken data, and random number (interference factor). Among them, the random number can be a random six-digit value.

[0095] Next, the Quantum Shield SDK applies for a keyHandle from the Guodun quantum middleware based on the sessionId and identity authentication platform account information, derives the quantum key based on the keyHandle and caches it, and then decrypts the quantum splicing token set based on the quantum key to obtain a splicing token set, which may include interference factors and decrypted access Token and refresh Token. The interference factors in the splicing token set are compared with the interference factors sent by the identity authentication platform. If the comparison is successful, the ticket, as well as the decrypted access Token and refreshToken, can be cached, thus realizing identity authentication for the application to be accessed based on protecting the identity authentication information.

[0096] In summary, the embodiment of the present invention not only encapsulates the quantum key-based identity authentication function through the Quantum Shield SDK, but also provides independent cryptographic calculation / key management capabilities. The application to be connected can easily and quickly access the quantum identity authentication system through simple adaptation.

[0097] In order to enable those skilled in the art to better understand the embodiments of the present invention, the following describes the identity authentication process of the embodiment of the present invention based on the Quantum Shield SDK, taking the account password as an example as the information in the identity authentication process.

[0098] Reference Figure 2(a)-Figure 2(b) , is a flowchart of identity authentication based on Quantum Shield SDK provided in an embodiment of the present invention, involving the application to be connected, Quantum Shield SDK, identity authentication platform and Guodun secret service platform; the specific authentication process is as follows:

[0099] 1. The identity authentication platform initializes the National Shield Secret Service Platform according to the parameters;

[0100] 2. The National Shield Confidential Service Platform successfully initializes and returns the token (first token) to the identity authentication platform;

[0101] 3. The Quantum Shield SDK initializes the National Shield secret service platform according to the parameters;

[0102] 4. The National Shield Cryptographic Service Platform is successfully initialized and returns a token (second token) to the Quantity Shield SDK;

[0103] 5. Liangdun SDK initializes the identity authentication platform based on secure media according to phone+iccid (integrated circuit card identifier, which can be used to uniquely identify a SIM card or eSIM card);

[0104] 6. The identity authentication platform is successfully initialized and returns the access token of the Liangdun SDK to the Liangdun SDK;

[0105] 7. The user (Actor) enters the account password (user password) through the application to be accessed;

[0106] 8. The application to be connected initiates account and password authentication through the Quantity Shield SDK;

[0107] 9. Liangdun SDK applies for a challenge code from the identity authentication platform;

[0108] 10. The identity authentication platform Vector Shield SDK returns a challenge code;

[0109] 11. The Quantum Shield SDK encrypts the challenge code and the account password (password) using SM4 identity encryption;

[0110] 12. Quantum Shield SDK applies for quantum key from Guodun Secret Service Platform: Specifically, it applies for quantum key from Guodun Secret Service Platform based on sessionid and user's mobile phone number; Guodun Secret Service Platform applies for keyHandle with token, and derives key (quantum key) according to keyHandle and caches it;

[0111] 13. National Shield Secret Service Platform Vector Shield SDK returns the key;

[0112] 14. Quantum Shield SDK performs quantum encryption of user passwords: specifically, it uses quantum keys to encrypt account passwords;

[0113] 15. Quantum Shield SDK logs in to the identity authentication platform for authentication: the quantum password, Quantum Shield SDK access token and other information are used for identity authentication;

[0114] 16. The identity authentication platform verifies the legitimacy of the access token of the QuantumShield SDK;

[0115] 17. The identity authentication platform applies for quantum keys based on the National Shield Secret Service Platform token;

[0116] 18. The National Shield Secret Service Platform returns the key (quantum key);

[0117] 19. The identity authentication platform uses quantum keys to decrypt user passwords and obtain encrypted information;

[0118] 20. The identity authentication platform uses the previous ciphertext (encrypted information) and challenge code as the key to decrypt the SM4 identity;

[0119] 21. The identity authentication platform performs a hash operation on the SM4 identity decryption result (account password) with the SM3 identity to obtain the SM3 password summary value (second password summary value);

[0120] 22. The identity authentication platform matches the SM3 password summary value with the SM3 password summary value (first password summary value) stored by the user;

[0121] 23. The identity authentication platform successfully authenticates and issues ticket, access token and refresh token;

[0122] 24. The identity authentication platform uses the six-digit random number as an interference factor and concatenates it with the above-mentioned token (access token, refresh token, etc.), and applies for quantum key encryption in combination with the quantum key;

[0123] 25. The National Shield Cryptographic Service Platform returns quantum encryption access Token and quantum encryption refreshToken to the identity authentication platform;

[0124] 26. The identity authentication platform Vector Shield SDK returns the ticket, quantum encryption access Token, quantum encryption refresh Token, and random number (interference factor);

[0125] 27. Quantum Shield SDK applies to the National Shield Cryptographic Service Platform for parsing quantum encryption access Token and quantum encryption refresh Token based on the key;

[0126] 28. National Shield Cryptographic Service Platform Vector Shield SDK returns access Token and refresh Token;

[0127] 29. The Quantity Shield SDK compares the decrypted result (including the interference factor) with the interference factor sent to the Quantity Shield SDK by the identity authentication platform. If the comparison is successful, the access token and refresh token are cached;

[0128] 30. The Quantum Shield SDK returns a ticket to the application to be connected, realizing identity authentication based on quantum keys.

[0129] Applying the Quantum Shield SDK of the embodiment of the present invention to implement quantum key identity authentication has at least the following advantages: 1. Quantum Shield SDK processes the encryption protection function of quantum key and authentication information, and simplifies the integration of business applications with quantum identity authentication through Quantum Shield SDK; 2. Quantum Shield SDK provides certificate management; 3. Identity authentication provides quantum authentication capabilities such as account password, verification code, security medium, three-party authentication, and certificate authentication. The authentication process and the successful authentication ticket use quantum encryption to improve the security of authentication; 4. Quantum capabilities are used to perform token verification when performing sensitive functions such as password modification, password forgetting, logout, single-point authentication, and ticket refresh. Among them, when performing sensitive interface function operations, Quantum Shield SDK salts the original token (adds random numbers) and performs quantum encryption. Identity authentication will verify the legitimacy of the quantum token, and the function will be allowed to execute only after the verification passes. The ability to integrate quantum one-time pad protects the token from brute force cracking during data transmission. Improve resource controllability and security.

[0130] Reference Figure 3 , is a flowchart of the steps of an identity authentication method based on the Quantum Shield software development kit provided in an embodiment of the present invention, which is applied to an identity authentication system. The identity authentication system includes the Quantum Shield software development kit of the application to be accessed, the identity authentication platform and the National Shield secret service platform. The Quantum Shield software development kit has an access token allocated by the identity authentication platform, such as Figure 3 As shown, the method may include the following steps:

[0131] Step 301, the Quantity Shield software development kit obtains identity authentication information; the identity authentication information at least includes the account password entered by the user through the application to be accessed;

[0132] Step 302: the Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information;

[0133] Step 303: the Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information;

[0134] Step 304: When determining that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password;

[0135] Step 305: If the identity authentication platform successfully authenticates the account and password, it issues a ticket and a token set to the Quantum Shield software development kit;

[0136] Step 306: The Quantum Shield software development kit sends the ticket and the token set to the application to be accessed to complete the identity authentication of the application to be accessed.

[0137] In one embodiment of the present invention, the identity authentication platform applies to the National Shield Secret Service Platform for a first token; the first token is used by the identity authentication platform to apply to the National Shield Secret Service Platform for a quantum key;

[0138] The Quantum Shield software development tool applies for a second token from the National Shield secret service platform; the first token is used by the Quantum Shield software development tool to apply for a quantum key from the National Shield secret service platform.

[0139] In one embodiment of the present invention, the Quantum Shield software development tool applies for an access token from the identity authentication platform based on a secure medium according to the user information of the user; wherein the user information includes at least the user's mobile phone number and an integrated circuit card identifier.

[0140] In one embodiment of the present invention, the Quantum Shield software development toolkit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information, including:

[0141] The Liangdun software development kit applies for a challenge code from the identity authentication platform;

[0142] The Quantum Shield software development kit uses a specified cryptographic algorithm and the challenge code to encrypt the account password to obtain encrypted information;

[0143] The Quantum Shield software development toolkit applies to the National Shield secret service platform to obtain the quantum key;

[0144] The Quantum Shield software development toolkit uses the quantum key to quantum encrypt the encrypted information to obtain quantum encrypted information.

[0145] In one embodiment of the present invention, when determining that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password, including:

[0146] When the identity authentication platform determines that the access token is legitimate, it applies to the National Shield Secret Service Platform for a quantum key;

[0147] The identity authentication platform uses the quantum key to decrypt the quantum encrypted information to obtain encrypted information, and uses a specified cryptographic algorithm and a challenge code to decrypt the encrypted information to obtain the account password.

[0148] In one embodiment of the present invention, the identity authentication platform obtains a first password digest value; the first password digest value is generated by the Quantity Shield SDK or the application to be connected according to the account password using a specified message digest algorithm;

[0149] The identity authentication platform generates a second password digest value according to the account password using a specified message digest algorithm;

[0150] The identity authentication platform matches the first password summary value and the second password summary value. If the match is successful, the account password authentication is successful.

[0151] In one embodiment of the present invention, if the identity authentication platform successfully authenticates the account password, a ticket and a token set are issued to the Quantum Shield software development kit, including:

[0152] If the identity authentication platform successfully authenticates the account and password, it will issue a ticket and token set;

[0153] The identity authentication platform uses interference factors to splice the token set to obtain a spliced ​​token set, and encrypts the spliced ​​token set using the quantum key through the Guodun secret service platform to obtain a quantum spliced ​​token set;

[0154] The identity authentication platform sends the ticket, the quantum splicing token set and the interference factor to the Quantum Shield software development kit;

[0155] The Quantum Shield software development kit uses the quantum key to decrypt the quantum splicing token set through the National Shield secret service platform to obtain a splicing token set;

[0156] The Quantum Shield software development kit compares the interference factors in the spliced ​​token set with the interference factors returned by the identity authentication platform, and if the comparison is successful, caches the ticket and the spliced ​​token set.

[0157] The identity authentication system based on the Quantum Shield software development kit of the embodiment of the present invention may include the Quantum Shield software development kit of the application to be accessed, the identity authentication platform and the National Shield secret service platform, wherein the Quantum Shield software development kit has an access token allocated by the identity authentication platform, the Quantum Shield software development kit obtains identity authentication information, such as the account and password entered by the user through the application to be accessed, the Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account and password to obtain quantum encryption information, the Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information, the identity authentication platform applies to the National Shield secret service platform for a quantum key when determining that the access token is legal, and uses the quantum key to decrypt the quantum encryption information to obtain the account and password, if the identity authentication platform successfully authenticates the account and password, the Quantum Shield software development kit issues a ticket and a token set, the Quantum Shield software development kit sends the ticket and the token set to the application to be accessed, and completes the identity authentication of the application to be accessed. The embodiments of the present invention can protect information (such as account passwords) in the identity authentication process based on quantum keys based on the Quantum Shield software development kit. Therefore, there is no need for each application client to implement a cumbersome access process. It is only necessary to call the Quantum Shield software development kit when the information in the identity authentication process needs to be protected. This improves the ease of use and convenience of the information protection solution based on quantum key identity authentication, and further improves the reusability and scalability of quantum key-based identity authentication.

[0158] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0159] As for the above method embodiment, since it is basically similar to the system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the system embodiment.

[0160] The embodiment of the present invention further provides an electronic device, such as Figure 4As shown, it includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.

[0161] Memory 503, used for storing computer programs;

[0162] The processor 501 is used to implement the identity authentication system method based on the Quantum Shield software development kit described in any of the above embodiments when executing the program stored in the memory 503.

[0163] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0164] The communication interface is used for communication between the above terminal and other devices.

[0165] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0166] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0167] In another embodiment provided by the present invention, a computer-readable storage medium is also provided, in which instructions are stored. When the computer-readable storage medium is executed on a computer, the computer executes the identity authentication system method based on the Quantum Shield software development kit described in any of the above embodiments.

[0168] In another embodiment provided by the present invention, a computer program product containing instructions is also provided, which, when executed on a computer, enables the computer to execute the identity authentication system method based on the Quantum Shield software development kit described in any of the above embodiments.

[0169] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0170] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or still includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0171] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0172] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. An identity authentication system based on the Quantum Shield software development kit, characterized in that: It includes the Quantum Shield software development kit, identity authentication platform and National Shield secret service platform of the application to be accessed, and the Quantum Shield software development kit has an access token allocated by the identity authentication platform, wherein: The Quantum Shield software development kit obtains identity authentication information; the identity authentication information at least includes the account password entered by the user through the application to be accessed; The Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information; The Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information; When the identity authentication platform determines that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password; If the identity authentication platform successfully authenticates the account and password, it will issue a ticket and token set to the Quantum Shield software development kit; The Quantum Shield software development kit sends the ticket and the token set to the application to be accessed to complete the identity authentication of the application to be accessed.

2. The identity authentication system based on the quantum shield software development kit according to claim 1 is characterized in that: The identity authentication platform applies to the National Shield Secret Service Platform for a first token; the first token is used by the identity authentication platform to apply to the National Shield Secret Service Platform for a quantum key; The Quantum Shield software development tool applies for a second token from the National Shield secret service platform; the first token is used by the Quantum Shield software development tool to apply for a quantum key from the National Shield secret service platform.

3. The identity authentication system based on the quantum shield software development kit according to claim 2 is characterized in that: The Quantum Shield software development tool applies for an access token from the identity authentication platform based on a secure medium according to the user information of the user; wherein the user information includes at least the user's mobile phone number and an integrated circuit card identifier.

4. The identity authentication system based on the quantum shield software development kit according to claim 3 is characterized in that: The Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information, including: The Liangdun software development kit applies for a challenge code from the identity authentication platform; The Quantum Shield software development kit uses a specified cryptographic algorithm and the challenge code to encrypt the account password to obtain encrypted information; The Quantum Shield software development toolkit applies to the National Shield secret service platform to obtain the quantum key; The Quantum Shield software development toolkit uses the quantum key to quantum encrypt the encrypted information to obtain quantum encrypted information.

5. The identity authentication system based on the quantum shield software development kit according to claim 4 is characterized in that: When determining that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password, including: When the identity authentication platform determines that the access token is legitimate, it applies to the National Shield Secret Service Platform for a quantum key; The identity authentication platform uses the quantum key to decrypt the quantum encrypted information to obtain encrypted information, and uses a specified cryptographic algorithm and a challenge code to decrypt the encrypted information to obtain the account password.

6. The identity authentication system based on the quantum shield software development kit according to claim 5 is characterized in that: The identity authentication platform obtains a first password digest value; the first password digest value is generated by the Liangdun SDK or the application to be connected according to the account password using a specified message digest algorithm; The identity authentication platform generates a second password digest value according to the account password using a specified message digest algorithm; The identity authentication platform matches the first password summary value and the second password summary value. If the match is successful, the account password authentication is successful.

7. The identity authentication system based on the quantum shield software development kit according to claim 6 is characterized in that: If the identity authentication platform successfully authenticates the account and password, it will issue a ticket and token set to the QuantumShield software development kit, including: If the identity authentication platform successfully authenticates the account and password, it will issue a ticket and token set; The identity authentication platform uses interference factors to splice the token set to obtain a spliced ​​token set, and encrypts the spliced ​​token set using the quantum key through the Guodun secret service platform to obtain a quantum spliced ​​token set; The identity authentication platform sends the ticket, the quantum splicing token set and the interference factor to the Quantum Shield software development kit; The Quantum Shield software development kit uses the quantum key to decrypt the quantum splicing token set through the National Shield secret service platform to obtain a splicing token set; The Quantum Shield software development kit compares the interference factors in the spliced ​​token set with the interference factors returned by the identity authentication platform, and if the comparison is successful, caches the ticket and the spliced ​​token set.

8. An identity authentication method based on the Quantum Shield software development kit, characterized in that: Applied to an identity authentication system, the identity authentication system includes a quantum shield software development kit for an application to be accessed, an identity authentication platform and a national shield secret service platform, the quantum shield software development kit has an access token allocated by the identity authentication platform, and the method includes: The Quantum Shield software development kit obtains identity authentication information; the identity authentication information at least includes the account password entered by the user through the application to be accessed; The Quantum Shield software development kit applies to the National Shield secret service platform for a quantum key, and uses the quantum key to quantum encrypt the account password to obtain quantum encrypted information; The Quantum Shield software development kit performs login authentication on the identity authentication platform according to the access token and the quantum encryption information; When the identity authentication platform determines that the access token is legitimate, the identity authentication platform applies to the National Shield Secret Service Platform for a quantum key, and uses the quantum key to decrypt the quantum encrypted information to obtain the account password; If the identity authentication platform successfully authenticates the account and password, it will issue a ticket and token set to the Quantum Shield software development kit; The Quantum Shield software development kit sends the ticket and the token set to the application to be accessed to complete the identity authentication of the application to be accessed.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor is used to implement the method steps described in claim 8 when executing the program stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method as claimed in claim 8 is implemented.

Images