Standard password channel cross-platform password-free login method and system based on UKey

Abstract

The invention discloses a national password channel cross-platform password-free login method and system based on a UKey, and relates to the technical field of network security communication, and the method comprises the steps: verifying UKey login, obtaining a UKey serial number, and encrypting the UKey serial number; the secret management platform decrypts the UKey serial number and verifies the UKey serial number, and generates a session ID and a random number after the UKey serial number is verified to be qualified; signing the random number, obtaining and encrypting network information and hardware information of the current equipment, calling a secret management platform to obtain a UKey serial number through a session ID, extracting a UKey certificate, and verifying a signature value; the dense management platform generates a login authorization code, decrypts the network information and the hardware information and then judges whether the operation is a common environment operation, if the operation is a non-common environment operation, double password verification is triggered, and otherwise, the login authorization code is returned to the CPCS system rear end; and the back end of the CPCS system carries out SM2 private key signature on the URL address parameter, the address signature value is spliced into the URL address of the dense management platform, the dense management platform is called to carry out SM2 public key signature verification on the URL address parameter, and a page token is generated.

Description

Technical Field

[0001] The present invention relates to the field of network security communication technology, and more specifically to a cross-platform password-free login method and system based on UKey national secret channel. Background Art

[0002] With the rapid development of information technology, cloud-native technology has been widely used. Many enterprises and institutions have migrated their businesses to cloud platforms. Various cloud-native vendors have provided a variety of password platform pages for users to access. However, there are many problems in cross-platform login.

[0003] At present, most traditional login methods rely on a combination of username and password. This method not only requires users to remember multiple complex passwords, which is prone to forgetting or misremembering, but also has security risks, such as passwords being stolen and subjected to brute force cracking. At the same time, the password platforms of different cloud native vendors lack a unified secure password-free login docking mechanism, making it cumbersome and inefficient for users to access across platforms, and unable to log in to different platforms conveniently and securely to obtain corresponding services. In addition, although hardware security devices such as UKEY have been used for identity authentication in some fields, they have not yet been fully integrated into the cross-platform password-free login process, making it difficult to meet the login needs of both convenience and security in the current cloud environment.

[0004] Therefore, how to provide a cross-platform password-free login method and system for the national secret channel based on UKey is a problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of this, the present invention provides a UKey-based national secret channel cross-platform password-free login method and system, which can realize cross-platform password-free login operation. In actual work scenarios, employees do not need to repeatedly enter cumbersome passwords between different platforms, which greatly improves work efficiency. At the same time, the login method based on certificates and UKey also greatly improves security.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A cross-platform password-free login method for national secret channels based on UKey, comprising:

[0008] The CPCS system front end verifies the UKey login and obtains the UKey serial number after verification. The CPCS system back end encrypts the UKey serial number using the SM2 public key of the key management platform.

[0009] The key management platform decrypts the UKey serial number using the key management platform SM2 private key and verifies it. After the verification is qualified, it generates a session ID and a random number.

[0010] The CPCS system front end signs the random number by calling the UKey control signature method to obtain the network information and hardware information of the current device. The CPCS system back end encrypts the signature value, network information and hardware information through the SM2 public key of the key management platform and then calls the key management platform. The key management platform obtains the UKey serial number through the session ID, extracts the UKey certificate, and verifies the signature value.

[0011] After the signature verification is passed, the key management platform generates a login authorization code. After the network information and hardware information are decrypted by the key management platform SM2 private key, it is determined whether it is a common environment operation. If it is a non-common environment, double password verification is triggered. Otherwise, the login authorization code is returned to the CPCS system backend;

[0012] The CPCS system backend performs SM2 private key signature on the URL address parameters, splices the address signature value into the URL address of the key management platform, calls the key management platform to perform SM2 public key signature verification on the URL address parameters, and generates a page token.

[0013] Preferably, the UKey login is verified through the CPCS system front end, specifically including:

[0014] Insert the UKey device, enter the UKey password, and call UKey to verify the UKey password. If the UKey password fails to be entered more than five times, the UKey will be locked for ten minutes. If it fails more than fifteen times, the certificate will be cleared.

[0015] Preferably, whether it is a common environment is determined according to the Bayesian model, and the specific process is as follows:

[0016] Get features from hardware information and network information;

[0017] Calculate the prior probability of the commonly used environment of historical data and the prior probability of the uncommon environment of historical data in the statistical historical data;

[0018] For each feature, calculate the probability of the feature appearing in common environments and uncommon environments;

[0019] The probability of all feature combinations in common environments is calculated based on the probability of each feature appearing in common environments, and the probability of all feature combinations in uncommon environments is calculated based on the probability of each feature appearing in uncommon environments;

[0020] Calculate the posterior probability of common environments and the posterior probability of uncommon environments based on the prior probability of common environments in historical data, the prior probability of uncommon environments in historical data, the probability of all feature combinations in common environments, and the probability of all feature combinations in uncommon environments;

[0021] Compare whether the posterior probability of the commonly used environment is greater than or equal to the posterior probability of the uncommon environment. If so, it is a commonly used environment, otherwise it is an uncommon environment.

[0022] Preferably, the double password verification includes:

[0023] Enter the user password. The CPCS system backend will encrypt the user password through the SM2 public key of the key management platform.

[0024] After receiving the encrypted user password, the key management platform decrypts it using the key management platform SM2 private key and verifies whether the user password is consistent with the stored user hash password.

[0025] Preferably, it also includes:

[0026] A user configures multiple certificates, including primary certificates and backup certificates. When the UKey is lost and the UKey configured with the backup certificate is enabled, the primary certificate automatically becomes invalid:

[0027] When a UKey device with a backup certificate is inserted for logging in, the key management platform determines that the current UKey is configured with a backup certificate and invalidates the primary certificate.

[0028] A cross-platform password-free login system based on UKey, including:

[0029] Login verification module: The CPCS system front end verifies the UKey login and obtains the UKey serial number after the verification. The CPCS system back end encrypts the UKey serial number through the SM2 public key of the key management platform;

[0030] Serial number verification module: The key management platform decrypts the UKey serial number through the key management platform SM2 private key and verifies it. After the verification is qualified, the session ID and random number are generated;

[0031] Signature verification module: The CPCS system front-end signs the random number by calling the UKey control signature method to obtain the network information and hardware information of the current device. The CPCS system back-end encrypts the signature value, network information and hardware information through the SM2 public key of the key management platform and calls the key management platform. The key management platform obtains the UKey serial number through the session ID, extracts the UKey certificate, and verifies the signature value;

[0032] Authorization code generation module: After the signature verification is passed, the key management platform generates a login authorization code. After decrypting the network information and hardware information through the key management platform SM2 private key, it determines whether it is a common environment operation. If it is a non-common environment, double password verification is triggered. Otherwise, the login authorization code is returned to the CPCS system backend;

[0033] Page token acquisition module: The CPCS system backend performs SM2 private key signature on the URL address parameter, splices the address signature value into the URL address of the key management platform, calls the key management platform to perform SM2 public key signature verification on the URL address parameter, and generates a page token.

[0034] Preferably, the UKey login is verified through the CPCS system front end, specifically including:

[0035] Insert the UKey device, enter the UKey password, and call UKey to verify the UKey password. If the UKey password fails to be entered more than five times, the UKey will be locked for ten minutes. If it fails more than fifteen times, the certificate will be cleared.

[0036] Preferably, whether it is a common environment is determined according to the Bayesian model, and the specific process is as follows:

[0037] Get features from hardware information and network information;

[0038] Calculate the prior probability of the commonly used environment of historical data and the prior probability of the uncommon environment of historical data in the statistical historical data;

[0039] For each feature, calculate the probability of the feature appearing in common environments and uncommon environments;

[0040] The probability of all feature combinations in common environments is calculated based on the probability of each feature appearing in common environments, and the probability of all feature combinations in uncommon environments is calculated based on the probability of each feature appearing in uncommon environments;

[0041] Calculate the posterior probability of common environments and the posterior probability of uncommon environments based on the prior probability of common environments in historical data, the prior probability of uncommon environments in historical data, the probability of all feature combinations in common environments, and the probability of all feature combinations in uncommon environments;

[0042] Compare whether the posterior probability of the commonly used environment is greater than or equal to the posterior probability of the uncommon environment. If so, it is a commonly used environment, otherwise it is an uncommon environment.

[0043] Preferably, the double password verification includes:

[0044] Enter the user password. The CPCS system backend will encrypt the user password using the public key of the SM2 algorithm of the key management platform.

[0045] After receiving the encrypted user password, the key management platform decrypts it using the key management platform SM2 private key and verifies whether the user password is consistent with the stored user hash password.

[0046] Preferably, it also includes:

[0047] A user configures multiple certificates, including primary certificates and backup certificates. When the UKey is lost and the UKey configured with the backup certificate is enabled, the primary certificate automatically becomes invalid:

[0048] When a UKey device with a backup certificate is inserted for logging in, the key management platform determines that the current UKey is configured with a backup certificate and invalidates the primary certificate.

[0049] It can be seen from the above technical solution that, compared with the prior art, the present invention discloses a cross-platform password-free login method and system based on UKey national secret channel, which has the following advantages:

[0050] 1) The password platform page can be quickly connected to the cloud vendor page to ensure smooth application in diverse cross-platform environments such as different operating systems and different cloud service architectures, thereby achieving decoupling of business platform functions and password-free login.

[0051] 2) Use national secret channels to further ensure data transmission security.

[0052] 3) Innovative use of machine learning algorithms to judge common environments, further ensure security, and improve the reliability of identity authentication.

[0053] 4) The control adds processing logic after password input fails, providing a solution to password blasting

[0054] 5) Provide a primary and backup certificate solution. When the backup certificate is enabled, the primary certificate will automatically become invalid, which can deal with the possibility of identity fraud caused by the loss of UKey. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0056] Figure 1 A flow chart of a cross-platform password-free login method for a national secret channel based on UKey provided by the present invention.

[0057] Figure 2 A schematic diagram of a cross-platform password-free login system for a national secret channel based on UKey provided by the present invention. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] The embodiment of the present invention discloses a cross-platform password-free login method based on a national secret channel of UKey, wherein UKey is a hardware device for identity authentication, which usually needs to be inserted and a password is input for operation. In the present invention, it is mainly used for identity authentication of cross-platform secure login. The interaction between data is based on the SSL / TLS protocol of the national standard SM2 algorithm of elliptic curve cryptography (ECC). The SM2 algorithm is used in the SSL / TLS protocol to realize encrypted communication of a two-way channel, which is mainly used to ensure the security and reliability of data during transmission, such as Figure 1 As shown, including:

[0060] (1) Before users log in using UKey, they need to install the UKey control in the user browser. Then, they need to import the certificate into UKey through the UKey control and configure the certificate for the corresponding user on the key management platform. The key management platform will generate the SM2 key pair after the deployment is completed.

[0061] (2) The CPCS system front end verifies the UKey login, obtains the UKey serial number after verification, and sends the UKey serial number to the CPCS system back end. The CPCS (Cloud Platform Cryptosystem Service) system back end encrypts the UKey serial number using the SM2 public key of the cryptographic management platform and sends it to the cryptographic management platform after encryption.

[0062] (3) The secret management platform decrypts the UKey serial number through the secret management platform SM2 private key and verifies whether the serial number is legal. After the verification is qualified, the session ID and random number are generated, wherein the session ID is bound to the UKey serial number and the random number. The secret management platform generates a random number and returns it to the CPCS system backend, and then returns it to the CPCS system frontend through the CPCS system backend, and stores the session information in Redis (including validity period verification). The present invention identifies the user login session by generating a session ID and verifies whether the session ID is valid, which can ensure the legitimacy and security of the login session. The session ID is used to identify the unique identifier of the user login session.

[0063] (4) The CPCS system front end signs the random number by calling the UKey control signature method, obtains the network information and hardware information of the current device, and sends the signature value, network information and hardware information to the CPCS system back end. The CPCS system back end encrypts the signature value, network information and hardware information through the SM2 public key of the key management platform and calls the UKey login interface of the key management platform. The key management platform obtains the UKey serial number through the session ID, extracts the UKey certificate, and verifies the signature value; among them, the network information includes IP and MAC address, and the hardware information includes device fingerprint, etc.

[0064] (5) After the signature verification is passed, the key management platform calls the dynamic token service to generate a one-time login authorization code. After decrypting the network information and hardware information through the key management platform SM2 private key, it determines whether it is a common environment operation. If it is a non-common environment, it triggers double password verification. Otherwise, the key management platform returns the login authorization code after verification, and splices the login authorization code into the key management platform URL, and the user automatically jumps to the platform page; the present invention generates a one-time dynamic password based on time or event, which is used in the present invention to generate a login authorization code after the signature verification is passed, thereby ensuring the uniqueness, reliability and security of the authorization code.

[0065] (6) The CPCS system front end calls the CPCS system back end to perform SM2 private key signing. Specifically, the CPCS system back end splices the login authorization code returned by the key management platform to the URL address of the key management platform, and then signs the entire URL address using the CPCS system back end's own SM2 private key. After obtaining a signature value, it is spliced ​​to the URL address and then returned to the CPCS system front end. The CPCS system front end accesses the key management platform address. After receiving the request, the key management platform verifies whether the login authorization code is valid and uses the CPCS system back end SM2 public key to perform public key verification on the URL address parameters. The verification is performed by generating a key management platform page token, which is a credential used for identity authentication and authorization.

[0066] The user brings the token to access the key management platform and completes the login process.

[0067] All business calls of the present invention are uniformly carried out using the national secret channel. In the present invention, the national secret channel is constructed based on openSSL and the national secret algorithm. The RSA encryption method is commonly used in traditional SSL. Different from it, the present invention uses the SM2 encryption algorithm, which can play an important role in the data transmission process and further enhance the security of data transmission. In addition, for the CPCS system backend and the secret management platform, it is necessary to complete the configuration of the national secret certificate, the purpose of which is to realize SSL two-way authentication.

[0068] In this embodiment, the secret management platform determines whether it is a common environment based on the Bayesian model. The specific process is as follows:

[0069] 1) Select feature information. The features in the device hardware information and network information mainly include: IP address, MAC address, network connection name, CPU name and main frequency, system total memory, system hard disk information, and motherboard information.

[0070] 2) Common environments in statistical historical data and unusual environments The prior probability of historical data is commonly used in the environment prior probability. , historical data is not a priori probability of the environment 、The number of logins in common environments is , the number of logins in the non-common environment is , the total number of logins is A.

[0071]

[0072] When there is no prior knowledge about the “common environment” and the “uncommon environment”, the uninformative prior assumption in Bayesian estimation can be used. A common method is to use a uniform distribution as the prior probability distribution, that is, .

[0073] 3) For each feature , respectively calculate the probability of the feature appearing in the "common environment" and "uncommon environment". The number of times is , unusual environment The number of times is .

[0074]

[0075] When logging in for the first time, set the initial assumptions based on Laplace smoothing. ,in, Indicates features in common environments The probability of occurrence, Indicates features in unusual environments Probability of occurrence.

[0076] 4) Calculation of common environments and unusual environments The posterior probability is first calculated in the common environment Current feature combination Probability , n is the number of features:

[0077]

[0078] Computing in an unusual environment Current feature combination Probability :

[0079]

[0080] Then calculate the common environment posterior probability and the posterior probability of the uncommon environment :

[0081]

[0082] Among them, the value of k is 1 or 2.

[0083] 5) Finally, compare the posterior probabilities of commonly used environments and the posterior probability of the uncommon environment Size, if Greater than or equal to , then it is a common environment, if it is less than, then it is an uncommon environment. Subsequently, the prior probability is dynamically updated according to the number of common environments and uncommon environments.

[0084] If it is determined to be an uncommon environment, the user needs to enter the user password for double verification, and then set the environment as a common environment. If it is a common environment, the password management platform generates a unique login authorization code by calling the dynamic token service. Double password verification specifically includes:

[0085] In an unusual environment, the front-end page of the CPCS system will prompt the user to enter the user password. After the user enters the user password, the CPCS system back-end will encrypt the user password through the public key of the SM2 algorithm of the key management platform. After receiving the encrypted user password, the key management platform will decrypt it through the private key of the SM2 algorithm of the key management platform, and then verify whether the password entered by the user is consistent with the stored user hash password through PBKDF2 (a password derivation function used to securely store passwords through multiple hashes).

[0086] The present invention is based on Bayesian theorem and uses Bayesian model to judge the commonly used login environment. It collects multi-dimensional data such as network information (such as IP address, network name), hardware information (such as device model, serial number) during historical login as features, calculates the probability of each feature appearing in commonly used and uncommon environments, constructs a Bayesian model, assists in password-free login decision-making, and improves security and convenience.

[0087] In this embodiment, a user can configure multiple certificates, and the certificates have the concept of primary and backup. The primary and backup certificate types are automatically selected when the user imports the certificate. The user initially uses the UKey configured with the primary certificate for password-free login. When the UKey configured with the backup certificate is used to log in, it is assumed that the UKey is lost. Specifically, when the UKey is lost and the UKey configured with the backup certificate is enabled, the primary certificate automatically becomes invalid. When logging in with the UKey device with the backup certificate inserted, the key management platform determines that the current UKey is configured with a backup certificate, and the primary UKey will be invalidated.

[0088] The present invention can be applied in many fields, for example:

[0089] Application areas of this patent

[0090] 1. Enterprise-level cloud service platform

[0091] In various cloud service platforms used within the enterprise, employees need to frequently log in to different cloud application systems. Through the cross-platform secure password-free login method based on UKey, employees only need to insert UKey and enter the password to quickly and securely log in to the password platform page of each cloud native vendor, without having to remember multiple complex passwords, which improves work efficiency and enhances the security of enterprise data. For example, the enterprise's financial cloud system, human resources cloud system, etc. can use this login method to ensure that sensitive business data is not illegally accessed.

[0092] 2. Financial Technology

[0093] When conducting online business, financial institutions such as banks and securities companies involve a large number of user fund transactions and sensitive information interactions. This patented technology can be applied to the customer login system of financial institutions and the internal employee operation platform. For customers, using UKey for cross-platform secure password-free login can effectively prevent account theft and fund theft; for internal employees of financial institutions, when operating core business systems, this secure login method can ensure the confidentiality, integrity and non-repudiation of financial transaction data, and meet the strict security supervision requirements of the financial industry.

[0094] 3. Government Cloud Platform

[0095] In the process of promoting the construction of digital government affairs, many government affairs application systems are deployed on cloud platforms. The login method of the present invention can be used for unified identity authentication of government affairs cloud platforms. When government workers handle government affairs documents, citizen information management and other tasks, they can log in securely and without passwords through UKey, which can not only access different government affairs systems conveniently and quickly, but also prevent government affairs data leakage, protect state secrets and citizen privacy, and improve the security and convenience of government affairs services.

[0096] IV. Medical Information System

[0097] In the medical industry, the hospital's internal information management systems (such as HIS, LIS, PACS, etc.) and regional medical information sharing platforms involve a large amount of patient privacy information. When medical staff, managers, and authorized medical researchers access these systems, they can use UKey-based cross-platform secure password-free login technology to ensure that only legally authorized personnel can log in to the system, prevent patient information from being illegally obtained and abused, and ensure the security of medical data and the normal development of medical services.

[0098] The embodiment of the present invention discloses a cross-platform password-free login system based on UKey national secret channel, such as Figure 2 As shown, including:

[0099] Login verification module: The CPCS system front end verifies the UKey login and obtains the UKey serial number after the verification. The CPCS system back end encrypts the UKey serial number through the SM2 public key of the key management platform;

[0100] Serial number verification module: The key management platform decrypts the UKey serial number through the key management platform SM2 private key and verifies it. After the verification is qualified, the session ID and random number are generated;

[0101] Signature verification module: The CPCS system front-end signs the random number by calling the UKey control signature method to obtain the network information and hardware information of the current device. The CPCS system back-end encrypts the signature value, network information and hardware information through the SM2 public key of the key management platform and calls the key management platform. The key management platform obtains the UKey serial number through the session ID, extracts the UKey certificate, and verifies the signature value;

[0102] Authorization code generation module: After the signature verification is passed, the key management platform generates a login authorization code. After decrypting the network information and hardware information through the key management platform SM2 private key, it determines whether it is a common environment operation. If it is a non-common environment, double password verification is triggered. Otherwise, the login authorization code is returned to the CPCS system backend;

[0103] Page token acquisition module: The CPCS system backend performs SM2 private key signature on the URL address parameter, splices the address signature value into the URL address of the key management platform, calls the key management platform to perform SM2 public key signature verification on the URL address parameter, and generates a page token.

[0104] The specific details of the system of the present invention are consistent with the above method and will not be repeated here. Please refer to the method section.

[0105] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0106] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cross-platform password-free login method based on UKey national secret channel, characterized in that: include: The CPCS system front end verifies the UKey login and obtains the UKey serial number after verification. The CPCS system back end encrypts the UKey serial number through the SM2 public key of the key management platform. The key management platform decrypts the UKey serial number using the key management platform SM2 private key and verifies it. After the verification is qualified, it generates a session ID and a random number. The CPCS system front end signs the random number by calling the UKey control signature method to obtain the network information and hardware information of the current device. The CPCS system back end encrypts the signature value, network information and hardware information through the SM2 public key of the key management platform and then calls the key management platform. The key management platform obtains the UKey serial number through the session ID, extracts the UKey certificate, and verifies the signature value. After the signature verification is passed, the key management platform generates a login authorization code. After the network information and hardware information are decrypted by the key management platform SM2 private key, it is determined whether it is a common environment operation. If it is a non-common environment, double password verification is triggered. Otherwise, the login authorization code is returned to the CPCS system backend; The CPCS system backend performs SM2 private key signature on the URL address parameters, splices the address signature value into the URL address of the key management platform, calls the key management platform to perform SM2 public key signature verification on the URL address parameters, and generates a page token.

2. According to claim 1, a UKey-based national secret channel cross-platform password-free login method is characterized in that: Verify UKey login through CPCS system front-end, including: Insert the UKey device, enter the UKey password, and call UKey to verify the UKey password. If the UKey password fails to be entered more than five times, the UKey will be locked for ten minutes. If it fails more than fifteen times, the certificate will be cleared.

3. According to claim 1, a UKey-based national secret channel cross-platform password-free login method is characterized in that: According to the Bayesian model, whether it is a common environment is determined. The specific process is as follows: Get features from hardware information and network information; Calculate the prior probability of the commonly used environment of historical data and the prior probability of the uncommon environment of historical data in the statistical historical data; For each feature, calculate the probability of the feature appearing in common environments and uncommon environments; The probability of all feature combinations in common environments is calculated based on the probability of each feature appearing in common environments, and the probability of all feature combinations in uncommon environments is calculated based on the probability of each feature appearing in uncommon environments; Calculate the posterior probability of common environments and the posterior probability of uncommon environments based on the prior probability of common environments in historical data, the prior probability of uncommon environments in historical data, the probability of all feature combinations in common environments, and the probability of all feature combinations in uncommon environments; Compare whether the posterior probability of the commonly used environment is greater than or equal to the posterior probability of the uncommon environment. If so, it is a commonly used environment, otherwise it is an uncommon environment.

4. According to claim 3, a UKey-based national secret channel cross-platform password-free login method is characterized in that: Two-factor password verification includes: Enter the user password. The CPCS system backend will encrypt the user password through the SM2 public key of the key management platform. After receiving the encrypted user password, the key management platform decrypts it using the key management platform SM2 private key and verifies whether the user password is consistent with the stored user hash password.

5. According to claim 1, a UKey-based national secret channel cross-platform password-free login method is characterized in that: Also includes: A user configures multiple certificates, including primary certificates and backup certificates. When the UKey is lost and the UKey configured with the backup certificate is enabled, the primary certificate automatically becomes invalid: When a UKey device with a backup certificate is inserted for logging in, the key management platform determines that the current UKey is configured with a backup certificate and invalidates the primary certificate.

6. A cross-platform password-free login system based on UKey, characterized in that: include: Login verification module: The CPCS system front end verifies the UKey login and obtains the UKey serial number after the verification. The CPCS system back end encrypts the UKey serial number through the SM2 public key of the key management platform; Serial number verification module: The key management platform decrypts the UKey serial number through the key management platform SM2 private key and verifies it. After the verification is qualified, the session ID and random number are generated; Signature verification module: The CPCS system front-end signs the random number by calling the UKey control signature method to obtain the network information and hardware information of the current device. The CPCS system back-end encrypts the signature value, network information and hardware information through the SM2 public key of the key management platform and calls the key management platform. The key management platform obtains the UKey serial number through the session ID, extracts the UKey certificate, and verifies the signature value; Authorization code generation module: After the signature verification is passed, the key management platform generates a login authorization code. After decrypting the network information and hardware information through the key management platform SM2 private key, it determines whether it is a common environment operation. If it is a non-common environment, double password verification is triggered. Otherwise, the login authorization code is returned to the CPCS system backend; Page token acquisition module: The CPCS system backend performs SM2 private key signature on the URL address parameter, splices the address signature value into the URL address of the key management platform, calls the key management platform to perform SM2 public key signature verification on the URL address parameter, and generates a page token.

7. According to claim 6, a UKey-based national secret channel cross-platform password-free login system is characterized in that: Verify UKey login through CPCS system front-end, including: Insert the UKey device, enter the UKey password, and call UKey to verify the UKey password. If the UKey password fails to be entered more than five times, the UKey will be locked for ten minutes. If it fails more than fifteen times, the certificate will be cleared.

8. According to claim 6, a UKey-based national secret channel cross-platform password-free login system is characterized in that: According to the Bayesian model, whether it is a common environment is determined. The specific process is as follows: Get features from hardware information and network information; Calculate the prior probability of the commonly used environment of historical data and the prior probability of the uncommon environment of historical data in the statistical historical data; For each feature, calculate the probability of the feature appearing in common environments and uncommon environments; The probability of all feature combinations in common environments is calculated based on the probability of each feature appearing in common environments, and the probability of all feature combinations in uncommon environments is calculated based on the probability of each feature appearing in uncommon environments; Calculate the posterior probability of common environments and the posterior probability of uncommon environments based on the prior probability of common environments in historical data, the prior probability of uncommon environments in historical data, the probability of all feature combinations in common environments, and the probability of all feature combinations in uncommon environments; Compare whether the posterior probability of the commonly used environment is greater than or equal to the posterior probability of the uncommon environment. If so, it is a commonly used environment, otherwise it is an uncommon environment.

9. According to claim 8, a UKey-based national secret channel cross-platform password-free login system is characterized in that: Two-factor password verification includes: Enter the user password. The CPCS system backend will encrypt the user password using the public key of the SM2 algorithm of the key management platform. After receiving the encrypted user password, the key management platform decrypts it using the key management platform SM2 private key and verifies whether the user password is consistent with the stored user hash password.

10. According to claim 6, a UKey-based national secret channel cross-platform password-free login method is characterized in that: Also includes: A user configures multiple certificates, including primary certificates and backup certificates. When the UKey is lost and the UKey configured with the backup certificate is enabled, the primary certificate automatically becomes invalid: When a UKey device with a backup certificate is inserted for logging in, the key management platform determines that the current UKey is configured with a backup certificate and invalidates the primary certificate.

Images