CN104038486B - System and method for realizing user login identification based on identification type codes - Google Patents

Abstract

The present invention relates to a system and method for realizing user login authentication based on an identification type password. Based on the system, a user's password identification that has nothing to do with the account of the Web information system is stored in the user account data of the Web information system as the authentication data of the account. ; When the user logs into the Web information system, the system confirms that the user is the owner of the account by confirming that the user has the currently valid identification private key identified by the password of the account. Furthermore, if the web information system originally adopts the login method of account name + password or password, the security gateway or plug-in that implements login processing will fill in the login request with the user password identifier as the password or password on behalf of the user after completing the account authentication of the user login. In order to realize the user's login in the Web information system. In the present invention, the user's identification key is only used to replace the password or password of the account as a safe and private data that proves that the user has the account rather than as an identity certificate for the user to log in to the system.

Description

System and method for realizing user login authentication based on identification password

technical field

The invention belongs to the field of information security, in particular to a system and method for realizing user login authentication based on an identification password.

Background technique

When a user accesses a security-protected and restricted Web information system (including various application systems and security systems), a login operation (Logon or Login) is usually required. The purpose of the user login operation is to confirm that the user is a legitimate user of the Web information system, that is, user authentication (User Authentication); in fact, for many Web information systems, whether the user's identity information is true or not, who he is does not matter. Important, therefore, more precisely, the purpose of the user login operation is to confirm that the user is the owner of a registered account in the Web information system, that is, to perform account authentication (Account Authentication).

The current Web information system generally adopts the method of account name + password or password (account name is also called user name) as a security means for user or account authentication of user login (Long On or Long In) Web information system. The scheme of account name+password or password is simple and convenient for users to operate and use, but its insecurity is well known. Although the PKI (Public Key Infrastructure) digital certificate (Digital Certificate) is safe, it is used for user or account authentication in the Web information system, which is inconvenient for user operation, difficult for user private key loss and recovery, troublesome for certificate renewal (usually requires manual operation) ) and other problems of poor usability, and it is necessary to develop controls or plug-ins for relevant browsers, resulting in problems such as heavy technical development workload and poor applicability: First, because different controls or plug-ins need to be developed for different browsers, and currently There are many browsers, and the workload of developing controls or plug-ins for all browsers including browsers running in different environments is very large; secondly, some browsers have very limited or even no support for controls or plug-ins. Furthermore, when PKI digital certificates are used in deployed systems that use account names + passwords or passwords, existing systems need to be modified, so PKI digital certificates have not been widely used so far.

Identity Based Cryptography (Identity Based Cryptography, IBC) is a public key cryptography technology that has recently gained widespread attention. It overcomes the shortcomings of PKI digital certificates in terms of ease of use. Its main technical feature is that a user A unique identifier (such as an email address) constitutes a public key of the user (strictly speaking, a unique identifier of the user plus a set of public parameters constitutes the public key), which can be used for data encryption or signature verification, and an identifier corresponds to There is a private key for data decryption or digital signature (the IBC public key and private key used for data encryption are not necessarily the same as the IBC public key and private key used for digital signature); Generated by the key service system of the key generator. IBC can also be used for user or account identification when users log in in a web information system, but there are also the following problems when using IBC directly for user or account identification in a web information system:

1) When IBC is used for user or account identification in a Web information system, the usual solution is to use the user's account name in the Web information system as the user's IBC identifier. The system has different account names, so different IBC key pairs need to be obtained. Second, users obtain non-electronic communication identifications (email addresses, mobile phone numbers, etc. addresses or terminal identifications used for electronic communication are called electronic key pairs) from the key service system. Communication ID) corresponding to the private key, it is more troublesome and difficult for the key service system to confirm that the user is the real owner of the ID (for electronic communication IDs, such as e-mail address, mobile phone number, it is easier to do this);

2) When IBC is used in the Web information system, since the cryptographic module needs to be invoked on the client side to perform IBC cryptographic operations, similar to digital certificates, the current solution is usually to use browser controls and plug-ins to invoke the cryptographic module to perform IBC cryptographic operations on the client side. Cryptographic operations, which have the same problems as the application of digital certificates in user login of Web information systems;

3) At present, there are a large number of deployed systems using account names + passwords or passwords. To directly deploy IBC-based user or account authentication schemes in these systems requires modification of the Web information system.

The purpose of the present invention is to use Identity-Typed Cryptography (Identity-Typed Cryptography) technology for user or account identification when logging in to a Web information system, and avoid using browser plug-ins and control technologies, while maintaining compatibility with deployed systems.

The identity-based cryptographic technology of the present invention includes the aforementioned Identity-Based Cryptography (Identity-Based Cryptography) and the identity-based elliptic curve technology (see the applicant's patent application "a identity-based elliptic curve cryptosystem", Application number: 20131052098.5).

The identification type cryptographic technology adopted in the present invention, whether it is IBC cryptographic technology or elliptic curve cryptographic technology based on identification, they all have the following common characteristics:

1) An identity of a user corresponds to an identity public key and an identity private key (the identity public key and private key used for data encryption are not necessarily the same as the identity public key and private key used for digital signature);

2) In the actual process of key generation and cryptographic operations, instead of using an identifier itself for key generation and cryptographic operations, an extended identifier with other limited information added is used for key generation and cryptographic operations;

3) If the patented technology in "An identification-type cryptographic system and method for automatically updating and restoring private keys" (Application No.: 201410058689.3) is adopted, the private key can be automatically restored and the currently valid identification of the identification can be automatically updated Public key and identity private key.

The commonly used identification limited information is time period limited information, such as "identification||time period", in which "||" indicates a combination of strings. The time period limitation information stipulates that the public key and private key corresponding to the extended identifier are valid and used only within the specified time period. The public key and private key corresponding to the extended identity whose time period covers the current moment are called the currently valid identity public key and identity private key of the identity.

Contents of the invention

The purpose of the present invention is to provide an identity-based password implementation that uses identification-type cryptography for user or account authentication when logging in to a Web information system, avoids the use of browser plug-ins and control technologies, and maintains compatibility with deployed systems A system and method for user login authentication.

In order to achieve the above object, the technical solution adopted in the present invention is:

A system for implementing user login authentication based on an identification password, the system comprising:

Web information system: a system based on Web technology to provide information or application services to users: an identifier of a user (such as an email address, a mobile phone number) or a hash value of an identifier of a user is used as the authentication of the user's account in the Web information system Data (Authentication Data) is stored in the user account data of the Web information system (if the original account authentication data of the Web information system is a password or password, the user ID or the hash value of the user ID is stored in the Web information system as the password or password). The original password or password depository in the user account data); Correspondingly, the user identification stored in the user account data as the identification data of the user account, or the hash value of the user identification is stored in the user account identification data as the user account The user identification in the user account data is called the password identification corresponding to the user account or simply the password identification of the user account; the password identification of the user account is entered by the user when registering an account in the Web information system, or is provided by the account management system or tool Obtain and set by other means (how the account management system or tool obtains the user's password identification belongs to the problem outside the present invention);

Browser: the client used by the user to access the Web information system; during the user login process, the browser uses the identification private key identified by the password of the user login account to digitally sign the random string returned by the Web information system through the background processing program Or decrypt the encrypted random string data returned by the Web information system, and perform other cryptographic budgets (the identification public key and private key used for data encryption are not necessarily the same as the identification public key and private key used for digital signatures);

Background processing program: a program running in the background of the computing device at the user end; during the user login process, the cryptographic module is called to digitally sign the random string returned by the Web information system or decrypt the encrypted random string data returned by the Web information system , and perform other cryptographic calculations;

Cryptographic module: a client software component or a combination of software and hardware that implements identification-type cryptographic techniques for cryptographic operations;

When a user uses a browser to access the Web information system and submits an account name to log in, the Web information system verifies that the user is the owner of the login account by verifying that the user owns the private key identified by the password through the following digital signature method or data encryption method:

Digital signature method: the web information system returns the password identification of the user's login account and a randomly generated string (random string) to the client browser, and the browser invokes the password module through the background processing program to adopt the identification of the password identification of the user's login account The private key signs the returned random string, and then submits the signature data of the random string to the Web information system, and the Web information system uses the random string returned to the browser and the identification public key identified by the password of the user's login account to verify the client The validity of the signature data of the random string submitted by the browser to confirm that the user is the owner of the password identification, and further confirm that the user is the owner of the login account;

Data encryption method: the web information system returns a randomly generated string (random string) encrypted with the identification public key identified by the password of the user's login account to the client browser, and the browser invokes the password module through the background processing program to adopt the user login The identity private key of the password identification of the account decrypts the returned encrypted random string, and then completes the user login by directly returning the decrypted random string or using the decrypted random string through HMAC (Hashed Message Authentication Code) digital signature Authentication operation (if the decrypted random string is returned correctly, or the correct HMAC digital signature is realized with the decrypted random string, it means that the user has the identification private key that can correctly decrypt the encrypted random string, and it can be determined that the user is a password identification owner of the user, thereby identifying the user as the owner of the login account);

If the web information system that the user logs in originally adopts the method of account name + password or password to authenticate the user as the owner of the account and keeps the original authentication method unchanged, but the information of the web information system implements the system of user login authentication based on the identification password The component is a security gateway pre-installed in the Web information system or a security plug-in inserted into the request response transmission channel of the Web information system, and the password ID of the user account or the hash value of the password ID of the user account is saved as a password or password In the original password or password storage place in the user account data of the Web information system, and the security gateway or the security plug-in, after using the password identification of the user account to complete the identification of the user as the owner of the account, the user's account name and account The password ID is used as the account name and password for the user to log in to the Web information system, or the password is submitted to the Web information system in the form of a login request on behalf of the user to complete the login operation, or the hash value of the user's account name and the password ID of the account is used as the user's login Web information The account name and password or password of the system are submitted to the Web information system in the form of a login request to complete the login operation on behalf of the user. The former corresponds to the situation where the account authentication data stored in the user account data of the Web information system is the password identification of the user account, and the latter Corresponding to the case where the account authentication data stored in the user account data of the Web information system is the hash value of the password identification of the user account; no matter what the situation is, the Web information system itself will verify the user login by verifying the account name and password or password. Account Authentication Processing.

If a password identifier of the user is stored in the user account data of the Web information system as the authentication data of the user account, when the user uses a browser to log in to the Web information system, the Web information system, the user, the client browser and the background processing program pass through The following data encryption method completes the user login authentication process:

Step 1: the Web information system requires the user to input the account name through the browser;

Step II: the user enters the account name through the browser and submits the entered account name to the Web information system;

Step III: After the Web information system receives the account name submitted by the client browser, use the received account name to obtain the password identification of the user account by querying the authentication data of the user account corresponding to the account name in the user account data, and then use the obtained The currently effective identification public key identified by the password encrypts the name of the Web information system and a randomly generated string (random string), and then returns the encrypted Web information system name and the random string to the browser of the client;

Step IV: After the client browser receives the data returned by the Web information system, it submits the received encrypted Web information system name and random string to a local background processing program on the client side through the network communication mechanism, and then prompts the user Input the random password or password displayed on the computing terminal into the password or password input box of the browser;

Step V: After receiving the encrypted Web information system name and random string submitted by the browser, the local background processing program of the client uses the password ID of the user account to call the password module and uses the currently valid ID private key of the password ID to decrypt the Web The encrypted web information system name and random string returned by the information system, and then the decrypted web information system name and random string are used as a one-time random password or password for the user to log in to the web information system through a man-machine interface on the computing terminal displayed to the user;

Step VI: The user enters the random character string displayed by the background processing program as a one-time random password or password into the password or password input box of the browser and submits the random character string entered by the user as the account password or password through the browser to the Web information system;

The VII step: after the web information system receives the random character string as the account password or password submitted by the client browser, the received random character string and (the third step) return to the browser as the account password or password The plaintext of the random string is compared, if they are consistent, it is confirmed that the user is the owner of the user account corresponding to the submitted account name and the user is allowed to log in, otherwise it is rejected.

If a password identifier of the user is stored in the user account data of the Web information system as the authentication data of the user account, when the user uses a browser to log in to the Web information system, the Web information system, the user, the client browser and the background processing program pass through The following data encryption method completes the user login authentication process:

Step 1: The Web information system requires the user to input the account name through the browser;

Step 2: The user enters the account name through the browser and submits the entered account name to the Web information system;

Step 3: After the Web information system receives the account name submitted by the browser, it uses the received account name to obtain the password identification of the user account by querying the authentication data of the user account corresponding to the account name in the user account data, and then uses the obtained password identification The currently effective identification public key encrypts a randomly generated string (random string), and then returns the encrypted random string to the client's browser;

Step 4: After receiving the data returned by the Web information system, the browser at the client side submits the received encrypted random string to the background processing program through network communication, and requests to decrypt the encrypted random string;

Step 5: After the background processing program receives the request submitted by the client browser to decrypt the encrypted random string, it calls the cryptographic module to decrypt the encrypted random string using the currently valid identification private key identified by the password of the user account, and then Return the decrypted random string to the client browser;

Step 6: After the client browser receives the decrypted random string returned by the background processing program, it completes the user login authentication operation by directly returning the decrypted random string or using the decrypted random string through HMAC digital signature.

If the hash value of a password identifier of the user is stored in the user account data of the Web information system as the authentication data of the user account, when the user logs in to the Web information system with a browser, the Web information system, the user, the browser of the user end, and The background processing program completes the user login authentication process through the following data encryption methods:

Step 1: The Web information system requires the user to input the account name and identification data through the browser;

Step 2: the user enters the account name and the password identification of the account through the browser, wherein the password identification of the account is input as the identification data, and then submits the input account name and the password identification as the account identification data to the Web information system through the browser;

Step 3: After the web information system receives the data submitted by the browser, it calculates the hash value of the received password identification, and compares the calculated hash value of the password identification with the user account data stored in the web information system and the user Compare the hash value of the password ID of the user account corresponding to the submitted account name. If they are consistent, use the currently valid ID public key of the password ID submitted by the user to encrypt a randomly generated string, and then encrypt the encrypted random word The string is returned to the client's browser; otherwise, an error is returned;

Step 4: If the received data from the web information system returns an error message, the browser on the client side will prompt an error; otherwise, the browser on the client side will submit the received encrypted random string to the background processing program through network communication, and request decryption encrypted random string;

Step 5: After the background processing program receives the request submitted by the client browser to decrypt the encrypted random string request, it calls the cryptographic module to decrypt the encrypted random string using the currently valid identification private key identified by the password of the user account, and then decrypts the encrypted random string. The random string of is returned to the client browser;

Step 6: After the client browser receives the decrypted random string returned by the background processing program, it returns the decrypted random string directly or uses the decrypted random string to complete the user login authentication operation through the HMAC digital signature.

If a password identifier of the user is stored in the user account data of the Web information system as the authentication data of the user account, when the user uses a browser to log in to the Web information system, the Web information system, the user, the client browser and the background processing program pass through The following digital signature method completes the user login authentication process:

Step 1: The Web information system requires the user to input the account name through the browser;

The second step: the user enters the account name through the browser and submits the entered account name to the Web information system through the browser;

Step 3: After the Web information system receives the account name submitted by the browser, it uses the received account name to obtain the password identification of the user account by querying the authentication data of the user account corresponding to the account name in the user account data, and then the obtained The password ID and a randomly generated string are returned to the client's browser;

Step 4: After receiving the data returned by the Web information system, the browser on the client side submits the received password identifier and random string to the background processing program through network communication, and requests to digitally sign the returned random string;

Step 5: After the background processing program receives the request submitted by the client browser to digitally sign the returned random string, it calls the cryptographic module to digitally sign the random string using the currently valid identification private key identified by the password of the user account. Sign, and then return the signed data to the client browser (the signed data does not need to contain the random string itself);

Step 6: After receiving the signature data of the random string returned by the background processing program, the client browser submits the signature data to the Web information system;

Step 7: After the web information system receives the signature data of the random string submitted by the browser, it uses the random string returned to the browser and the currently effective identification public key identified by the password of the user account to verify the signature data of the random string submitted by the browser. The validity of the signature of the signature data of the string is verified, and if the verification is passed, it is confirmed that the user is the owner of the user account corresponding to the submitted account name and the user is allowed to log in, otherwise it is rejected.

If the hash value of a password identifier of the user is stored in the user account data of the Web information system as the authentication data of the user account, when the user logs in to the Web information system with a browser, the Web information system, the user, the browser of the user end, and The background processing program completes the user login authentication process through the following digital signature method:

Step 1: the Web information system requires the user to input the account name and authentication data through the browser;

Step 2: the user inputs the account name and the password identification of the account through the browser, wherein the password identification of the account is input as authentication data, and then submits the input account name and the password identification as account identification data to the Web information system;

Step 3: After the web information system receives the data submitted by the browser, it calculates the hash value of the received password ID, and compares the calculated hash value of the password ID with the user account data stored in the web information system and the user Compare the hash value of the password ID of the user account corresponding to the submitted account name, if they are consistent, then return the password ID submitted by the user and a randomly generated string to the browser of the client; otherwise, return an error;

Step 4: If the received return data of the Web information system prompts an error, then the browser at the client end prompts an error; otherwise, the browser at the client end submits the received password identifier and random character string to the background processing program through network communication, Request to digitally sign the returned random string;

Step 5: After the background processing program receives the request submitted by the client browser to digitally sign the returned random string, it calls the cryptographic module to digitally sign the random string using the currently valid identification private key identified by the password of the user account , and then return the signed data to the client browser (the signed data does not need to contain the random string itself);

Step 6: After receiving the signature data of the random character string returned by the background processing program, the client browser submits the signature data to the Web information system;

Step 7: After the web information system receives the signature data of the random string submitted by the browser, it uses the random string returned to the browser and the currently valid identification public key identified by the password of the user account to verify the signature data submitted by the browser. Verify the validity of the signature. If the verification is passed, it is confirmed that the user is the owner of the user account corresponding to the submitted account name and the user is allowed to log in, otherwise it is rejected.

If the password identification of the user account is entered by the user when registering an account in the Web information system, after receiving the user's account registration information, the Web information system first uses digital signature or data encryption to verify in the same way as the account authentication when the user logs in. Confirm that the user owns the private key of the password ID entered for registration, thereby confirming that the user is the owner of the password ID entered. After the verification and confirmation pass, the user account registration is completed and the registration information is saved, otherwise an error is returned.

If the identity-based cryptography adopted by the system for realizing user login authentication based on identity-based ciphers is IBC (Identity-Based Cryptography) cryptography and supports multiple sets of different IBC cryptography operation public parameters, then the Web information system is determined in the following manner: The password for the user account identifies the set of public parameters used for cryptographic operations:

If the user enters and submits the account name and the password ID as authentication data at the same time when logging into the web information system through the browser, the browser will request the background processing program through the network communication mechanism to return the password ID to the public parameters used for cryptographic operations before submitting the password ID Group indication information (such as parameter group ID or version number), after the background processing program receives the request, it calls the cryptographic module to inquire about the indication information of the public parameter group used by the cryptographic identifier for cryptographic operations, and then queries the acquired public parameter group indication information After receiving the instruction information of the public parameter group returned by the background processing program, the browser submits the instruction information of the public parameter group together with the password identification to the Web information system. Instructions identifying the set of public parameters used for cryptographic operations using the cryptographic identity of the user account;

Otherwise, if the web information system stores in the user account data the indication information of the public parameter group used by the user account's password identifier for cryptographic operations, the web information system will pass the user account data before using the user account's password identifier to perform encryption operations. The instruction information of the public parameters used for cryptographic operations in the cryptographic identifier determines the public parameter groups used for cryptographic operations;

Otherwise, the web information system returns the password identifier of the user account to the browser on the user end before using the password identifier of the user account to perform encryption operations, and requests to obtain the instruction information of the public parameter group used for the encryption operation using the password identifier; the browser on the user end After receiving the password ID and request returned by the Web information system, submit the received password ID to the local background processing program of the client through the network communication mechanism, and request to obtain the instruction information of the public parameter group used by the password ID for cryptographic operations; the background The processing program invokes the cryptographic module to query and obtain the instruction information of the public parameter group used for the cryptographic operation using the password identifier of the user account, and returns the instruction information of the public parameter group obtained by query to the browser of the user end; the browser performs the obtained password identifier The instruction information of the public parameter group used for the cryptographic operation is returned to the Web information system; the Web information system determines the public parameter group used for the cryptographic operation according to the returned public parameter group instruction information;

Further, if the background processing program invokes the cryptographic module to decrypt the data encrypted by the web information system using the password identifier and finds that the web information system uses an incorrect public parameter set, the background processing program updates the web information system through the browser. The user account's password identifies an indication of the set of public parameters used for cryptographic operations.

If the web information system also saves the digital signature (signed by the web information system) of the combined data of the user account name and the password identifier of the user account or the hash value of the password identifier (such as the data after the string combination) in the user account data, In order to prevent unauthorized modification of the user account name and account password ID or the hash value of the password ID in the account data, the Web information system, in the process of account authentication for user login, receives the user's password ID through the browser After submitting the account name, first verify the digital signature of the combined data of the account name and the password identifier of the user account or the hash value of the password identifier to determine the user account name and the password identifier of the user account saved in the account data of the web information system or Whether the hash value of the password ID has been modified, if it has been modified, the login account authentication process will be terminated and an error will be returned; otherwise, the user login account authentication process will continue; the account name and the password ID of the user account or the hash value of the password ID will be merged The digital signature methods adopted for the digital signature of the final data include HMAC-based symmetric key digital signatures and digital signatures based on asymmetric key cryptographic algorithms (such as RSA, ECC, IBC).

Based on the above content of the invention, it can be seen that the user login authentication scheme adopted by the system of the present invention has the following advantages or characteristics:

1) If the identification used is an electronic communication identification (such as email address, mobile phone number), then the generation, recovery and update of the identification key will be convenient; in particular, if the automatic update of the identification key is further implemented, the identification key The update operation of the key does not require manual intervention by the user, which brings great convenience to the user;

2) No browser is used, so it is not limited by the type and type of browser, nor is it limited by the operating platform of the client computing device;

3) In the present invention, the user identification and the identification key are not used as the identity certificate of the user, but are used as account authentication private data with high security strength, and different Web information systems can use the key identified by the same password to perform user identification. For account authentication during login, there is no need to use different identification keys for different web information systems;

4) The solution of the present invention can be well used for deployed Web information systems that originally use account names + passwords or passwords for login account authentication, and can pass through external security gateways or passwords without modifying the Web information system. The method of built-in security plug-in implements the security login scheme of the present invention in the Web information system using account name+password or password for login account authentication.

Description of drawings

Fig. 1 is a schematic diagram of the system structure of the present invention.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

The specific implementation of the present invention firstly relates to the implementation scheme of the identification type encryption technology, and there are two options: IBC encryption technology or identification-based elliptic curve encryption technology, among which the IBC scheme is the simplest.

If the IBC encryption technology is used, the identification public key and private key at this time are the IBC public key and private key, and the public key is the identification itself. At this time, the IBE encryption module and data encryption and decryption method in the patent application "an IBE encryption device and data encryption and decryption method" (application number: 20131043846.2) (although the name of the encryption module in this patent application is called IBE encryption Module, in fact, the relevant technical solutions are suitable for IBC) and the identification key automatic update scheme in the patent application "An identification-type cryptographic system and method for automatically updating and recovering private keys" (application number: 201410058689.3), and the implementation of a IBC key service system (including IBC private key generator) for IBC private key generation and recovery. For the technical implementation of IBC itself, please refer to IEEE International Standard IEEE Std 1363.3-2013: IEEE Standard for Identity-Based Cryptographic Techniques using Pairings, 22August 2013. Under the IBC implementation scheme, if the IBC encryption supports the use of multiple different sets of IBC public parameter sets for cryptographic operations, different sets of public parameter sets can be indicated by different identifiers or version numbers.

If the identity-based elliptic curve cryptography technology is adopted, the cryptographic system in the patent application "A Identity-Based Elliptic Curve Cryptosystem" (application number: 20131052098.5) must be implemented, including the key service system and the cryptographic module of the client. The identification public key and private key are elliptic curve cryptographic public keys and private keys generated based on the identification. Furthermore, the identification key automatic update scheme in the patent application "An Identification Cryptographic System and Method for Automatically Updating and Restoring Private Keys" (Application No.: 201410058689.3) must be implemented. Using the identity-based elliptic curve cryptography scheme, there are two options for how the Web information system obtains the currently effective identity public key of the cryptographic identity: one is to obtain and cache it from the key service system, and the other is to let the browser obtain it from the key service system. The cryptographic module on the client end obtains it from the local keystore and submits it to the Web information system. The latter scheme needs to identify the public key and be signed by the key service system to ensure security (the X509 format is not required).

Regardless of whether IBC cryptography or identity-based elliptic curve cryptography is used, a scheme for authenticating whether the user is the owner of the account or password identification by using the decrypted random string through HMAC data signature is (other schemes can also be used): The background processing program on the client end combines the current time with the decrypted random string, and then uses a hash algorithm (such as SHA-1) to generate a hash value for the combined data through the cryptographic module, and then the browser converts the current time Together with the generated hash value, it is sent to the Web information system; after the Web information system receives the data submitted by the browser, it first checks whether the difference between the time in the data submitted by the browser and the current time is within the specified time range, and if so, Then merge the time in the data submitted by the client browser with the random string returned to the client by the Web information system, use the same hash algorithm to generate a hash value for the merged data, and then compare it with the client browser Whether the submitted hash value is consistent with the hash value calculated by the Web information system itself. If they are consistent, it proves that the user has the currently valid identification private key identified by the password, and then confirms that the user is the owner of the login account.

For the background processing program, a program running on the client computing device can be developed as a background processing program. On the one hand, this program receives a request to sign a random string or decrypt an encrypted random string submitted in the form of an HTTP request. , and return the processing result in the form of HTTP response; on the other hand, sign the random string or decrypt the encrypted random string by calling the cryptographic module, and obtain the instruction information of the public parameter group used by the cryptographic identifier for cryptographic operations; and , the background processing program prompts the user to log in the one-time random password or password of the Web information system by popping up a human-computer interaction interface.

Corresponding to the processing method that the background processing program receives a request to sign a random string or decrypt an encrypted random string through HTTP request and response, and returns the processing result, the client browser submits the request to the background through automatic HTTP POST The processing program submits the processing results returned by the background processing program to the Web information system through automatic HTTP POST, or the client browser interacts with the background processing program through Ajax and submits the processing results returned by the background processing program to the Web information system.

If the web information system also saves the digital signature of the account name and password ID or the hash value of the password ID, the digital signature data of the account name and password ID or the hash value of the password ID can be stored separately, or can be stored together with the password ID or password ID. The hash value of the password is stored together as the authentication data of the account; if the digital signature data is stored together with the password identifier or the hash value of the password identifier as the authentication data of the account, the account authentication data when implementing the login operation on behalf of the user includes the authentication data from the user account Digitally signed data obtained in data. Web information system uses a special public key pair or random string for digital signature (public key cryptographic signature or HMAC signature).

In order to further enhance the security of user login authentication, one of the following solutions can be adopted:

Solution 1: Before the background processing program signs the random string returned by the web information system with the private key identified by the password of the user account or decrypts the returned encrypted random string, a man-machine interface pops up to prompt the user to proceed. Login processing, asking the user whether to continue;

Scenario 2: The trusted web information system is issued a digitally signed security site token, and when the user logs in to the web information system, the security site token and the random string (encrypted or non-encrypted random string) are Return to the client browser and be submitted to the background processing program by the browser; the background processing program uses the identification private key identified by the password of the user account to sign the returned random string or decrypt the returned encrypted random string when calling the password module Before checking whether there is a credible security site token (the signature is valid and credible), if there is no security site token or the digital signature of the security site token is untrustworthy, a human-computer interaction interface will pop up to remind the user of the risk; if If there is a credible security site token, it prompts the user that the system to be accessed is credible and displays the address of the site the user wants to visit, and asks the user whether to continue;

Scheme 3: Before the web information system returns random strings or encrypted random strings to the client browser, it uses public key cryptography to digitally sign the returned data, and then returns the data; Before the module signs the returned random string or decrypts the returned encrypted random string, it first verifies the digital signature of the data returned by the web information system. If the returned data does not have a digital signature or the signature is untrustworthy, a human-computer interaction will pop up. The interface reminds the user of risks; if there is a digital signature and the signature is credible, it will prompt the user that the system to be accessed is credible and display the address of the site the user wants to visit;

Solution 4: The browser on the client end submits the random string or encrypted random string returned by the Web information system to the background processing program, and at the same time submits the host address (host DNS domain name) of the Web information system that the user wants to log in to the background Processing program; before the background processing program calls the cryptographic module to sign the returned random string with the private key identified by the password of the user account or decrypt the returned encrypted random string, it first displays the current status to the user through a human-computer interaction interface The host address of the web information system to be accessed by the browser, and ask the user whether to continue; if the user chooses to continue, sign the returned random character string or decrypt the returned encrypted random character string, and then call the password module to use the web information system The public key encrypts the signed random string or the decrypted random string to be returned directly or the login authentication data signed with the decrypted random string HMAC, and then returns the encrypted data to the browser and is submitted by the browser to Web information system; after receiving the encrypted data returned by the browser, the Web information system first uses the private key of the Web information system to decrypt the received encrypted data, and then performs further login authentication processing according to the decrypted data; The public key of the web information system includes the IBC public key of the web information system (such as using the host address of the web information system as the public key) or the public key issued by a trusted key service system (such as the CA certificate system) (such as through the data Certificate issued RSA, ECC public key, etc.).

In addition to the above solutions, the Web information system can also improve system security through server certificates and SSL (Secure Socket Layer) secure transmission channels.

If the Web information system that the user logs in originally adopts the mode of account name+password or password to identify the user as the owner of the account, and the system component that the Web information system implements the technical solution of the present invention to authenticate the user's login account is pre-located A security gateway of the Web information system, then the security gateway can be developed based on Web reverse proxy technology (as available Apache development); If the Web information system implements the technical scheme of the present invention, the system component that the user logs in to account authentication is built into the Web information system. A security plug-in of the system, the security plug-in can be developed based on filters (such as ISAPI, Servlet Filter) or other plug-in technologies.

Other unspecified specific technical implementations are well known and self-evident to those skilled in the relevant fields.

Claims (10)

1. a kind of to realize the system that User logs in differentiates based on identification type password, the system includes：

Web information system：Based on the system that Web technological development user oriented provides information or application service：One mark of user Know or the hashed value for identifying of user is stored in Web information as user in the authentication data of the account of Web information system In the user account data of system；Correspondingly, the authentication data as user account is stored in user account data ID, or use of the hashed value of ID when being stored in user account data as the authentication data of user account Family identifies, referred to as the cipher mark of the corresponding cipher mark of user account or abbreviation user account；The password of the user account Mark is input into by user in Web information system registry account, or is obtained by other means by account management system or instrument Obtain and arrange；

Browser：User is used to access the client of Web information system；The browser described in process of user login passes through backstage The random word string number that processing routine is returned using the identity private key of the cipher mark of User logs in account to Web information system The random words string data of the encryption that word is signed or returned to Web information system is decrypted；

Spooler：The program on one computing device backstage for operating in user side；Call in process of user login close Code module the random word string that Web information system is returned is digitally signed or to Web information system return encryption it is random Word string data are decrypted；

Crypto module：Enforcement identification type cryptographic technique carries out the user side component software or software and hardware of crypto-operation and combines Component；

When user submits to account name to carry out account's login using browser access Web information system, Web information system is by such as Lower digital signature encryption mode or data encryption mode complete user and are logged on by the identity private key that checking user possesses cipher mark The discriminating of the owner of account：

Digital signature encryption mode：Web information system returns the cipher mark of User logs in account and a random word string for generating is arrived User side browser, browser calls crypto module using the mark of the cipher mark of User logs in account by spooler Private key is known to the random word string signature for returning, then the signed data of random word string is submitted to into Web information system, Web information System utilization returns to the random word string of browser and the mark public key verifications user side of the cipher mark of User logs in account is clear The validity of the signed data of the random word string that device of looking at is submitted to is the owner of cipher mark so as to confirm user, and and then is confirmed User is logged on the owner of account；

Data encryption mode：Web information system returns a mark public key encryption using the cipher mark of User logs in account Random generation word string to user side browser, browser calls crypto module to adopt User logs in by spooler The random word string of encryption of the identity private key of the cipher mark of account to returning is decrypted, then by directly returning decryption Random words string mode or the random words string obtained using decryption are completed User logs in and differentiate operation by HMAC digital signature encryption modes；

If the Web information system script of User logs in is that account possesses to user by the way of account name+password or password Person is differentiated and is kept original identification method constant, and Web information system information implements User logs in based on identification type password The system component of discriminating is a preposition security gateway in Web information system or is inserted into the request response of Web information system A safety insert in transmission channel, then the hashed value conduct of the cipher mark of the cipher mark of user account or user account Password or password are stored in original password or password storeroom in the user account data of Web information system, and the safety Gateway or safety insert completed using the cipher mark of user account to user be account owner differentiate after, by user's The cipher mark of account name and account as User logs in Web information system account name and password or the alternative family of password logging in The mode of request is submitted to Web information system and completes register, or by the cipher mark of the account name of user and account Hashed value as User logs in Web information system account name and password or the alternative family of password be submitted in the way of logging request Web information system completes register, and the former differentiates number corresponding to the account preserved in the user account data of Web information system According to the situation of the cipher mark for being user account, the latter is corresponding to the account preserved in the user account data of Web information system Authentication data is the situation of the hashed value of the cipher mark of user account；No matter which kind of situation, Web information system itself is by checking The mode of account name and password or password carries out account's discriminating process to User logs in.

2. realize that the User logs in of the system that User logs in differentiates is reflected based on identification type password described in a kind of utilization claim 1 Other method, is characterized in that：If a cipher mark of user is stored in Web information system as the authentication data of user account In user account data, then when user logs in Web information system using browser, Web information system, user, user side Browser and spooler complete User logs in discriminating and process by following data encryption mode：

I is walked：Web information system passes through browser requirement user input account name；

Ii is walked：User is input into account name and the account name of input is submitted to into Web information system by browser；

Ii I is walked：Web information system receive user side browser submission account name after, using receive account name with The cipher mark of user account is obtained in the account data of family by the authentication data of the corresponding user account of inquiry account name, then The random word string for generating of Web information systematic name and one is encrypted with the currently valid mark public key for obtaining cipher mark, Then Web information systematic name and random word string after encryption returned to the browser of user side；

Iv is walked：The browser of user side is received after the data of Web information system return, will be received by network communication mechanism To encryption Web information systematic name and random word string be submitted to a local spooler of user side, Ran Houti Show user by the password or Password Input frame of the random password shown on computing terminal or Password Input to browser；

V is walked：The local spooler of user side receive browser submission encryption Web information systematic name and with After machine word string, crypto module is called to use the currently valid identity private key solution of cipher mark using the cipher mark of user account The Web information systematic name and random word string of the encryption that close Web information system is returned, then by the Web information system after decryption Title and random word string pass through as the disposable random password or password of User logs in Web information system on computing terminal One personal-machine interface displays to the user that；

VI is walked：User is input to the random word string that spooler is shown as disposable random password or password clear Look at device password or Password Input frame and the random word string as account password or password of user input is carried by browser It is sent to Web information system；

VII is walked：Web information system receive user side browser submission as account password or the random word string of password Afterwards, the random word string as account password or password for receiving and the plaintext of the random word string for returning to browser are compared Compared with if unanimously, confirmation user is the owner of the user account corresponding to the account name submitted to and allows User logs in, otherwise Refusal.

3. realize that the User logs in of the system that User logs in differentiates is reflected based on identification type password described in a kind of utilization claim 1 Other method, is characterized in that:If a cipher mark of user is stored in Web information system as the authentication data of user account In user account data, then when user logs in Web information system using browser, Web information system, user, user side Browser and spooler complete User logs in discriminating and process by following data encryption mode：

1st step：Web information system passes through browser requirement user input account name；

2nd step：User is input into account name and the account name of input is submitted to into Web information system by browser；

3rd step：Web information system is received after the account name of browser submission, using the account name for receiving in user account number The cipher mark of user account is obtained by the authentication data of the corresponding user account of inquiry account name according in, it is then close with obtaining The word string encryption for generating random to one of the currently valid mark public key of code mark, afterwards by encryption after random word string return To the browser of user side；

4th step：The browser of user side is received after the data of Web information system return, will be received by network communication mode To the random word string of encryption be submitted to spooler, the random word string of request decryption encryption；

5th step：Spooler is received after the request of the random word string of the request decryption encryption of user side browser submission, Crypto module is called to use the random word string of the currently valid identity private key decryption encryption of the cipher mark of user account, then The random word string of decryption is returned to into user side browser；

6th step：User side browser is received after the random word string of the decryption of spooler return, by directly returning solution Close random words string mode or the random words string obtained using decryption complete User logs in discriminating by HMAC digital signature encryption modes Operation.

4. realize that the User logs in of the system that User logs in differentiates is reflected based on identification type password described in a kind of utilization claim 1 Other method, is characterized in that：If the hashed value of a cipher mark of user is stored in Web letters as the authentication data of user account In the user account data of breath system, then when user using browser log in Web information system when, Web information system, user, The browser and spooler of user side completes User logs in discriminating and processes by following data encryption mode：

Step 1：Web information system is by browser requirement user input account name and authentication data；

Step 2：User is input into the cipher mark of account name and account by browser, and wherein the cipher mark of account is used as discriminating Data input, is then submitted to Web letters by browser using the account name of input and as the cipher mark of account's authentication data Breath system；

Step 3：Web information system is received after the data of browser submission, calculates the hashed value of the cipher mark for receiving, and By the account submitted to user preserved in the user account data of the hashed value of calculated cipher mark and Web information system The hashed value of the cipher mark of the corresponding user account of name in an account book is compared, if unanimously, the cipher mark submitted to using user is worked as The word string encryption for generating random to one of front effective mark public key, returns to the clear of user side by the random word string of encryption afterwards Look at device；Otherwise, return reports an error；

Step 4：If the Web information system returned data prompting error for receiving, the browser prompts mistake of user side；It is no Then, the random word string of the encryption for receiving is submitted to spooler by the browser of user side by network communication mode, The random word string of request decryption encryption；

Step 5：Spooler is received after the random word string request of request decryption encryption of user side browser submission, is adjusted With crypto module using the random word string of the currently valid identity private key decryption encryption of the cipher mark of user account, then will The random word string of decryption returns to user side browser；

Step 6：User side browser is received after the random word string of the decryption of spooler return, by directly returning solution Close random words string mode or the random words string obtained using decryption complete User logs in discriminating by HMAC digital signature encryption modes Operation.

5. realize that the User logs in of the system that User logs in differentiates is reflected based on identification type password described in a kind of utilization claim 1 Other method, is characterized in that：If a cipher mark of user is stored in Web information system as the authentication data of user account In user account data, then when user logs in Web information system using browser, Web information system, user, user side Browser and spooler complete User logs in discriminating and process by following digital signature encryption mode：

The first step：Web information system passes through browser requirement user input account name；

Second step：User is input into account name and the account name of input is submitted to into Web information system by browser by browser System；

3rd step：Web information system is received after the account name of browser submission, using the account name for receiving in user account The cipher mark of user account is obtained in data by the authentication data of the corresponding user account of inquiry account name, then will be obtained Cipher mark and random word string for generating return to the browser of user side；

4th step：The browser of user side is received after the data of Web information system return, will be received by network communication mode To cipher mark and random word string be submitted to spooler, ask the random word string to returning to be digitally signed；

5th step：Spooler receives what the random word string to returning of user side browser submission was digitally signed After request, call crypto module using the currently valid identity private key of the cipher mark of user account to random word string number Word is signed, and then signed data is returned to into user side browser；

6th step：User side browser is received after the signed data of the random word string of spooler return, by number of signature According to being submitted to Web information system；

7th step：Web information system is received after the signed data of the random word string of browser submission, using returning to browser Random word string and user account cipher mark the currently valid mark public key label of random word string that browser is submitted to The signature validity of name data is verified, is verified that confirmation user is the user account corresponding to the account name submitted to Owner simultaneously allows User logs in, otherwise refuses.

6. realize that the User logs in of the system that User logs in differentiates is reflected based on identification type password described in a kind of utilization claim 1 Other method, is characterized in that：If the hashed value of a cipher mark of user is stored in Web letters as the authentication data of user account In the user account data of breath system, then when user using browser log in Web information system when, Web information system, user, The browser and spooler of user side completes User logs in discriminating and processes by following digital signature encryption mode：

Step one：Web information system is by browser requirement user input account name and authentication data；

Step 2：User is input into the cipher mark of account name and account by browser, and wherein the cipher mark of account is used as mirror Other data input, is then submitted to Web information system using the account name of input and as the cipher mark of account's authentication data；

Step 3：Web information system is received after the data of browser submission, calculates the hashed value of the cipher mark for receiving, And will preserve in the user account data of the hashed value of calculated cipher mark and Web information system and submitted to user The hashed value of the cipher mark of the corresponding user account of account name is compared, if unanimously, the cipher mark of then submitting to user and One random word string for generating returns to the browser of user side；Otherwise, error is returned；

Step 4：If the returned data prompting of the Web information system for receiving reports an error, the browser prompts error of user side； Otherwise, the cipher mark for receiving and random word string are submitted to background process by the browser of user side by network communication mode Program, asks the random word string to returning to be digitally signed；

Step 5：Spooler receives what the random word string to returning of user side browser submission was digitally signed After request, call crypto module using the currently valid identity private key of the cipher mark of user account to random word string number Word is signed, and then signed data is returned to into user side browser；

Step 6：User side browser is received after the signed data of the random word string of spooler return, by number of signature According to being submitted to Web information system；

Step 7：Web information system is received after the signed data of the random word string of browser submission, using returning to browser Random word string and user account cipher mark the currently valid mark public key label of signed data that browser is submitted to Name validity is verified, is verified that confirmation user is the owner of the user account corresponding to the account name submitted to and permits Perhaps User logs in, otherwise refuses.

7. it is according to claim 1 that the system that User logs in differentiates is realized based on identification type password, it is characterized in that：If user The cipher mark of account is input into by user in Web information system registry account, then Web information system is receiving the account of user After the log-on message of family, first when User logs in account differentiate it is the same in the way of verified using digital signature or data encryption mode, Confirm that user possesses the private key of the cipher mark of registration input, so as to confirm that user is the owner of the cipher mark of input, test Card, be identified through after complete user account and register and preserve log-on message, otherwise return error.

8. it is according to claim 1 that the system that User logs in differentiates is realized based on identification type password, it is characterized in that：If described The identification type cryptographic technique that system is adopted is IBC cryptographic techniques and supports that multigroup different IBC crypto-operations disclose parameter, then Web information system is determined as follows the open parameter group that the cipher mark of user account carries out used by crypto-operation：

If input simultaneously, submission account name and the password as authentication data when user logs in Web information system by browser Mark, then browser submit to cipher mark before first pass through network communication mechanism request spooler return cipher mark enter The configured information of the open parameter group used by row crypto-operation, spooler is received and call crypto module to inquire about after request Cipher mark carries out the configured information of the open parameter group used by crypto-operation, the finger of the open parameter group for then obtaining inquiry Show that information returns to browser, browser is received will be openly after the configured information of the open parameter group of spooler return The configured information of parameter group is submitted to together Web information system with cipher mark, and Web information system is submitted to according in logging request The configured information of open parameter determine the open parameter group for carrying out using the cipher mark of user account used by crypto-operation；

Otherwise, if Web information system is preserved the cipher mark of user account in user account data and carries out crypto-operation institute The configured information of open parameter group, then Web information system using the cipher mark of user account before computing is encrypted First pass through the cipher mark in user account data carry out open parameter used by crypto-operation configured information determine carry out it is close Open parameter group used by code computing；

Otherwise, Web information system before computing is encrypted using the cipher mark of user account first by the password of user account Mark returns to the browser of user side, and acquisition request cipher mark carries out the instruction letter of the open parameter group used by crypto-operation Breath；The browser of user side is received after the cipher mark of Web information system return and request, will be connect by network communication mechanism The cipher mark for receiving is submitted to the local spooler of user side, and acquisition request cipher mark is carried out used by crypto-operation Open parameter group configured information；Spooler calls the cipher mark that crypto module inquiry obtains user account to carry out The configured information of the open parameter group used by crypto-operation, and the configured information of the open parameter group that inquiry is obtained returns to use The browser at family end；Browser the cipher mark of acquisition is carried out the configured information of the open parameter group used by crypto-operation and returned To Web information system；Web information system determines that cipher mark carries out password fortune according to the configured information of the open parameter group for returning Calculate open parameter group used；

Further, if spooler calls crypto module to enter Web information system using the data that cipher mark is encrypted Find that Web information system has used incorrect open parameter group in row decryption processes, then spooler is by clear Device of looking at carries out the instruction letter of the open parameter group used by crypto-operation to the cipher mark of Web information system update user account Breath.

9. it is according to claim 1 that the system that User logs in differentiates is realized based on identification type password, it is characterized in that：If Web Information system preserves the cipher mark or the hash of cipher mark of user account names and user account also in user account data Value merge after data digital signature, with prevent check account user data in user account names and account cipher mark or password The unwarranted modification of the hashed value of mark, then Web information system during account's discriminating is carried out to User logs in, User is received after the account name that browser is submitted to, first to the cipher mark or cipher mark of account name and user account The user account that the digital signature of the data after hashed value merging is preserved in being verified to determine Web information systematic account data Whether the hashed value of the cipher mark or cipher mark of name and user account is changed, if being changed, stops login account Discriminating processes and returns mistake；Otherwise, the account's discriminating for continuing User logs in is processed；The cipher mark of account name and user account Or the digital signature method that the digital signature of the data after the hashed value merging of cipher mark is adopted is included based on the right of HMAC Claim key digital signature and the digital signature based on asymmetric key cipher algorithm.

10. according to any one of claim 3-6 based on identification type password realize User logs in differentiate system user Discrimination method is logged in, be it is characterized in that：The User logs in discrimination method improves what User logs in differentiated by one of following scheme Security：

Scheme one：Spooler is returned in the identity private key of the cipher mark using user account to Web information system Before random word string decryption before random word string signature or to the encryption for returning, first eject a personal-machine interface prompt user and enter Row login process, asks the user whether to continue；

Scheme two：Believable Web information system has been signed and issued a digitally signed secure site token, works as User logs in This secure site token is returned to together user side browser and is submitted to by browser with random word string during Web information system To spooler；Spooler is calling crypto module using the identity private key of the cipher mark of user account to returning Before the random word string signature for returning or the random word string decryption to the encryption for returning, believable secure site order is first checked whether there is Board, if the digital signature without secure site token or secure site token is insincere, ejects a personal-machine interactive interface and carries Show consumer's risk；If there is believable secure site token, user's system to be accessed is pointed out to be believable and show that user will The address of the website of access, asks the user whether to continue；

Scheme three：Web information system was first adopted before the random word string of random word string or encryption is returned to user side browser Public-key cipher technology is digitally signed to the data for returning, and then returns again to data；Spooler call it is close Before code module is to the random word string signature of return or the random word string decryption to the encryption for returning, Web information system is first verified The digital signature of the data of return, if the data for returning do not have digital signature or sign insincere, ejects personal-machine interaction Interface prompt consumer's risk；If having digital signature and signing credible, user's system to be accessed is pointed out to be believable and show The address of user's website to be accessed；

Scheme four：The browser of user side is submitted in the random word string of the random word string or encryption that return Web information system The host address of the Web information system to be logged in user while spooler is while be submitted to spooler； Spooler is calling random word string label of the crypto module using the identity private key of the cipher mark of user account to return Before name or the random word string decryption to the encryption for returning, first pass through a personal-machine interactive interface and display to the user that current browser will The host address of the Web information system of access, asks the user whether to continue；If user selects to continue, to the random words for returning String signature or the random word string decryption of the encryption to returning, then call crypto module to use the public key of Web information system to signing The random word string of name or the random word string of the decryption directly to return are differentiated with the login of the random word string HMAC signature of decryption Data are encrypted, and then the data after encryption are returned to into browser and are submitted to Web information system by browser；Web believes Breath system receive browser return encryption data after, first using Web information system private key decryption receive plus Close data, then make further login discriminating and process according to the data after decryption；The public key of the Web information system includes The IBC public keys of Web information system or the public key issued by a trusted key service system.