Security access system, method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, and discloses a security access system, method and device, electronic equipment and a storage medium, a platform server returns a key dynamic library name to a user side under the condition of determining that the user side has started a key authentication service; the user side initializes a key interface object according to the key dynamic library name, and calls equipment information, a public key and a signature certificate based on the key interface object; and obtaining an original random number from the signature verification server, performing hash operation on the public key and the original random number to obtain a target random number and a corresponding digital signature, performing validity verification on the signature certificate by the signature verification server according to the digital signature, the signature certificate and the target random number, and when the signature certificate passes the validity verification, sending the signature certificate to the signature verification server. And the user side accesses the cloud management platform based on the legal identity. According to the method and the device, the legality of the identity of the user side is verified by adopting a mode of combining key verification and login account authentication, so that the reliability of an identity security verification result is ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a secure access system, method, device, electronic device and storage medium. Background Art

[0002] With the rise of the cloud computing industry and the rapid expansion of its market size, the resource management scope of the cloud management platform has also been further expanded to include a series of important resources and confidential information such as private cloud, public cloud, virtual equipment, physical equipment, personnel management and order management. Therefore, in order to achieve secure access to the cloud management platform by the user, how to perform identity security verification on the client has become a key research topic.

[0003] In related technologies, user identity is usually identified by combining user biometric features such as face and fingerprint. Under the current technological development, this method is based on feature similarity matching, and authentication is successful if it is above a certain threshold.

[0004] However, if the above method is used to perform user identity security verification, it is necessary to ensure that the user end is equipped with hardware such as a camera or fingerprint reader, and when the confidentiality level of the user's access data is high, user biometric recognition cannot be used as the main means of identification, which is not conducive to ensuring the reliability of identity security verification. Summary of the invention

[0005] The present application provides a secure access system, method, device, electronic device and storage medium to address the defects of related technologies such as being unfavorable in ensuring the reliability of identity security verification.

[0006] The first aspect of the present application provides a secure access system, including: a user terminal, a platform service terminal and a signature verification server;

[0007] The user terminal is used to send a key authentication request to the platform server when opening the cloud management platform access page to verify whether the user terminal has turned on the key authentication service;

[0008] The platform server is used to receive and respond to the key authentication request, and return the key dynamic library name to the user terminal when it is determined that the user terminal has turned on the key authentication service;

[0009] The user terminal is used to perform key interface object initialization processing according to the key dynamic library name when the key dynamic library name is obtained, and based on the key interface object, call device information, public key and signature certificate from the identity authentication device inserted by the user terminal; obtain the original random number from the signature verification server, perform hash operation on the public key and the original random number to obtain the target random number, perform a signing operation on the target random number based on the private key to obtain a digital signature, and send the digital signature, signature certificate and target random number to the signature verification server;

[0010] The signature verification server is used to verify the legitimacy of the signature certificate based on the digital signature, signature certificate and target random number. If the signature certificate passes the legitimacy verification, the user terminal jumps to the user login page to enable the user terminal to access the cloud management platform based on a legal identity.

[0011] In an optional implementation manner, the user terminal is further used for:

[0012] The device information is stored based on a storage plug-in so as to share the device information during access to the cloud management platform.

[0013] In an optional embodiment, the system further includes:

[0014] The routing switching verification module is used to trigger a query request when the user terminal switches the cloud management platform access page to verify whether the identity authentication information of the user terminal remains legal.

[0015] In an optional implementation manner, the user terminal is further used for:

[0016] In response to the query request triggered by the routing switching verification module, based on the key interface object, the device information is recalled from the identity authentication device inserted into the user end to obtain new device information, and the shared original device information is obtained from the storage plug-in;

[0017] By comparing the new device information with the original device information, determining whether the new device information is consistent with the original device information, so as to verify whether the identity authentication information of the user terminal remains legal;

[0018] Wherein, when the new device information is consistent with the original device information, it is determined that the identity authentication information of the user terminal remains legal.

[0019] In an optional embodiment, the system further includes:

[0020] The interceptor is used to clear the currently visited page and jump to the user login page when it is determined that the identity authentication information of the user terminal is not legal.

[0021] In an optional implementation manner, the interceptor is further used to:

[0022] During the process of the user terminal accessing the cloud management platform, if the user terminal initiates a sensitive request in the preset red list, a secondary identity authentication is performed on the user terminal;

[0023] If the secondary identity authentication of the user terminal fails, the current access page is cleared and the page jumps to the user login page.

[0024] A second aspect of the present application provides a secure access method, which is applied to a user terminal and includes:

[0025] When opening the cloud management platform access page, a key authentication request is sent to the platform server; wherein, when the platform server determines that the user terminal has turned on the key authentication service, the key dynamic library name is returned to the user terminal;

[0026] When the key dynamic library name is obtained, performing key interface object initialization processing according to the key dynamic library name;

[0027] Based on the key interface object, calling device information, public key and signature certificate from the identity authentication device inserted into the user end;

[0028] Obtain an original random number from the signature verification server, perform a hash operation on the public key and the original random number to obtain a target random number;

[0029] Performing a signing operation on the target random number based on the private key to obtain a digital signature, and sending the digital signature, the signature certificate and the target random number to the signature verification server; wherein the signature verification server verifies the legitimacy of the signature certificate based on the digital signature, the signature certificate and the target random number;

[0030] When the signature certificate passes the legitimacy verification, the user is redirected to the user login page to access the cloud management platform based on a legal identity.

[0031] A third aspect of the present application provides a secure access device, which is applied to a user terminal and includes:

[0032] A request module, used to send a key authentication request to the platform server when opening the cloud management platform access page; wherein, the platform server returns the key dynamic library name to the user end when determining that the user end has turned on the key authentication service;

[0033] An object initialization module, used for performing key interface object initialization processing according to the key dynamic library name when the key dynamic library name is obtained;

[0034] A calling module, used to call device information, public key and signature certificate from the identity authentication device inserted into the user end based on the key interface object;

[0035] The operation module is used to obtain the original random number from the signature verification server, perform a hash operation on the public key and the original random number, and obtain a target random number;

[0036] A verification module, configured to perform a signing operation on the target random number based on a private key to obtain a digital signature, and send the digital signature, the signature certificate and the target random number to the signature verification server; wherein the signature verification server verifies the legitimacy of the signature certificate based on the digital signature, the signature certificate and the target random number;

[0037] The access module is used to jump to the user login page when the signature certificate passes the legitimacy verification, so as to access the cloud management platform based on the legal identity.

[0038] A fourth aspect of the present application provides an electronic device, comprising: at least one processor and a memory;

[0039] The memory stores computer-executable instructions;

[0040] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method described in the second aspect and various possible designs of the second aspect.

[0041] A fifth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the method described in the second aspect and various possible designs of the second aspect are implemented.

[0042] The technical solution of this application has the following advantages:

[0043] The present application provides a secure access system, method, device, electronic device and storage medium, the system comprising: a user end, a platform server and a signature verification server; the user end is used to send a key authentication request to the platform server when opening a cloud management platform access page to verify whether the user end has turned on the key authentication service; the platform server is used to receive and respond to the key authentication request, and return the key dynamic library name to the user end when it is determined that the user end has turned on the key authentication service; the user end is used to perform key interface object initialization processing according to the key dynamic library name when obtaining the key dynamic library name, and based on the key interface object, The device information, public key and signature certificate are called from the identity authentication device inserted by the user; the original random number is obtained from the signature verification server, the public key and the original random number are hashed to obtain the target random number, the target random number is signed based on the private key to obtain a digital signature, and the digital signature, signature certificate and target random number are sent to the signature verification server; the signature verification server is used to verify the legitimacy of the signature certificate based on the digital signature, signature certificate and target random number. If the signature certificate passes the legitimacy verification, the user terminal jumps to the user login page, so that the user terminal can access the cloud management platform based on the legal identity. The system provided by the above scheme verifies the legitimacy of the identity of the user terminal by combining key verification and login account authentication, which ensures the reliability of the identity security verification results and lays the foundation for improving the security of the cloud management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the following is a brief introduction to the drawings required for use in the embodiments or the related technical descriptions. Obviously, the drawings described below are some embodiments of the present application, and a person skilled in the art can also obtain other drawings based on these drawings.

[0045] Figure 1 A schematic diagram of the interaction process of the secure access system provided in an embodiment of the present application;

[0046] Figure 2 A schematic diagram of the structure of a secure access system provided in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of the structure of another secure access system provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the login process provided for an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the platform security assurance process after enabling Ukey authentication login provided in an embodiment of the present application;

[0050] Figure 6 A flowchart of a secure access method provided by an embodiment of the present application;

[0051] Figure 7 A schematic diagram of the structure of a secure access device provided in an embodiment of the present application;

[0052] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0053] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0055] In addition, the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. In the description of the following embodiments, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0056] In related technologies, with the rise of the cloud computing industry and the rapid expansion of its market size, the resource management scope of the cloud management platform has also been further expanded, including a series of important resources and confidential information such as private cloud, public cloud, virtual equipment, physical equipment, personnel management, order management, etc. Correspondingly, web security detection should be further strengthened, such as identity confirmation of login personnel, permission restriction, etc.

[0057] Existing web security protection strategies are mainly oriented towards code and operation and maintenance, such as:

[0058] 1. SQL injection: The attacker adds SQL statements to the web query statements, and the server directly executes them to obtain private data in the database. The solution to this problem can be keyword filtering or using precompiled statements to bind variables on the server.

[0059] 2. HTTP information is not encrypted: You can use the encryption method of your own platform to encrypt the data, or upgrade the HTTP protocol to HTTPS;

[0060] 3. CSRF attack: Impersonate the user to send a forged request to the server; the solution to the problem can be to modify the get request to post and use referer verification to limit cross-domain.

[0061] The above security methods are aimed at code, data storage, and data transmission direction. There is another link that is also very important: confirming the user's identity to ensure that it is the person operating the platform.

[0062] There are multiple authentication methods to ensure user identity:

[0063] 1. Implementation in combination with mobile phone: Login by mobile phone verification code or scan code login with third-party communication software or mobile phone app. The first two solutions require cooperation of three parties. As the number of users increases, the cost also increases linearly, and there is a risk of user information leakage. If there is no mobile app planned for the latter, the development cost of the app needs to be increased, which is not practical.

[0064] 2. Combined with biometric features such as face and fingerprint recognition, this method, under the current technological development, is based on feature similarity matching. Authentication is successful if it is above a certain threshold. It cannot be used as the main identification method when the confidentiality level is high. From the implementation point of view, it not only increases the hardware cost of external devices such as cameras / fingerprint readers, but also increases the cost of developing the recognition model. The development time and manpower cost of the latter cannot be underestimated.

[0065] In response to the above problems, the embodiments of the present application provide a secure access system, method, device, electronic device and storage medium, the system comprising: a user end, a platform server and a signature verification server; the user end is used to send a key authentication request to the platform server when opening the cloud management platform access page to verify whether the user end has turned on the key authentication service; the platform server is used to receive and respond to the key authentication request, and when it is determined that the user end has turned on the key authentication service, return the key dynamic library name to the user end; the user end is used to perform key interface object initialization processing according to the key dynamic library name when obtaining the key dynamic library name, and based on the key The interface object calls the device information, public key and signature certificate from the identity authentication device inserted by the user; obtains the original random number from the signature verification server, performs a hash operation on the public key and the original random number to obtain the target random number, signs the target random number based on the private key to obtain a digital signature, and sends the digital signature, signature certificate and target random number to the signature verification server; the signature verification server is used to verify the legitimacy of the signature certificate based on the digital signature, signature certificate and target random number. When the signature certificate passes the legitimacy verification, the user terminal jumps to the user login page to allow the user terminal to access the cloud management platform based on a legal identity. The system provided by the above scheme verifies the legitimacy of the identity of the user terminal by combining key verification and login account authentication, thereby ensuring the reliability of the identity security verification results and laying the foundation for improving the security of the cloud management platform.

[0066] The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0067] An embodiment of the present application provides a secure access system for performing user identity security verification when a user accesses a cloud management platform.

[0068] like Figure 1 , which is a schematic diagram of the interaction process of the secure access system provided in an embodiment of the present application, the system includes: a user end, a platform service end and a signature verification server.

[0069] The user end is used to send a key authentication request to the platform server when opening the cloud management platform access page to verify whether the user end has enabled the key authentication service;

[0070] The platform server is used to receive and respond to key authentication requests, and return the key dynamic library name to the user end when it is determined that the user end has enabled the key authentication service;

[0071] The user end is used to initialize the key interface object according to the key dynamic library name when the key dynamic library name is obtained, and based on the key interface object, call the device information, public key and signature certificate from the identity authentication device inserted by the user end; obtain the original random number from the signature verification server, perform a hash operation on the public key and the original random number to obtain the target random number, perform a signing operation on the target random number based on the private key to obtain a digital signature, and send the digital signature, signature certificate and target random number to the signature verification server;

[0072] The signature verification server is used to verify the legitimacy of the signature certificate based on the digital signature, signature certificate and target random number. If the signature certificate passes the legitimacy verification, the user client jumps to the user login page to enable the user client to access the cloud management platform based on a legal identity.

[0073] Specifically, the system provided in the embodiment of the present application is to achieve the purpose of secure access, and adopts Ukey two-factor security authentication for the user's login method, one of which refers to Ukey authentication and the other to web platform authentication. Figure 2 As shown, it is a structural diagram of a secure access system provided in an embodiment of the present application. In the embodiment of the present application, the web platform is developed based on the vue framework, and other frameworks such as react can also use this implementation solution.

[0074] Specifically, Figure 2 As shown, the user first inserts Ukey at the user end, starts the driver equipped by the corresponding Ukey manufacturer, and this operation will cause a service with a port number of 9876 to run locally at the user end. This service is the basis for a series of subsequent operations. It is equivalent to setting up a channel for local interaction and communication with Ukey. The embodiment of the present application is called key authentication service. When the user end opens the web page (access page) of the cloud management platform, the page will first ask the platform server whether the currently logged-in user end has opened Ukey authentication (key authentication service). If it is turned on, the platform server will not only return the information of opening, but also carry the Ukey dynamic library name (key dynamic library name) used by the platform, also known as lib name. The dynamic library names provided by different Ukey manufacturers here may be different, and the platform server can be configured accordingly according to the actual access Ukey situation, and then returned to the user end as required. If the website has low security level requirements and does not want to use the Ukey verification function, it can also directly turn off this switch in the configuration, so that users can directly log in using the platform account and skip the Ukey authentication link.

[0075] Furthermore, after the user side gets the library name returned from the platform server, it will initialize the SKF object (key interface object) and mount it on the Windows object. This SKF object will play a key role later, facilitating the user side to call a series of function interfaces that interact with Ukey, to obtain and operate the Ukey device and the information stored therein, and to mount it on the Windows object for easy use at any time in the subsequent process.

[0076] Furthermore, by calling the SKF_EnumDev function with the mounted SKF object, you can get the Ukey device name from the identity authentication device Ukey, and then use the SKF_ConnectDev function to connect to the device. After a successful connection, you will get the device handle. The device handle is the identity identifier for subsequent operations on the device. Only with the device handle can you accurately issue instructions to this specific Ukey device and obtain information. Among them, the device information includes at least the device name and device handle. In addition to the device information, the SKF_ExportCertificate function is also called to obtain the signature certificate carried in the Ukey, and then the X509 library is used to decode the certificate to obtain the user name.

[0077] Furthermore, the user terminal obtains the initial random number from the signature verification server, then calls the SKF_ExportPublicKey function to export the Ukey public key, then uses the SKF_DigestInit function to initialize the hash operation, and then uses the randomized data to hash the public key and other information through the SKF_DigestUpdate function, and finally obtains the final hashed data through the SKF_DigestFinal function to obtain the target random number. Use the SKF_ECCSignData function to digitally sign the target random number. After the signature is completed, the randomized data, signature certificate, digital signature and other information are sent to the signature verification server, and the signature verification server verifies the legitimacy of Ukey, that is, determines whether the signature certificate of the user terminal is legal. The embodiment of the present application uses the above-mentioned rigorous digital signature and verification mechanism to ensure the security and reliability of the user terminal that logs in using Ukey, and prevents the cloud management platform from being illegally accessed and operated.

[0078] Among them, if the signature verification server verifies the legitimacy of Ukey and succeeds, the user name previously obtained from Ukey and stored in vuex will be used to enter the platform server login process, that is, the user end jumps to the user login page. In order to ensure security, the embodiment of this application prohibits manual input of the user name, avoiding security risks such as arbitrary tampering of the user name.

[0079] Based on the above embodiment, as an implementable manner, in one embodiment, the user terminal is further used for:

[0080] Device information is stored based on the storage plug-in (Vuex conversation storage) to share device information during access to the cloud management platform.

[0081] Specifically, in order to share this data between the various tabs of this website, the user end uses the Vuex persistent storage plug-in (vuex-persistedstate) to save the data in vuex to the target storage sessionStorage, so that these key Ukey related information can be retrieved at any time during the use of the entire website. In addition to device-related information, you can also call the SKF_ExportCertificate function to obtain the signature certificate carried in the Ukey, and then use the X509 library to decode the certificate to obtain the user name, and also store this user name in the vuex persistent storage plug-in, further improving the relevant information reserves for authentication.

[0082] On the basis of the above embodiment, in order to further ensure the security of user access to the cloud management platform, after the user completes the login, the user terminal continues to be security verified, mainly verifying whether the platform user name and the user name of the Ukey itself are consistent, whether the Ukey remains connected, whether the Ukey is replaced, etc. As an implementable method, in one embodiment, the system also includes:

[0083] The routing switching verification module (routing guard) is used to trigger a query request when the user switches the cloud management platform access page to verify whether the user's identity authentication information remains legal.

[0084] Among them, Figure 3 As shown, it is a structural diagram of another secure access system provided by an embodiment of the present application, which is mainly used in the access stage after login. After login, when the user accesses the cloud management platform, when the access page is switched, the routing switching verification module triggers a query request to verify whether the identity authentication information of the user terminal remains legal, that is, to determine whether there is any operation on the user terminal that is not the user himself.

[0085] Among them, the route switching verification module is actually Vue-Router, which is the official route of Vue.js, providing a variety of navigation priorities for the web side, global, single route exclusive, or component level. The embodiment of this application mainly uses the global front guard. The life cycle of vue mainly uses the created cycle.

[0086] Accordingly, in one embodiment, in response to a query request triggered by the routing switching verification module, based on the key interface object, the device information is recalled from the identity authentication device inserted into the user end, new device information is obtained, and the shared original device information is obtained from the storage plug-in; by comparing the new device information with the original device information, it is determined whether the new device information is consistent with the original device information to verify whether the identity authentication information of the user end remains legal.

[0087] Wherein, when the new device information is consistent with the original device information, it is determined that the identity authentication information of the user terminal remains legal.

[0088] Specifically, in one embodiment, the system also includes an interceptor for clearing the currently accessed page and jumping to the user login page when it is determined that the identity authentication information of the user terminal is not legal.

[0089] Specifically, after the platform login is successful, the platform user information returned by the server is saved in vuex (similarly, because vuex-persistedstate is used, this information will also be saved in sessionStorage). The first thing to verify is whether the logged-in platform username and Ukey username are consistent. The Ukey username has been stored in Vuex and sessionStorage before login. After login, the layout framework component will be used globally. In the create cycle of the framework component, the platform username and Ukey username are obtained from vuex for comparison. If the two are inconsistent, the login will be logged out immediately, and the vuex, sessionStorage, localStorage and Cookie information will be cleared, and then the login page will be returned. This verification mechanism utilizes the storage characteristics of the username in sessionStorage, and the username can be compared even when the component create is triggered by opening a new tab. When the webpage is closed, these stored information will be automatically cleared, which not only ensures security, but also facilitates user operation. In order to ensure that the user operation is the user's own operation, the uniqueness of Ukey itself is used for verification. In the global front guard of Vue-Router, add the process of obtaining Ukey information comparison. In the global front guard, reference the SKF object mounted in the window, use the device handle saved in vuex, and call SKF_GetDevInfo to obtain the device information. Compare the serial number in the newly obtained device information (new device information) with the serial number stored in Vuex (original device information). If they are consistent, it means that in the process of switching routes (switching pages), Ukey has not changed, and the same person is operating the platform. If the interface call fails or the obtained device serial number is incorrect, it is determined that the user has left, and the webpage will automatically clear the information and return to the login page. This operation requires the user to ensure the connection status of Ukey when using the platform, because the device serial number of Ukey is specific, which can ensure one person, one KEY, and can be unplugged as you go, ensuring the user's own operation.

[0090] If you open a new tab and cannot share the Window object of the previous tab, you can use the previously saved dynamic library name to reinitialize the SKF object. This initialization and the interface for obtaining device information are all executed locally and directly, and the response delay can be ignored.

[0091] Specifically, in one embodiment, the interceptor is also used to perform secondary identity authentication on the user terminal during the user terminal's access to the cloud management platform. If the user terminal initiates a sensitive request in a preset red list, the user terminal will be prompted for secondary identity authentication; if the user terminal's secondary identity authentication fails, the current access page will be cleared and the page will be redirected to the user login page.

[0092] Specifically, when important requests involving authentication (such as modifying confidential information such as user passwords) are involved, secondary authentication is implemented with the help of axios's request interceptor. A red list of important sensitive requests is pre-listed, and when the request is a sensitive request in the preset red list, the user's identity is authenticated twice.

[0093] Secondary identity authentication process: The program automatically obtains the signature certificate in the Ukey through the saved device handle, verifies the validity of the signature certificate, compares the device username and platform username, and only sends the real modification or setting request and other sensitive requests after success. If any step in this authentication fails, the user information will be cleared, the current access page will be cleared, and the user will be logged out and returned to the login page.

[0094] Among them, if the requirements for the confidentiality level are higher, you can use the encryption method specified by the platform to encrypt at the stage of saving the device username, or use the public key encryption in Ukey. For performance considerations, the embodiment of the present application places the Ukey verification in the process of switching routes (access page switching), so that frequent verification is not required in actual applications, because the single page operation items are extremely limited and the security risk is low. For important requests, sensitive requests in the preset red list have been intercepted. In addition, the verification of the embodiment of the present application does not consider timeout logout, because timeout logout is a regular restriction on the server side, and the front end does not have to do repeated processing. If Ukey is lost, the corresponding account of the platform can be directly closed.

[0095] In order to facilitate those skilled in the art to more clearly understand the secure access system provided by the embodiment of the present application, the embodiment of the present application provides the following application process, wherein, Figure 4 As shown, it is a schematic diagram of the login process provided by the embodiment of the present application, such as Figure 5 The figure shows a schematic diagram of the platform security assurance process after enabling Ukey authentication login provided in an embodiment of the present application.

[0096] The system provided by the embodiment of the present application adds a switch that can be configured to use UKey. Users can choose whether to use Ukey to strengthen user authentication according to their actual needs, increasing the user's freedom of use; using two-factor authentication instead of system authentication alone, the cipher machine and the service background dual authentication are more secure; taking VUE as an example and combining it with the emerging front-end framework, it can not only verify the user when the operation command is initiated, but also trigger the verification when the user browses the page, which has a higher degree of confidentiality; and the embodiment of the present application provides a flexible adjustment scheme under various confidentiality scenarios, which is more adaptable to various projects. It is widely used, uses the SKF library, supports a variety of UKeys, and can use this scheme as long as the Ukey prepared by the Ukey manufacturer of the standard SKF library is used, and the certificate is imported into the cipher machine. It does not use the internal protocol and cannot use the manufacturer's Ukey that the user wants to use; compared with other authentication methods such as fingerprint / face recognition, it has low cost, high accuracy, and low technical difficulty. Fast response speed, all front-end verification except login, Ukey connection service is deployed locally, and there is basically no delay. High security, multiple protections guarantee the uniqueness of the operating user. Strong scalability, adjust the security verification strategy according to the confidentiality level.

[0097] The embodiment of the present application is an embodiment of web security protection implemented based on the SKF library. It uses Ukey two-factor login to authenticate users. The web terminal saves the device and user information in the device. After login, the Ukey connection status is jointly detected through routing guards and request interception. The Ukey information is obtained and compared with the information used during login to verify the validity of the certificate, ensure user uniqueness, and ensure the security of the operating platform.

[0098] The web page of the embodiment of the present application is written based on the vue framework, vue-router is introduced to build a single-page application, VueX is used for responsive storage, vuex-persistedstate ensures storage persistence, and axios is used for request management. In the secure access system provided in the embodiment of the present application, the detailed process of the user end is as follows:

[0099] Step 1, start the safe-usbkey application, enable the local 9876 service, and insert the Ukey;

[0100] Step 2, open the web client, the web sends a request to the platform server, confirms whether the Ukey switch is turned on, and obtains the Ukey device dynamic library name. If it is turned on, the user name input box is disabled. At this time, the empty devInfo object of vuex has been registered in vuex-persistedstate for persistent storage and saved in sessionStorage;

[0101] Step 3, get the library name to initialize the SKF object, mount this object to the window, and call the interface in steps 4, 7, and 14 through this object;

[0102] Step 4, SKF_EnumDev obtains the device list, returns the device name, gets the first device, and SKF_ConnectDev obtains the device handle through the device name;

[0103] SKF_GetDevInfo obtains device information, SKF_EnumContainer passes in the device handle to get the certificate container name, and SKF_ExportCertificate passes in the device handle and certificate container name to export the signature certificate.

[0104] Step 5, use the X509 library readCertPEM to decode the certificate, get the device username, and save the devInfo object, including the hDev device handle, SerialNumber device serial number, remark device dynamic library name, and username device username;

[0105] Step 6: Obtain a random number from the signature verification server;

[0106] Step 7, SKF_ExportPublicKey exports the public key, SKF_DigestInit initializes the hash, SKF_DigestUpdate uses the randomized data to update the hash content, SKF_DigestFinal obtains the final data after hashing, SKF_CloseDigestHandle closes the hash pointer, and SKF_ECCSignData uses the hashed data to obtain the digital signature;

[0107] Step 8: Send the randomized data (target random number), digital signature, and digital certificate to the signature verification server to verify the validity and legitimacy of the certificate;

[0108] Step 9: Verification is successful. The user uses the device username and password to go through the platform account and password verification process;

[0109] Step 10: After logging into the platform, verify the consistency between the platform user name and the user name in devInfo. If they are inconsistent, proceed to step 11; otherwise, proceed to step 12.

[0110] Step 11; Clear the website information storage locations such as sessionStorage / localStorage / Cookie, return to the login page, and return to step 1;

[0111] Step 12, jump to the home page, trigger the route guard, which is registered by router.beforeEach. If the verification fails, the jump is blocked;

[0112] Step 13, get the devInfo stored in vuex to determine whether window.skf exists. If not, use the dynamic library name in devInfo to initialize the SKF object;

[0113] Step 14, pass the device handle in devInfo to call SKF_GetDevInfo to obtain device information. If the call interface fails, proceed to step 11. If successful, continue to compare the device serial number with devInfo to see if they are consistent. If they are inconsistent, proceed to step 11;

[0114] Step 15, axios registers the verification red list, such as the password modification interface, service.interceptors.request intercepts the request to verify the certificate. Verification is triggered when the user changes the password.

[0115] Step 16, go to step 13 again to obtain the SKF object, and then continue with steps 4 to 8 to verify the validity of the certificate. If the verification fails, go to step 11. If the verification succeeds, send the request normally. After logging into the platform, various operations will repeat steps 12 to 16 to effectively ensure user operation safety and information security.

[0116] The secure access system provided by the embodiment of the present application includes: a user end, a platform service end and a signature verification server; the user end is used to send a key authentication request to the platform service end when opening the cloud management platform access page to verify whether the user end has turned on the key authentication service; the platform service end is used to receive and respond to the key authentication request, and return the key dynamic library name to the user end when it is determined that the user end has turned on the key authentication service; the user end is used to perform key interface object initialization processing according to the key dynamic library name when obtaining the key dynamic library name, and call device information, public key and signature certificate from the identity authentication device inserted by the user end based on the key interface object; obtain the original random number from the signature verification server, perform a hash operation on the public key and the original random number to obtain a target random number, perform a signing operation on the target random number based on the private key to obtain a digital signature, and send the digital signature, signature certificate and target random number to the signature verification server; the signature verification server is used to verify the legitimacy of the signature certificate based on the digital signature, signature certificate and target random number, and when the signature certificate passes the legitimacy verification, the user end jumps to the user login page so that the user end can access the cloud management platform based on a legal identity. The system provided by the above solution verifies the legitimacy of the user's identity by combining key verification and login account authentication, ensuring the reliability of the identity security verification results and laying the foundation for improving the security of the cloud management platform. In addition, it also has the following advantages: it implements a configurable Ukey login strategy in combination with the server interface, adapts to a variety of Ukeys, and can turn off Ukey verification at any time. After Ukey verification is turned on, the user name input is disabled, and the device information is stored before logging in. After logging in, the platform user name and the device user name are compared to further ensure that the logged-in user is the Ukey user himself. Innovatively combined with the SKF library, combined with the routing guard, the device handle and the device serial number are used to detect the device connection status and device consistency in real time to ensure the user's own operation. If the Ukey is unplugged or replaced, the platform will automatically exit to ensure security. Pure front-end verification, fast response. Intercept high-risk requests before sending, verify the validity of the certificate and the correctness of the user again, and all are built-in operations, which will not affect the user experience. Scalability, the verification strength can be strengthened or weakened at any time according to the confidentiality level through the number / type of detection.

[0117] The embodiment of the present application provides a secure access method, which is applied to the user end of the secure access system provided in the above embodiment. The execution subject of the embodiment of the present application is an electronic device, such as a server, a desktop computer, a laptop computer, a tablet computer and other electronic devices that can be used as a user end.

[0118] like Figure 6 FIG. 1 is a flow chart of a secure access method provided by an embodiment of the present application, the method comprising:

[0119] Step 601, when opening the cloud management platform access page, a key authentication request is sent to the platform server; wherein, when the platform server determines that the user terminal has enabled the key authentication service, the platform server returns the key dynamic library name to the user terminal;

[0120] Step 602, when the key dynamic library name is obtained, the key interface object initialization process is performed according to the key dynamic library name;

[0121] Step 603, based on the key interface object, calling device information, public key and signature certificate from the identity authentication device inserted by the user end;

[0122] Step 604, obtain the original random number from the signature verification server, perform a hash operation on the public key and the original random number, and obtain a target random number;

[0123] Step 605: perform a signing operation on the target random number based on the private key to obtain a digital signature, and send the digital signature, the signature certificate and the target random number to the signature verification server; wherein the signature verification server verifies the legitimacy of the signature certificate based on the digital signature, the signature certificate and the target random number;

[0124] Step 606, when the signature certificate passes the legitimacy verification, jump to the user login page to access the cloud management platform based on the legal identity.

[0125] Regarding the secure access method in this embodiment, its specific method has been described in detail in the embodiment of the system, and will not be elaborated here.

[0126] The secure access method provided in the embodiment of the present application is applied to the secure access system provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0127] An embodiment of the present application provides a secure access device for executing the secure access method provided in the above embodiment.

[0128] like Figure 7 , which is a schematic diagram of the structure of a secure access device provided by an embodiment of the present application. The secure access device 70 comprises: a request module 701 , an object initialization module 702 , a call module 703 , a calculation module 704 , a verification module 705 and an access module 706 .

[0129] Among them, the request module is used to send a key authentication request to the platform server when opening the cloud management platform access page; wherein, the platform server returns the key dynamic library name to the user end when it is determined that the user end has turned on the key authentication service; the object initialization module is used to perform key interface object initialization processing according to the key dynamic library name when the key dynamic library name is obtained; the calling module is used to call device information, public key and signature certificate from the identity authentication device inserted by the user end based on the key interface object; the operation module is used to obtain the original random number from the signature verification server, perform hash operation on the public key and the original random number, and obtain the target random number; the verification module is used to sign the target random number based on the private key to obtain a digital signature, and send the digital signature, signature certificate and target random number to the signature verification server; wherein the signature verification server verifies the legitimacy of the signature certificate based on the digital signature, signature certificate and target random number; the access module is used to jump to the user login page when the signature certificate passes the legitimacy verification, so as to access the cloud management platform based on a legal identity.

[0130] Regarding the secure access device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0131] The secure access device provided in the embodiment of the present application is used to execute the secure access method provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0132] An embodiment of the present application provides an electronic device for executing the secure access method provided in the above embodiment.

[0133] like Figure 8 FIG. 8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 80 includes: at least one processor 81 and a memory 82.

[0134] The memory stores computer-executable instructions; at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the security access method provided in the above embodiment.

[0135] The electronic device provided in the embodiment of the present application is used to execute the secure access method provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0136] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the secure access method provided in any of the above embodiments is implemented.

[0137] The storage medium containing computer executable instructions provided in the embodiments of the present application can be used to store computer executable instructions of the secure access method provided in the aforementioned embodiments. The implementation method and principle are the same and will not be repeated here.

[0138] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0141] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0142] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A secure access system, characterized in that: include: User end, platform server and signature verification server; The user terminal is used to send a key authentication request to the platform server when opening the cloud management platform access page to verify whether the user terminal has turned on the key authentication service; The platform server is used to receive and respond to the key authentication request, and return the key dynamic library name to the user terminal when it is determined that the user terminal has turned on the key authentication service; The user end is used to perform key interface object initialization processing according to the key dynamic library name when obtaining the key dynamic library name, and call device information, public key and signature certificate from the identity authentication device inserted by the user end based on the key interface object; Obtain an original random number from the signature verification server, perform a hash operation on the public key and the original random number to obtain a target random number, perform a signing operation on the target random number based on the private key to obtain a digital signature, and send the digital signature, signature certificate and target random number to the signature verification server; The signature verification server is used to verify the legitimacy of the signature certificate based on the digital signature, signature certificate and target random number. If the signature certificate passes the legitimacy verification, the user terminal jumps to the user login page to enable the user terminal to access the cloud management platform based on a legal identity.

2. The system according to claim 1, characterized in that The user terminal is also used for: The device information is stored based on a storage plug-in so as to share the device information during access to the cloud management platform.

3. The system according to claim 1, characterized in that The system further comprises: The routing switching verification module is used to trigger a query request when the user terminal switches the cloud management platform access page to verify whether the identity authentication information of the user terminal remains legal.

4. The system according to claim 3, characterized in that The user terminal is also used for: In response to the query request triggered by the routing switching verification module, based on the key interface object, the device information is recalled from the identity authentication device inserted into the user end to obtain new device information, and the shared original device information is obtained from the storage plug-in; By comparing the new device information with the original device information, determining whether the new device information is consistent with the original device information, so as to verify whether the identity authentication information of the user terminal remains legal; Wherein, when the new device information is consistent with the original device information, it is determined that the identity authentication information of the user terminal remains legal.

5. The system according to claim 3, characterized in that The system further comprises: The interceptor is used to clear the currently visited page and jump to the user login page when it is determined that the identity authentication information of the user terminal is not legal.

6. The system according to claim 5, characterized in that The interceptor is also used to: During the process of the user terminal accessing the cloud management platform, if the user terminal initiates a sensitive request in the preset red list, a secondary identity authentication is performed on the user terminal; If the secondary identity authentication of the user terminal fails, the current access page is cleared and the page jumps to the user login page.

7. A secure access method, characterized in that: The method is applied to a user terminal, and the method comprises: When opening the cloud management platform access page, a key authentication request is sent to the platform server; wherein, when the platform server determines that the user terminal has turned on the key authentication service, the key dynamic library name is returned to the user terminal; When the key dynamic library name is obtained, performing key interface object initialization processing according to the key dynamic library name; Based on the key interface object, calling device information, public key and signature certificate from the identity authentication device inserted into the user end; Obtain an original random number from the signature verification server, perform a hash operation on the public key and the original random number to obtain a target random number; Performing a signing operation on the target random number based on the private key to obtain a digital signature, and sending the digital signature, the signature certificate and the target random number to the signature verification server; wherein the signature verification server verifies the legitimacy of the signature certificate based on the digital signature, the signature certificate and the target random number; When the signature certificate passes the legitimacy verification, the user is redirected to the user login page to access the cloud management platform based on a legal identity.

8. A secure access device, characterized in that: The device is applied to a user terminal, and the device includes: A request module, used to send a key authentication request to the platform server when opening the cloud management platform access page; wherein, the platform server returns the key dynamic library name to the user end when determining that the user end has turned on the key authentication service; An object initialization module, used for performing key interface object initialization processing according to the key dynamic library name when the key dynamic library name is obtained; A calling module, used to call device information, public key and signature certificate from the identity authentication device inserted into the user end based on the key interface object; The operation module is used to obtain the original random number from the signature verification server, perform a hash operation on the public key and the original random number, and obtain a target random number; A verification module, configured to perform a signing operation on the target random number based on a private key to obtain a digital signature, and send the digital signature, the signature certificate and the target random number to the signature verification server; wherein the signature verification server verifies the legitimacy of the signature certificate based on the digital signature, the signature certificate and the target random number; The access module is used to jump to the user login page when the signature certificate passes the legitimacy verification, so as to access the cloud management platform based on the legal identity.

9. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-implemented instructions stored in the memory, so that the at least one processor performs the method of claim 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to claim 7 is implemented.

Images