Data verification method and device based on two-dimensional code third-party login and national secret authentication

Abstract

The invention provides a data verification method based on two-dimensional code third-party login and national secret authentication, and the method comprises the steps: obtaining a user identity bill and obtaining a private key password corresponding to the user identity bill by an encryption end when a login request sent by a user end through scanning a login two-dimensional code of a login end is received; the encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end; the encryption end determines collaborative signature response data according to the collaborative signature request and the user identity bill and sends the collaborative signature response data to the login end; and the encryption end verifies the complete signature through the verification request, and sends a verification result to the authentication end. By arranging the encryption end, national secret authentication and two-dimensional code third-party login are combined, and the safety of logging in a third-party website when the two-dimensional code is scanned is guaranteed.

Description

TECHNICAL FIELD

[0001] The present application mainly relates to the technical field of data processing, and particularly relates to a data verification method and device based on two-dimensional code third-party login and national secret authentication. BACKGROUND

[0002] With the rapid development of mobile Internet and Internet of Things technology, two-dimensional codes have become important carriers in third-party login scenarios due to their high information density, easy identification, and low cost, and are widely used in social, financial, and e-commerce fields. Third-party login simplifies the operation process of repeated password input by two-dimensional code scanning authentication, improving the convenience of use, but also faces security risks such as identity forgery, information leakage, and phishing attacks due to the low authentication strength of two-dimensional codes. The existing and widely used third-party login protocol (such as OAuth 2.0) itself is still insufficient to meet the needs of high-security scenarios (for example, OAuth 2.0 mainly solves the authorization problem, and the token itself may be stolen and replayed), and traditional verification methods based on account passwords or simple tokens have been difficult to meet the needs of high-security scenarios. SUMMARY

[0003] In view of the problems, the present application is proposed to provide a data verification method and device based on two-dimensional code third-party login and national secret authentication to overcome the problems or at least partially solve the problems, which comprises: A data verification method based on two-dimensional code third-party login and national secret authentication, the method involves a user end, a server end, an encryption end, an authentication end, and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end. The method comprises: When receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the encryption end obtains a user identity ticket and a private key password corresponding to the user identity ticket. The encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end. The login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a co-signature request to the encryption end through the local private key. The encryption end determines a co-signature response data according to the co-signature request and the user identity ticket and sends to the login end; the login end generates a complete signature according to the co-signature response data and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information; The encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end.

[0004] Further, further comprising: The encryption end obtains application information; The encryption end sends the application information to the server end, and the server end sends user login behavior data to the encryption end according to the application information; The encryption end maps the user login behavior data to the user identity ticket to generate a corresponding mapping relationship between the two; When the login end initiates login authentication, the encryption end verifies the user identity ticket according to the mapping relationship.

[0005] Further, further comprising: When the login end requests to download a fragment key, the encryption end obtains a user identity ticket and binding information; The encryption end verifies the correctness of the user identity ticket through the mapping relationship, and binds the binding information with the user information corresponding to the user identity ticket according to the user identity ticket to obtain binding user information; The encryption end generates a fragment key KC and a private key password according to the binding user information and the application information, and encrypts the private key password and the fragment key KC to generate a ciphertext C; The encryption end sends the ciphertext C to the login end.

[0006] Further, the encryption end generates a fragment key KC and a private key password according to the binding user information and the application information, and encrypts the private key password and the fragment key KC to generate a ciphertext C, comprising: The encryption end obtains the SM2 temporary public key, user ID and device ID sent by the login end; The encryption end generates a fragment key KC according to the user ID and the device ID; The encryption end randomly generates a private key password, and saves the private key password and the SM2 temporary public key to a KV data record, wherein the KV data record corresponds to the device ID and the user ID; The encryption end encrypts the private key password and the fragment key KC through the SM2 temporary public key respectively to obtain a ciphertext C.

[0007] A data verification method based on two-dimensional code third-party login and national secret authentication, the method involves user end, server end, encryption end, authentication end and login end, the user end is used for sending login information and user information to the server end; the server end has user information login verification authority; the login end temporarily stores a user identity ticket for authenticating user identity; the encryption end stores a mapping relationship of user identity ticket and user login behavior; the authentication end stores user information login authority authorized by the server end; The method comprises: When receiving a login request response sent by the user end by scanning the login two-dimensional code of the login end, the login end initiates login authentication to the encryption end through the user identity ticket, and the encryption end sends an encryption key password corresponding to the user identity ticket to the login end; The login end decrypts the encryption key password to obtain a private key password, loads a local private key through the private key password, sends a collaborative signature request to the encryption end through the local private key, and signs login request data to generate a local partial signature; the encryption end sends corresponding collaborative signature response data to the login end according to the collaborative signature request and the user identity ticket; The login end obtains a complete signature through the local partial signature and the collaborative signature response data, and requests national secret authentication from the authentication end according to the complete signature.

[0008] Further, it further comprises: When the user end scans the login two-dimensional code of the login end, and obtains the user identity ticket returned by the server, the login end determines whether there is a fragment key in the local according to the user information; If the fragment key exists, the login end performs collaborative signature operation; If the fragment key does not exist, the login end performs binding operation.

[0009] Further, the step of binding operation performed by the login end if the fragment key does not exist, comprises: The login end sends the user identity ticket and binding information to the encryption end; the encryption end retrieves user login behavior according to the mapping relationship, binds the user login behavior with the binding information, and returns an authentication token to the login end; The login end calls a fragment key download interface through the user identity ticket and the authentication token; the encryption end generates ciphertext C according to the binding information and the application information, and sends the ciphertext C to the login end; The login terminal decrypts the ciphertext C to obtain a fragment key KC and a private key password. The login terminal encrypts the fragment key KC by using the private key password and stores the encrypted fragment key KC.

[0010] Further, the login terminal decrypts the encryption key password to obtain a private key password, loads a local private key by using the private key password, sends a cooperative signature request to the encryption terminal by using the local private key, and signs login request data to generate a local partial signature. The login terminal decrypts the encryption key password to obtain a private key password. The login terminal loads a local private key by using the private key password. The login terminal sends a cooperative signature request by using the local private key and performs a local partial signature by using the local private key.

[0011] A two-dimensional code third-party login and encryption method of national secret authentication, the method involves a user terminal, a server terminal, an encryption terminal, an authentication terminal and a login terminal, the user terminal is used to send login information and user information to the server terminal; the server terminal has user information login verification authority; the login terminal temporarily stores a user identity ticket used for authenticating user identity; the encryption terminal stores a mapping relationship between the user identity ticket and user login behavior; the authentication terminal stores user information login authority authorized by the server terminal; The method comprises: When receiving a login request sent by the user terminal by scanning a login two-dimensional code of the login terminal, the authentication terminal obtains a complete signature and calls a signature verification request interface to the encryption terminal by using the complete signature; the encryption terminal generates a verification result according to the complete signature and sends the verification result to the authentication terminal. The authentication terminal performs login authentication on the login authentication request of the login terminal by using the verification result.

[0012] A data verification device based on two-dimensional code third-party login and national secret authentication, the device involves a user end, a server end, an encryption end, an authentication end and a login end, the user end is used for sending login information and user information to the server end; the server end has user information login verification authority; the login end temporarily stores a user identity ticket used for authenticating user identity; the encryption end stores a mapping relationship of user identity ticket and user login behavior; the authentication end stores user information login authority authorized by the server end; the encryption device of two-dimensional code third-party login and national secret authentication realizes the steps of the data verification method based on two-dimensional code third-party login and national secret authentication according to any one of the above: Comprise: A ticket acquisition module is used for acquiring a user identity ticket and a private key password corresponding to the user identity ticket when the encryption end receives a login request sent by the user end by scanning a login two-dimensional code of the login end; A key password module is used for the encryption end to encrypt the private key password to obtain an encrypted key password, and send the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a cooperative signature request to the encryption end through the local private key; A cooperative signature module is used for the encryption end to determine cooperative signature response data according to the cooperative signature request and the user identity ticket and send the cooperative signature response data to the login end; the login end generates a complete signature according to the cooperative signature response data and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information; A signature verification module is used for the encryption end to verify the complete signature through the verification request and send a verification result to the authentication end.

[0013] In the embodiments of the present application, in order to solve the problem of low security of third-party login through a two-dimensional code in the prior art, the present application provides a data verification method based on two-dimensional code third-party login and national secret authentication. The method involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate the user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end. The method comprises the following steps: when receiving a login request sent by the user end by scanning a login two-dimensional code of the login end, the encryption end acquires a user identity ticket and a private key password corresponding to the user identity ticket; the encryption end encrypts the private key password to obtain an encrypted key password and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption end through the local private key; the encryption end determines collaborative signature response data according to the collaborative signature request and the user identity ticket and sends the collaborative signature response data to the login end; the login end generates a complete signature according to the collaborative signature response data and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information; the encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end. By setting the encryption end, the national secret authentication is combined with the two-dimensional code third-party login, thereby ensuring the security of logging into a third-party website when scanning a two-dimensional code. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed to be used in the description of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without any creative labor. Figure 1 is a step flow chart of an encryption end of a data verification method based on two-dimensional code third-party login and national secret authentication provided by an embodiment of the present application; Figure 2 is a step flow chart of a login end of a data verification method based on two-dimensional code third-party login and national secret authentication provided by an embodiment of the present application; Figure 3 is a step flow chart of an authentication end of a data verification method based on two-dimensional code third-party login and national secret authentication provided by an embodiment of the present application; Figure 4is a module structure schematic diagram of an encryption end of a data verification method based on a two-dimensional code third-party login and a national secret authentication, provided by an embodiment of the present application. Figure 5 is a module structure schematic diagram of a login end of a data verification method based on a two-dimensional code third-party login and a national secret authentication, provided by an embodiment of the present application. Figure 6 is a module structure schematic diagram of an authentication end of a data verification method based on a two-dimensional code third-party login and a national secret authentication, provided by an embodiment of the present application. Figure 7 is a flowchart of a scanning authentication process when a certain login software as a third party performs two-dimensional code scanning login, provided by an embodiment of the present application. Figure 8 is a flowchart of a fragment key downloading process when a certain login software as a third party performs two-dimensional code scanning login, provided by an embodiment of the present application. Figure 9 is a flowchart of a collaborative signature authentication process when a certain login software as a third party performs two-dimensional code scanning login, provided by an embodiment of the present application. Figure 10 is a structure schematic diagram of a computer device, provided by an embodiment of the present application. DETAILED DESCRIPTION

[0015] In order to make the purposes, characteristics and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0016] The inventor finds through analyzing the prior art that when scanning a two-dimensional code for third-party login, a user identity ticket (such as a token) is usually stored in plaintext or simple encrypted form in the client, which is easy to be decompiled or extracted. Moreover, the ticket is insufficiently associated with user equipment, IP and other environmental information, and cannot effectively identify abnormal login.

[0017] It should be noted that the “national secret” mentioned in the present application refers to the Chinese national secret standard, including but not limited to SM2 (elliptic curve public key cryptography algorithm), SM3 (hash algorithm), SM4 (block cipher algorithm) and a series of cryptographic algorithm standards.

[0018] In any embodiment of the present application, the login end is a browser end for providing user browsing of a website; the authentication end is a website business application; the server end is a third-party platform for logging user information, which is an open authentication platform for logging software; and the user end is a user device, such as a mobile phone or a tablet, which has logged user information on the third-party platform and can be used to scan a two-dimensional code.

[0019] Referring to Figure 1 , a two-dimensional code third-party login and data verification method based on a national secret authentication is shown, which involves a user end, a server end, an encryption end, an authentication end, and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end. The method includes: S110, when receiving a login request sent by the user end by scanning a login two-dimensional code of the login end, the encryption end acquires a user identity ticket and a private key password corresponding to the user identity ticket; S120, the encryption end encrypts the private key password to obtain an encrypted key password and sends the encrypted key password to the login end. The login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a cooperative signature request to the encryption end through the local private key; S130, the encryption end determines cooperative signature response data according to the cooperative signature request and the user identity ticket and sends the cooperative signature response data to the login end. The login end generates a complete signature according to the cooperative signature response data and submits verification information to the authentication end. The authentication end sends a verification request to the encryption end according to the verification information. S140, the encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end.

[0020] In the embodiments of the present application, in order to solve the problem of low security of third-party login through two-dimensional code in the prior art, the present application provides a data verification method based on two-dimensional code third-party login and national secret authentication, which involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate the user identity. The encryption end stores a mapping relationship between the user identity ticket and the user login behavior. The authentication end stores the user information login authority authorized by the server end. The method comprises the following steps: when receiving a login request sent by the user end by scanning a login two-dimensional code of the login end, the encryption end acquires a user identity ticket and a private key password corresponding to the user identity ticket; the encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption end through the local private key; the encryption end determines collaborative signature response data according to the collaborative signature request and the user identity ticket, and sends the collaborative signature response data to the login end; the login end generates a complete signature according to the collaborative signature response data, and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information; the encryption end verifies the complete signature through the verification request, and sends a verification result to the authentication end. By setting the encryption end, the national secret authentication is combined with the two-dimensional code third-party login, the deep integration of the national secret authentication and the login process is realized, and the security of logging in the third-party website when scanning the two-dimensional code is ensured.

[0021] It should be noted that the user end is the login initiator, triggers a login request by scanning the two-dimensional code of the login end, and submits user information (such as an account, device information, etc.) to the server end, which is the entrance of user operation.

[0022] The server end has user information login verification authority, is responsible for storing and managing user basic information, and is a basic data source of user identity legitimacy.

[0023] The login end is a target terminal (such as a PC end, an APP end, etc.) that needs to be logged in, stores a user identity ticket, and is used to prove the identity association of itself to be logged in to other ends.

[0024] The encryption end is a core security node, stores a mapping relationship between the user identity ticket and the user login behavior, is responsible for key generation, encryption, collaborative signature and final signature verification, and is a core executor of national secret authentication.

[0025] The authentication end stores the user login permission authorized by the server end, serves as a judge of login legality, receives the verification request of the login end, and initiates the final verification to the encryption end, to ensure that the login behavior conforms to the authorized rules.

[0026] When the user scans the two-dimensional code of the login end through the user end, the login request of the login end is received by the encryption end. At this time, the encryption end first acquires the user identity ticket stored by the login end, and matches the corresponding private key password according to the ticket.

[0027] The encryption end encrypts the private key password, generates an encrypted key password and sends it to the login end. After receiving, the login end decrypts the private key password through the password algorithm module embedded in the local login interface, loads the local private key (the login end only stores part of the private key corresponding to the user identity, and does not store the complete private key) through the private key password, and sends a collaborative signature request to the encryption end based on the private key.

[0028] The encryption end generates collaborative signature response data (another part of the signature information held by the encryption end) according to the collaborative signature request of the login end and the user identity ticket acquired previously, and sends it to the login end. The login end combines the partial signature generated by the local private key with the collaborative signature response data of the encryption end, generates a complete signature (a digital signature based on a national secret algorithm such as SM2, with unforgeability), and submits verification information (such as signature value, user identity ticket, timestamp, etc.) containing the signature to the authentication end.

[0029] After receiving the verification information of the login end, the authentication end sends a verification request to the encryption end to request to confirm the signature legality. The encryption end completes the signature validity check through the complete signature, user identity ticket and stored user login behavior mapping relationship in the verification request, and finally returns the verification result (pass / reject) to the authentication end, which decides whether to allow login.

[0030] In the following, a data verification method based on two-dimensional code third-party login and national secret authentication in the present exemplary embodiment will be further described.

[0031] In an embodiment of the present application, it further comprises: As described in the following steps, the encryption end acquires application information; As described in the following steps, the encryption end sends the application information to the server end, and the server end sends user login behavior data to the encryption end according to the application information; As described in the following steps, the encryption end maps the user login behavior data to the user identity ticket, and generates a mapping relationship corresponding to the two; As described in the following steps, when the login end initiates login authentication, the encryption end verifies the user identity ticket according to the mapping relationship.

[0032] As an example, when the user selects a certain login software to log in through a third-party application (such as a certain e-commerce APP), the encryption end first obtains the information of the application: such as application ID (a unique identifier assigned by the login software to the e-commerce APP), security level: the security level preset by the login software according to the application type (such as financial applications requiring stricter verification), authorization scope: the permissions applied by the e-commerce APP (such as obtaining nickname, avatar, mobile phone number), and the like. The server end returns the login behavior data of the user to the encryption end according to the application information: such as historical login devices: the mobile phone models commonly used by the user, device fingerprints, login geographic location characteristics, login time patterns, and the like.

[0033] The encryption end binds the above behavior data with the identity ticket of the user in the login software to generate a mapping relationship.

[0034] In an embodiment of the present application, it further comprises: When the login end requests to download the fragment key, the encryption end obtains the user identity ticket and the binding information; The encryption end verifies the correctness of the user identity ticket through the mapping relationship, and binds the binding information with the user information corresponding to the user identity ticket according to the user identity ticket to obtain the binding user information; The encryption end generates a fragment key KC and a private key password according to the binding user information and the application information, and encrypts the private key password and the fragment key KC to generate a ciphertext C; The encryption end sends the ciphertext C to the login end.

[0035] It should be noted that when the user logs in for the first time, the login end needs to download the fragment key, and through identity verification, information binding, and key encryption transmission, it is ensured that the fragment key is only obtained by the legal login end, thereby blocking unauthorized access risks from the source of the key.

[0036] When the login end initiates a request to download the fragment key (such as when the user logs in on a PC end for the first time, and the PC end does not have a local private key), the encryption end first obtains the user identity ticket and the binding information: The binding information includes the device feature information of the login end (such as device ID, MAC address, and operating system version) and the user's actively submitted confirmation information (such as SMS verification code and biometric features, proving that the current operation is initiated by the user himself), and the like.

[0037] The encryption end calls the mapping relationship between the user identity ticket and the login behavior to verify whether the currently submitted user identity ticket is legal. If the verification fails, the download request is directly rejected.

[0038] After the verification, the encryption end binds the binding information of the login end with the user information (such as user account information, avatar information, real-name information) corresponding to the user identity ticket, and generates binding user information.

[0039] The encryption end generates a fragment key KC based on the binding user information and the application information, and encrypts and protects it: Fragment key KC: a private key fragment used by the login end to participate in collaborative signature; Private key password: a password used to encrypt and store the fragment key KC (the login end needs to decrypt it using the password when using the fragment key later).

[0040] Subsequently, the encryption end encrypts the private key password and the fragment key KC using a national secret algorithm to generate ciphertext C that cannot be directly interpreted.

[0041] In an embodiment of the present application, the specific process of the step "the encryption end generates a fragment key KC based on the binding user information and the application information, and encrypts and protects it" can be further described in combination with the following description.

[0042] As described in the following steps, the encryption end obtains the SM2 temporary public key, user ID, and device ID sent by the login end; As described in the following steps, the encryption end generates a fragment key KC based on the user ID and the device ID; As described in the following steps, the encryption end randomly generates a private key password and saves the private key password and the SM2 temporary public key to a KV data record, wherein the KV data record corresponds to the device ID and the user ID; As described in the following steps, the encryption end encrypts the private key password and the fragment key KC using the SM2 temporary public key to obtain ciphertext C.

[0043] It should be noted that the SM2 temporary public key is a public key temporarily generated by the login end based on the national secret SM2 algorithm, which is a public key in asymmetric encryption and is only used for this session. The login end locally holds the corresponding pairing private key. The user ID is a unique identifier of the user in the system (such as a mobile phone number, an account ID, etc., used to associate the user's identity), and the device ID is a browser thumbprint.

[0044] The encryption end takes the user ID and the device ID as core inputs, generates a sharded key KC through a preset algorithm; the encryption end further generates a key password, the login end needs to encrypt the key password when storing the sharded key KC, and needs to decrypt the key password when using the sharded key KC subsequently. The encryption end stores the private key password in association with the SM2 temporary public key sent by the login end, forms a KV data record, and the record is bound to the device ID and the user ID; based on the SM2 asymmetric encryption algorithm, the private key password is encrypted by using the SM2 temporary public key to obtain encrypted password ciphertext; the sharded key KC is also encrypted by using the SM2 temporary public key to obtain encrypted key ciphertext; the key ciphertext and the password ciphertext are combined to obtain ciphertext C.

[0045] In an embodiment of the present application, a data verification method based on two-dimensional code third-party login and national secret authentication is provided. The method involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end. The method comprises: S210, when receiving a login request response sent by the user end by scanning the login two-dimensional code of the login end, the login end initiates login authentication to the encryption end by using the user identity ticket, and the encryption end sends an encrypted key password corresponding to the user identity ticket to the login end. S220, the login end decrypts the encrypted key password to obtain a private key password, loads a local private key by using the private key password, sends a cooperative signature request to the encryption end by using the local private key, and signs login request data to generate a local partial signature. The encryption end sends corresponding cooperative signature response data to the login end according to the cooperative signature request and the user identity ticket. S230, the login end obtains a complete signature by using the local partial signature and the cooperative signature response data, and requests national secret authentication from the authentication end according to the complete signature.

[0046] It should be noted that the login end sends a user identity ticket to the encryption end to request login authentication; the encryption end generates an encryption key password corresponding to the ticket after verifying the validity of the ticket, and returns it to the login end; the login end decrypts the encryption key password using the locally stored decryption key to obtain the local private key; the login end generates a local partial signature by partially signing the login request through the local private key, and sends the signature request and the user identity ticket to the encryption end; the encryption end generates a co-signature response data in combination with the user identity ticket and the private key fragment stored by itself, and returns it to the login end; the login end combines the local partial signature with the co-signature response data to generate a complete signature, that is, a digital signature conforming to the national standard SM2; the login end submits the complete signature and the user identity ticket to the authentication end to request national authentication; the authentication end verifies the validity of the signature, and decides whether to grant login permission according to the pre-authorized permission of the server end.

[0047] In an embodiment of the present application, further comprising: As described in the following steps, when the user end scans the login two-dimensional code of the login end and obtains the user identity ticket returned by the service end, the login end determines whether there is a fragment key in the local according to the user information; As described in the following steps, if the fragment key exists, the login end performs a co-signature operation; As described in the following steps, if the fragment key does not exist, the login end performs a binding operation.

[0048] It should be noted that when the user scans the two-dimensional code of the login end through the user end, the login end first searches the local storage according to the current user information (such as user ID) to determine whether there is a fragment key bound with the user, and designs different processes for two scenarios through judging whether the fragment key exists, to avoid process interruption due to no key when first login or experience redundancy caused by repeated binding when non-first login.

[0049] In an embodiment of the present application, the specific process of the step "if the fragment key does not exist, the login end performs a binding operation" can be further described in combination with the following description.

[0050] As described in the following steps, the login end sends the user identity ticket and the binding information to the encryption end; the encryption end searches the user login behavior according to the mapping relationship, binds the user login behavior with the binding information, and returns an authentication token to the login end; As described in the following steps, the login end calls a fragment key download interface through the user identity ticket and the authentication token; the encryption end generates a ciphertext C according to the binding information and the application information, and sends the ciphertext C to the login end; The login end decrypts the ciphertext C to obtain a fragment key KC and a private key password according to the following steps: The login end encrypts the fragment key KC by using the private key password and stores the encrypted KC to obtain the fragment key according to the following steps.

[0051] It should be noted that when the login end requests login for the first time and there is no fragment key locally, the binding needs to be completed through the above steps to finally obtain the fragment key. The login end sends a user identity ticket and binding information to the encryption end, the binding information is the device characteristics of the login end, such as device ID, MAC address, operating system version and the authorization information actively submitted by the user, such as SMS verification code, biometric characteristics, proving that the current binding is operated by the user himself. The encryption end calls the stored mapping relationship between the user identity ticket and the login behavior, retrieves the historical login behavior of the user, and verifies whether the current binding request conforms to the user's habits; after verification, the encryption end associates the user's historical login behavior with the binding information of the current login end, and completes the binding of the user information; the encryption end generates an authentication token (temporary authorization token, containing an encrypted digest of the binding information), and returns it to the login end; the login end carries the user identity ticket and the authentication token, calls the fragment key download interface, and requests the encryption end to download the fragment key; the encryption end first verifies the validity of the authentication token (such as whether it is within the valid period, whether it matches the user identity ticket), to prevent the authentication token from being stolen and misused; after verification, the encryption end generates the fragment key KC and the private key password in combination with the binding information (such as device ID) and the application information (such as application security level, authorization range); the encryption end encrypts KC and the private key password by using the national secret algorithm, generates a ciphertext C, and sends it to the login end. After receiving the ciphertext C, the login end decrypts it by using the locally stored SM2 temporary private key to obtain the fragment key KC and the private key password; the login end encrypts the fragment key KC by using the private key password, and stores the encrypted KC in the local secure area, to finally form the fragment key.

[0052] In an embodiment of the present application, the "the login end decrypts the encryption key password to obtain a private key password, loads a local private key by using the private key password, sends a co-signature request to the encryption end by using the local private key, and signs login request data to generate a local part signature" in step S220 can be further described in combination with the following description.

[0053] The login end decrypts the encryption key password to obtain a private key password according to the following steps: The login end loads a local private key by using the private key password according to the following steps: The login end sends a cooperative signature request through the local private key and performs local partial signature through the local private key, as described in the following steps.

[0054] It should be noted that, through cooperative signature, the private key only exists temporarily in memory and is not stored in plaintext; the signature process is completed by the login end and the encryption end, and a single entity cannot forge a complete signature, even if the login end is attacked, an attacker cannot obtain the complete private key or copy the signature logic.

[0055] In an embodiment of the present application, a two-dimensional code third-party login and national secret authentication encryption method is also provided, which involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end. The method comprises: S310, when receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the authentication end obtains a complete signature and calls a signature verification request interface to the encryption end through the complete signature; the encryption end generates a verification result according to the complete signature and sends the verification result to the authentication end. S320, the authentication end performs login authentication on the login authentication request of the login end through the verification result.

[0056] It should be noted that the login end generates a complete signature and submits a login authentication request containing the signature to the authentication end. The authentication end extracts the complete signature from the request of the login end; the authentication end calls a signature verification request interface, sends information such as the complete signature and the user identity ticket to the encryption end, and requests to verify the legality of the signature; after receiving the complete signature, the encryption end first verifies whether the signature format conforms to the national secret standard; combined with the user identity ticket, the historical login behavior of the user is extracted from the stored mapping relationship to verify whether the login behavior corresponding to the signature is abnormal; the authenticity of the complete signature is verified through the national secret algorithm, that is, it is verified whether the signature is generated by the local private key of the login end and the cooperative private key of the encryption end, to ensure that the signature is not forged; the encryption end generates a verification result and returns it to the authentication end. The authentication end receives the verification result of the encryption end; combined with the user information login authority authorized by the server end stored by itself, it comprehensively judges whether to allow login; if the verification is passed and the authority is matched, the authentication end sends a "login success" response to the login end; if the verification fails or the authority is insufficient, the login is refused and the reason is returned.

[0057] As an example, refer to Figure 7A flow chart of a scanning authentication process when a certain login software is used as a third party to perform two-dimensional code scanning login, wherein a PC browser is used as a login end, the certain login software is used as a user end, a website business application (national secret authentication) is used as an authentication end, an open platform of the certain login software is used as a server end, and a third party encryption platform is used as an encryption end.

[0058] Referring to Figure 8 A flow chart of a fragment key downloading process when a certain login software is used as a third party to perform two-dimensional code scanning login, wherein a PC browser is used as a login end, a website business application (national secret authentication) is used as an authentication end, and a third party encryption platform is used as an encryption end.

[0059] Referring to Figure 9 A flow chart of a collaborative signature authentication process when a certain login software is used as a third party to perform two-dimensional code scanning login, wherein a PC browser is used as a login end, a website business application (national secret authentication) is used as an authentication end, and a third party encryption platform is used as an encryption end.

[0060] Figures 7-9 Among them, appid: application ID, used to identify a certain application; appsecret: application authentication code, used together with the application ID to identify the identity of the application; auth ticket: user identity authentication ticket, used to authenticate the temporary authentication data of the user identity; access token: token data used to mark the user login behavior in the authentication protocol, generally issued by the business system after the user logs in successfully; and passwd: password used to protect the private key.

[0061] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts are described in the part of the method embodiment.

[0062] Referring to Figure 4 A data verification device based on two-dimensional code third party login and national secret authentication is shown, which relates to a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate the user identity. The encryption end stores a mapping relationship between the user identity ticket and the user login behavior. The authentication end stores user information login authority authorized by the server end. The encryption device of the two-dimensional code third party login and national secret authentication implements the steps of the data verification method based on the two-dimensional code third party login and national secret authentication as described in any one of the above. including: The bill obtaining module 410 is configured to, when receiving a login request sent by the user terminal by scanning a login two-dimensional code of the login terminal, obtain a user identity bill and a private key password corresponding to the user identity bill by the encryption terminal; The key password module 420 is configured to, the encryption terminal encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login terminal; the login terminal decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption terminal through the local private key; The collaborative signature module 430 is configured to, the encryption terminal determines collaborative signature response data according to the collaborative signature request and the user identity bill, and sends the collaborative signature response data to the login terminal; the login terminal generates a complete signature according to the collaborative signature response data, and submits verification information to the authentication terminal; the authentication terminal sends a verification request to the encryption terminal according to the verification information. The signature verification module 440 is configured to, the encryption terminal verifies the complete signature through the verification request, and sends a verification result to the authentication terminal.

[0063] In an embodiment of the present application, further comprising: The obtaining module is configured to, the encryption terminal obtains application information; The application information module is configured to, the encryption terminal sends the application information to a server terminal, and the server terminal sends user login behavior data to the encryption terminal according to the application information; The mapping module is configured to, the encryption terminal maps the user login behavior data to the user identity bill to generate a mapping relationship corresponding to the two; The mapping relationship verification module is configured to, when the login terminal initiates login authentication, the encryption terminal verifies the user identity bill according to the mapping relationship.

[0064] In an embodiment of the present application, further comprising: The binding information obtaining module is configured to, when the login terminal requests to download a fragment key, the encryption terminal obtains a user identity bill and binding information; The binding user information module is configured to, the encryption terminal verifies the correctness of the user identity bill through the mapping relationship, and binds the binding information with user information corresponding to the user identity bill according to the user identity bill to obtain binding user information; The ciphertext C module is configured to, the encryption terminal generates a fragment key KC and a private key password according to the binding user information and the application information, and encrypts the private key password and the fragment key KC to generate a ciphertext C; The ciphertext C sending module is configured to send the ciphertext C to the login end by the encryption end.

[0065] In an embodiment of the present application, the ciphertext C module comprises: The information obtaining module is configured to obtain the SM2 temporary public key, the user ID and the device ID sent by the login end by the encryption end. The fragment key generating module is configured to generate a fragment key KC by the encryption end according to the user ID and the device ID. The KV data module is configured to randomly generate a private key password by the encryption end, and save the private key password and the SM2 temporary public key to a KV data record, wherein the KV data record corresponds to the device ID and the user ID. The ciphertext C generating module is configured to encrypt the private key password and the fragment key KC by the SM2 temporary public key by the encryption end, to obtain the ciphertext C.

[0066] Referring to Figure 5 , a kind of data verification device based on two-dimensional code third-party login and national secret authentication provided in an embodiment of the present application is shown, the device involves user end, server end, encryption end, authentication end and login end, the user end is used to send login information and user information to the server end;The server end has user information login verification authority;The login end temporarily stores user identity ticket for authenticating user identity;The encryption end stores the mapping relationship of user identity ticket and user login behavior;The authentication end stores the user information login authority authorized by server end;The encryption device of two-dimensional code third-party login and national secret authentication realizes the steps of the data verification method based on two-dimensional code third-party login and national secret authentication as described in any of the above: including: Login authentication module 510, for when receiving the login request sent by the user end by scanning the login two-dimensional code of the login end, the login end initiates login authentication to the encryption end by the user identity ticket, and the encryption end sends the encryption key password corresponding to the user identity ticket to the login end; Local private key module 520, for the login end to obtain the private key password by decrypting the encryption key password, and load local private key by the private key password, and send collaborative signature request to the encryption end by the local private key, and sign login request data to generate local partial signature;The encryption end sends corresponding collaborative signature response data to the login end according to the collaborative signature request and the user identity ticket; Request authentication module 530, for the login end to obtain complete signature by the local partial signature and the collaborative signature response data, and request national secret authentication to the authentication end according to the complete signature.

[0067] In an embodiment of the present application, further comprising: A fragment key verification module, configured to determine whether a fragment key exists locally according to user information when the user terminal scans the login two-dimensional code of the login terminal and obtains the user identity ticket returned by the server; A request signature module, configured to perform a collaborative signature operation if the fragment key exists; A request binding module, configured to perform a binding operation if the fragment key does not exist.

[0068] In an embodiment of the present application, the request binding module comprises: A binding information sending submodule, configured to send the user identity ticket and the binding information to the encryption terminal by the login terminal; the encryption terminal retrieves user login behavior according to the mapping relationship, binds the user login behavior with the binding information, and returns an authentication token to the login terminal; A fragment key downloading submodule, configured to call a fragment key downloading interface by the user identity ticket and the authentication token by the login terminal; the encryption terminal generates a ciphertext C according to the binding information and the application information, and sends the ciphertext C to the login terminal; A decryption submodule, configured to decrypt the ciphertext C to obtain a fragment key KC and a private key password by the login terminal; A storage submodule, configured to encrypt and store the fragment key KC by the private key password by the login terminal, to obtain a fragment key.

[0069] In an embodiment of the present application, the local private key module 520 comprises: A key password decryption submodule, configured to decrypt the encryption key password to obtain a private key password by the login terminal; A local private key loading submodule, configured to load a local private key by the private key password by the login terminal; A local signature submodule, configured to send a collaborative signature request by the local private key by the login terminal, and perform a local partial signature by the local private key.

[0070] Refer to Figure 6, the embodiment of the application provides a kind of data verification device based on two-dimensional code third party login and national secret authentication, the device involves user end, server end, encryption end, authentication end and login end, the user end is used to send login information and user information to the server end;The server end has user information login verification authority;The login end temporarily stores the user identity ticket for authenticating user identity;The encryption end stores the mapping relationship of user identity ticket and user login behavior;The authentication end stores the user information login authority authorized by server end;The encryption device of two-dimensional code third party login and national secret authentication realizes the steps of the data verification method based on two-dimensional code third party login and national secret authentication as described in any of the above: Including: Complete signature module 610, for when receiving the login request sent by the user end by scanning the login two-dimensional code of the login end, the authentication end obtains complete signature, and calls signature verification request interface to the encryption end by the complete signature;The encryption end generates verification result according to the complete signature, and sends the verification result to the authentication end; Login authentication module 620, for the authentication end carries out login authentication to the login authentication request of the login end by the verification result.

[0071] Refer to Figure 10 The computer equipment of the data verification method based on two-dimensional code third party login and national secret authentication of the application, specifically can include the following: The above-mentioned computer equipment 12 is in the form of general-purpose computing equipment, and the components of the computer equipment 12 can include but are not limited to: one or more processors or processing units 16, system memory 28, bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0072] Bus 18 represents one or more of several types of bus 18 structures, including memory bus 18 or memory controller, peripheral bus 18, graphics acceleration port, processor or local bus 18 using any of the bus 18 structures. For example, these architectures include but are not limited to industry standard architecture (ISA) bus 18, microchannel architecture (MAC) bus 18, enhanced ISA bus 18, video electronics standards association (VESA) local bus 18 and peripheral component interconnect (PCI) bus 18.

[0073] Computer equipment 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer equipment 12, including volatile and non-volatile media, removable and non-removable media.

[0074] System memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer device 12 can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 can be provided for reading from and writing to a non-removable, non-volatile magnetic media (typically called a "hard drive"). Figure 4 not shown in FIG. 1, a magnetic hard disk drive for reading from and writing to a removable, nonvolatile magnetic media (e.g., a "floppy disk"), and an optical disk drive for reading from or writing to a removable, non- volatile optical disk (e.g., a CD-ROM, DVD-ROM or other optical media). Each of these drives can be connected to bus 18 by one or more drive interfaces. Storage media can include one or more program products 42 having sets (e.g., one or more) of instructions 42 executable by computer device 12. The program product 42 can be packaged on a variety of non-transitory computer-readable media.

[0075] Program / utility 40, having a set (at least one) of instructions 42 executable by computer device 12, can be stored in, for example, storage by way of example, such as RAM 30 or floppy disk 36. Each of the operating systems, one or more application programs, other program modules 42, and program data, or some combination thereof, can include implementation of the network environment in each of these examples or some combination thereof. Program modules 42 generally carry out the functions and / or methodologies of embodiments of the application as described herein.

[0076] Computer device 12 can also communicate with one or more external devices 14 such as a keyboard or a pointing device, displays 24, camera, etc. and also with one or more devices that enable a health care professional to interact with the computer device 12 and / or allow the computer device 12 to interact with one or more other computer devices. Such interaction can occur through input / output (I / O) interface(s) 22. Additionally, computer device 12 can communicate with one or more networks such as a local area network (LAN), a wide area network (WAN), and / or the Internet through network adapter 20. As depicted, network adapter 20 communicates with the other components of computer device 12 via bus 18. It should be appreciated that although not shown, other hardware and / or software Figure 10 modules can be used in conjunction with computer device 12 including, but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems 34, etc.

[0077] The processing unit 16 executes various function applications and data processing by running programs stored in the system memory 28, such as implementing a data verification method based on two-dimensional code third-party login and national secret authentication provided by the embodiments of the application.

[0078] That is, when the processing unit 16 executes the above program, it realizes that when receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the encryption end obtains a user identity ticket and obtains a private key password corresponding to the user identity ticket; The encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a co-signature request to the encryption end through the local private key; The encryption end determines co-signature response data according to the co-signature request and the user identity ticket and sends it to the login end; the login end generates a complete signature according to the co-signature response data and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information; The encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end.

[0079] In the embodiments of the application, the application also provides a computer readable storage medium having a computer program stored thereon, which is executed by a processor to implement a data verification method based on two-dimensional code third-party login and national secret authentication provided by all embodiments of the application: That is, when the program is executed by the processor, it realizes that when receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the encryption end obtains a user identity ticket and obtains a private key password corresponding to the user identity ticket; The encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a co-signature request to the encryption end through the local private key; The encryption end determines co-signature response data according to the co-signature request and the user identity ticket and sends it to the login end; the login end generates a complete signature according to the co-signature response data and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information; The encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end.

[0080] Any combination of one or more computer readable medium can be employed. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium can be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0081] A computer readable signal medium can include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0082] Program code embodied on a computer readable medium can be transmitted using any apparatus adapted to transmit such a program code, including a modem, or other fetal communication apparatus. As another exemplary, transmitting can comprise communicating data, receiving data, or both, in a network, including one or more packet networks, such as the Internet. A computer readable medium storing such a program code can be accessed by a processor-based system selected from a group consisting of a server, a client, or both. Program code embodied on a computer readable medium can also receive inputs from a user.

[0083] While the preferred embodiments of the application have been described above, it will be recognized and understood that various modifications and changes can be made to the embodiments of the present application by those skilled in the art having the benefit of this detailed description without departing from the scope of the present application. It is therefore intended that the appended claims be construed to include all such embodiments and modifications as fall within the scope of the present application.

[0084] Finally, it should be noted that, in the specification, relational terms such as first and second, and the like, can be used solely to distinguish one entity or action from another entity or action without necessarily implying any actual relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0085] The above describes in detail a data verification method based on two-dimensional code third-party login and national secret authentication provided by the present application, and the principle and implementation mode of the present application are described by using specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range can be changed, and the above description of the specification should not be understood as a limitation of the present application.

Claims

1. A data verification method based on QR code third-party login and national cryptographic authentication, characterized in that, The method involves a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used to authenticate user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; The authentication terminal stores user information and login permissions authorized by the server. The method includes: When the client receives a login request sent by the user terminal by scanning the login QR code of the login terminal, the encryption terminal obtains the user identity ticket and the private key password corresponding to the user identity ticket; The encryption terminal encrypts the private key password to obtain an encryption key password, and sends the encryption key password to the login terminal; the login terminal decrypts the encryption key password to obtain a private key password, loads a local private key using the private key password, and sends a collaborative signature request to the encryption terminal using the local private key. The encryption terminal determines collaborative signature response data based on the collaborative signature request and the user identity ticket, and sends it to the login terminal; the login terminal generates a complete signature based on the collaborative signature response data and submits verification information to the authentication terminal; the authentication terminal sends a verification request to the encryption terminal based on the verification information. The encryption end verifies the complete signature through the verification request and sends the verification result to the authentication end.

2. The method according to claim 1, characterized in that, Also includes: The encrypted terminal obtains application information; The encrypted terminal sends the application information to the server, and the server sends user login behavior data to the encrypted terminal based on the application information. The encryption terminal maps the user login behavior data to the user identity ticket, generating a corresponding mapping relationship between the two. When the login terminal initiates login authentication, the encryption terminal verifies the user identity ticket based on the mapping relationship.

3. The method according to claim 2, characterized in that, Also includes: When the login terminal requests to download the fragment key, the encryption terminal obtains the user's identity ticket and binding information; The encryption terminal verifies the correctness of the user identity ticket through the mapping relationship, and binds the binding information with the user information corresponding to the user identity ticket based on the user identity ticket to obtain the bound user information; The encryption terminal generates a fragmentation key KC and a private key password based on the bound user information and the application information, and encrypts the private key password and the fragmentation key KC to generate ciphertext C; The encryption terminal sends the ciphertext C to the login terminal.

4. The method according to claim 3, characterized in that, The step of generating a fragmentation key KC and a private key password based on the bound user information and the application information, and encrypting the private key password and the fragmentation key KC to generate ciphertext C, includes: The encryption terminal obtains the SM2 temporary public key, user ID, and device ID sent by the login terminal; The encryption terminal generates a fragmentation key KC based on the user ID and the device ID; The encryption terminal randomly generates a private key password and saves the private key password and the SM2 temporary public key into a KV data record, wherein the KV data record corresponds to the device ID and the user ID; The encryption terminal uses the SM2 temporary public key to encrypt the private key password and the fragmentation key KC respectively, to obtain ciphertext C.

5. A data verification method based on QR code third-party login and national cryptographic authentication, characterized in that, The method involves a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used to authenticate user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; The authentication terminal stores user information and login permissions authorized by the server. The method includes: When the login request response is received from the user terminal by scanning the login QR code of the login terminal, the login terminal initiates login authentication to the encryption terminal through the user identity ticket, and the encryption terminal sends the encryption key password corresponding to the user identity ticket to the login terminal; The login terminal decrypts the encryption key password to obtain the private key password, loads the local private key using the private key password, sends a collaborative signature request to the encryption terminal using the local private key, and signs the login request data to generate a local partial signature; the encryption terminal sends the corresponding collaborative signature response data to the login terminal based on the collaborative signature request and the user identity ticket. The login terminal obtains a complete signature by combining the local partial signature with the collaborative signature response data, and requests national cryptographic authentication from the authentication terminal based on the complete signature.

6. The method according to claim 5, characterized in that, Also includes: When the user terminal scans the login QR code of the login terminal and obtains the user identity ticket returned by the server, the login terminal determines whether a fragmentation key exists locally based on the user information. If the fragmentation key exists, the login terminal performs a collaborative signature operation; If the fragment key does not exist, the login terminal will perform a binding operation.

7. The method according to claim 6, characterized in that, If the fragment key does not exist, the steps for the login terminal to perform the binding operation include: The login terminal sends a user identity ticket and binding information to the encryption terminal; the encryption terminal retrieves the user login behavior according to the mapping relationship, binds the user login behavior with the binding information, and returns an authentication token to the login terminal; The login terminal calls the fragment key download interface using the user identity ticket and the authentication token; the encryption terminal generates ciphertext C based on the binding information and application information, and sends ciphertext C to the login terminal; The login terminal decrypts the ciphertext C to obtain the fragmentation key KC and the private key password; The login terminal encrypts and stores the fragment key KC using a private key password to obtain the fragment key.

8. The method according to claim 5, characterized in that, The login terminal decrypts the encryption key password to obtain the private key password, loads the local private key through the private key password, sends a collaborative signature request to the encryption terminal through the local private key, and signs the login request data to generate a local partial signature. The step of the encryption terminal sending corresponding collaborative signature response data to the login terminal based on the collaborative signature request and the user identity ticket includes: The login terminal decrypts the encrypted key password to obtain the private key password; The login terminal loads a local private key using the private key password; The login terminal sends a collaborative signature request using the local private key and performs a local partial signature using the local private key.

9. A method for encrypting QR code third-party login with national cryptographic authentication, characterized in that, The method involves a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used to authenticate user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; The authentication terminal stores user information and login permissions authorized by the server. The method includes: When the authentication terminal receives a login request sent by the user terminal by scanning the login QR code of the login terminal, the authentication terminal obtains the complete signature and calls the signature verification request interface of the encryption terminal using the complete signature; the encryption terminal generates a verification result based on the complete signature and sends the verification result to the authentication terminal. The authentication terminal performs login authentication on the login terminal's login authentication request based on the verification result.

10. A data verification device based on QR code third-party login and national cryptographic authentication, characterized in that, The device includes a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used for authenticating user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; the authentication terminal stores user information login permissions authorized by the server; the data verification device based on QR code third-party login and national cryptographic authentication implements the steps of the data verification method based on QR code third-party login and national cryptographic authentication as described in any one of claims 1 to 4: include: The ticket acquisition module is used to obtain the user identity ticket and the private key password corresponding to the user identity ticket when the encryption terminal receives a login request sent by the user terminal by scanning the login QR code of the login terminal. The key-password module is used by the encryption terminal to encrypt the private key password to obtain an encryption key password, and send the encryption key password to the login terminal; the login terminal decrypts the encryption key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption terminal through the local private key. The collaborative signature module is used by the encryption terminal to determine collaborative signature response data based on the collaborative signature request and the user identity ticket, and send it to the login terminal; the login terminal generates a complete signature based on the collaborative signature response data and submits verification information to the authentication terminal; the authentication terminal sends a verification request to the encryption terminal based on the verification information. The signature verification module is used by the encryption end to verify the complete signature through the verification request and send the verification result to the authentication end.

Images