User identity verification method

Abstract

The invention provides a user identity authentication method, which belongs to the technical field of computers, and realizes the protection of user passwords and avoids the risk of password leakage by encrypting the passwords input by a user and storing the passwords in an identity authentication database. Meanwhile, through interaction with the server, verification of the identity of the user is achieved, and the accuracy and efficiency of identity verification are improved. By using the random code, the security bill and the key pair in the application certificate of the target application, automatic processing of identity verification and login operation of the target application is realized.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a user identity authentication method. Background Art

[0002] With the advancement of information technology, the management of daily work has gradually shifted to informatization and digitization, and desktop C / S application systems have been widely used in various occasions.

[0003] In the prior art, people often need to log in to various desktop C / S application systems (such as financial systems, attendance systems, ERP systems, OA systems, instant messaging systems, etc.) when using computers. Users usually log in to C / S applications by entering a combination of an account number and a password. With the increase in the number of enterprise application systems, the number of accounts and passwords that users need to remember is also increasing, which adds an extra burden to users. Moreover, in recent years, in order to enhance the awareness of enterprise information security, passwords are usually required to contain uppercase and lowercase letters, numbers, special characters, and be long enough, which makes it more difficult to remember passwords. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a user identity authentication method to realize automatic login of an application system. This method realizes automatic processing of identity authentication and login operations of a target application by utilizing a random code and a security ticket, as well as a key pair in an application certificate of the target application.

[0005] The technical solution of the present invention is:

[0006] A user identity verification method comprises the following steps:

[0007] 1) The security client receives the parameters to be verified sent by the target application, including signature information and a first public key. The signature information is generated and sent by the target application in response to the first startup operation, after the random code is signed using the first private key. The first private key and the first public key are a pair of keys stored in the application certificate of the target application.

[0008] 2) When the security client verifies the signature information using the first public key, it generates a security ticket based on the random code and returns the security ticket to the target application.

[0009] 3) The target application sends the security ticket and random code to the IDP service. After the IDP service verifies the security ticket based on the random code, it obtains the login credentials sent by the IDP service.

[0010] 4) The security client performs a login operation based on the login credentials.

[0011] Among them, the step of the security client generating a security ticket based on the random code may include: the security client uses the second public key to encrypt the random code to generate a security ticket; after receiving the security ticket, the IDP service uses the second private key to decrypt the security ticket, and when the random code sent by the verification target application is consistent with the decrypted random code, it is determined that the security ticket verification has passed. In addition, after the identity authentication is passed, the security client can receive a token sent by the IDP service, and encrypt the random code and the token together to generate a security ticket. After receiving the security ticket, the IDP service uses the second private key to decrypt the security ticket, and when the random code sent by the verification target application is consistent with the decrypted random code, and the decrypted token is valid, it is determined that the security ticket verification has passed.

[0012] In addition, the present invention also provides a user identity verification device for executing the above method, comprising a receiving unit, a transmission unit and a determination unit.

[0013] The receiving unit is used to receive the JSon network token sent by the user through the portal center. The JSon network token is a token that is determined to be valid and has passed the verification by the front end. After receiving the token, the receiving unit passes it to the transmission unit.

[0014] After receiving the JSon network token, the transmission unit transmits it to the backend server. If the JSon network token is not empty and passes the verification, the transmission unit sends the token to the backend server.

[0015] The determination unit is used to parse the JSON network token to obtain the user's personal identity information, and determine the user's authentication result based on the user's personal identity information. The parsing process may include obtaining the user's personal identity information based on the attribute value.

[0016] Furthermore,

[0017] The JSON network token is pre-encrypted by the backend server using a private key.

[0018] When the transmission unit determines that the JSon network token is not empty and passes the verification at the front end, the JSon network token is stored in the header file and the header file is sent to the back-end server. The determination unit obtains the user's personal identity information according to the attribute value, and determines the user's identity authentication result according to the user's personal identity information.

[0019] Furthermore,

[0020] When the transmission unit determines that the JSon network token is not empty and passes the verification at the front end, it sends the data acquisition request and the JSon network token to the back-end server. After verifying that the user's identity authentication is passed, the return unit determines the data of the business item requested by the user according to the data acquisition request, and returns the data of the business item to the front end of the microservice center.

[0021] The beneficial effects of the present invention are

[0022] 1. Reduce the burden on users: Users only need to log in once to access all C / S application systems, reducing the workload of remembering and entering passwords.

[0023] 2. Improve security: Use secure clients for identity authentication to ensure the security, integrity and authenticity of user identity information.

[0024] 3. Improve user experience: It is more convenient and quick for users to log into the C / S application system, which improves user work efficiency.

[0025] 4. Strong scalability: The solution can be seamlessly integrated with the existing C / S architecture and is suitable for various application systems.

[0026] By encrypting the password input by the user and storing it in the identity authentication database, the user password is protected and the risk of password leakage is avoided. At the same time, through interaction with the server, the user identity is verified, and the accuracy and efficiency of identity authentication are improved. In addition, the invention also has the advantages of high security, high availability, high scalability and high convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram of a login page of the present invention;

[0028] Figure 2 is a schematic diagram of an application login device;

[0029] Figure 3 This is a diagram of successful login;

[0030] Figure 4 This is a schematic diagram of a login failure;

[0031] Figure 5 It is a schematic diagram of computer equipment. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0033] The abbreviations and key terms appearing in this application are explained as follows:

[0034] C / S: Client / Server structure is a classic architecture of application systems, consisting of a server system and multiple clients. The server is responsible for storing data and providing communication interfaces, while the client provides a user interface. Users can connect to the server through the client and operate the data stored on the server.

[0035] Office mode: refers to a new office mode, which is to conduct office work through the unified identity authentication standards and interfaces provided by the application system.

[0036] In the prior art, people often need to log in to various desktop C / S application systems (such as financial systems, attendance systems, ERP systems, OA systems, instant messaging systems, etc.) when using computers. Users usually log in to C / S applications by entering a combination of an account number and a password. With the increase in the number of enterprise application systems, the number of accounts and passwords that users need to remember is also increasing, which adds an extra burden to users. Moreover, in recent years, in order to enhance the awareness of enterprise information security, passwords are usually required to contain uppercase and lowercase letters, numbers, special characters, and be long enough, which makes it more difficult to remember passwords.

[0037] This application proposes a new way of working, which uses a unified identity authentication standard and interface to achieve one-time login to access all C / S applications. Specifically, the user only needs to enter the account and password in a login interface, and then complete the login process by clicking the login button. Then, the user can automatically log in to all C / S application systems through the security client without having to enter the account and password again.

[0038] To achieve this goal, this application provides an identity provider (IDP) that is responsible for uniformly storing user accounts and passwords. When the user enters the account and password on the login interface, the security client sends an authentication request to the IDP. The IDP verifies the user's identity and generates an identity token (Token). The security client encrypts and signs the token using algorithms such as MD5, SHA1, and HMAC to ensure the security, integrity, and authenticity of the token. The security client then sends the encrypted and signed token to each C / S application system for login.

[0039] In this way, users only need to remember one account and password to easily access all C / S application systems, which greatly reduces the burden on users. At the same time, the security of the identity authentication process is ensured by using a secure client and encryption algorithm. In the prior art, users need to frequently log in to various C / S application systems when using computers, such as financial systems, attendance systems, ERP systems, OA systems, and instant messaging systems. Users usually need to enter their account and password on the login interface of each application system, and then click the login button to complete the login process.

[0040] The present invention is based on the existing C / S architecture and introduces a security client into the C / S application system. The security client includes a special security process, provides an automated login process for users, and ensures the data security, integrity and authenticity of the login process.

[0041] Users only need to log in once to get access to all C / S application systems. In specific implementation, users first log in using a secure client, which communicates with the server and sends the user account and password to the server for identity authentication. The server verifies the user account and password with the identity provider (IDP) to ensure that the user's identity information is legal. After successful verification, the server generates a Token and returns the Token to the secure client.

[0042] When a user needs to access the C / S application system, the user opens the interface of the C / S application system and selects the login method as "Secure Client Login". The C / S application system sends the user's identity information to the secure client, which signs the identity information using the Token and the user account. The signed identity information is sent to the server through the network for verification. The server receives the signed identity information and uses the user account and Token for identity authentication. After the verification is passed, the server will allow the user to access the C / S application system.

[0043] The methods in the embodiments provided in the present application can be implemented by computer program instruction hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executing the computer program, the various method steps described in the embodiments can be included. References to memory, database or other media can include at least one of non-volatile memory and volatile memory.

[0044] The non-volatile memory may be ROM, magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, ReRAM, MRAM, FRAM, PCM, graphene memory, etc. The volatile memory may be RAM or external cache memory, etc. The RAM may be SRAM or DRAM, etc. The database may be a relational database or a non-relational database, including a distributed database based on blockchain, etc.

[0045] The processor can be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, etc.

[0046] The methods in the embodiments provided in the present application may be implemented by computer programs and related hardware, and may be applied to different types of storage media, databases, and processors.

[0047] The above description is only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, and is not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A user identity authentication method, characterized in that: The following steps are involved: 1) The security client receives the parameter to be verified sent by the target application, where the parameter to be verified includes signature information and a first public key; the signature information is generated and sent by the target application after signing the random code using the first private key when responding to the first startup operation; 2) The security client uses the first public key to verify whether the signature information has passed the verification; if the verification passes, the security client generates a security ticket based on the random code and returns the security ticket to the target application; 3) The target application sends the security ticket and random code to the IDP service; after the IDP service verifies the security ticket based on the random code, the IDP service obtains and sends the login credentials; 4) The security client performs a login operation based on the login credentials.

2. The method according to claim 1, characterized in that The first private key and the first public key are a pair of keys stored in the application certificate of the target application.

3. The method according to claim 1, It is characterized in that The step of the security client generating a security ticket based on the random code may include: The security client encrypts the random code using the second public key to generate a security ticket; After receiving the security ticket, the IDP service uses the second private key to decrypt the security ticket. When the random code sent by the verification target application is consistent with the decrypted random code, it is determined that the security ticket verification is successful.

4. The method according to claim 3, characterized in that In addition, after the identity authentication is passed, the security client can receive the token sent by the IDP service and encrypt the random code and token together to generate a security ticket; After receiving the security ticket, the IDP service uses the second private key to decrypt the security ticket. When the random code sent by the verification target application is consistent with the decrypted random code and the decrypted token is valid, it is determined that the security ticket verification has passed.

5. The method according to claim 4, characterized in that Setting up a user identity verification device, including a receiving unit, a transmitting unit and a determining unit; The receiving unit is used to receive the JSon network token sent by the user through the portal center; The JSon network token is a token that is determined to be valid and verified by the front end. After receiving the token, the receiving unit passes it to the transmitting unit; After receiving the JSon network token, the transmission unit transmits it to the backend server; if the JSon network token is not empty and passes the verification, the transmission unit sends the token to the backend server; The determination unit is used to parse the JSON network token to obtain the user's personal identity information, and determine the user's identity authentication result according to the user's personal identity information.

6. The method according to claim 5, characterized in that The determination unit resolution process includes obtaining the user's personal identity information based on the attribute value.

7. The method according to claim 5, characterized in that The JSON network token is pre-encrypted by the backend server using a private key.

8. The method according to claim 7, characterized in that When the transmission unit determines at the front end that the JSon network token is not empty and passes the verification, it stores the JSon network token in the header file and sends the header file to the back-end server; the determination unit obtains the user's personal identity information according to the attribute value, and determines the user's identity authentication result according to the user's personal identity information.

9. The method according to claim 5, characterized in that When the transmission unit determines at the front end that the JSon network token is not empty and passes the verification, it sends the data acquisition request and the JSon network token to the back-end server; after verifying that the user's identity authentication is passed, the return unit determines the data of the business item requested by the user according to the data acquisition request, and returns the data of the business item to the front end of the microservice center.

Images