Data verification method and device based on two-dimensional code third-party login and national cryptography authentication

Abstract

The application provides a data verification method based on a two-dimensional code third-party login and a national secret authentication. When receiving a login request sent by a user end by scanning a login two-dimensional code of a login end, an encryption end acquires a user identity ticket and acquires a private key password corresponding to the user identity ticket; the encryption end encrypts the private key password to obtain an encrypted key password and sends the encrypted key password to the login end; the encryption end determines a co-signing response data according to the co-signing request and the user identity ticket and sends the co-signing response data to the login end; and the encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end. By setting the encryption end, the national secret authentication is combined with the two-dimensional code third-party login, and the safety of logging in a third-party website when scanning the two-dimensional code is ensured.

Description

TECHNICAL FIELD

[0001] The present application mainly relates to the technical field of data processing, and particularly relates to a data verification method and device based on two-dimensional code third-party login and national secret authentication. BACKGROUND

[0002] With the rapid development of mobile Internet and Internet of Things technology, two-dimensional codes have become an important carrier in the third-party login scene and are widely used in social, financial, e-commerce and other fields due to their high information density, easy identification and low cost. The third-party login simplifies the operation process of repeated password input of users through the two-dimensional code scanning authentication mode, improving the use convenience, but at the same time, it also faces security risks such as identity forgery, information leakage and phishing attacks caused by the low authentication strength of two-dimensional codes. The existing and widely used third-party login protocol (such as OAuth 2.0) itself is still insufficient to meet the needs of high security level scenarios (for example, OAuth 2.0 mainly solves the authorization problem, and the token itself may be stolen and replayed), and the traditional verification method based on account password or simple token has been difficult to meet the needs of high security level scenarios. SUMMARY

[0003] In view of the problems, the present application is proposed to provide a data verification method and device based on two-dimensional code third-party login and national secret authentication to overcome the problems or at least partially solve the problems, which comprises:

[0004] A data verification method based on two-dimensional code third-party login and national secret authentication, the method involves a user end, a server end, an encryption end, an authentication end and a login end, the user end is used to send login information and user information to the server end; the server end has user information login verification authority; the login end temporarily stores a user identity ticket used to authenticate the user identity; the encryption end stores a mapping relationship between the user identity ticket and the user login behavior; the authentication end stores the user information login authority authorized by the server end;

[0005] The method comprises:

[0006] When receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the encryption end acquires the user identity ticket and acquires the private key password corresponding to the user identity ticket;

[0007] The encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain the private key password, loads the local private key through the private key password, and sends a co-signing request to the encryption end through the local private key;

[0008] The encryption end determines the co-signature response data according to the co-signature request and the user identity ticket and sends to the login end; the login end generates a complete signature according to the co-signature response data and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information;

[0009] The encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end.

[0010] Further, it also includes:

[0011] The encryption end obtains application information;

[0012] The encryption end sends the application information to the server end, and the server end sends user login behavior data to the encryption end according to the application information;

[0013] The encryption end maps the user login behavior data to the user identity ticket to generate a corresponding mapping relationship between the two;

[0014] When the login end initiates login authentication, the encryption end verifies the user identity ticket according to the mapping relationship.

[0015] Further, it also includes:

[0016] When the login end requests to download the fragment key, the encryption end obtains the user identity ticket and the binding information;

[0017] The encryption end verifies the correctness of the user identity ticket through the mapping relationship, and binds the binding information with the user information corresponding to the user identity ticket according to the user identity ticket to obtain binding user information;

[0018] The encryption end generates a fragment key KC and a private key password according to the binding user information and the application information, and encrypts the private key password and the fragment key KC to generate a ciphertext C;

[0019] The encryption end sends the ciphertext C to the login end.

[0020] Further, the encryption end generates a fragment key KC and a private key password according to the binding user information and the application information, and encrypts the private key password and the fragment key KC to generate a ciphertext C, which includes:

[0021] The encryption end obtains the SM2 temporary public key, user ID and device ID sent by the login end;

[0022] The encryption end generates a shard key KC according to the user ID and the device ID;

[0023] The encryption end randomly generates a private key password and saves the private key password and the SM2 temporary public key to a KV data record, wherein the KV data record corresponds to the device ID and the user ID;

[0024] The encryption end encrypts the private key password and the shard key KC respectively through the SM2 temporary public key to obtain ciphertext C.

[0025] A data verification method based on two-dimensional code third-party login and national cryptographic authentication, the method involves a user end, a server end, an encryption end, an authentication end and a login end, the user end is used to send login information and user information to the server end; the server end has user information login verification authority; the login end temporarily stores a user identity ticket used to authenticate user identity; the encryption end stores a mapping relationship between user identity ticket and user login behavior; the authentication end stores user information login authority authorized by the server end;

[0026] The method comprises:

[0027] When receiving a login request response sent by the user end by scanning the login two-dimensional code of the login end, the login end initiates login authentication to the encryption end through the user identity ticket, and the encryption end sends an encryption key password corresponding to the user identity ticket to the login end;

[0028] The login end decrypts the encryption key password to obtain a private key password, loads a local private key through the private key password, sends a collaborative signature request to the encryption end through the local private key, and signs login request data to generate a local partial signature; the encryption end sends corresponding collaborative signature response data to the login end according to the collaborative signature request and the user identity ticket;

[0029] The login end obtains a complete signature through the local partial signature and the collaborative signature response data, and requests national cryptographic authentication from the authentication end according to the complete signature.

[0030] Further, it further comprises:

[0031] When the user end scans the login two-dimensional code of the login end and obtains the user identity ticket returned by the server, the login end determines whether there is a shard key in the local according to user information;

[0032] If the shard key exists, the login end performs collaborative signature operation;

[0033] If the shard key does not exist, the login end performs a binding operation.

[0034] Further, the step of the login end performing a binding operation if the shard key does not exist includes:

[0035] The login end sends a user identity ticket and binding information to the encryption end; the encryption end retrieves user login behavior according to the mapping relationship, binds the user login behavior with the binding information, and returns an authentication token to the login end;

[0036] The login end calls a shard key download interface through the user identity ticket and the authentication token; the encryption end generates ciphertext C according to the binding information and the application information, and sends the ciphertext C to the login end;

[0037] The login end decrypts the ciphertext C to obtain a shard key KC and a private key password;

[0038] The login end encrypts the shard key KC through the private key password and stores it to obtain a shard key.

[0039] Further, the login end decrypts the encryption key password to obtain a private key password, loads a local private key through the private key password, sends a collaborative signature request to the encryption end through the local private key, and signs login request data to generate a local partial signature; the step of the encryption end sending corresponding collaborative signature response data to the login end according to the collaborative signature request and the user identity ticket includes:

[0040] The login end decrypts the encryption key password to obtain a private key password;

[0041] The login end loads a local private key through the private key password;

[0042] The login end sends a collaborative signature request through the local private key and performs a local partial signature through the local private key.

[0043] A two-dimensional code third-party login and national secret authentication encryption method, the method involves a user end, a server end, an encryption end, an authentication end and a login end, the user end is used to send login information and user information to the server end; the server end has user information login verification authority; the login end temporarily stores a user identity ticket used for authenticating user identity; the encryption end stores a mapping relationship of user identity ticket and user login behavior; the authentication end stores user information login authority authorized by the server end;

[0044] The method includes:

[0045] When receiving the login request sent by the user terminal by scanning the login two-dimensional code of the login terminal, the authentication terminal acquires a complete signature, and calls a signature verification request interface to the encryption terminal through the complete signature; the encryption terminal generates a verification result according to the complete signature, and sends the verification result to the authentication terminal;

[0046] The authentication terminal performs login authentication on the login authentication request of the login terminal through the verification result.

[0047] A data verification device based on two-dimensional code third-party login and national secret authentication, the device relates to a user terminal, a server terminal, an encryption terminal, an authentication terminal and a login terminal, the user terminal is used for sending login information and user information to the server terminal; the server terminal has user information login authentication permission; the login terminal temporarily stores a user identity ticket used for authenticating user identity; the encryption terminal stores a mapping relationship of user identity ticket and user login behavior; the authentication terminal stores user information login permission authorized by the server terminal; the encryption device of two-dimensional code third-party login and national secret authentication realizes the steps of the data verification method based on two-dimensional code third-party login and national secret authentication in any one of the above:

[0048] Including:

[0049] A ticket acquisition module is configured to acquire a user identity ticket and a private key password corresponding to the user identity ticket when receiving a login request sent by the user terminal by scanning a login two-dimensional code of the login terminal;

[0050] A key password module is configured to encrypt the private key password by the encryption terminal to obtain an encrypted key password, and send the encrypted key password to the login terminal; the login terminal decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a cooperative signature request to the encryption terminal through the local private key;

[0051] A cooperative signature module is configured to determine cooperative signature response data according to the cooperative signature request and the user identity ticket by the encryption terminal, and send the cooperative signature response data to the login terminal; the login terminal generates a complete signature according to the cooperative signature response data, and sends verification information to the authentication terminal; the authentication terminal sends a verification request to the encryption terminal according to the verification information;

[0052] A signature verification module is configured to verify the complete signature by the encryption terminal through the verification request, and send a verification result to the authentication terminal.

[0053] In the embodiments of the present application, in order to solve the problem of low security of third-party login through a two-dimensional code in the prior art, the present application provides a data verification method based on two-dimensional code third-party login and national secret authentication, which involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate the user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end. The method comprises the following steps: when receiving a login request sent by the user end by scanning a login two-dimensional code of the login end, the encryption end acquires a user identity ticket and a private key password corresponding to the user identity ticket. The encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end. The login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption end through the local private key. The encryption end determines collaborative signature response data according to the collaborative signature request and the user identity ticket, and sends the collaborative signature response data to the login end. The login end generates a complete signature according to the collaborative signature response data, and submits verification information to the authentication end. The authentication end sends a verification request to the encryption end according to the verification information. The encryption end verifies the complete signature through the verification request, and sends a verification result to the authentication end. By setting the encryption end, the national secret authentication is combined with the two-dimensional code third-party login, so as to ensure the security of logging in a third-party website when scanning a two-dimensional code. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the present application, the drawings needed to be used in the description of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0055] Figure 1 is a step flow chart of an encryption end of a data verification method based on two-dimensional code third-party login and national secret authentication provided by an embodiment of the present application;

[0056] Figure 2 is a step flow chart of a login end of a data verification method based on two-dimensional code third-party login and national secret authentication provided by an embodiment of the present application;

[0057] Figure 3is a step flow chart of an authentication end of a data verification method based on a two-dimensional code third-party login and a national secret authentication, provided by an embodiment of the present application.

[0058] Figure 4 is a module structure schematic diagram of an encryption end of a data verification method based on a two-dimensional code third-party login and a national secret authentication, provided by an embodiment of the present application.

[0059] Figure 5 is a module structure schematic diagram of a login end of a data verification method based on a two-dimensional code third-party login and a national secret authentication, provided by an embodiment of the present application.

[0060] Figure 6 is a module structure schematic diagram of an authentication end of a data verification method based on a two-dimensional code third-party login and a national secret authentication, provided by an embodiment of the present application.

[0061] Figure 7 is a flow chart of a scanning authentication process when a certain login software as a third party performs two-dimensional code scanning login, provided by an embodiment of the present application.

[0062] Figure 8 is a flow chart of a fragmented key downloading process when a certain login software as a third party performs two-dimensional code scanning login, provided by an embodiment of the present application.

[0063] Figure 9 is a flow chart of a collaborative signature authentication process when a certain login software as a third party performs two-dimensional code scanning login, provided by an embodiment of the present application.

[0064] Figure 10 is a structure schematic diagram of a computer device, provided by an embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0066] The inventor finds through analyzing the prior art that when scanning a two-dimensional code for third-party login, a user identity ticket (such as a token) is usually stored in plaintext or simple encrypted form in the client, which is easy to be decompiled or extracted. Moreover, the ticket is insufficiently associated with user equipment, IP and other environmental information, and cannot effectively identify abnormal login.

[0067] It should be noted that the "national secret" mentioned in the present application refers to the Chinese national cryptographic standard, including but not limited to SM2 (elliptic curve public key cryptography algorithm), SM3 (hash algorithm), SM4 (block cipher algorithm) and a series of cryptographic algorithm standards.

[0068] In any embodiment of the present application, the login end is a browser end for providing user browsing of a website; the authentication end is a website business application; the server end is a third-party platform for logging in user information, which is an open authentication platform for logging in software; and the user end is a user device such as a mobile phone or a tablet computer that can be used to scan a two-dimensional code and has logged in user information on the third-party platform.

[0069] Referring to Figure 1 , a data verification method based on two-dimensional code third-party login and national secret authentication is shown, which involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end.

[0070] The method comprises:

[0071] S110, when receiving a login request sent by the user end by scanning a login two-dimensional code of the login end, the encryption end acquires a user identity ticket and acquires a private key password corresponding to the user identity ticket;

[0072] S120, the encryption end encrypts the private key password to obtain an encrypted key password and sends the encrypted key password to the login end. The login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a co-signature request to the encryption end through the local private key.

[0073] S130, the encryption end determines co-signature response data according to the co-signature request and the user identity ticket and sends the co-signature response data to the login end. The login end generates a complete signature according to the co-signature response data and submits verification information to the authentication end. The authentication end sends a verification request to the encryption end according to the verification information.

[0074] S140, the encryption end verifies the complete signature through the verification request and sends a verification result to the authentication end.

[0075] In the embodiments of the present application, in order to solve the problem of low security of third-party login through two-dimensional code in the prior art, the present application provides a data verification method based on two-dimensional code third-party login and national secret authentication, which involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate the user identity. The encryption end stores a mapping relationship between the user identity ticket and the user login behavior. The authentication end stores the user information login authority authorized by the server end. The method comprises the following steps: when receiving a login request sent by the user end by scanning a login two-dimensional code of the login end, the encryption end acquires a user identity ticket and a private key password corresponding to the user identity ticket; the encryption end encrypts the private key password to obtain an encrypted key password, and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption end through the local private key; the encryption end determines collaborative signature response data according to the collaborative signature request and the user identity ticket, and sends the collaborative signature response data to the login end; the login end generates a complete signature according to the collaborative signature response data, and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information; the encryption end verifies the complete signature through the verification request, and sends a verification result to the authentication end. By setting the encryption end, the national secret authentication is combined with the two-dimensional code third-party login, the deep integration of the national secret authentication and the login process is realized, and the security of logging in the third-party website when scanning the two-dimensional code is ensured.

[0076] It should be noted that the user end is the login initiator, triggers a login request by scanning the two-dimensional code of the login end, and submits user information (such as an account, device information, etc.) to the server end, which is the entrance of user operation.

[0077] The server end has the login verification authority of the user information, is responsible for storing and managing the user basic information, and is the basic data source of the legality of the user identity.

[0078] The login end is a target terminal (such as a PC end, an APP end, etc.) that needs to be logged in, stores a user identity ticket, and is used to prove the identity association of the terminal to be logged in to other ends.

[0079] The encryption end is a core security node, stores a mapping relationship between the user identity ticket and the user login behavior, is responsible for key generation, encryption, collaborative signature and final signature verification, and is the core executor of the national secret authentication.

[0080] The authentication end stores the user login permission authorized by the server end, serves as a judge of login legality, receives the verification request of the login end, and initiates the final verification to the encryption end, to ensure that the login behavior conforms to the authorized rules.

[0081] When the user scans the two-dimensional code of the login end through the user end, the login request of the login end is received by the encryption end. At this time, the encryption end first acquires the user identity ticket stored by the login end, and matches the corresponding private key password according to the ticket.

[0082] The encryption end encrypts the private key password, generates an encrypted key password and sends it to the login end. After receiving, the login end decrypts the private key password through the password algorithm module embedded in the local login interface, loads the local private key (the login end only stores part of the private key corresponding to the user identity, and does not store the complete private key) through the private key password, and sends a collaborative signature request to the encryption end based on the private key.

[0083] The encryption end generates collaborative signature response data (another part of the signature information held by the encryption end) according to the collaborative signature request of the login end and the user identity ticket acquired previously, and sends it to the login end. The login end combines the partial signature generated by the local private key with the collaborative signature response data of the encryption end, generates a complete signature (a digital signature based on a national secret algorithm such as SM2, with unforgeability), and submits verification information (such as signature value, user identity ticket, timestamp, etc.) containing the signature to the authentication end.

[0084] After receiving the verification information of the login end, the authentication end sends a verification request to the encryption end to request to confirm the signature legality. The encryption end completes the signature validity check through the complete signature, the user identity ticket in the verification request and the stored user login behavior mapping relationship, and finally returns the verification result (pass / reject) to the authentication end, which decides whether to allow login.

[0085] Next, a data verification method based on two-dimensional code third-party login and national secret authentication in the present exemplary embodiment will be further described.

[0086] In an embodiment of the present application, it further comprises:

[0087] As described in the following steps, the encryption end acquires application information;

[0088] As described in the following steps, the encryption end sends the application information to the server end, and the server end sends user login behavior data to the encryption end according to the application information;

[0089] As described in the following steps, the encryption end maps the user login behavior data to the user identity ticket, and generates a mapping relationship corresponding to the two;

[0090] When the login end initiates login authentication, the encryption end verifies the user identity ticket according to the mapping relationship.

[0091] As an example, when a user selects a login software to log in through a third-party application (such as an e-commerce APP), the encryption end first obtains the information of the application: such as application ID (a unique identifier assigned by the login software to the e-commerce APP), security level: the login software presets the security level according to the application type (such as financial applications require stricter verification), authorization scope: the permissions applied by the e-commerce APP (such as obtaining nickname, avatar, mobile phone number), etc.

[0092] The server end returns the login behavior data of the user to the encryption end according to the application information: such as historical login devices: the mobile phone models commonly used by the user, device fingerprints, login geographic location characteristics, login time patterns, etc.

[0093] The encryption end binds the above behavior data with the identity ticket of the user in the login software to generate a mapping relationship.

[0094] In an embodiment of the present application, it further comprises:

[0095] When the login end requests to download the fragment key, the encryption end obtains the user identity ticket and the binding information;

[0096] The encryption end verifies the correctness of the user identity ticket through the mapping relationship, and binds the binding information with the user information corresponding to the user identity ticket according to the user identity ticket to obtain the binding user information;

[0097] The encryption end generates a fragment key KC and a private key password according to the binding user information and the application information, and encrypts the private key password and the fragment key KC to generate a ciphertext C;

[0098] The encryption end sends the ciphertext C to the login end.

[0099] It should be noted that when the user logs in for the first time, the login end needs to download the fragment key, and through identity verification, information binding, and key encryption transmission, it is ensured that the fragment key is only obtained by the legal login end, and the unauthorized access risk is blocked from the source of the key.

[0100] When the login end initiates a request to download the fragment key (such as when a user logs in on a PC end for the first time, and the PC end has no local private key), the encryption end first obtains the user identity ticket and the binding information:

[0101] The binding information is device feature information (such as device ID, MAC address, operating system version) of the login end and user-initiated confirmation information (such as SMS verification code, biological characteristics, proving that the current operation is initiated by the user himself) and the like.

[0102] The encryption end calls a user identity ticket and login behavior mapping relationship to verify whether the currently submitted user identity ticket is legal. If the verification fails, the download request is directly rejected.

[0103] After the verification passes, the encryption end binds the binding information of the login end and user information (such as user account information, avatar information, real-name information) corresponding to the user identity ticket to generate bound user information.

[0104] The encryption end generates a fragment key KC based on the bound user information and application information, and encrypts and protects it:

[0105] Fragment key KC: private key fragment used by the login end to participate in collaborative signature;

[0106] Private key password: password used to encrypt and store the fragment key KC (the login end needs to decrypt it through the password when using the fragment key later).

[0107] Subsequently, the encryption end encrypts the private key password and the fragment key KC using a national secret algorithm to generate ciphertext C that cannot be directly interpreted.

[0108] In an embodiment of the present application, the specific process of the step "the encryption end generates a fragment key KC and a private key password according to the bound user information and the application information, and encrypts the private key password and the fragment key KC to generate ciphertext C" can be further described in combination with the following description.

[0109] As described in the following steps, the encryption end obtains the SM2 temporary public key, user ID and device ID sent by the login end;

[0110] As described in the following steps, the encryption end generates a fragment key KC according to the user ID and the device ID;

[0111] As described in the following steps, the encryption end randomly generates a private key password, and saves the private key password and the SM2 temporary public key to a KV data record, wherein the KV data record corresponds to the device ID and the user ID;

[0112] As described in the following steps, the encryption end encrypts the private key password and the fragment key KC through the SM2 temporary public key respectively to obtain ciphertext C.

[0113] It should be noted that the SM2 temporary public key is a public key generated temporarily by the login end based on the national secret SM2 algorithm, a public key in asymmetric encryption, used only for this session, and corresponding to the pairing private key of the login end locally holding the public key. The user ID is a unique identifier of the user in the system (such as a mobile phone number, account ID, etc., used to associate the user identity), and the device ID is a browser thumbprint.

[0114] The encryption end generates a fragment key KC through a preset algorithm with the user ID and the device ID as core inputs; the encryption end randomly generates a key password, which is used to encrypt the fragment key KC when the login end stores the fragment key KC, and needs to be decrypted before the fragment key KC is used subsequently. The encryption end stores the private key password in association with the SM2 temporary public key sent by the login end to form a KV data record, and the record is bound to the device ID and the user ID; the private key password is encrypted by the SM2 temporary public key based on the national secret SM2 asymmetric encryption algorithm to obtain encrypted password ciphertext; the fragment key KC is also encrypted by the SM2 temporary public key to obtain encrypted key ciphertext; and the key ciphertext and the password ciphertext are combined to obtain ciphertext C.

[0115] In an embodiment of the present application, a data verification method based on two-dimensional code third-party login and national secret authentication is provided, which involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate the user identity. The encryption end stores a mapping relationship between the user identity ticket and the user login behavior. The authentication end stores the user information login authority authorized by the server end.

[0116] The method comprises:

[0117] S210, when receiving the login request response sent by the user end by scanning the login two-dimensional code of the login end, the login end initiates login authentication to the encryption end through the user identity ticket, and the encryption end sends an encryption key password corresponding to the user identity ticket to the login end;

[0118] S220, the login end decrypts the encryption key password to obtain a private key password, loads a local private key through the private key password, sends a cooperative signature request to the encryption end through the local private key, and signs login request data to generate a local partial signature. The encryption end sends corresponding cooperative signature response data to the login end according to the cooperative signature request and the user identity ticket.

[0119] S230, the login end gets a complete signature by signing the local part signature and the collaborative signature response data, and requests the national secret authentication from the authentication end according to the complete signature.

[0120] It should be noted that the login end sends a user identity ticket to the encryption end to request login authentication; the encryption end generates an encryption key password corresponding to the ticket after verifying the validity of the ticket, and returns the encryption key password to the login end; the login end decrypts the encryption key password by using a locally stored decryption key to obtain a local private key; the login end generates a local part signature by partially signing the login request through the local private key, and sends the signature request and the user identity ticket to the encryption end; the encryption end generates collaborative signature response data in combination with the user identity ticket and a private key fragment stored by itself, and returns the collaborative signature response data to the login end; the login end combines the local part signature and the collaborative signature response data to generate a complete signature, that is, a digital signature conforming to the national secret SM2 standard; the login end submits the complete signature and the user identity ticket to the authentication end to request national secret authentication; and the authentication end verifies the validity of the signature, and decides whether to grant login permission according to the pre-authorized permission of the server end.

[0121] In an embodiment of the present application, further comprising:

[0122] As described in the following steps, when the user end scans the login two-dimensional code of the login end and obtains the user identity ticket returned by the server end, the login end determines whether there is a fragment key in the local end according to the user information;

[0123] As described in the following steps, if the fragment key exists, the login end performs a collaborative signature operation;

[0124] As described in the following steps, if the fragment key does not exist, the login end performs a binding operation.

[0125] It should be noted that when the user scans the two-dimensional code of the login end through the user end, the login end first searches the local storage according to the current user information (such as user ID) to determine whether there is a fragment key bound to the user, and designs different processes for two scenarios by judging whether the fragment key exists, so as to avoid process interruption due to no key when logging in for the first time or experience redundancy caused by repeated binding when logging in for the second time.

[0126] In an embodiment of the present application, the specific process of the step “if the fragment key does not exist, the login end performs a binding operation” can be further illustrated in combination with the following description.

[0127] As described in the following steps, the login end sends the user identity ticket and the binding information to the encryption end; the encryption end searches the user login behavior according to the mapping relationship, binds the user login behavior and the binding information, and returns an authentication token to the login end;

[0128] The login end calls a fragment key download interface according to the user identity ticket and the authentication token; and the encryption end generates ciphertext C according to the binding information and the application information, and sends the ciphertext C to the login end.

[0129] The login end decrypts the ciphertext C to obtain a fragment key KC and a private key password.

[0130] The login end encrypts the fragment key KC according to the private key password and stores the encrypted KC to obtain the fragment key.

[0131] It should be noted that when the login end requests login for the first time and there is no fragment key locally, the binding needs to be completed through the above steps to finally obtain the fragment key. The login end sends a user identity ticket and binding information to the encryption end, the binding information is device characteristics of the login end, such as a device ID, a MAC address, an operating system version, and user-initiated authorization information such as an SMS verification code and a biological feature, proving that the current binding is operated by the user himself / herself. The encryption end calls a stored user identity ticket and login behavior mapping relationship to retrieve historical login behaviors of the user, and verifies whether the current binding request conforms to the user's habits; after verification, the encryption end associates the user's historical login behaviors with the binding information of the current login end to complete the binding of the user information; the encryption end generates an authentication token (a temporary authorization token containing an encrypted digest of the binding information) and returns it to the login end; the login end carries the user identity ticket and the authentication token, calls a fragment key download interface, and requests the encryption end to download the fragment key; the encryption end first verifies the validity of the authentication token (such as whether it is within the valid period and whether it matches the user identity ticket) to prevent the authentication token from being stolen and misused; after verification, the encryption end generates a fragment key KC and a private key password in combination with the binding information (such as a device ID) and the application information (such as an application security level and an authorization range); the encryption end encrypts KC and the private key password through a national secret algorithm to generate ciphertext C and sends it to the login end. After receiving the ciphertext C, the login end decrypts it through a locally stored SM2 temporary private key to obtain the fragment key KC and the private key password; the login end encrypts the fragment key KC through the private key password and stores the encrypted KC in a local secure area to finally form the fragment key.

[0132] In an embodiment of the present application, the step S220 can be further described as follows: the login end decrypts the encryption key password to obtain a private key password, loads a local private key through the private key password, sends a co-signature request to the encryption end through the local private key, and signs login request data to generate a local partial signature; and the encryption end sends corresponding co-signature response data to the login end according to the co-signature request and the user identity ticket.

[0133] The login end decrypts the encryption key password to obtain a private key password, as described in the following steps.

[0134] The login end loads a local private key through the private key password, as described in the following steps.

[0135] The login end sends a cooperative signature request through the local private key and performs local partial signature through the local private key, as described in the following steps.

[0136] It should be noted that through cooperative signature, the private key only exists temporarily in the memory and is not stored in the form of plaintext; the signature process is completed by the login end and the encryption end, and a single entity cannot forge a complete signature, even if the login end is attacked, an attacker cannot obtain a complete private key or copy the signature logic.

[0137] In an embodiment of the present application, a two-dimensional code third-party login and national secret authentication encryption method is also provided, which involves a user end, a server end, an encryption end, an authentication end and a login end. The user end is used to send login information and user information to the server end. The server end has user information login verification authority. The login end temporarily stores a user identity ticket used to authenticate user identity. The encryption end stores a mapping relationship between the user identity ticket and user login behavior. The authentication end stores user information login authority authorized by the server end.

[0138] The method comprises the following steps.

[0139] S310, when receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the authentication end obtains a complete signature and calls a signature verification request interface to the encryption end through the complete signature. The encryption end generates a verification result according to the complete signature and sends the verification result to the authentication end.

[0140] S320, the authentication end performs login authentication on the login authentication request of the login end through the verification result.

[0141] It should be noted that the login end generates a complete signature and submits a login authentication request containing the signature to the authentication end. The authentication end extracts the complete signature from the login end's request; the authentication end calls the signature verification request interface, sends the complete signature, user identity ticket and other information to the encryption end, and requests to verify the legality of the signature; after receiving the complete signature, the encryption end first verifies whether the signature format conforms to the national standard; combined with the user identity ticket, the historical login behavior of the user is extracted from the stored mapping relationship to verify whether the login behavior corresponding to the signature is abnormal; the authenticity of the complete signature is verified through the national cryptographic algorithm, that is, whether the signature is generated by the local private key of the login end and the collaborative private key of the encryption end, to ensure that the signature has not been forged; the encryption end generates a verification result and returns it to the authentication end. The authentication end receives the verification result of the encryption end; combined with the user information login permission authorized by the server end stored by itself, it comprehensively judges whether to allow login; if the verification is passed and the permission is matched, the authentication end sends a "login success" response to the login end; if the verification fails or the permission is insufficient, the login is rejected and the reason is returned.

[0142] As an example, refer to Figure 7 , a flowchart of the scanning authentication process when a certain login software acts as a third party to perform two-dimensional code scanning login, wherein the PC browser acts as the login end, the certain login software acts as the user end, the website business application (national cryptographic authentication) acts as the authentication end, the open platform of the certain login software acts as the server end, and the third-party encryption platform acts as the encryption end.

[0143] Refer to Figure 8 , a flowchart of the fragment key download process when a certain login software acts as a third party to perform two-dimensional code scanning login, wherein the left dashed line is the PC browser, i.e. the login end; the middle dashed line is the website business application (national cryptographic authentication), i.e. the authentication end; and the right dashed line is the third-party encryption platform, i.e. the encryption end.

[0144] Refer to Figure 9 , a flowchart of the collaborative signature authentication process when a certain login software acts as a third party to perform two-dimensional code scanning login, wherein the left dashed line is the PC browser, i.e. the login end; the middle dashed line is the website business application (national cryptographic authentication), i.e. the authentication end; and the right dashed line is the third-party encryption platform, i.e. the encryption end.

[0145] Figures 7-9 Among them, appid: application ID, used to identify a certain application; appsecret: application authentication code, used together with application ID to identify the identity of the application; auth ticket: user identity authentication ticket, used for temporary authentication data to authenticate user identity; access token: token data used to mark user login behavior in the authentication protocol, generally issued by the business system after the user logs in successfully; passwd: password for protecting the private key.

[0146] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant part can be referred to the part of the method embodiment.

[0147] Referring to Figure 4 , a two-dimensional code third-party login and data verification device based on SM authentication is shown, the device relates to a user end, a server end, an encryption end, an authentication end and a login end, the user end is used for sending login information and user information to the server end; the server end has user information login verification authority; the login end temporarily stores a user identity ticket used for authenticating user identity; the encryption end stores a mapping relationship of user identity ticket and user login behavior; the authentication end stores user information login authority authorized by the server end; the encryption device of the two-dimensional code third-party login and SM authentication realizes the steps of the data verification method based on the two-dimensional code third-party login and SM authentication as described in any one of the above:

[0148] including:

[0149] The ticket acquisition module 410 is used for acquiring the user identity ticket and acquiring the private key password corresponding to the user identity ticket when the login request sent by the user end by scanning the login two-dimensional code of the login end is received.

[0150] The key password module 420 is used for the encryption end to encrypt the private key password to obtain an encrypted key password, and send the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain the private key password, loads the local private key through the private key password, and sends the cooperative signature request to the encryption end through the local private key.

[0151] The cooperative signature module 430 is used for the encryption end to determine the cooperative signature response data according to the cooperative signature request and the user identity ticket and send the cooperative signature response data to the login end; the login end generates a complete signature according to the cooperative signature response data and submits the verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information.

[0152] The signature verification module 440 is used for the encryption end to verify the complete signature through the verification request, and send the verification result to the authentication end.

[0153] In an embodiment of the application, further comprising:

[0154] The acquisition module is used for the encryption end to acquire application information.

[0155] An application information module is configured to send, by the encryption end, the application information to a server end, and the server end is configured to send, according to the application information, user login behavior data to the encryption end;

[0156] A mapping module is configured to map, by the encryption end, the user login behavior data to the user identity ticket, and generate a mapping relationship corresponding to the two.

[0157] A mapping relationship verification module is configured to, when the login end initiates login authentication, verify, by the encryption end, the user identity ticket according to the mapping relationship.

[0158] In an embodiment of the present application, the application further comprises:

[0159] A binding information acquisition module is configured to, when the login end requests to download a fragment key, acquire, by the encryption end, a user identity ticket and binding information.

[0160] A bound user information module is configured to verify, by the encryption end, the correctness of the user identity ticket through the mapping relationship, bind, according to the user identity ticket, the binding information and user information corresponding to the user identity ticket, and obtain bound user information.

[0161] A ciphertext C module is configured to generate, by the encryption end, a fragment key KC and a private key password according to the bound user information and the application information, encrypt the private key password and the fragment key KC, and generate a ciphertext C.

[0162] A ciphertext C sending module is configured to send, by the encryption end, the ciphertext C to the login end.

[0163] In an embodiment of the present application, the ciphertext C module comprises:

[0164] An information acquisition module is configured to acquire, by the encryption end, an SM2 temporary public key, a user ID and a device ID sent by the login end.

[0165] A fragment key generation module is configured to generate, by the encryption end, a fragment key KC according to the user ID and the device ID.

[0166] A KV data module is configured to randomly generate, by the encryption end, a private key password, and save the private key password and the SM2 temporary public key to a KV data record, wherein the KV data record corresponds to the device ID and the user ID.

[0167] A ciphertext C generation module is configured to encrypt, by the encryption end, the private key password and the fragment key KC through the SM2 temporary public key, respectively, and obtain a ciphertext C.

[0168] Reference Figure 5, a two-dimensional code third-party login and national secret authentication data verification device is shown, the device relates to a user end, a server end, an encryption end, an authentication end and a login end, the user end is used for sending login information and user information to the server end; the server end has user information login verification authority; the login end temporarily stores a user identity ticket used for authenticating user identity; the encryption end stores a mapping relationship of the user identity ticket and user login behavior; the authentication end stores user information login authority authorized by the server end; the encryption device of the two-dimensional code third-party login and national secret authentication realizes the steps of the data verification method based on the two-dimensional code third-party login and national secret authentication as described in any one of the above:

[0169] comprising:

[0170] The login authentication module 510 is configured to, when receiving a login request sent by the user end by scanning a login two-dimensional code of the login end, initiate login authentication by the user identity ticket to the encryption end by the login end, and send an encryption key password corresponding to the user identity ticket to the login end by the encryption end;

[0171] The local private key module 520 is configured to decrypt the encryption key password to obtain a private key password by the login end, load a local private key by the private key password, send a collaborative signature request to the encryption end by the local private key, and sign login request data to generate a local partial signature; and the encryption end sends corresponding collaborative signature response data to the login end according to the collaborative signature request and the user identity ticket.

[0172] The request authentication module 530 is configured to obtain a complete signature by the login end through the local partial signature and the collaborative signature response data, and request national secret authentication from the authentication end according to the complete signature.

[0173] In an embodiment of the application, further comprising:

[0174] The fragment key verification module is configured to, when the user end scans the login two-dimensional code of the login end and obtains the user identity ticket returned by the server end, determine whether a fragment key exists locally according to user information by the login end;

[0175] The request signature module is configured to, if the fragment key exists, perform a collaborative signature operation by the login end.

[0176] The request binding module is configured to, if the fragment key does not exist, perform a binding operation by the login end.

[0177] In an embodiment of the application, the request binding module comprises:

[0178] The binding information sending submodule is configured to send the user identity ticket and the binding information to the encryption end by the login end; the encryption end searches the user login behavior according to the mapping relationship, binds the user login behavior with the binding information, and returns an authentication token to the login end;

[0179] The fragment key downloading submodule is configured to call a fragment key downloading interface by the login end through the user identity ticket and the authentication token; the encryption end generates a ciphertext C according to the binding information and the application information, and sends the ciphertext C to the login end;

[0180] The decryption submodule is configured to decrypt the ciphertext C to obtain a fragment key KC and a private key password by the login end;

[0181] The storage submodule is configured to encrypt the fragment key KC through the private key password and store the fragment key KC by the login end, so as to obtain a fragment key.

[0182] In an embodiment of the application, the local private key module 520 comprises:

[0183] The key password decryption submodule is configured to decrypt the encrypted key password to obtain a private key password by the login end;

[0184] The local private key loading submodule is configured to load a local private key through the private key password by the login end;

[0185] The local signature submodule is configured to send a cooperative signature request through the local private key by the login end, and perform local partial signature through the local private key.

[0186] Referring to Figure 6 , a kind of data verification device based on two-dimensional code third-party login and national secret authentication provided in an embodiment of the application is shown, the device involves user end, server end, encryption end, authentication end and login end, the user end is used to send login information and user information to the server end;The server end has user information login verification authority;The login end temporarily stores user identity ticket for authenticating user identity;The encryption end stores the mapping relationship of user identity ticket and user login behavior;The authentication end stores the user information login authority authorized by server end;The encryption device of two-dimensional code third-party login and national secret authentication realizes the steps of the data verification method based on two-dimensional code third-party login and national secret authentication as described in any one of the above embodiments:

[0187] Including:

[0188] The complete signature module 610 is used for when receiving the login request sent by the user end by scanning the login two-dimensional code of the login end, the authentication end acquires a complete signature, and calls a signature verification request interface to the encryption end through the complete signature; the encryption end generates a verification result according to the complete signature, and sends the verification result to the authentication end;

[0189] The login authentication module 620 is used for the authentication end to perform login authentication on the login authentication request of the login end through the verification result.

[0190] Referring to Figure 10 , a computer device based on a two-dimensional code third-party login and a data verification method of a national secret authentication is shown, and specifically can include the following:

[0191] The computer device 12 is in the form of a general-purpose computing device, and the components of the computer device 12 can include but are not limited to one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0192] The bus 18 represents one or more of several types of buses 18 structures, including a memory bus 18 or a memory controller, a peripheral bus 18, a graphics acceleration port, a processor, or a local bus 18 using any of a variety of bus 18 structures. For example, these architectures include but are not limited to industry standard architecture (ISA) bus 18, micro channel architecture (MAC) bus 18, enhanced ISA bus 18, video electronics standards association (VESA) local bus 18, and peripheral component interconnect (PCI) bus 18.

[0193] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and nonvolatile media, removable and non-removable media.

[0194] The system memory 28 can include a computer system readable medium in the form of volatile memory, such as a random access memory (RAM) 30 and / or a cache memory 32. The computer device 12 can further include other mobile / non-mobile, volatile / non-volatile computer system storage media. For example, a storage system 34 can be used to read from and write to a non-removable, non-volatile magnetic media (commonly referred to as a "hard disk drive"). Although not specifically shown, the computer device 12 can further include other removable / non-removable, volatile / non-volatile computer system storage media such as a magnetic disk drive, a solid state drive, a Blu-ray drive, and the like. Figure 4A disk drive, a floppy disk drive, a CD-ROM drive, etc. can be provided for reading from or writing to a removable nonvolatile magnetic media (e.g., a "floppy disk"), and to a removable nonvolatile optical disk (e.g., an optical CD ROM or other optical media). In these instances, each will be connected to the bus 18 by one or more data media interfaces. The memory can include at least one program product having a set (e.g., at least one) of program modules 42 configured to carry out the functions of embodiments of the application.

[0195] The program / utility 40, having a set (at least one) of program modules 42, can be stored in, for example, memory (RAM, ROM, etc.) as noted above. Each of the operating system, one or more applications, other program modules 42, and program data, or some combination thereof, can include implementation of a networking environment. The program modules 42 generally carry out the functions and / or methodologies of embodiments of the application as described herein.

[0196] The computer device 12 can also communicate with one or more external devices 14 such as a keyboard, a pointing device, a display 24, a camera, etc.; one or more devices that enable a health care professional to interact with the computer device 12; and / or one or more devices that enable the computer device 12 to communicate with one or more other computer devices. Such communication can be via an input / output (I / O) interface 22. Further, the computer device 12 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with the other components of the computer device 12 via the bus 18. It should be appreciated that the network adapter 20 and / or the bus 18 can be implemented using one or more types of technology that are known in the art. Figure 10 Other hardware and / or software modules can be used in conjunction with the computer device 12, including but not limited to microcode, device drivers, redundant processing units 16, external disk drive arrays, RAID systems, tape drives, and data archival storage systems 34, etc.

[0197] The processing unit 16 performs various function applications and data processing by running programs stored in the system memory 28, such as implementing a data verification method based on a two-dimensional code third-party login and a national secret authentication.

[0198] That is, the processing unit 16 implements the following when executing the above program: when receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the encryption end obtains a user identity ticket and obtains a private key password corresponding to the user identity ticket;

[0199] The encryption end encrypts the private key password downward to obtain an encrypted key password, and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption end through the local private key;

[0200] The encryption end determines collaborative signature response data according to the collaborative signature request and the user identity ticket, and sends the collaborative signature response data to the login end; the login end generates a complete signature according to the collaborative signature response data, and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information;

[0201] The encryption end verifies the complete signature through the verification request, and sends a verification result to the authentication end.

[0202] In the embodiment of the application, the application also provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the data verification method based on the third-party login of a two-dimensional code and the national secret authentication provided by all embodiments of the application:

[0203] That is, the program is executed by the processor to realize the following: when receiving a login request sent by the user end by scanning the login two-dimensional code of the login end, the encryption end obtains a user identity ticket and a private key password corresponding to the user identity ticket;

[0204] The encryption end encrypts the private key password downward to obtain an encrypted key password, and sends the encrypted key password to the login end; the login end decrypts the encrypted key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption end through the local private key;

[0205] The encryption end determines collaborative signature response data according to the collaborative signature request and the user identity ticket, and sends the collaborative signature response data to the login end; the login end generates a complete signature according to the collaborative signature response data, and submits verification information to the authentication end; the authentication end sends a verification request to the encryption end according to the verification information;

[0206] The encryption end verifies the complete signature through the verification request, and sends a verification result to the authentication end.

[0207] Any combination of one or more computer readable medium can be utilized. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium can be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0208] A computer readable signal medium can include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0209] Program code embodied on a computer readable medium can be transmitted using any apparatus adapted to transmit such a program code, including a modem, or other wired and wireless communication techniques. A mobile computing device can include one or more processing units and memory and execute instructions stored in the memory to implement various operations, functions, and / or acts described herein. A mobile computing device can also include a user interface, which can include a display, a keyboard, a touch screen, a microphone, a speaker, and / or other input / output devices.

[0210] Although the preferred embodiments of the application have been described in detail, those skilled in the art will appreciate that various modifications and alterations can be made hereto without departing from the scope and spirit of the application. Accordingly, it is intended that all possible modifications and alterations be included within the scope of the application. The application is intended to cover any and all modifications of the application within the scope of the claims.

[0211] Finally, it should be noted that, in the present document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily implying any actual relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0212] The above describes in detail a data verification method based on two-dimensional code third-party login and national cryptographic authentication provided by the present application, and the principle and implementation mode of the present application are described by using specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range can be changed, and the above description should not be understood as a limitation of the present application.

Claims

1. A data verification method based on QR code third-party login and national cryptographic authentication, characterized in that, The method involves a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used to authenticate user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; The authentication terminal stores user login information and permissions authorized by the server. The method includes: When the client receives a login request sent by the user terminal by scanning the login QR code of the login terminal, the encryption terminal obtains the user identity ticket and the private key password corresponding to the user identity ticket; The encryption terminal encrypts the private key password to obtain an encryption key password, and sends the encryption key password to the login terminal; the login terminal decrypts the encryption key password to obtain a private key password, loads a local private key using the private key password, and sends a collaborative signature request to the encryption terminal using the local private key. The encryption terminal determines collaborative signature response data based on the collaborative signature request and the user identity ticket, and sends it to the login terminal; the login terminal generates a complete signature based on the collaborative signature response data and submits verification information to the authentication terminal; the authentication terminal sends a verification request to the encryption terminal based on the verification information. The encryption end verifies the complete signature through the verification request and sends the verification result to the authentication end.

2. The method according to claim 1, characterized in that, Also includes: The encrypted terminal obtains application information; The encrypted terminal sends the application information to the server, and the server sends user login behavior data to the encrypted terminal based on the application information. The encryption terminal maps the user login behavior data to the user identity ticket, generating a corresponding mapping relationship between the two. When the login terminal initiates login authentication, the encryption terminal verifies the user identity ticket based on the mapping relationship.

3. The method according to claim 2, characterized in that, Also includes: When the login terminal requests to download the fragment key, the encryption terminal obtains the user's identity ticket and binding information; The encryption terminal verifies the correctness of the user identity ticket through the mapping relationship, and binds the binding information with the user information corresponding to the user identity ticket based on the user identity ticket to obtain the bound user information; The encryption terminal generates a fragmentation key KC and a private key password based on the bound user information and the application information, and encrypts the private key password and the fragmentation key KC to generate ciphertext C; The encryption terminal sends the ciphertext C to the login terminal.

4. The method according to claim 3, characterized in that, The step of generating a fragmentation key KC and a private key password based on the bound user information and the application information, and encrypting the private key password and the fragmentation key KC to generate ciphertext C, includes: The encryption terminal obtains the SM2 temporary public key, user ID, and device ID sent by the login terminal; The encryption terminal generates a fragmentation key KC based on the user ID and the device ID; The encryption terminal randomly generates a private key password and saves the private key password and the SM2 temporary public key into a KV data record, wherein the KV data record corresponds to the device ID and the user ID; The encryption terminal uses the SM2 temporary public key to encrypt the private key password and the fragmentation key KC respectively, to obtain ciphertext C.

5. A data verification method based on QR code third-party login and national cryptographic authentication, characterized in that, The method involves a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used to authenticate user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; The authentication terminal stores user login information and permissions authorized by the server. The method includes: When the login request response is received from the user terminal by scanning the login QR code of the login terminal, the login terminal initiates login authentication to the encryption terminal through the user identity ticket, and the encryption terminal sends the encryption key password corresponding to the user identity ticket to the login terminal; The login terminal decrypts the encryption key password to obtain the private key password, loads the local private key using the private key password, sends a collaborative signature request to the encryption terminal using the local private key, and signs the login request data to generate a local partial signature; the encryption terminal sends the corresponding collaborative signature response data to the login terminal based on the collaborative signature request and the user identity ticket. The login terminal obtains a complete signature by combining the local partial signature with the collaborative signature response data, and requests national cryptographic authentication from the authentication terminal based on the complete signature.

6. The method according to claim 5, characterized in that, Also includes: When the user terminal scans the login QR code of the login terminal and obtains the user identity ticket returned by the server, the login terminal determines whether a fragmentation key exists locally based on the user information. If the fragmentation key exists, the login terminal performs a collaborative signature operation; If the fragment key does not exist, the login terminal will perform a binding operation.

7. The method according to claim 6, characterized in that, If the fragment key does not exist, the steps for the login terminal to perform the binding operation include: The login terminal sends a user identity ticket and binding information to the encryption terminal; the encryption terminal retrieves the user login behavior according to the mapping relationship, binds the user login behavior with the binding information, and returns an authentication token to the login terminal; The login terminal calls the fragment key download interface using the user identity ticket and the authentication token; the encryption terminal generates ciphertext C based on the binding information and application information, and sends ciphertext C to the login terminal; The login terminal decrypts the ciphertext C to obtain the fragmentation key KC and the private key password; The login terminal encrypts and stores the fragment key KC using a private key password to obtain the fragment key.

8. The method according to claim 5, characterized in that, The login terminal decrypts the encryption key password to obtain the private key password, loads the local private key through the private key password, sends a collaborative signature request to the encryption terminal through the local private key, and signs the login request data to generate a local partial signature. The step of the encryption terminal sending corresponding collaborative signature response data to the login terminal based on the collaborative signature request and the user identity ticket includes: The login terminal decrypts the encrypted key password to obtain the private key password; The login terminal loads a local private key using the private key password; The login terminal sends a collaborative signature request using the local private key and performs a local partial signature using the local private key.

9. A method for encrypting QR code third-party login and national cryptographic authentication, characterized in that, The method involves a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used to authenticate user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; The authentication terminal stores user login information and permissions authorized by the server. The method includes: When the authentication terminal receives a login request sent by the user terminal by scanning the login QR code of the login terminal, the authentication terminal obtains the complete signature and calls the signature verification request interface of the encryption terminal using the complete signature; the encryption terminal generates a verification result based on the complete signature and sends the verification result to the authentication terminal. The authentication terminal performs login authentication on the login terminal's login authentication request based on the verification result.

10. A data verification device based on QR code third-party login and national cryptographic authentication, characterized in that, The device includes a user terminal, a server terminal, an encryption terminal, an authentication terminal, and a login terminal. The user terminal is used to send login information and user information to the server terminal. The server has user information login verification permissions; the login terminal temporarily stores user identity tickets used for authenticating user identity; the encryption terminal stores the mapping relationship between user identity tickets and user login behavior; the authentication terminal stores user information login permissions authorized by the server; the data verification device based on QR code third-party login and national cryptographic authentication implements the steps of the data verification method based on QR code third-party login and national cryptographic authentication as described in any one of claims 1 to 4: include: The ticket acquisition module is used to obtain the user identity ticket and the private key password corresponding to the user identity ticket when the encryption terminal receives a login request sent by the user terminal by scanning the login QR code of the login terminal. The key-password module is used by the encryption terminal to encrypt the private key password to obtain an encryption key password, and send the encryption key password to the login terminal; the login terminal decrypts the encryption key password to obtain a private key password, loads a local private key through the private key password, and sends a collaborative signature request to the encryption terminal through the local private key. The collaborative signature module is used by the encryption terminal to determine collaborative signature response data based on the collaborative signature request and the user identity ticket, and send it to the login terminal; the login terminal generates a complete signature based on the collaborative signature response data and submits verification information to the authentication terminal; the authentication terminal sends a verification request to the encryption terminal based on the verification information. The signature verification module is used by the encryption end to verify the complete signature through the verification request and send the verification result to the authentication end.

Images