[go: up one dir, main page]

CN107454077B - Single sign-on method based on IKI identification authentication - Google Patents

Single sign-on method based on IKI identification authentication Download PDF

Info

Publication number
CN107454077B
CN107454077B CN201710648422.3A CN201710648422A CN107454077B CN 107454077 B CN107454077 B CN 107454077B CN 201710648422 A CN201710648422 A CN 201710648422A CN 107454077 B CN107454077 B CN 107454077B
Authority
CN
China
Prior art keywords
identification
entity
user
server
public key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201710648422.3A
Other languages
Chinese (zh)
Other versions
CN107454077A (en
Inventor
李庄
欧阳震诤
杨艳
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Erdos Dimanson Cryptography Technology Co ltd
Original Assignee
Beijing Dimansen Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Dimansen Technology Co ltd filed Critical Beijing Dimansen Technology Co ltd
Priority to CN201710648422.3A priority Critical patent/CN107454077B/en
Publication of CN107454077A publication Critical patent/CN107454077A/en
Application granted granted Critical
Publication of CN107454077B publication Critical patent/CN107454077B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3249—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using RSA or related signature schemes, e.g. Rabin scheme
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

The invention relates to a single sign-on method based on IKI identification authentication, which comprises the following steps: sending an access request, generating a random number r, and sending the random number r and the identifier to a server; verifying the identifier, generating a random number R after the identifier passes the verification, combining the random number R with R (R | | R), and signing by using a private key to generate signature data Sig 1; send R, identity, Sig 1; verifying the identifier, verifying Sig1, and confirming identity validity after verification; signing (R | | R) by using a private key to generate signature data Sig2, and sending Sig2 to the server side; verifying the Sig2, confirming identity validity after verification, checking a single sign-on mapping table, finding out an account number bound by the identifier, producing a user token, and directing to an application system; and receiving the user token, obtaining the login account of the user, setting the state of the user as login, returning to the page requesting access, and completing the access. The invention has the beneficial effects that: the security of the single sign-on system is improved, and a high-strength identity authentication method is provided.

Description

Single sign-on method based on IKI identification authentication
Technical Field
The invention relates to the technical field of information security, in particular to a single sign-on method.
Background
With the rapid development of information technology and network technology, more and more application systems are used in enterprises. Such as human resources management systems, financial systems, OA systems, customer relationship management systems, and the like. Because these systems are independent of each other, the user must log in according to the corresponding system identity before using each application system, and for this reason, the user must remember the user name and password of each system, which brings much trouble to the user. In particular, as the number of systems increases, the possibility of errors increases, the possibility of illegal interception and destruction increases, and the security decreases accordingly. For this situation, the concept of single sign-on is now and continuously applied to enterprise applications.
Single sign-on is a unified authentication and authorization mechanism, which refers to the same user accessing protected resources in different applications, and only needs to log on once, i.e. after passing security verification in one application, when accessing protected resources in other applications, re-login verification is not needed. The single sign-on can improve the work efficiency of the system and reduce the error probability of the system.
With the continuous and deep research in the field of single sign-on and the continuous warming up of Web services and application system integration, there are various single sign-on solutions. For example, IBM's WebSphere Single sign-on solution, SUN Java System Access Manager of SUN, Microsoft's Net Pasport and NeegritySiteMiner, BEA's WebLogic, and SAML-based products such as OPENSAL and SourceID, among others. However, the security of the existing products in single sign-on is still insufficient, most schemes transmit sensitive information in a plaintext form in the communication process between servers, and the information is easily stolen, so that important information is leaked. In addition, most schemes do not sign key information in the communication process, and are easy to be attacked by disguise.
An effective solution to the problems in the related art has not been proposed yet.
Disclosure of Invention
Aiming at the technical problems in the related art, the invention provides a single sign-on method based on IKI identification authentication, which can solve the technical problems.
In order to achieve the technical purpose, the technical scheme of the invention is realized as follows:
a single sign-on method based on IKI identification authentication comprises the following steps:
s1, the user end sends out the access request to the server, generates the random number r, and sends the random number r to the server end together with the user end identification;
s2, the server side verifies the user side identification, after the user side identification passes, the server side generates a random number R, the random number R is combined with the user side random number R to be (R | | | R), and the server side private key is used for signing to generate signature data Sig 1;
s3 the server side sends the random number R, the server side identification and the signature data Sig1 to the user side;
s4, the user side verifies the server side identification, the public key in the server identification is used for verifying the signature data Sig1 after the verification is passed, and the identity validity of the server side is confirmed after the verification is passed;
the S5 user side signs the random number (R | | | R) by using a private key to generate signature data Sig2, and the signature data Sig2 is sent to the server side;
the S6 server verifies the signature data Sig2 by using the public key of the user end, and confirms the validity of the identity of the user end after the verification is passed;
s7, the server-side login authentication device checks the single-point login mapping table of the user, finds out the account number bound by the user identifier on the corresponding application system, produces a user token, and redirects the user token to the application system;
and S8, the application system receives the user token with the uniform format, acquires the login account of the user in the system, sets the state of the user in the system as login, and returns the page requested to be accessed by the user to finish the access of the user to the application system.
Further, the server side identification, the user side identification, the private key and the public key are produced through an IKI identification management center.
Further, the server side identifier, the user side identifier, the private key and the public key are produced by the following steps:
s101IKI identifier management center IMC public parameter: public key matrix PKMS, identity management center public key PKIDorgECC curve, base point G; wherein the public key matrix PKMS is an identification management center private key SKIDorgFor public key matrix pkm, ID of ID management centerorgIsoparametric signatures;
s102 entity generates entity ID and related parameters: generating secret value xID and secret value public key PKx ═ xID × G by using entity security device, and randomly generating asymmetric key pair SK by using ECC algorithmh、PKh；
S103, encrypting part of parameters to be uploaded: use of an identity management center public key PKIDorgFor secret value public key PKx and random asymmetric key public key PKhEncryption: e (PK)IDorg,PKx||PKh)；
S104 upload entity ID, E (PK)IDorg,PKx||PKh) And tag expiration date to tag managementA central IMC; the effective date is identified to determine whether to upload according to application requirements;
s105, identifying the management center to perform entity ID duplicate checking to generate an entity part private key: after the IMC determines the uniqueness of the validity period of the entity ID combination identification, the PKMS, the entity ID and the validity period of the identification are utilized to calculate the entity ID public key PKIDCalculating the entity ID private key SK by using the private key matrix skm and the entity ID and identification validity periodIDThe entity encrypts a private key SKE and transforms the SKE to obtain a partial signature private key SKS 1;
s106, identification management center IMC assembly identification: using identity authority private key SKIDorgDecryption E (PK)IDorg,PKx||PKh) PKx and PK were obtainedhAnd combining the entity ID signature public key: PKS SKS 1G + PKx; calculating a decryption public key PKE (SKE G), and using SKIDFor (PKS. RTM. PKE. RTM. ID. RTMorgI ID) signature to obtain the identification
Figure BDA0001367413020000031
S107, issuing an identifier and an entity key: utilization of PK by IMChEncrypting SKE to obtain E (PK)hSKE), mixing E (PK)hSKE) and identification
Figure BDA0001367413020000032
Sending the data to an entity;
s108, the entity receives the identification and the secret key, and combines the signature private key: using SKhFor E (PK)hSKE), obtaining SKE after the SKE is decrypted, obtaining a partial signature private key SKS1 after the SKE is transformed, and safely storing SKS and SKE through SKS1 and a secret value xID.
Further, in steps S2 and S4, the step of verifying the server-side identifier and the user-side identifier specifically includes:
s201, calculating an entity identification public key by using a public key matrix and an entity ID;
s202, the identification is verified by using the identification public key, if the verification is correct, the identification is valid and passes, otherwise, the identification is invalid and does not pass;
and S203, after the verification is passed, the public key in the acquired identifier verifies the signature data.
The invention has the beneficial effects that: the invention takes IKI safety equipment as a carrier, realizes the bidirectional authentication of the client and the server through identification, improves the safety of the single sign-on system and provides a high-strength identity authentication method.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings without creative efforts.
Fig. 1 is a system architecture diagram involved in a single sign-on method based on IKI identity authentication according to an embodiment of the present invention;
FIG. 2 is a flowchart of generating ID and secret key in a single sign-on method based on IKI ID authentication according to an embodiment of the present invention
FIG. 3 is a schematic diagram of a system involved in a single sign-on method based on IKI identity authentication according to an embodiment of the present invention; FIG. 4 is a flowchart of the identification verification in the single sign-on method based on IKI identification authentication according to the embodiment of the present invention;
fig. 5 is a flowchart of a single sign-on method based on IKI identity authentication according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments that can be derived by one of ordinary skill in the art from the embodiments given herein are intended to be within the scope of the present invention.
As shown in fig. 5, a single sign-on method based on IKI identity authentication according to an embodiment of the present invention includes the following steps:
s1, the user end sends out the access request to the server, generates the random number r, and sends the random number r to the server end together with the user end identification;
s2, the server side verifies the user side identification, after the user side identification passes, the server side generates a random number R, the random number R is combined with the user side random number R to be (R | | | R), and the server side private key is used for signing to generate signature data Sig 1;
s3 the server side sends the random number R, the server side identification and the signature data Sig1 to the user side;
s4, the user side verifies the server side identification, the public key in the server identification is used for verifying the signature data Sig1 after the verification is passed, and the identity validity of the server side is confirmed after the verification is passed;
the S5 user side signs the random number (R | | | R) by using a private key to generate signature data Sig2, and the signature data Sig2 is sent to the server side;
the S6 server verifies the signature data Sig2 by using the public key of the user end, and confirms the validity of the identity of the user end after the verification is passed;
s7, the server-side login authentication device checks the single-point login mapping table of the user, finds out the account number bound by the user identifier on the corresponding application system, produces a user token, and redirects the user token to the application system;
and S8, the application system receives the user token with the uniform format, acquires the login account of the user in the system, sets the state of the user in the system as login, and returns the page requested to be accessed by the user to finish the access of the user to the application system.
In a specific embodiment of the present invention, the server-side identifier, the user-side identifier, the private key, and the public key are generated by an IKI identifier management center.
In an embodiment of the present invention, the server identifier, the client identifier, the private key, and the public key are produced by the following steps:
s101IKI identifier management center IMC public parameter: public key matrix PKMS, identity management center public key PKIDorgECC curve, base point G; wherein the public key matrix PKMS is an identification management center private key SKIDorgFor the public key matrix pkm,Identification management center identification IDorgIsoparametric signatures;
s102 entity generates entity ID and related parameters: generating secret value xID and secret value public key PKx ═ xID × G by using entity security device, and randomly generating asymmetric key pair SK by using ECC algorithmh、PKh；
S103, encrypting part of parameters to be uploaded: use of an identity management center public key PKIDorgFor secret value public key PKx and random asymmetric key public key PKhEncryption: e (PK)IDorg,PKx||PKh)；
S104 upload entity ID, E (PK)IDorg,PKx||PKh) And marking effective date to the mark management center IMC; the effective date is identified to determine whether to upload according to application requirements;
s105, identifying the management center to perform entity ID duplicate checking to generate an entity part private key: after the IMC determines the uniqueness of the validity period of the entity ID combination identification, the PKMS, the entity ID and the validity period of the identification are utilized to calculate the entity ID public key PKIDCalculating the entity ID private key SK by using the private key matrix skm and the entity ID and identification validity periodIDThe entity encrypts a private key SKE and transforms the SKE to obtain a partial signature private key SKS 1;
s106, identification management center IMC assembly identification: using identity authority private key SKIDorgDecryption E (PK)IDorg,PKx||PKh) PKx and PK were obtainedhAnd combining the entity ID signature public key: PKS SKS 1G + PKx; calculating a decryption public key PKE (SKE G), and using SKIDFor (PKS. RTM. PKE. RTM. ID. RTMorgI ID) signature to obtain the identification
Figure BDA0001367413020000051
S107, issuing an identifier and an entity key: utilization of PK by IMChEncrypting SKE to obtain E (PK)hSKE), mixing E (PK)hSKE) and identification
Figure BDA0001367413020000052
Sending the data to an entity;
s108 the entity receives the identification and the secretKey, combined signature private key: using SKhFor E (PK)hSKE), obtaining SKE after the SKE is decrypted, obtaining a partial signature private key SKS1 after the SKE is transformed, and safely storing SKS and SKE through SKS1 and a secret value xID.
In an embodiment of the present invention, in steps S2 and S4, the step of verifying the server-side identifier and the user-side identifier specifically includes:
s201, calculating an entity identification public key by using a public key matrix and an entity ID;
s202, the identification is verified by using the identification public key, if the verification is correct, the identification is valid and passes, otherwise, the identification is invalid and does not pass;
and S203, after the verification is passed, the public key in the acquired identifier verifies the signature data.
In order to facilitate understanding of the above-described technical aspects of the present invention, the above-described technical aspects of the present invention will be described in detail below in terms of specific usage.
As shown in fig. 1, the system architecture diagram related to the single sign-on method based on the IKI identifier authentication according to the present invention includes a user security device, a security device and a sign-on authentication device, where the security device is disposed at a server side, a user security device stores a private key, a user identifier and a public key matrix of a user, and the security device at the server side stores a private key, a server identifier and a public key matrix of a server. The user safety equipment is a USB-KEY or IC card containing an IKI chip, and the server end safety equipment is a server cipher machine or a signature verification server containing a PCIe cipher card. The user end and the server end safety equipment both comprise an IKI algorithm unit which is responsible for reading the identification in the user end and the server end safety equipment and verifying the validity of the identification and identity authentication processes such as private key signature, public key verification signature and the like.
As shown in fig. 2, based on the IKI chip identifier authentication center in the single sign-on system architecture, firstly, according to the entity identity (which can be customized, and uses a name, a unit name, etc., and needs to ensure the uniqueness) of each user, the key and the identifier are generated, and the specific steps are as follows:
s101IKI identity management center IMC discloses parameters: public key matrix PKMS, identity management center public key PKIDorgECC curve, base point G; wherein the public key matrix PKMS is an identification management center private key SKIDorgFor public key matrix pkm, ID of ID management centerorgIsoparametric signatures;
s102 entity generates entity ID and related parameters: generating secret value xID and secret value public key PKx ═ xID × G by using entity security device, and randomly generating asymmetric key pair SK by using ECC algorithmh、PKh；
S103, encrypting part of parameters to be uploaded: use of an identity management center public key PKIDorgFor secret value public key PKx and random asymmetric key public key PKhEncryption: e (PK)IDorg,PKx||PKh)；
S104 upload entity ID, E (PK)IDorg,PKx||PKh) And marking effective date to the mark management center IMC; the effective date is identified to determine whether to upload according to application requirements;
s105, identifying the management center to perform entity ID duplicate checking to generate an entity part private key: after the IMC determines the uniqueness of the validity period of the entity ID combination identification, the PKMS, the entity ID and the validity period of the identification are utilized to calculate the entity ID public key PKIDCalculating the entity ID private key SK by using the private key matrix skm and the entity ID and identification validity periodIDThe entity encrypts a private key SKE and transforms the SKE to obtain a partial signature private key SKS 1;
s106, identification management center IMC assembly identification: using identity authority private key SKIDorgDecryption E (PK)IDorg,PKx||PKh) PKx and PK were obtainedhAnd combining the entity ID signature public key: PKS SKS 1G + PKx; calculating a decryption public key PKE (SKE G), and using SKIDFor (PKS. RTM. PKE. RTM. ID. RTMorgI ID) signature to obtain the identification
Figure BDA0001367413020000061
S107, issuing an identifier and an entity key: utilization of PK by IMChEncrypting SKE to obtain E (PK)hSKE), mixing E (PK)hSKE) and identification
Figure BDA0001367413020000062
Sending the data to an entity;
s108, the entity receives the identification and the secret key, and combines the signature private key: using SKhFor E (PK)hSKE), obtaining SKE after the SKE is decrypted, obtaining a partial signature private key SKS1 after the SKE is transformed, and safely storing SKS and SKE through SKS1 and a secret value xID.
As shown in fig. 3 and 5, based on the single sign-on system, a user connects a user security device with a user login device, accesses a login page of a server through the user login device, prompts the user to input a PIN code to open the user security device, and after the PIN code is input, the user security device is opened, at this time, the following steps are performed, so as to implement the single sign-on method of the present invention, specifically:
s1, the user end sends out the access request to the server, generates the random number r, and sends the random number r to the server end together with the user end identification;
s2, the server side verifies the user side identification, after the user side identification passes the verification, the server side generates a random number R, the random number R is combined with the user side random number R (R | | | R), and the server side private key is used for signing to generate signature data Sig 1;
s3 the server side sends the random number R, the server side identification and the signature data Sig1 to the user side;
s4, the user side verifies the server side identification, the public key in the server identification is used for verifying the signature data Sig1 after the verification is passed, and the identity validity of the server side is confirmed after the verification is passed;
the S5 user side signs the random number (R | | | R) by using a private key to generate signature data Sig2, and the signature data Sig2 is sent to the server side;
the S6 server verifies the signature data Sig2 by using the public key of the user end, and confirms the validity of the identity of the user end after the verification is passed;
s7, the server-side login authentication device checks the single-point login mapping table of the user, finds out the account number bound by the user identifier on the corresponding application system, produces a user token, and redirects the user token to the application system;
and S8, the application system receives the user token with the uniform format, acquires the login account of the user in the system, sets the state of the user in the system as login, and returns the page requested to be accessed by the user to finish the access of the user to the application system.
In the single sign-on method, the step of verifying the server side identifier and the user side identifier comprises the following steps:
s201, calculating an entity identification public key by using a public key matrix and an entity ID;
s202, the identification is verified by using the identification public key, if the verification is correct, the identification is valid and passes, otherwise, the identification is invalid and does not pass; and S203, after the verification is passed, the public key in the acquired identifier verifies the signature data.
In one embodiment of the present invention, when the public key matrix PKMS published by the identity authority is known, entity a knows entity ID and identity of entity B
Figure BDA0001367413020000071
The corresponding authentication steps for the server side identifier and the user side identifier specifically include:
1. using public key matrix PKMS and entity B entity IDBComputing entity B identification public key { PKID}B；
2. And (3) verifying the validity of the identifier: identifying public key { PK with entity BID}BVerifying identity of entity B
Figure BDA0001367413020000072
If the verification is correct, the identification is valid and passes, otherwise, the identification is invalid and does not pass;
3. and after the verification is passed, the public key in the identifier is obtained to verify the signature data.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims (2)

1. A single sign-on method based on IKI identification authentication is characterized by comprising the following steps:
s1, the user end sends out the access request to the server, generates the random number r, and sends the random number r to the server together with the user end identification;
the S2 server verifies the user end identification, after the user end identification passes, the server generates a random number R, the random number R is combined with the user end random number R to be (R | | | R), and the server carries out signature by using a server private key to generate signature data Sig 1;
s3 server sends the random number R, server identification, signature data Sig1 to user end;
s4, the user side verifies the server identification, the public key in the server identification is used for verifying the signature data Sig1 after the server identification passes the verification, and the identity validity of the server is confirmed after the server identification passes the verification;
the S5 user side signs the random number (R | | | R) by using a private key to generate signature data Sig2 and sends the signature data Sig2 to the server;
the S6 server verifies the signature data Sig2 by using the public key of the user end, and confirms the validity of the identity of the user end after the verification is passed;
s7, the server login authentication device checks the user single sign-on mapping table, finds out the account number of the user end identifier bound on the corresponding application system, produces the user token, and redirects the user token to the application system;
s8, the application system receives the user token with uniform format, obtains the login account of the user in the system, sets the state of the user in the system as login, returns the page requested to be accessed by the user, and completes the access of the user to the application system;
producing the server identification, the user side identification, the private key and the public key through an identification management center;
the server identification, the user side identification, the private key and the public key are produced by the following steps:
s101, identifying public parameters of a management center: public key matrix PKMS, identity management center public key PKIDorgECC curve, base point G; wherein the public key matrix PKMS is an identification management center private key SKIDorgFor public key matrix pkm, ID of ID management centerorgThe signature of (2);
s102 entity generates entity ID and related parameters: generating secret value xID and secret value public key PKx ═ xID × G by using entity security device, and randomly generating asymmetric key pair SK by using ECC algorithmh、PKh；
S103, encrypting part of parameters to be uploaded: use of an identity management center public key PKIDorgFor secret value public key PKx and random asymmetric key public key PKhEncryption: e (PK)IDorg,PKx||PKh)；
S104 upload entity ID, E (PK)IDorg,PKx||PKh) And the effective date of the mark is sent to the mark management center; the effective date is identified to determine whether to upload according to application requirements;
s105, identifying the management center to perform entity ID duplicate checking to generate an entity part private key: after the IMC determines the uniqueness of the validity period of the entity ID combination identification, the PKMS, the entity ID and the validity period of the identification are utilized to calculate the entity ID public key PKIDCalculating the entity ID private key SK by using the private key matrix skm and the entity ID and identification validity periodIDThe entity encrypts a private key SKE and transforms the SKE to obtain a partial signature private key SKS 1;
s106, identification of management center assembly identification: using identity authority private key SKIDorgDecryption E (PK)IDorg,PKx||PKh) PKx and PK were obtainedhAnd combining the entity ID signature public key: PKS SKS 1G + PKx; calculating a decryption public key PKE (SKE G), and using SKIDFor (PKS. RTM. PKE. RTM. ID. RTMorgI ID) signature to obtain the identification
Figure FDA0002361074480000021
S107, issuing an identifier and an entity key: utilization of PK by IMChEncrypting SKE to obtain E (PK)hSKE), mixing E (PK)hSKE) and the identifier SKID[ PKS | | PKE | | | effective date | | | expiration date | | IDorg||ID]Sending the data to an entity;
s108, the entity receives the identification and the secret key, and combines the signature private key: using SKhFor E (PK)hSKE) is decrypted to obtain SKE, the SKE is transformed to obtain a partial signature private key SKS1,and summing the SKS1 and the secret value xID to obtain a signature private key SKS of xID + SKS1, deleting the secret value xID, and safely storing the SKS and the SKE.
2. The method of claim 1, wherein the steps of verifying the server id and the user side id in steps S2 and S4 are specifically as follows:
s201, calculating an entity identification public key by using a public key matrix and an entity ID;
s202, the identification is verified by using the identification public key, if the verification is correct, the identification is valid and passes, otherwise, the identification is invalid and does not pass;
and S203, after the verification is passed, the public key in the acquired identifier verifies the signature data.
CN201710648422.3A 2017-08-01 2017-08-01 Single sign-on method based on IKI identification authentication Active CN107454077B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710648422.3A CN107454077B (en) 2017-08-01 2017-08-01 Single sign-on method based on IKI identification authentication

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710648422.3A CN107454077B (en) 2017-08-01 2017-08-01 Single sign-on method based on IKI identification authentication

Publications (2)

Publication Number Publication Date
CN107454077A CN107454077A (en) 2017-12-08
CN107454077B true CN107454077B (en) 2020-05-19

Family

ID=60490685

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710648422.3A Active CN107454077B (en) 2017-08-01 2017-08-01 Single sign-on method based on IKI identification authentication

Country Status (1)

Country Link
CN (1) CN107454077B (en)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101816651B1 (en) * 2017-02-14 2018-01-09 주식회사 코인플러그 Method for providing login flow via authentication based on public key infrastructure in response to user’s login request for using service provided by service provider server in use of blockchain database with unspent transaction output based protocol and server using the same
CN109510822A (en) * 2018-11-08 2019-03-22 蓝信移动（北京）科技有限公司 Obtain the method and system of public and private key
CN110287685A (en) * 2019-06-28 2019-09-27 浪潮云信息技术有限公司 KEY authentication method and system based on domestic CPU, operating system and database
CN110321682B (en) * 2019-07-08 2021-10-22 国网电子商务有限公司 A unified identity authentication method and device based on UAF and IBC
CN110336820B (en) * 2019-07-09 2022-08-05 中国联合网络通信集团有限公司 Single-point logout method, device, equipment, storage medium and system
CN110505207A (en) * 2019-07-19 2019-11-26 苏州浪潮智能科技有限公司 A kind of single sign-on realization method based on ukey certification
CN110661783B (en) * 2019-08-28 2022-04-26 视联动力信息技术股份有限公司 A terminal registration method, device and storage medium
CN111698225B (en) * 2020-05-28 2022-08-19 国家电网有限公司 Application service authentication encryption method suitable for power dispatching control system
CN112039674B (en) * 2020-08-06 2021-07-20 珠海格力电器股份有限公司 Central control system access and signature identification generation method and device and storage medium
CN112887331B (en) * 2021-02-26 2022-07-08 政采云有限公司 A two-way authentication method, device and equipment between different single sign-on systems
CN116389007B (en) * 2023-04-12 2025-02-21 烟台云朵软件有限公司 A code scanning authentication method and system based on PKI system

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102238484A (en) * 2010-04-22 2011-11-09 中兴通讯股份有限公司 Method and system for group-based authentication in machine to machine communication systems
CN102710605A (en) * 2012-05-08 2012-10-03 重庆大学 Information security management and control method under cloud manufacturing environment
CN102739687A (en) * 2012-07-09 2012-10-17 广州杰赛科技股份有限公司 Application service network access method and system based on identifier
CN104378210A (en) * 2014-11-26 2015-02-25 成都卫士通信息安全技术有限公司 Cross-trust-domain identity authentication method

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103237004A (en) * 2013-03-15 2013-08-07 福建联迪商用设备有限公司 Key download method, key management method, method, device and system for download management
JP6256116B2 (en) * 2014-03-10 2018-01-10 富士通株式会社 Communication terminal, secure login method, and program

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102238484A (en) * 2010-04-22 2011-11-09 中兴通讯股份有限公司 Method and system for group-based authentication in machine to machine communication systems
CN102710605A (en) * 2012-05-08 2012-10-03 重庆大学 Information security management and control method under cloud manufacturing environment
CN102739687A (en) * 2012-07-09 2012-10-17 广州杰赛科技股份有限公司 Application service network access method and system based on identifier
CN104378210A (en) * 2014-11-26 2015-02-25 成都卫士通信息安全技术有限公司 Cross-trust-domain identity authentication method

Also Published As

Publication number Publication date
CN107454077A (en) 2017-12-08

Similar Documents

Publication Publication Date Title
CN107454077B (en) Single sign-on method based on IKI identification authentication
CA2531533C (en) Session-based public key infrastructure
US9860245B2 (en) System and methods for online authentication
CN108834144B (en) Method and system for managing association of operator number and account
KR101298562B1 (en) System and method for implementing digital signature using one time private keys
US8332920B2 (en) Token-based client to server authentication of a secondary communication channel by way of primary authenticated communication channels
US8843415B2 (en) Secure software service systems and methods
CN104601593B (en) The method that anti-tracking in network electronic authentication procedures is realized based on challenge mode
CN102170354B (en) Account number cipher certification is concentrated to generate system
CN109450843B (en) A blockchain-based SSL certificate management method and system
CN106713279B (en) video terminal identity authentication system
CN102932149A (en) Integrated identity based encryption (IBE) data encryption system
WO2008033590A2 (en) A method and apparatus to provide authentication and privacy with low complexity devices
US11082236B2 (en) Method for providing secure digital signatures
US11625476B2 (en) Remote processing of credential requests
CN108737376A (en) A kind of double factor authentication method and system based on fingerprint and digital certificate
CN106936588A (en) A kind of trustship method, the apparatus and system of hardware controls lock
CN104486087A (en) Digital signature method based on remote hardware security modules
KR101007375B1 (en) Smart card certificate management device and method
KR102012262B1 (en) Key management method and fido authenticator software authenticator
CN106533681B (en) A kind of attribute method of proof and system that support section is shown
CN103532961A (en) Method and system for authenticating identity of power grid website based on trusted crypto modules
KR101868564B1 (en) Apparatus for authenticating user in association with user-identification-registration and local-authentication and method for using the same
CN114079645A (en) Method and device for registering services
WO2022124352A1 (en) Request verification system and request verification method

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right
TR01 Transfer of patent right

Effective date of registration: 20221111

Address after: 017010 No. 1, No. 4, Dongwei Second Road North, Ordos, Inner Mongolia Autonomous Region (the fifth floor of the original Huatai Automobile Factory office building)

Patentee after: Erdos Dimanson Cryptography Technology Co.,Ltd.

Address before: 100012 unit 402, building 1, yard 5, Laiguangying West Road, Wangjing Chengying center, Chaoyang District, Beijing

Patentee before: BEIJING DIMANSEN TECHNOLOGY Co.,Ltd.