Access authentication method and device, electronic equipment and storage medium

Abstract

The invention discloses an access authentication method and device, electronic equipment and a storage medium, and the method and device are applied to a three-party system, and specifically comprise the steps: controlling an enterprise client to receive a first message input by an enterprise user, calling a digital certificate configured at the enterprise client to sign the first message, obtaining a first signature value, and sending the first signature value to a server; the first signature value is sent to the bank end; controlling the bank end to verify the first signature value, obtaining a second signature value based on the first signature value after determining that the first signature value is from the enterprise client, and sending the first signature value and the second signature value to a third-party mechanism end; and controlling the third-party mechanism end to verify the first signature value and the second signature value, and establishing trusted connection with the enterprise client based on the bank end after verification is passed. According to the invention, the security of the connection is ensured through a dual-signature mechanism.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to an access authentication method, device, electronic device and storage medium. Background Art

[0002] With the expansion of corporate business and actual needs, enterprises often need to connect with third-party institutions through banking systems in order to enrich corresponding shopping or other financial services based on third-party institutions. However, existing technical solutions can only connect corporate clients with banking systems, and cannot meet the needs of enterprises for secure connection between their corporate clients through banking and third-party institutions. Summary of the invention

[0003] In view of this, the present application provides an access authentication method, device, electronic device and storage medium, which are used to meet the needs of enterprises for secure connection between a bank and a third-party institution through an enterprise client.

[0004] In order to achieve the above objectives, the proposed solution is as follows:

[0005] An access authentication method is applied to a three-party system, wherein the three-party system includes an enterprise client, a bank terminal, and at least one third-party institution terminal. The access authentication method includes the following steps:

[0006] Control the enterprise client to receive a first message input by an enterprise user, and call the digital certificate configured in the enterprise client to sign the first message to obtain a first signature value, and send the first signature value to the bank end;

[0007] Control the bank end to verify the first signature value, and after determining that the first signature value comes from the enterprise client, obtain a second signature value based on the first signature value, and send the first signature value and the second signature value to the third-party institution end;

[0008] The third-party institution end is controlled to verify the first signature value and the second signature value, and after verification, a trust connection is established between the bank end and the enterprise client.

[0009] Optionally, controlling the enterprise client to receive a first message input by an enterprise user, calling a digital certificate configured on the enterprise client to sign the first message to obtain a first signature value, and sending the first signature value to the bank end includes the steps of:

[0010] Processing the first message based on a first digest algorithm of the digital certificate to obtain a first digest value;

[0011] Encrypting the first summary value using the first private key of the digital certificate to obtain a first ciphertext;

[0012] Packing the first message, the first summary value, the first ciphertext, and the first public key certificate of the digital certificate into the first signature value;

[0013] The first signature value is sent to the bank end.

[0014] Optionally, controlling the bank end to verify the first signature value, after determining that the first signature value comes from the enterprise client, obtaining a second signature value based on the first signature value, and sending the first signature value and the second signature value to the third-party institution end, includes the steps of:

[0015] Verifying whether the first signature value comes from the enterprise client;

[0016] After verification, the second signature value is generated based on the first signature value;

[0017] The first signature value and the second signature value are sent to the third-party institution.

[0018] Optionally, the verifying whether the first signature value comes from the enterprise client comprises the steps of:

[0019] Parsing the first signature value to obtain the first message, the first summary value, the first public key certificate, and the first ciphertext;

[0020] Decrypting the first ciphertext using the first public key certificate and performing digest verification to obtain the first digest value;

[0021] Generate a verification digest value using the first digest algorithm;

[0022] The verification digest value is compared with the first digest value, and if they are consistent, the authentication is passed.

[0023] Optionally, generating the second signature value based on the first signature value after verification comprises the steps of:

[0024] Processing a second message using a second digest algorithm to obtain a second digest value, wherein the second message includes the first ciphertext, the first public key certificate, the first message, and data required by a third-party organization;

[0025] Encrypt the second digest value using a second private key to form a second ciphertext;

[0026] The first message, the second message, the second ciphertext and the second digest algorithm are signed and packaged into a second signature value.

[0027] Optionally, the following steps are also included:

[0028] The bank verifies whether the enterprise client has been registered on the third-party institution side. If not, the bank applies for registration for the enterprise client on the third-party institution side.

[0029] Optionally, the following steps are also included:

[0030] The bank determines whether the digital certificate needs to be updated. If necessary, the digital certificate is updated and a new application is made to the third-party institution for filing for the enterprise client.

[0031] An access authentication device is applied to a three-party system, wherein the three-party system includes an enterprise client, a bank terminal, and at least one third-party institution terminal, and the access authentication device includes:

[0032] a connection request module, configured to control the enterprise client to receive a first message input by an enterprise user, and to call a digital certificate configured in the enterprise client to sign the first message to obtain a first signature value, and to send the first signature value to the bank end;

[0033] a verification and sending module, configured to control the bank end to verify the first signature value, obtain a second signature value based on the first signature value after determining that the first signature value comes from the enterprise client, and send the first signature value and the second signature value to the third-party institution end;

[0034] A verification connection module is configured to control the third-party institution to verify the first signature value and the second signature value, and establish a trust connection between the bank and the enterprise client after verification;

[0035] Or, also include:

[0036] A client filing module is configured to verify whether the enterprise client has been filed on the third-party institution side based on the bank side, and if not, apply to the third-party institution side for filing for the enterprise client;

[0037] Or, also include:

[0038] The certificate update module is configured to determine whether the digital certificate needs to be updated based on the bank side, and if necessary, update the digital certificate and re-apply for filing with the third-party institution side for the enterprise client.

[0039] An electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0040] The memory is used to store computer programs or instructions;

[0041] The processor is used to execute the computer program or instruction so that the electronic device implements the access authentication method as described above.

[0042] A computer-readable storage medium is applied to an electronic device, wherein the storage medium carries one or more computer programs, and the one or more computer programs can be executed by the electronic device, so that the electronic device implements the access authentication method as described above.

[0043] It can be seen from the above technical solutions that the present application discloses an access authentication method, device, electronic device and storage medium. The method and device are applied to a three-party system including an enterprise client, a bank end and at least one third-party institution end. Specifically, the enterprise client is controlled to receive a first message input by an enterprise user, and the digital certificate configured on the enterprise client is called to sign the first message to obtain a first signature value, and the first signature value is sent to the bank end; the bank end is controlled to verify the first signature value, and after determining that the first signature value comes from the enterprise client, a second signature value is obtained based on the first signature value, and the first signature value and the second signature value are sent to the third-party institution end; the third-party institution end is controlled to verify the first signature value and the second signature value, and a trust connection is established between the bank end and the enterprise client after verification. The present application uses a double signature mechanism to enable the third-party institution end to parse the signature to ensure that the data has not been tampered with and comes from the bank, and parse the business signature to ensure that the customer data has not been tampered with and comes from the enterprise client, thereby ensuring the security of the connection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flowchart of an access authentication method according to an embodiment of the present application;

[0046] Figure 2 A schematic diagram of a filing process of an enterprise client according to an embodiment of the present application;

[0047] Figure 3 A block diagram of an access authentication device according to an embodiment of the present application;

[0048] Figure 4A block diagram of another access authentication device according to an embodiment of the present application;

[0049] Figure 5 A block diagram of another access authentication device according to an embodiment of the present application;

[0050] Figure 6 A block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] The present application discloses an authentication method for an enterprise client to access a third-party institution based on a bank end, and the method is applied to a three-party system including an enterprise client, a bank end and a third-party institution end. The method includes: the first step, the bank system uses the first summary algorithm of Kbao (client) to generate a first summary value for the first message input by the customer based on the enterprise client, and then uses the Kbao private key to encrypt the summary value to generate a first ciphertext, the system packages the first message, the first summary value, the public key certificate, the first ciphertext, etc. to form a first signature value, and sends the first signature value and the original text of the specified rule (used to generate the summary) to the access front-end system. The second step, the front-end system parses the first signature value (first message, first summary value, public key certificate, first ciphertext), and uses the public key certificate in the first signature value to decrypt the first ciphertext for summary verification to obtain the first summary value, and uses the first summary algorithm to generate a verification summary value for the input original text, and compares the verification summary value with the first summary value. If they are consistent, the authentication is passed. In the third step, the front-end system uses the second digest algorithm to generate the second digest value for the second message (the message contains the first signature value, the first public key certificate, the first message, and the data required by the third-party organization, etc.), and then uses the second private key to encrypt the second digest value to form the second ciphertext, and signs and packages the first message, the second message, the second ciphertext, the second digest algorithm and other information to form the second signature value, and sends it to the third-party organization through the HTTPS request. In the fourth step, the third-party organization uses the sender's public key to decrypt the second ciphertext to obtain the second digest value, uses the second digest algorithm to generate a digest value for the second message, and compares the obtained digest value with the second digest value. If they are consistent, it means that they have not been tampered with, and the verification message comes from the bank system. In the fifth step, the third-party organization uses the customer public key certificate in the message to decrypt the first ciphertext to obtain the first digest value, uses the first digest algorithm to generate a verification digest value for the first message, and compares the obtained digest value with the first digest value. If they are consistent, it means that they have not been tampered with, and the verification message request comes from the customer's will. The present invention utilizes asymmetric secret key and public-private key technology combination to ensure the security of message transmission when a bank accesses a third party institution.

[0053] The digest algorithm of the present application is used to calculate any set of input data to obtain a fixed-length output digest. Its characteristics are that the same input must obtain the same output, and different inputs must obtain different outputs.

[0054] The key is a parameter input into the algorithm for converting plaintext into ciphertext or ciphertext into plaintext. It is divided into symmetric keys and asymmetric keys.

[0055] The authentication medium distributed by Keybao Bank to corporate customers is called differently by different banks and is actually a hardware carrier form of digital certificate.

[0056] Symmetric encryption algorithm means that the sender and receiver of information use the same key to encrypt and decrypt data. Its biggest advantage is the fast encryption / decryption speed, which is suitable for encrypting large amounts of data.

[0057] Asymmetric encryption algorithms are also called public key encryption algorithms. They require different keys to complete encryption and decryption operations. One is publicly released, i.e., the public key (public key), and the other is kept by the user himself, i.e., the private key (private key). Information is encrypted using the public key when it is sent, and the recipient of the information uses the private key to decrypt it. Asymmetric encryption algorithms are flexible, but the encryption and decryption speed is much slower than symmetric encryption algorithms.

[0058] Based on the above, the present application provides the following specific embodiments:

[0059] Figure 1 This is a flow chart of an access authentication method according to an embodiment of the present application.

[0060] like Figure 1 As shown, the access authentication method provided in this embodiment is applied to an electronic device, and is used to establish a trusted connection between the enterprise client and the third-party institution end based on the bank end in the above-mentioned three-party system. The electronic device can be understood as a computer, server or cloud platform with data computing and information processing capabilities. The access authentication method includes the following steps:

[0061] S1. Control the enterprise client to receive a first message input by an enterprise user, and call the digital certificate configured in the enterprise client to sign the first message to obtain a first signature value, and send the first signature value to the bank end.

[0062] The digital certificate in this application refers to a hardware certificate carrier such as a key treasure configured on the enterprise client, which carries the first digest algorithm, the first private key and the first public key certificate, etc. When the user inputs the first message based on the enterprise client to initiate a connection request, the following operations are specifically performed.

[0063] First, the first message is processed based on a first digest algorithm to obtain a first digest value; then, the first digest value is encrypted using a first private key to obtain a first ciphertext; the first message, the first digest value, the first ciphertext and the first public key certificate are packaged into a first signature value; and the first signature value is sent to the bank end.

[0064] S2. Control the bank to verify the first signature value. After determining that the first signature value comes from the enterprise client, obtain the second signature value based on the first signature value, and send the first signature value and the second signature value to the third-party institution.

[0065] That is, after the bank receives the first digest value sent by the enterprise client, it performs the first verification process on the first digest value to determine whether the enterprise client is a legitimate user, and if so, performs subsequent operations. The specific process is as follows:

[0066] First, verify whether the first signature value comes from the enterprise client;

[0067] The first signature value is parsed to obtain a first message, a first summary value, a first public key certificate and a first ciphertext; the first ciphertext is decrypted using the first public key certificate and summary verification is performed to obtain a first summary value; a verification summary value is generated using a first summary algorithm; the verification summary value is compared with the first summary value, and if they are consistent, the authentication is passed, that is, the first signature value is indeed from a legitimate enterprise client.

[0068] Then, after verification, a second signature value is generated based on the first signature value;

[0069] The second message is processed by the second digest algorithm to obtain a second digest value, wherein the second message includes the first ciphertext, the first public key certificate, the first message and data required by the third-party organization, and the specific content of the data can be set according to the needs of the user; the second digest value is encrypted using the second private key to form a second ciphertext; and the first message, the second message, the second ciphertext and the second digest algorithm are signed and packaged into a second signature value.

[0070] Finally, the first signature value and the second signature value are sent to the third-party institution via HTTPS.

[0071] S3. Control the third-party institution to verify the first signature value and the second signature value, and after verification, establish a trust connection between the bank and the enterprise client.

[0072] The specific process is to use the client public key certificate obtained in advance to decrypt the first ciphertext, obtain the first summary value, use the first summary algorithm to generate a verification summary value for the first message, and compare the obtained summary value with the first summary value. If they are consistent, it means that there is no tampering and the verification message request comes from the client's intention. The present invention uses a combination of asymmetric secret keys and public and private key technologies to ensure the security of message transmission from the bank end to the third institution end.

[0073] It can be seen from the above technical solution that this embodiment provides an access authentication method, which is applied to a three-party system including an enterprise client, a bank end and at least one third-party institution end, specifically controlling the enterprise client to receive a first message input by an enterprise user, and calling the digital certificate configured on the enterprise client to sign the first message, obtain a first signature value, and send the first signature value to the bank end; controlling the bank end to verify the first signature value, and after determining that the first signature value comes from the enterprise client, obtain a second signature value based on the first signature value, and send the first signature value and the second signature value to the third-party institution end; controlling the third-party institution end to verify the first signature value and the second signature value, and after verification, establish a trust connection between the bank end and the enterprise client. This application uses a dual signature mechanism to enable the third-party institution end to parse the signature to ensure that the data has not been tampered with and comes from the bank, and parse the business signature to ensure that the customer data has not been tampered with and comes from the enterprise client, thereby ensuring the security of the connection.

[0074] In addition, the application also includes the following steps:

[0075] That is, after the corporate client logs into the bank system through the corporate client, the bank determines whether the corporate client has ever been registered with the third-party institution. If there is no registration record, the bank will apply for registration for the corporate client with the third-party institution. The specific registration process is as follows: Figure 2 shown.

[0076] In addition, the application also includes the following steps:

[0077] The digital certificate of the enterprise client is judged, that is, whether the digital certificate needs to be updated. If necessary, the digital certificate is updated. After the update is completed, the enterprise client is re-registered with the third-party agency.

[0078] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0079] Although operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0080] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0081] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as C or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer.

[0082] Figure 3 A block diagram of an access authentication device according to an embodiment of the present application.

[0083] like Figure 3 As shown, the access authentication device provided in this embodiment is applied to an electronic device, and is used to establish a trusted connection between the enterprise client and the third-party institution end based on the bank end in the above-mentioned three-party system. The electronic device can be understood as a computer, server or cloud platform with data computing and information processing capabilities. The access authentication device includes a connection request module 10, a verification sending module 20 and a verification connection module 30.

[0084] The connection request module is used to control the enterprise client to receive the first message input by the enterprise user, and call the digital certificate configured in the enterprise client to sign the first message, obtain the first signature value, and send the first signature value to the bank end.

[0085] The digital certificate in this application refers to a hardware certificate carrier such as a key treasure configured on the enterprise client, which carries the first digest algorithm, the first private key and the first public key certificate, etc. When the user inputs the first message based on the enterprise client to initiate a connection request, the following operations are specifically performed.

[0086] First, the first message is processed based on a first digest algorithm to obtain a first digest value; then, the first digest value is encrypted using a first private key to obtain a first ciphertext; the first message, the first digest value, the first ciphertext and the first public key certificate are packaged into a first signature value; and the first signature value is sent to the bank end.

[0087] The verification and sending module is used to control the bank end to verify the first signature value. After determining that the first signature value comes from the enterprise client, the second signature value is obtained based on the first signature value, and the first signature value and the second signature value are sent to the third-party institution end.

[0088] That is, after the bank receives the first digest value sent by the enterprise client, it performs the first verification process on the first digest value to determine whether the enterprise client is a legitimate user, and if so, performs subsequent operations. The specific process is as follows:

[0089] First, verify whether the first signature value comes from the enterprise client;

[0090] The first signature value is parsed to obtain a first message, a first summary value, a first public key certificate and a first ciphertext; the first ciphertext is decrypted using the first public key certificate and summary verification is performed to obtain a first summary value; a verification summary value is generated using a first summary algorithm; the verification summary value is compared with the first summary value, and if they are consistent, the authentication is passed, that is, the first signature value is indeed from a legitimate enterprise client.

[0091] Then, after verification, a second signature value is generated based on the first signature value;

[0092] The second message is processed by the second digest algorithm to obtain a second digest value, wherein the second message includes the first ciphertext, the first public key certificate, the first message and data required by the third-party organization, and the specific content of the data can be set according to the needs of the user; the second digest value is encrypted using the second private key to form a second ciphertext; and the first message, the second message, the second ciphertext and the second digest algorithm are signed and packaged into a second signature value.

[0093] Finally, the first signature value and the second signature value are sent to the third-party institution via HTTPS.

[0094] The verification connection module is used to control the third-party institution to verify the first signature value and the second signature value, and after the verification, a trust connection is established between the bank and the enterprise client.

[0095] The specific process is to use the client public key certificate obtained in advance to decrypt the first ciphertext, obtain the first summary value, use the first summary algorithm to generate a verification summary value for the first message, and compare the obtained summary value with the first summary value. If they are consistent, it means that there is no tampering and the verification message request comes from the client's intention. The present invention uses a combination of asymmetric secret keys and public and private key technologies to ensure the security of message transmission from the bank end to the third institution end.

[0096] It can be seen from the above technical solution that this embodiment provides an access authentication device, which is applied to a three-party system including an enterprise client, a bank end and at least one third-party institution end, specifically to control the enterprise client to receive a first message input by an enterprise user, and call the digital certificate configured on the enterprise client to sign the first message to obtain a first signature value, and send the first signature value to the bank end; control the bank end to verify the first signature value, and after determining that the first signature value comes from the enterprise client, obtain a second signature value based on the first signature value, and send the first signature value and the second signature value to the third-party institution end; control the third-party institution end to verify the first signature value and the second signature value, and after verification, establish a trust connection between the bank end and the enterprise client. This application uses a dual signature mechanism to enable the third-party institution end to parse the signature to ensure that the data has not been tampered with and comes from the bank, and parse the business signature to ensure that the customer data has not been tampered with and comes from the enterprise client, thereby ensuring the security of the connection.

[0097] In addition, the present application also includes a client filing module 40, such as Figure 4 As shown:

[0098] This module is used for the bank to determine whether the corporate client has ever been registered with a third-party institution after the corporate client logs in to the bank system through the corporate client. If there is no registration record, the bank will apply for registration for the corporate client with the third-party institution. The specific registration process is as follows: Figure 2 shown.

[0099] In addition, the present application also includes a certificate update module 50, such as Figure 5 As shown:

[0100] This module is used to judge the digital certificate of the enterprise client, that is, to judge whether the digital certificate needs to be updated. If necessary, the digital certificate is updated. After the update is completed, the enterprise client is re-registered with the third-party agency.

[0101] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0102] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0103] Figure 6 A block diagram of an electronic device according to an embodiment of the present application.

[0104] Reference below Figure 6 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. The electronic device is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0105] The electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory ROM 602 or a program loaded from an input device 606 into a random access memory RAM 603. In the RAM, various programs and data required for the operation of the electronic device are also stored. The processing device, ROM, and RAM are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0106] Typically, the following devices may be connected to the I / O interface: input devices including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 608 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 609. The communication device 609 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various devices, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively.

[0107] The present application also provides a computer-readable storage medium embodiment.

[0108] The computer-readable storage medium is applied to an electronic device and carries one or more computer programs. When the one or more computer programs are executed by the electronic device, the electronic device controls the enterprise client to receive the first message input by the enterprise user, and calls the digital certificate configured on the enterprise client to sign the first message, obtain the first signature value, and send the first signature value to the bank end; the bank end is controlled to verify the first signature value, and after determining that the first signature value comes from the enterprise client, the second signature value is obtained based on the first signature value, and the first signature value and the second signature value are sent to the third-party institution end; the third-party institution end is controlled to verify the first signature value and the second signature value, and after verification, a trust connection is established between the bank end and the enterprise client. This application uses a dual signature mechanism to enable the third-party institution end to parse the signature to ensure that the data has not been tampered with and comes from the bank, and parse the business signature to ensure that the customer data has not been tampered with and comes from the enterprise client, thereby ensuring the security of the connection.

[0109] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0110] In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0111] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0112] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0113] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0114] The technical solution provided by the present invention is introduced in detail above. Specific examples are used in this article to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. An access authentication method, applied to a three-party system, the three-party system comprising an enterprise client, a bank terminal and at least one third-party institution terminal, characterized in that: The access authentication method comprises the steps of: Control the enterprise client to receive a first message input by an enterprise user, and call the digital certificate configured in the enterprise client to sign the first message to obtain a first signature value, and send the first signature value to the bank end; Control the bank end to verify the first signature value, and after determining that the first signature value comes from the enterprise client, obtain a second signature value based on the first signature value, and send the first signature value and the second signature value to the third-party institution end; The third-party institution end is controlled to verify the first signature value and the second signature value, and after verification, a trust connection is established between the bank end and the enterprise client.

2. The access authentication method according to claim 1, characterized in that: The controlling the enterprise client to receive a first message input by an enterprise user, calling a digital certificate configured on the enterprise client to sign the first message to obtain a first signature value, and sending the first signature value to the bank end includes the following steps: Processing the first message based on a first digest algorithm of the digital certificate to obtain a first digest value; Encrypting the first summary value using the first private key of the digital certificate to obtain a first ciphertext; Packing the first message, the first summary value, the first ciphertext, and the first public key certificate of the digital certificate into the first signature value; The first signature value is sent to the bank end.

3. The access authentication method according to claim 1, characterized in that: The controlling the bank end to verify the first signature value, after determining that the first signature value comes from the enterprise client, obtaining a second signature value based on the first signature value, and sending the first signature value and the second signature value to the third-party institution end, comprises the steps of: Verifying whether the first signature value comes from the enterprise client; After verification, the second signature value is generated based on the first signature value; The first signature value and the second signature value are sent to the third-party institution.

4. The access authentication method according to claim 3, characterized in that: The verifying whether the first signature value comes from the enterprise client comprises the steps of: Parsing the first signature value to obtain the first message, the first summary value, the first public key certificate, and the first ciphertext; Decrypting the first ciphertext using the first public key certificate and performing digest verification to obtain the first digest value; Generate a verification digest value using the first digest algorithm; The verification digest value is compared with the first digest value, and if they are consistent, the authentication is passed.

5. The access authentication method according to claim 3, characterized in that: The step of generating the second signature value based on the first signature value after verification comprises the following steps: Processing a second message using a second digest algorithm to obtain a second digest value, wherein the second message includes the first ciphertext, the first public key certificate, the first message, and data required by a third-party organization; Encrypt the second digest value using a second private key to form a second ciphertext; The first message, the second message, the second ciphertext and the second digest algorithm are signed and packaged into a second signature value.

6. The access authentication method according to any one of claims 1 to 5, characterized in that: Also includes the steps: The bank verifies whether the enterprise client has been registered on the third-party institution side. If not, the bank applies for registration for the enterprise client on the third-party institution side.

7. The access authentication method according to any one of claims 1 to 5, characterized in that: Also includes the steps: The bank determines whether the digital certificate needs to be updated. If necessary, the digital certificate is updated and a new application is made to the third-party institution for filing for the enterprise client.

8. An access authentication device, applied to a three-party system, the three-party system comprising an enterprise client, a bank terminal and at least one third-party institution terminal, characterized in that: The access authentication device comprises: a connection request module, configured to control the enterprise client to receive a first message input by an enterprise user, and to call a digital certificate configured in the enterprise client to sign the first message to obtain a first signature value, and to send the first signature value to the bank end; a verification and sending module, configured to control the bank end to verify the first signature value, obtain a second signature value based on the first signature value after determining that the first signature value comes from the enterprise client, and send the first signature value and the second signature value to the third-party institution end; A verification connection module is configured to control the third-party institution to verify the first signature value and the second signature value, and establish a trust connection between the bank and the enterprise client after verification; Or, also include: A client filing module is configured to verify whether the enterprise client has been filed on the third-party institution side based on the bank side, and if not, apply to the third-party institution side for filing for the enterprise client; Or, also include: The certificate update module is configured to determine whether the digital certificate needs to be updated based on the bank side, and if necessary, update the digital certificate and re-apply for filing with the third-party institution side for the enterprise client.

9. An electronic device, characterized in that: The electronic device comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs or instructions; The processor is used to execute the computer program or instruction so that the electronic device implements the access authentication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, applied to an electronic device, characterized in that: The storage medium carries one or more computer programs, and the one or more computer programs can be executed by the electronic device, so that the electronic device implements the access authentication method according to any one of claims 1 to 7.

Images