CN107454077A - A kind of single-point logging method based on IKI ID authentications - Google Patents

Abstract

The present invention relates to a kind of single-point logging method based on IKI ID authentications, comprise the following steps：Access request is sent, random number r is produced, service end is sent collectively to together with mark；Mark is verified, by rear, generation random number R, and be combined with r（R||r）, signed with private key, generation signed data Sig1；Send R, mark, Sig1；Checking mark, verifies Sig1, confirms identity legitimacy after being verified；Utilize private key pair（R||r）Signed, generate signed data Sig2, Sig2 is sent to server end；Sig2 is verified, identity legitimacy is confirmed after being verified, checks single-sign-on mapping table, finds out the account of mark binding, User Token is produced, is directed to application system；User Token is received, obtains the login account of user, the state of user is set to login, returns to the page that request accesses, completes to access.Beneficial effects of the present invention：The security of single-node login system is improved, gives a kind of identity identifying method of high intensity.

Description

A kind of single-point logging method based on IKI ID authentications

Technical field

The present invention relates to field of information security technology, it particularly relates to a kind of single-point logging method.

Background technology

With the fast development of information technology and network technology, the application system of enterprises is more and more.Such as manpowerResource management system, financial system, OA systems, CRM system etc..Because these systems are independent mutually, user makesWith must be logged in before each application system according to corresponding system identity, for this, user must remember each systemUsername and password, this brings many troubles to user.In particular with increasing for system, the possibility of error will increaseAdd, the possibility illegally intercepted and captured and destroyed can also increase, and security will be reduced accordingly.It is directed to such case, single-pointLog in concept to arise at the historic moment, and be constantly applied in enterprise application system.

Single-sign-on is a kind of unified certification and licensing scheme, refers to the same use for accessing the locked resource in different applicationFamily, it is only necessary to log in once, i.e., by the safety verification in an application after, visit again the locked resource in other applicationWhen, it is no longer necessary to login authentication again.Single-sign-on can improve the operating efficiency of system, reduce the error probability of system.

Along with single-sign-on field research deepen continuously and Web service and application Integrating it is persistently overheating,There are a variety of single-sign-on solutions at present.Such as the WebSphere single-sign-on solutions of IBM Corporation, SUN companiesSun Java System Access Manager, Microsoft .Net Passport and NetegritySiteMinder, BEA WebLogic, and some products based on SAML, such as OPENSAML and SourceID etc..ButIt is that existing product also has some shortcomings in the security of single-sign-on, most variations in the communication process between serverSensitive information is transmitted using plaintext version, these information are easy to be stolen, and cause important information to reveal.In addition, communicatingMost variations are not also signed to key message in journey, easily by spoof attack.

The problem of in correlation technique, effective solution is not yet proposed at present.

The content of the invention

For the above-mentioned technical problem in correlation technique, the present invention proposes a kind of single-sign-on based on IKI ID authenticationsMethod, it can solve the problem that above technical problem.

To realize above-mentioned technical purpose, the technical proposal of the invention is realized in this way：

A kind of single-point logging method based on IKI ID authentications, comprises the following steps：

S1 user terminals send access request to server, produce random number r, and service end is sent collectively to together with user terminal mark；

S2 server ends are verified to user terminal mark, and by rear, server end produces random number R, and random with user terminalNumber r is combined, for (R | | r), signed with server end private key, generation signed data Sig1；

Random number R, server end mark, signed data Sig1 are sent to user terminal by S3 server ends；

S4 user terminal authentication servers end is identified, and the public key verifications signed data in server identification is utilized after being verifiedSig1, it is verified rear confirmed service device end identity legitimacy；

S5 user terminals are signed using private key to random number (R | | r), generate signed data Sig2, signed data Sig2 is sent outIt is sent to server end；

S6 server by utilizing user terminal public key verifications signed data Sig2, user terminal identity legitimacy is confirmed after being verified；

S7 server end login authentications equipment checks user's single-sign-on mapping table, finds out user mark in corresponding application systemThe account bound on system, User Token is produced, is re-introduced into application system；

S8 application systems receive the User Token of unified form, login account of the user in the system are obtained, by user at thisThe state of system is set to login, returns to the page that user asks to access, completes access of the user to the application system.

Further, administrative center is identified by IKI and produces the server end mark, user terminal mark, private key and public affairsKey.

Further, the production stage of the server end mark, user terminal mark, private key and public key is：

S101IKI marks administrative center IMC discloses parameter：Public key matrix PKMS, identify administrative center public key PK_IDorg, ECC songsLine, basic point G；Wherein public key matrix PKMS is mark administrative center private key SK_IDorgTo public key matrix pkm, mark administrative center markKnow ID_orgEtc. the signature of parameter；

S102 entities produce entity ID and relevant parameter：Secret value xID, secret value public key PKx are produced using entity security equipment=xID*G, unsymmetrical key is randomly generated to SK using ECC algorithm_h、PK_h；

The partial parameters that S103 encryptions need to upload：Use mark administrative center public key PK_IDorgTo secret value public key PKx and at randomUnsymmetrical key public key PK_hEncryption：E(PK_IDorg,PKx||PK_h)；

S104 uploads entity ID, E (PK_IDorg,PKx||PK_h) and mark validity date extremely mark administrative center IMC；Wherein identifyValidity date is to be necessary to determine whether to upload according to application；

S105 marks administrative center carries out entity ID duplicate checkings, produces entity part private key：IMC determines that entity ID combination marks are effectiveAfter the uniqueness of phase, using PKMS and entity ID, the mark term of validity, entity ID public keys PK is calculated_ID, utilize private key matrix skmWith entity ID, mark term of validity computational entity ID private keys SK_ID, entity encryption key SKE and part signature is obtained after SKE is convertedPrivate key SKS1；

S106 mark administrative center IMC assembling marks：Use mark management organization private key SK_IDorgDecrypt E (PK_IDorg,PKx||PK_h) obtain PKx and PK_h, composite entity ID public signature keys：PKS=SKS1*G+PKx；Calculate decryption public key PKE=SKE*G, use SK_IDTo (PKS | | PKE | | the effective date | | the Expiration Date | | ID_org| | ID) signature, identified

S107 issues mark and entity key：IMC utilizes PK_hSKE is encrypted to obtain E (PK_h, SKE), by E (PK_h,SKE)With markIt is sent to entity；

S108 entities receive mark and key, combined signature private key：Utilize SK_hTo E (PK_h, SKE) it is decrypted to obtain SKE, willSKE obtains part signature private key SKS1 after entering line translation, by SKS1 and secret value xID, securely held SKS and SKE.

Further, it is specific to the verification step of server end mark and user terminal mark in step S2 and S4For：

S201 uses public key matrix and entity ID computational entities mark public key；

S202 is using public key verifications mark is identified, if checking is correct, mark effectively gives by otherwise identifying invalid obstructedCross；

The public key that S203 is obtained in mark after being verified is verified to signed data.

Beneficial effects of the present invention：The present invention realizes user terminal and server using IKI safety means as carrier, by markThe two-way authentication at end, the security of single-node login system is improved, give a kind of identity identifying method of high intensity.

Brief description of the drawings

In order to illustrate more clearly about the embodiment of the present invention or technical scheme of the prior art, below will be to institute in embodimentThe accompanying drawing needed to use is briefly described, it should be apparent that, drawings in the following description are only some implementations of the present inventionExample, for those of ordinary skill in the art, on the premise of not paying creative work, can also be obtained according to these accompanying drawingsObtain other accompanying drawings.

Fig. 1 is the system being related in the single-point logging method based on IKI ID authentications described according to embodiments of the present inventionOrganization Chart；

Fig. 2 is generation mark and key in the single-point logging method based on IKI ID authentications described according to embodiments of the present inventionFlow chart

Fig. 3 is the system principle being related in the single-point logging method based on IKI ID authentications described according to embodiments of the present inventionFigure；Fig. 4 is the flow that mark is verified in the single-point logging method based on IKI ID authentications described according to embodiments of the present inventionFigure；

Fig. 5 is the flow chart of the single-point logging method based on IKI ID authentications described according to embodiments of the present invention.

Embodiment

Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clear, completeSite preparation describes, it is clear that described embodiment is only part of the embodiment of the present invention, rather than whole embodiments.It is based onEmbodiment in the present invention, the every other embodiment that those of ordinary skill in the art are obtained, belong to what the present invention protectedScope.

As shown in figure 5, a kind of single-point logging method based on IKI ID authentications described according to embodiments of the present invention, bagInclude following steps：

S1 user terminals send access request to server, produce random number r, and service end is sent collectively to together with user terminal mark；

S2 server ends are verified to user terminal mark, and by rear, server end produces random number R, and random with user terminalNumber r is combined, for (R | | r), signed with server end private key, generation signed data Sig1；

Random number R, server end mark, signed data Sig1 are sent to user terminal by S3 server ends；

S4 user terminal authentication servers end is identified, and the public key verifications signed data in server identification is utilized after being verifiedSig1, it is verified rear confirmed service device end identity legitimacy；

S5 user terminals are signed using private key to random number (R | | r), generate signed data Sig2, signed data Sig2 is sent outIt is sent to server end；

S6 server by utilizing user terminal public key verifications signed data Sig2, user terminal identity legitimacy is confirmed after being verified；

S7 server end login authentications equipment checks user's single-sign-on mapping table, finds out user mark in corresponding application systemThe account bound on system, User Token is produced, is re-introduced into application system；

S8 application systems receive the User Token of unified form, login account of the user in the system are obtained, by user at thisThe state of system is set to login, returns to the page that user asks to access, completes access of the user to the application system.

In one particular embodiment of the present invention, administrative center is identified by IKI and produces the server end mark, useFamily end mark, private key and public key.

In one particular embodiment of the present invention, server end mark, user terminal mark, private key and public keyProduction stage is：

S101IKI marks administrative center IMC discloses parameter：Public key matrix PKMS, identify administrative center public key PK_IDorg, ECC songsLine, basic point G；Wherein public key matrix PKMS is mark administrative center private key SK_IDorgTo public key matrix pkm, mark administrative center markKnow ID_orgEtc. the signature of parameter；

S102 entities produce entity ID and relevant parameter：Secret value xID, secret value public key PKx are produced using entity security equipment=xID*G, unsymmetrical key is randomly generated to SK using ECC algorithm_h、PK_h；

The partial parameters that S103 encryptions need to upload：Use mark administrative center public key PK_IDorgTo secret value public key PKx and at randomUnsymmetrical key public key PK_hEncryption：E(PK_IDorg,PKx||PK_h)；

S104 uploads entity ID, E (PK_IDorg,PKx||PK_h) and mark validity date extremely mark administrative center IMC；Wherein identifyValidity date is to be necessary to determine whether to upload according to application；

S105 marks administrative center carries out entity ID duplicate checkings, produces entity part private key：IMC determines that entity ID combination marks are effectiveAfter the uniqueness of phase, using PKMS and entity ID, the mark term of validity, entity ID public keys PK is calculated_ID, utilize private key matrix skmWith entity ID, mark term of validity computational entity ID private keys SK_ID, entity encryption key SKE and part signature is obtained after SKE is convertedPrivate key SKS1；

S106 mark administrative center IMC assembling marks：Use mark management organization private key SK_IDorgDecrypt E (PK_IDorg,PKx||PK_h) obtain PKx and PK_h, composite entity ID public signature keys：PKS=SKS1*G+PKx；Decryption public key PKE=SKE*G is calculated, is usedSK_IDTo (PKS | | PKE | | the effective date | | the Expiration Date | | ID_org| | ID) signature, identified

S107 issues mark and entity key：IMC utilizes PK_hSKE is encrypted to obtain E (PK_h, SKE), by E (PK_h,SKE)With markIt is sent to entity；

S108 entities receive mark and key, combined signature private key：Utilize SK_hTo E (PK_h, SKE) it is decrypted to obtain SKE, willSKE obtains part signature private key SKS1 after entering line translation, by SKS1 and secret value xID, securely held SKS and SKE.

In one particular embodiment of the present invention, in step S2 and S4, to server end mark and user terminalThe verification step of mark is specially：

S201 uses public key matrix and entity ID computational entities mark public key；

S202 is using public key verifications mark is identified, if checking is correct, mark effectively gives by otherwise identifying invalid obstructedCross；

The public key that S203 is obtained in mark after being verified is verified to signed data.

In order to facilitate understand the present invention above-mentioned technical proposal, below by way of in specifically used mode to the present invention it is above-mentionedTechnical scheme is described in detail.

As shown in figure 1, it is the system involved by a kind of single-point logging method based on IKI ID authentications of the present inventionOrganization Chart, single-node login system framework include user security equipment and are arranged at safety means and the login authentication of server endPrivate key, user's mark and the public key matrix of user, server side security equipment are stored with equipment, wherein user end security equipmentIn be stored with the private key, server identification and public key matrix of server.The user security equipment is the USB- for including IKI chipsKEY or IC-card, server side security equipment are the server password machine comprising PCIe cipher cards or signature sign test server.UserAll include IKI algorithm units in end and server side security equipment, be responsible for reading in user terminal and server side security equipmentMark, the checking mark flow for authenticating ID such as legitimacy and private key signature, public key sign test name.

As shown in Fig. 2 used first according to each based on IKI chip identifications authentication center in above-mentioned single-node login system frameworkThe entity identities (can customize, using name, organization etc., need to ensure its uniqueness) at family produce key and mark for it,Comprise the following steps that：

S101IKI marks administrative center IMC discloses parameter：Public key matrix PKMS, identify administrative center public key PK_IDorg, ECC songsLine, basic point G；Wherein public key matrix PKMS is mark administrative center private key SK_IDorgTo public key matrix pkm, mark administrative center markKnow ID_orgEtc. the signature of parameter；

S102 entities produce entity ID and relevant parameter：Secret value xID, secret value public key PKx are produced using entity security equipment=xID*G, unsymmetrical key is randomly generated to SK using ECC algorithm_h、PK_h；

The partial parameters that S103 encryptions need to upload：Use mark administrative center public key PK_IDorgTo secret value public key PKx and at randomUnsymmetrical key public key PK_hEncryption：E(PK_IDorg,PKx||PK_h)；

S104 uploads entity ID, E (PK_IDorg,PKx||PK_h) and mark validity date extremely mark administrative center IMC；Wherein identifyValidity date is to be necessary to determine whether to upload according to application；

S105 marks administrative center carries out entity ID duplicate checkings, produces entity part private key：IMC determines that entity ID combination marks are effectiveAfter the uniqueness of phase, using PKMS and entity ID, the mark term of validity, entity ID public keys PK is calculated_ID, utilize private key matrix skmWith entity ID, mark term of validity computational entity ID private keys SK_ID, entity encryption key SKE and part signature is obtained after SKE is convertedPrivate key SKS1；

S106 mark administrative center IMC assembling marks：Use mark management organization private key SK_IDorgDecrypt E (PK_IDorg,PKx||PK_h) obtain PKx and PK_h, composite entity ID public signature keys：PKS=SKS1*G+PKx；Decryption public key PKE=SKE*G is calculated, is usedSK_IDTo (PKS | | PKE | | the effective date | | the Expiration Date | | ID_org| | ID) signature, identified

S107 issues mark and entity key：IMC utilizes PK_hSKE is encrypted to obtain E (PK_h, SKE), by E (PK_h,SKE)With markIt is sent to entity；

S108 entities receive mark and key, combined signature private key：Utilize SK_hTo E (PK_h, SKE) it is decrypted to obtain SKE, willSKE obtains part signature private key SKS1 after entering line translation, by SKS1 and secret value xID, securely held SKS and SKE.

As shown in Figures 3 and 5, based on above-mentioned single-node login system, user is by user security equipment and user's logging device phaseEven, the login page of server is accessed by user's logging device, prompts user to input PIN code and opens user security equipment, it is defeatedAfter entering PIN code, user security equipment is opened, and now carries out step, realizes single-point logging method of the present invention, toolBody is：

S1 user terminals send access request to server, produce random number r, and service end is sent collectively to together with user terminal mark；

S2 server ends are verified to user terminal mark, and by rear, server end produces random number R, and random with user terminalNumber r are combined (R | | r), are signed with server end private key, generation signed data Sig1；

Random number R, server end mark, signed data Sig1 are sent to user terminal by S3 server ends；

S4 user terminal authentication servers end is identified, and the public key verifications signed data in server identification is utilized after being verifiedSig1, it is verified rear confirmed service device end identity legitimacy；

S5 user terminals are signed using private key to random number (R | | r), generate signed data Sig2, signed data Sig2 is sent outIt is sent to server end；

S6 server by utilizing user terminal public key verifications signed data Sig2, user terminal identity legitimacy is confirmed after being verified；

S7 server end login authentications equipment checks user's single-sign-on mapping table, finds out user mark in corresponding application systemThe account bound on system, User Token is produced, is re-introduced into application system；

S8 application systems receive the User Token of unified form, login account of the user in the system are obtained, by user at thisThe state of system is set to login, returns to the page that user asks to access, completes access of the user to the application system.

In above-mentioned single-point logging method, the verification step to server end mark and user terminal mark is：

S201 uses public key matrix and entity ID computational entities mark public key；

S202 is using public key verifications mark is identified, if checking is correct, mark effectively gives by otherwise identifying invalid obstructedCross；The public key that S203 is obtained in mark after being verified is verified to signed data.

In one particular embodiment of the present invention, the parameter public key matrix PKMS announced when known mark management organization,Now, entity A knows entity B entity ID, markThen the corresponding verification step to server end mark and user terminal mark is specially：

1st, public key matrix PKMS and entity B entity ID are utilized_BComputational entity B mark public keys { PK_ID}_B；

2nd, checking mark validity：With entity B mark public key { PK_ID}_BVerify the mark of entity BIf checking is correct, mark is effectively led toCross, otherwise identify and invalid do not pass through；

3rd, the public key obtained after being verified in mark is verified to signed data.

The foregoing is merely illustrative of the preferred embodiments of the present invention, is not intended to limit the invention, all essences in the present inventionGod any modification, equivalent substitution and improvements made etc., should be included in the scope of the protection with principle.

Claims (4)

1. a kind of single-point logging method based on IKI ID authentications, it is characterised in that comprise the following steps：

S1 user terminals send access request to server, produce random number r, and service end is sent collectively to together with user terminal mark；

S2 server ends are verified to user terminal mark, and by rear, server end produces random number R, and random with user terminalNumber r is combined, and is（R||r）, signed with server end private key, generation signed data Sig1；

Random number R, server end mark, signed data Sig1 are sent to user terminal by S3 server ends；

S4 user terminal authentication servers end is identified, and the public key verifications signed data in server identification is utilized after being verifiedSig1, it is verified rear confirmed service device end identity legitimacy；

S5 user terminals are using private key to random number（R||r）Signed, generate signed data Sig2, signed data Sig2 is sent outIt is sent to server end；

S6 server by utilizing user terminal public key verifications signed data Sig2, user terminal identity legitimacy is confirmed after being verified；

S7 server end login authentications equipment checks user's single-sign-on mapping table, finds out user mark and is applied accordinglyThe account bound in system, User Token is produced, is re-introduced into application system；

S8 application systems receive the User Token of unified form, login account of the user in the system are obtained, by user at thisThe state of system is set to login, returns to the page that user asks to access, completes access of the user to the application system.

2. a kind of single-point logging method based on IKI ID authentications according to claim 1, it is characterised in that pass through IKIIdentify administrative center and produce the server end mark, user terminal mark, private key and public key.

A kind of 3. single-point logging method based on IKI ID authentications according to claim 1, it is characterised in that the clothesBusiness device end mark, user terminal mark, the production stage of private key and public key are：

S101 IKI marks administrative center IMC discloses parameter：Public key matrix, mark administrative center public key, ECCCurve, basic point；Wherein public key matrixFor mark administrative center private keyTo public key matrix, markAdministrative center identifiesEtc. the signature of parameter；

S102 entities produce entity ID and relevant parameter：Secret value is produced using entity security equipment, secret value public key, unsymmetrical key pair is randomly generated using ECC algorithm；

The partial parameters that S103 encryptions need to upload：Use mark administrative center public keyTo secret value public keyWithRandom asymmetries public keyEncryption：；

S104 upload entities ID,With mark validity date to mark administrative center IMC；It is got the bidIt is to be necessary to determine whether to upload according to application to know validity date；

S105 marks administrative center carries out entity ID duplicate checkings, produces entity part private key：IMC determines that entity ID combinations are identified withAfter the uniqueness of effect phase, utilizeWith entity ID, the mark term of validity, entity ID public keys are calculated, utilize private key squareBattle arrayWith entity ID, mark term of validity computational entity ID private keys, entity encryption keyAnd willAfter conversionObtain part signature private key；

S106 mark administrative center IMC assembling marks：Use mark management organization private keyDecryptionObtainWith, composite entity ID public signature keys：；Calculate decryption public key, useIt is right（||| | the effective date | | the Expiration Date | |||ID）Signature, is identified；

S107 issues mark and entity key：IMC is utilizedIt is rightIt is encrypted to obtain, willWith markIt is sent to entity；

S108 entities receive mark and key, combined signature private key：UtilizeIt is rightIt is decrypted to obtain, willPart signature private key is obtained after entering line translation, willWith secret valueSummation is signedPrivate key, delete secret value, it is securely heldWith。

4. a kind of single-point logging method based on IKI ID authentications, its feature exist according to any one in claim 1-3In in step S2 and S4, the verification step to server end mark and user terminal mark is specially：

S201 uses public key matrix and entity ID computational entities mark public key；

S202 is using public key verifications mark is identified, if checking is correct, mark effectively give by, otherwise identify it is invalid notPass through；

The public key that S203 is obtained in mark after being verified is verified to signed data.