Decentralized, distributed and RPC (Remote Procedure Call) low-dependency global user security authentication and system mutual trust security service system

Abstract

The invention relates to a decentralized, distributed and RPC (Remote Procedure Call) low-dependency global user security authentication and system mutual trust security service system, which comprises a user authentication certificate management module for managing signature certificates used for user authentication and basic authority management and control in the past, at present and in the future; the user verification certificate issuing and storage module is used for issuing a verification certificate list according to a request of the client, and after the client obtains the verification certificate list, binary block encryption is carried out on the verification certificate list in a mode of combining a fixed encryption key, a machine fingerprint encryption key and an environment variable encryption key and the verification certificate list is combined into a file system; the user authentication signature module supports a user to carry out single-mode or multi-element authentication processing in the modes of user passwords, registered mobile phone short messages, account electronic Key, face recognition and fingerprint recognition; and the user signature verification module is used for obtaining the asymmetric signature public key from the local certificate list according to the signature certificate ID to perform signature verification processing.

Description

Technical Field

[0001] The present invention relates to the field of information system authentication, in particular to the field of information system user authentication and system mutual trust authentication, and specifically refers to a global user security authentication and system mutual trust security service system that realizes decentralization, distribution, and low RPC dependence. Background Art

[0002] In the financial industry, simply authenticating and verifying users at the access gateway only controls the security of the entry traffic. If the system inside the gateway does not use user authentication and system mutual trust authentication, when a network security attack spreads to the inside of the gateway, the internal system can be accessed at will and the user's request can be imitated at will. In this case, it is difficult to ensure financial-grade global access security and global user data security.

[0003] If each application system inside the gateway verifies the user and uses remote service calls to call the user authentication service for signature verification, the user authentication service is strongly coupled to each internal system, and there are extremely high requirements for the throughput, RTO, and RPO of the user authentication service to meet financial-grade high availability.

[0004] If each application system inside the gateway fully trusts other systems, network security attackers can try to brute-force attack other application systems from the compromised application.

[0005] In this context, there is a need for a decentralized, distributed, low-database and RPC-dependent user authentication and system mutual trust service system that can reduce the strong dependence of other systems on the user authentication and system mutual trust management system while meeting the global security of inter-system access security and user data security, thus achieving the dual needs of security and reliability. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a radar-vision fusion target perception method, system, device, processor and computer-readable storage medium thereof based on a hybrid strategy.

[0007] In order to achieve the above objectives, the global user security authentication and system mutual trust security service system of the present invention that realizes decentralization, distribution, and low RPC dependence is as follows:

[0008] The decentralized, distributed, RPC-less global user security authentication and system mutual trust security service system has the following main features:

[0009] User authentication certificate management module, used to manage past, current and future signature certificates used for user authentication and basic permission control;

[0010] The user verification certificate issuance and storage module is used to issue the verification certificate list according to the client request. After obtaining the verification certificate list, the client uses a fixed encryption key, a machine fingerprint encryption key, and an environment variable encryption key to encrypt the verification certificate list in binary blocks and combine them into the file system;

[0011] User authentication signature module supports single-mode or multi-factor authentication by user password, registered mobile phone SMS, account electronic key, face recognition, fingerprint recognition;

[0012] The user signature verification module is used to obtain the asymmetric signature public key from the local certificate list according to the signature certificate ID for signature verification.

[0013] Preferably, the user authentication certificate management module is specifically:

[0014] It has the ability to dynamically generate a certificate list based on the core element data of the interface request parameters including the number of certificates, certificate algorithm, and certificate key length; it has the ability to control the scope of the current user authentication signature certificate list and the user authentication verification certificate list; wherein the user authentication signature certificate list is a subset of the user authentication verification certificate list, and the user authentication verification certificate includes the verification certificates corresponding to the signature certificates for fixed time periods in the past, present, and future; at the same time, in the user authentication certificate management module, each signature and verification certificate pair has a unique incremental ID.

[0015] Preferably, the user authentication certificate management module also has a certificate rotation function, which is used to batch-roll the valid signature certificate range and the valid verification certificate range, and roll them at a fixed time or temporarily.

[0016] Preferably, the user verification certificate issuing and storage module is specifically:

[0017] The fixed encryption key and machine fingerprint encryption key are set in C++ dynamic library mode, and the environment variable encryption key is generated randomly; and the user verification certificate issuance and storage module only requests the verification certificate, i.e., the public key, and synchronizes the symmetrically encrypted private key list;

[0018] The user verification certificate is issued and the verification list issued by the storage module includes a valid verification certificate list in the previous rotation cycle and a valid verification certificate list in the next rotation cycle; and the message is transmitted according to the two paths of active request and stream push.

[0019] Preferably, after the authentication is passed, the user authentication signature module uses the symmetric encryption and decryption algorithm and certificate in the license signature certificate list in the user authentication certificate management module to encrypt the key element information of the acquired user ID, user type, authentication signer, authentication source channel, authentication user type, authentication time, and asymmetric signature certificate ID SignKeyId to obtain keyContent, and digest hash the KeyContent and the symmetric encryption certificate ID EncryptKeyId as plain text, and use the private key corresponding to SignKeyId to perform asymmetric signing.

[0020] Preferably, the user signature verification module will report the verification result, wherein the reported content includes the verification system, verification user ID, verification key ID, verification asymmetric key ID, verification time, verification result, and verification failure reason; the reported content will be used as the retained evidence of the system verification and will also be used to indicate that a certain symmetric key ID, asymmetric key ID, and the verification user ID are at risk of being hacked.

[0021] Preferably, the system also includes a system mutual trust certificate management module, which is used to manage past, current and future system mutual trust authentication signature certificates and their algorithms according to application ID; the system mutual trust certificate management module has the ability to generate a certificate list according to interface request parameters; it has the ability to control the scope of the current user authentication signature certificate list and the user authentication verification certificate list, wherein the user authentication signature certificate list is a subset of the user authentication verification certificate list, and the user authentication verification certificate includes verification certificates corresponding to signature certificates for fixed time periods in the past, present and future; at the same time, in the system mutual trust certificate management module, each signature and verification certificate pair has a unique incremental ID.

[0022] Preferably, the system also includes a system mutual trust certificate issuance module, which is used to store the request certificate of the application ID, and only issue the signature and verification certificate list through the application ID to the verified client; and adopts two paths of active request and stream push for message transmission, and adopts binary block multi-source multi-encryption key encryption assembly.

[0023] Preferably, the system also includes a system mutual trust signature module, which is used to issue a verification certificate list based on a client request, and the request information includes an application ID. After obtaining the verification certificate list, the client uses a fixed encryption key, a machine fingerprint encryption key, and an environment variable encryption key to perform binary block encryption on the verification certificate list and combine it into a file system, wherein the fixed encryption key and the machine fingerprint encryption key are set in a C++ dynamic library manner, and the environment variable encryption key is generated in a random manner.

[0024] Preferably, the system further comprises:

[0025] The system mutual trust signature verification module is used to sign the request summary using the signature certificate and signature algorithm according to the summary information of the request during the request process;

[0026] The user authentication issuance and usage monitoring module is used to monitor the issuance of user authentication signatures and verification certificates to peripheral systems, and receive abnormal verification data reported by each system;

[0027] The system mutual trust issuance and use monitoring module is used to monitor the issuance of system mutual trust signatures and verification certificates, and receive abnormal mutual trust signatures and verification data reported by each system;

[0028] The request three-defense module is used to sign the signer information and request time information through the user authentication signature algorithm and the system mutual trust request signature algorithm.

[0029] The global user security authentication and system mutual trust security service system that realizes decentralization, distribution, and low RPC dependence of the present invention can realize global user identity verification and user data security protection, effectively prevent users from exceeding their rights, and at the same time, the peripheral system does not need to call the signature verification database or signature verification service, reducing the access pressure and strong coupling of the peripheral system to the signature verification service. At the same time, the rotation strategy of the signature and signature verification list and the effective monitoring strategy are used to ensure the freshness, strength, and effectiveness of the certificate, and asynchronous monitoring is used for abnormal authentication to ensure timely statistics and identification of abnormal points and abnormal users. In terms of mutual trust between systems, authoritative services are used to uniformly manage the signatures and signature verification certificates that are called between systems. The signatures and signature verification between systems do not need to directly rely on the intermediate system for signing and verification, reducing the strong coupling and strong dependence on the intermediate system. At the same time, through effective asynchronous monitoring, timely statistics and identification of abnormal communication channels between systems are guaranteed. By using this system and method, global channel authentication security and user access security are achieved, rather than just controlling the entrance security traffic, financial-level global security control is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a schematic diagram of user signature authentication for the decentralized, distributed, RPC-low-dependency global user security authentication and system mutual trust security service system of the present invention.

[0031] Figure 2 The present invention is a certificate rolling schematic diagram of the global user security authentication and system mutual trust security service system that realizes decentralization, distribution, and low RPC dependency.

[0032] Figure 3 The present invention is a schematic diagram of the certificate file encryption process of the global user security authentication and system mutual trust security service system that realizes decentralization, distribution, and low RPC dependence.

[0033] Figure 4 The present invention is a schematic diagram of the user signature and verification process of the global user security authentication and system mutual trust security service system that realizes decentralization, distribution, and low RPC dependence.

[0034] Figure 5 It is a schematic diagram of the signature verification process between systems of the global user security authentication and system mutual trust security service system that realizes decentralization, distribution, and low RPC dependence of the present invention. DETAILED DESCRIPTION

[0035] In order to more clearly describe the technical content of the present invention, further description is given below in conjunction with specific embodiments.

[0036] Before describing in detail embodiments according to the present invention, it should be noted that, hereinafter, the terms "comprises", "includes" or any other variations are intended to cover non-exclusive inclusion, whereby a process, method, article or apparatus comprising a series of elements includes not only these elements, but also other elements not explicitly listed or inherent to such process, method, article or apparatus.

[0037] See also Figures 1 to 5 As shown, the decentralized, distributed, RPC-less global user security authentication and system mutual trust security service system is implemented, wherein the system includes:

[0038] User authentication certificate management module: mainly manages the signature certificates and their algorithms used for user authentication and basic authority control in the past, present and future. This module has the ability to dynamically generate a certificate list based on the interface request parameters, including the number of certificates, certificate algorithms, certificate key length and other core elements. This module has the ability to control the scope of the certificate list currently used for user authentication signatures and the certificate list used for user authentication signature verification. The user authentication signature certificate list is a subset of the user authentication verification certificate list. The user authentication verification certificate contains the verification certificates corresponding to the signature certificates for fixed time periods in the past, present and future. At the same time, each signature and verification certificate pair in this module has a unique incrementing ID.

[0039] As a preferred embodiment of the present invention, user authentication certificate management has a certificate rotation function, which can batch roll the valid signature certificate range and the valid verification certificate range, and roll them at a fixed time or temporarily. The fixed time can be rolled weekly, monthly, or quarterly to ensure the validity and freshness of the certificates.

[0040] As a preferred embodiment of the present invention, in the process of each round of certificate rolling of user authentication certificate management, multiple symmetric encryption algorithms and asymmetric encryption algorithms need to be included. The user authentication module uses a random algorithm to select a symmetric encryption algorithm to encrypt the request and uses an asymmetric encryption algorithm for signing. The certificate list each time is no less than 20. This ensures the validity and security of the user authentication certificate.

[0041] User verification certificate issuance and storage module: The user authentication certificate management module issues a verification certificate list based on the client's request. After obtaining the verification certificate list, the client uses a combination of fixed encryption keys, machine fingerprint encryption keys, and environment variable encryption keys to encrypt the verification list in binary blocks and combine them into the file system. The fixed encryption key and machine fingerprint encryption key are set in C++ dynamic library mode. Each system and machine requires a random environment variable encryption key parameter to ensure the security of the public key verification certificate. The client will also regularly report its own verification certificate ID range and key status data such as the most recent synchronization time and status. This module only requests the verification certificate, that is, the public key. The private key is only visible to the user authentication signature module. The module will also synchronize the symmetrically encrypted private key list.

[0042] As a preferred embodiment of the present invention, the user verification certificate issuance and storage module should issue a verification list that includes a valid verification certificate list in the previous rotation cycle and a valid verification certificate list in the next rotation cycle. This ensures that during the certificate rotation process of the user authentication certificate management module, the client always has a valid verification certificate, and there will be no time window without a verification certificate corresponding to the signature certificate, resulting in the client security not being guaranteed.

[0043] As a preferred embodiment of the present invention, the user authentication certificate issuance and storage module adopts two paths of active request and stream push for message transmission. Active request is based on scheduled polling, mainly long polling, and the long polling time interval can be up to the hour level. Stream push will actively push change events to the access client. After the client receives the change event notification, it will trigger long polling outside the fixed time interval. By combining long polling with event notification, the access pressure of the user authentication certificate management module can be effectively reduced and timeliness can be guaranteed.

[0044] As a preferred implementation of the present invention, the certificate list is stored on the client side only storing the signature verification public key without any user authentication signature public key certificate.

[0045] As a preferred embodiment of the present invention, the certificate list is stored in the client in binary form, and then a fixed position exchange is performed. After the exchange, it is split into different binary blocks. Different binary blocks use different encryption algorithms. Some encryption keys are fixed in the dynamic link library, some are dynamically set according to environmental changes, and some are dynamically generated by machine fingerprint hash. Then, they are spliced ​​and stored in the form of key type, data length, and encrypted binary data. The confidentiality of the encrypted data is guaranteed. That is, data security is guaranteed by binary position conversion and multi-type, multi-position encryption key methods.

[0046] As a preferred implementation mode of the present invention, each time the certificate list is sent down, it includes at least three groups: the past group, the current group, and the future group. It can also be expanded to five groups: two past groups, the current group, and two future groups. This ensures that during the certificate switching process, even if the Token signed by the past certificate is used, the client also has the corresponding verification certificate. This ensures that even if the client fails to connect to the user certificate management module normally at the hourly or dayly level, even if the signing certificate is rotated to a new group, all access clients can verify the signature normally.

[0047] When the user verification certificate issuance and storage module requests a certificate from the user mutual trust certificate management module, its identity will be verified. Only the system that has passed the identity authentication can download the user certificate public key list, and only the user authentication signature module can download the user certificate public and private key list. At the same time, the access to the user authentication signature module and the access to the general system use different service exposures and different network security strategies. The user authentication signature module restricts access to the machine list, and the identity authentication certificate is replaced frequently.

[0048] User authentication signature module: This module supports users to perform single-mode or multi-factor authentication by means of user password, registered mobile phone SMS, account electronic key, face recognition, fingerprint recognition, etc. After the authentication is passed, the symmetric encryption and decryption algorithm and certificate in the licensed signature certificate list in the user authentication certificate management module are used to encrypt key element information such as user ID, user type, authentication signer, authentication source channel, authentication user type, authentication time, asymmetric signature certificate ID SignKeyId, etc. to obtain keyContent, and then the KeyContent and the symmetric encryption certificate ID EncryptKeyId are digested and hashed as plain text and asymmetric signature is performed using the private key corresponding to SignKeyId.

[0049] As a preferred implementation of the present invention, the plain text part of the user authentication signature module only contains non-client sensitive key information, which is only the ID of the symmetric encryption certificate.

[0050] As a preferred implementation of the present invention, when accessing the system to verify the signature, EncryptKeyId is obtained from the plaintext part, and the symmetric encryption key is found in the local memory and file certificate information, and KeyContent is decrypted. If decryption is not possible, it is regarded as an invalid request.

[0051] As a preferred implementation of the present invention, Key Content includes SignKeyId. When accessing the system for signature verification, the asymmetric encrypted public key is found in the local memory and file certificate information for signature verification. If the signature verification is successful, it is confirmed that the user ID has been authenticated by the user authentication signature module. This process does not require calling remote services, nor does it rely on the database of other systems. It only relies on local files and there is no network access pressure.

[0052] As a preferred implementation mode of the present invention, the client parses the user ID information in the request, and compares the input with the user ID in the above KeyContent to prevent horizontal unauthorized access and customer data leakage.

[0053] This part of the signature method is fundamentally different from the JWT signature algorithm of the current process, that is, it does not expose the signature algorithm or user information. JWT is a single signature algorithm, and this module is an encryption and signature composite algorithm. It is necessary to crack the private keys of both algorithms at the same time to tamper with the signature information, which has higher security. At the same time, sensitive data encryption is used to better protect user privacy and data security.

[0054] As a preferred embodiment of the present invention, the signature certificate includes various types of national secret and non-national secret certificates such as RSA, ECDSA, SM2, the hash algorithm includes MD5, SHA128, SHA256, SHA1024, SM3, and the symmetric encryption includes AES, 3DES, SM1, SM4, etc.

[0055] User signature verification module: mainly obtains the asymmetric signature public key from the local certificate list according to the signature certificate ID for signature verification. The signature verification uses symmetric encryption to parse and obtain the user ID information and signature validity period in the signature Token. If the signature has expired, it is considered invalid. The user ID will be compared with the user ID in the request body, and only the consistent ones can pass the user signature.

[0056] The user signature verification module will report the verification results, including the verification system, verification user ID, verification key ID, verification asymmetric key ID, verification time, verification results, verification failure reasons, etc., as the system verification evidence, it will also be used to indicate that a certain symmetric key ID, asymmetric key ID, and verification user ID are at risk of being hacked. The user signature management system can issue the expiration of a certain key as needed.

[0057] The four main modules, namely the user authentication certificate management module, the user authentication certificate issuance and storage module, the user authentication signature module and the user signature verification module, mainly solve the problems of global user access and data security.

[0058] System mutual trust certificate management module: mainly manages the past, current and future signature certificates and their algorithms used for system mutual trust authentication according to application ID. This module has the ability to dynamically generate a certificate list based on interface request parameters including application ID, number of certificates, certificate algorithm, certificate key length and other data. This module has the ability to control the scope of the current signature certificate list used for application communication mutual trust and the certificate list used for signature verification. The signature certificate list is a subset of the verification certificate list, and the verification certificate includes the verification certificates corresponding to the signature certificates for fixed time periods in the past, current and future. At the same time, each signature and verification certificate pair in this module has a unique incremental ID.

[0059] As a preferred implementation of the present invention, the system mutual trust certificate management supports a variety of stacked asymmetric encryption algorithms, including RSA, AES, DES, SM4, SM2, etc.

[0060] As a preferred implementation of the present invention, the system mutual trust certificate management module manages multiple groups of key lists of each system in the past, future and present based on the system dimension, and manages the rolling of key lists of different systems.

[0061] As a preferred implementation mode of the present invention, the system mutual trust certificate management module can manage the rotation period between systems in a staggered manner to avoid problems caused by a large number of systems changing certificates at the same time.

[0062] System mutual trust certificate issuance module: The client identity needs to be verified when the client queries. The system mutual trust certificate issuance module stores the request certificate of the application ID. Only the client that passes the verification will issue the signature and verification certificate list to the application ID. Application ID A can only request the verification certificate of application ID B, but cannot request its signature certificate.

[0063] As a preferred implementation of the present invention, the system mutual trust certificate issuing module adopts two paths, active request and stream push, for message transmission, see the user verification certificate issuing and storage module.

[0064] As a preferred implementation of the present invention, the system mutual trust certificate issuance module adopts binary block multi-source multi-encryption key encryption assembly to ensure the security of the file, see the user verification certificate issuance and storage module.

[0065] The module certificate for issuing system mutual trust certificates is only used for mutual trust between systems. The certificate list issued to the signature system includes not only the signature verification public key list but also the signature certificate list.

[0066] When the system mutual trust certificate issuing module requests a certificate from the system mutual trust certificate management module, its identity will be verified. Only the system that has passed the identity authentication can download the public and private keys of the signature certificate belonging to this system. At the same time, only the authorized upstream system maintained by the system mutual trust certificate management module can download the public key list of the system.

[0067] System mutual trust signature module: The system mutual trust certificate issuance module issues a verification certificate list based on the client's request. The request information includes the application ID. After obtaining the signature and verification certificate list, the client uses a combination of fixed encryption keys, machine fingerprint encryption keys, and environment variable encryption keys to perform binary block encryption on the verification certificate list and combine it into the file system. The fixed encryption key and machine fingerprint encryption key are set in C++ dynamic library mode. Each system and machine requires a random environment variable encryption key parameter to ensure the security of the public key verification certificate. Unlike the user authentication signature module, this module requests to download the signature certificate and verification certificate for this application, as well as the verification certificates for other system applications.

[0068] As a preferred embodiment of the present invention, mutual trust between systems tends to be more lightweight and efficient signature and verification algorithms, and security is improved by increasing the rotation frequency of signature and verification certificates.

[0069] System mutual trust signature verification module: When system A initiates a request to system B, system A will download its own application signature certificate, and sign the request summary using the signature certificate and signature algorithm according to the summary information of the request. The plain text transmitted during the signing process includes the application ID of system A, the request time, the signature certificate ID used by system A, and the corresponding signature value. When system B receives the request, it will find the verification certificate corresponding to the application ID and signature certificate ID of system A in the verification certificate list obtained in its own system mutual trust signature module, and verify the request of system A.

[0070] As a preferred implementation of the present invention, the system mutual trust signature verification module uses an asynchronous message queue to send the verification result to the system mutual trust issuance and use monitoring module, which is used to monitor the verification status of the system mutual trust signature verification module and discover abnormalities in time.

[0071] User authentication issuance and usage monitoring module: mainly monitors the issuance of user authentication signatures and verification certificates to peripheral systems, and receives abnormal verification data reported by each system.

[0072] As a preferred implementation mode of the present invention, the module timely detects abnormal user signature verification situations and abnormal signature verification channels, identifies the target system of network attacks and deceived user information, and timely detects certificate issuance anomalies, notifying relevant systems to process relevant nodes.

[0073] System mutual trust issuance and use monitoring module: mainly monitors the issuance of system mutual trust signatures and verification certificates, and receives abnormal mutual trust signatures and verification data reported by each system.

[0074] As a preferred implementation mode of the present invention, the module timely discovers abnormal signature verification situations between systems and abnormal signature verification target systems, identifies network attack target systems, and notifies related systems to process related nodes.

[0075] Request three-proof module: The signer information and request time information are signed through the user authentication signature algorithm and the system mutual trust request signature algorithm. Each request of the system mutual trust request signature algorithm needs to be signed and timestamped to ensure that the requests between systems are difficult to replay, tamper with, and forge.

[0076] In actual application, the four modules of system mutual trust certificate management module, system mutual trust certificate issuance module, system mutual trust certificate issuance module, and system mutual trust signature verification module mainly solve the problem of global application channel communication security, that is, attackers cannot arbitrarily access any application on internal or external machines. Under the premise of global channel security, global user data security is guaranteed, that is, attackers cannot arbitrarily access any user data on internal or external machines, achieving double security protection; at the same time, the user authentication issuance and use monitoring module, user authentication certificate management module, user signature certificate issuance and storage module, system mutual trust issuance and use monitoring module, and request three-defense module can quickly identify certificates and users attacked by brute force, take corresponding security measures, and realize dynamic perception and anti-explosive force cracking on the basis of channel security and user security.

[0077] In actual application, one part of the function of this technical solution is user access security, and the other part is inter-system channel security. The two modules are similar, but their functions are different, so as to ensure the regular automatic rotation of channel certificates and user access certificates. Inter-system access first verifies the channel certificate and then verifies the user certificate, ensuring that it is legal access between internal systems and legal access by users.

[0078] As a preferred implementation of the present invention, mutual trust authentication between systems is necessary, and no user authentication is required if it is not a user operation.

[0079] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0080] It should be understood that each part of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device.

[0081] A person of ordinary skill in the art may understand that all or part of the steps of the method for implementing the above-mentioned embodiment may be completed by instructing the relevant hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one of the steps of the method embodiment or a combination thereof.

[0082] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0083] In the description of this specification, the description with reference to the terms "an embodiment", "some embodiments", "example", "specific example", or "embodiment" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0084] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

[0085] The global user security authentication and system mutual trust security service system that realizes decentralization, distribution, and low RPC dependence of the present invention can realize global user identity verification and user data security protection, effectively prevent users from exceeding their rights, and at the same time, the peripheral system does not need to call the signature verification database or signature verification service, reducing the access pressure and strong coupling of the peripheral system to the signature verification service. At the same time, the rotation strategy of the signature and signature verification list and the effective monitoring strategy are used to ensure the freshness, strength, and effectiveness of the certificate, and asynchronous monitoring is used for abnormal authentication to ensure timely statistics and identification of abnormal points and abnormal users. In terms of mutual trust between systems, authoritative services are used to uniformly manage the signatures and signature verification certificates that are called between systems. The signatures and signature verification between systems do not need to directly rely on the intermediate system for signing and verification, reducing the strong coupling and strong dependence on the intermediate system. At the same time, through effective asynchronous monitoring, timely statistics and identification of abnormal communication channels between systems are guaranteed. By using this system and method, global channel authentication security and user access security are achieved, rather than just controlling the entrance security traffic, financial-level global security control is achieved.

[0086] In this specification, the present invention has been described with reference to specific embodiments thereof. However, it is apparent that various modifications and variations may be made without departing from the spirit and scope of the present invention. Therefore, the specification and drawings should be regarded as illustrative rather than restrictive.

Claims

1. A decentralized, distributed, low-RPC-dependency global user security authentication and system mutual trust security service system, characterized by: The system comprises: User authentication certificate management module, used to manage past, current and future signature certificates used for user authentication and basic permission control; The user verification certificate issuance and storage module is used to issue the verification certificate list according to the client request. After obtaining the verification certificate list, the client uses a fixed encryption key, a machine fingerprint encryption key, and an environment variable encryption key to encrypt the verification certificate list in binary blocks and combine them into the file system; User authentication signature module supports single-mode or multi-factor authentication by user password, registered mobile phone SMS, account electronic key, face recognition, fingerprint recognition; The user signature verification module is used to obtain the asymmetric signature public key from the local certificate list according to the signature certificate ID for signature verification.

2. According to claim 1, the decentralized, distributed, low-RPC-dependency global user security authentication and system mutual trust security service system is characterized by: The user authentication certificate management module is specifically: It has the ability to dynamically generate a certificate list based on the core element data of the interface request parameters including the number of certificates, certificate algorithm, and certificate key length; it has the ability to control the scope of the current user authentication signature certificate list and the user authentication verification certificate list; wherein the user authentication signature certificate list is a subset of the user authentication verification certificate list, and the user authentication verification certificate includes the verification certificates corresponding to the signature certificates for fixed time periods in the past, present, and future; at the same time, in the user authentication certificate management module, each signature and verification certificate pair has a unique incremental ID.

3. According to claim 2, the decentralized, distributed, RPC-less global user security authentication and system mutual trust security service system is characterized by: The user authentication certificate management module also has a certificate rotation function, which is used to batch roll the valid signature certificate range and the valid verification certificate range, and roll them at a fixed time or temporarily.

4. According to claim 3, the decentralized, distributed, RPC-less global user security authentication and system mutual trust security service system is characterized in that: The user verification certificate issuance and storage module is specifically: The fixed encryption key and machine fingerprint encryption key are set in C++ dynamic library mode, and the environment variable encryption key is generated randomly; and the user verification certificate issuance and storage module only requests the verification certificate, i.e., the public key, and synchronizes the symmetrically encrypted private key list; The user verification certificate is issued and the verification list issued by the storage module includes a valid verification certificate list in the previous rotation cycle and a valid verification certificate list in the next rotation cycle; and the message is transmitted according to the two paths of active request and stream push.

5. According to claim 1, the decentralized, distributed, low-RPC-dependency global user security authentication and system mutual trust security service system is characterized by: After the authentication is passed, the user authentication signature module uses the symmetric encryption and decryption algorithm and certificate in the license signature certificate list in the user authentication certificate management module to encrypt the key element information of the acquired user ID, user type, authentication signer, authentication source channel, authentication user type, authentication time, and asymmetric signature certificate ID SignKeyId to obtain keyContent, and uses the KeyContent and the symmetric encryption certificate ID EncryptKeyId as plain text for digest hashing, and uses the private key corresponding to SignKeyId for asymmetric signing.

6. According to claim 1, the decentralized, distributed, low-RPC-dependency global user security authentication and system mutual trust security service system is characterized by: The user signature verification module will report the verification result, wherein the reported content includes the verification system, verification user ID, verification key ID, verification asymmetric key ID, verification time, verification result, and verification failure reason; the reported content will be used as the retained evidence of the system verification and will also be used to indicate a certain symmetric key ID, asymmetric key ID, and the verification user ID is at risk of being hacked.

7. According to claim 1, the decentralized, distributed, low-RPC-dependency global user security authentication and system mutual trust security service system is characterized by: The system also includes a system mutual trust certificate management module, which is used to manage past, current and future system mutual trust authentication signature certificates and their algorithms according to application ID; the system mutual trust certificate management module has the ability to generate a certificate list according to interface request parameters; it has the ability to control the scope of the current user authentication signature certificate list and the user authentication verification certificate list, wherein the user authentication signature certificate list is a subset of the user authentication verification certificate list, and the user authentication verification certificate includes the verification certificates corresponding to the signature certificates in the past, current and future fixed time periods; at the same time, in the system mutual trust certificate management module, each signature and verification certificate pair has a unique incremental ID.

8. According to claim 1, the decentralized, distributed, low-RPC-dependency global user security authentication and system mutual trust security service system is characterized by: The system also includes a system mutual trust certificate issuing module, which is used to store the request certificate of the application ID and issue the signature and verification certificate list only to the verified client through the application ID; It uses two paths, active request and stream push, for message transmission, and uses binary block multi-source multi-encryption key encryption assembly.

9. According to claim 1, the decentralized, distributed, low-RPC-dependency global user security authentication and system mutual trust security service system is characterized by: The system also includes a system mutual trust signature module, which is used to issue a verification certificate list according to a client request. The request information includes an application ID. After obtaining the verification certificate list, the client uses a fixed encryption key, a machine fingerprint encryption key, and an environment variable encryption key to encrypt the verification certificate list in binary blocks and combine it into a file system. The fixed encryption key and the machine fingerprint encryption key are set in a C++ dynamic library manner, and the environment variable encryption key is generated in a random manner.

10. The decentralized, distributed, RPC-less global user security authentication and system mutual trust security service system according to claim 1 is characterized in that: The system further comprises: The system mutual trust signature verification module is used to sign the request summary using the signature certificate and signature algorithm according to the summary information of the request during the request process; The user authentication issuance and usage monitoring module is used to monitor the issuance of user authentication signatures and verification certificates to peripheral systems, and receive abnormal verification data reported by each system; The system mutual trust issuance and use monitoring module is used to monitor the issuance of system mutual trust signatures and verification certificates, and receive abnormal mutual trust signatures and verification data reported by each system; The request three-defense module is used to sign the signer information and request time information through the user authentication signature algorithm and the system mutual trust request signature algorithm.

Images