CN114422266A - IDaaS system based on dual verification mechanism - Google Patents

Abstract

The application discloses IDaaS system based on dual verification mechanism includes: the system comprises service request equipment, an identity authentication server, an identity management server and service providing equipment; after the service request equipment sends a first request carrying self identity information to the identity authentication server, the identity information is authenticated by the identity authentication server, and if the received first identity authentication token passes the authentication of the identity management server, the service request equipment receives a random encryption secret key sent by the identity management server. The service providing equipment receives the student privacy data encrypted by the random encryption key, sends a second request carrying the identity information of the equipment to the identity authentication server, receives the first identity authentication token and the second request, receives the random decryption key after the second request is authenticated by the identity management server, and analyzes the encrypted data to recover the student privacy data. By adopting the method and the device, identity authentication attack can be resisted, and the safety of the IDaaS system is improved.

Description

An IDaaS System Based on Double Verification Mechanism

technical field

The present application relates to the technical field of information security, and in particular, to an IDaaS system based on a two-factor authentication mechanism.

Background technique

Smart campus has become a new trend in the development of campus informatization. However, many information security problems are faced in the construction and exploration of the smart campus management system. For example, in the construction of the smart campus management system, problems such as forgery attacks, identity theft attacks and identity authentication attacks are often encountered.

SUMMARY OF THE INVENTION

Based on the above problems and the defects of the prior art, the present application provides an IDaaS system based on a double verification mechanism. Using the present application, the identity information of the communication device is double verified by using an identity verification server and an identity management server to resist the Identity authentication attacks or identity theft attacks can improve data security in IDaaS systems.

In a first aspect, the present application provides an IDaaS system based on a two-factor authentication mechanism, the system comprising:

a service requesting device, an authentication server, an identity management server and a service providing device; the service requesting device, the authentication server, the identity management server and the service providing device are connected through a network; wherein,

The service requesting device is configured to: send a first request carrying the identity information of the service requesting device to the identity verification server;

The identity verification server is used to: verify the identity information of the service requesting device, and if the verification passes, send a first identity verification token encrypted by the first encryption key to the service requesting device; the first The identity verification token is used for: the identity management server to verify the service requesting device as an authorized device that legally communicates with the identity management server;

The service requesting device is further configured to: send the first request, the first authentication token encrypted by the first encryption key, and the acquired identity information of the service providing device to the identity management server;

The identity management server is used for: verifying the first request, and if the verification is passed, sending the second identity verification token encrypted by the second encryption key and the random encryption key to the service requesting device;

The service requesting device is further configured to: send the student privacy data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key to the service providing device; The second authentication token is used for: the service requesting service device communicates with the service providing device; the service providing device is used for: in response to receiving the student privacy data and the second authentication token, sending a second request carrying the identity information of the service providing device to the identity verification server;

The identity verification server is further configured to: verify the identity information of the service providing device, and if the verification passes, send the first identity verification token encrypted by the first encryption key to the service providing device ;

The service providing device is further configured to: send the second request carrying the identity information of the service providing device and the first authentication token encrypted by the first encryption key to the server. the identity management server;

The identity management server is further configured to: verify the second request, and if the verification is passed, send the random decryption key and the second decryption key to the service providing device;

The service providing device is used for: using the random decryption key and the second decryption key to encrypt the student's private data encrypted by the random encryption key and the data encrypted by the second encryption key. The second authentication token is parsed to obtain the student privacy data; wherein, the second encryption key and the second decryption key are a pair of keys, the random encryption key and the The random decryption key is a pair of keys.

In conjunction with the first aspect, in some optional embodiments,

The first request is used for: the service requesting device requests the authentication server and the identity management server to provide a verification token, so as to implement the communication between the service requesting device and the service providing device;

The identity verification server is specifically configured to: verify the identity information of the service requesting device, and if the verification is passed, send the first identity verification token encrypted by the first encryption key and the obtained first timestamp to the Service requesting device; wherein, the first encryption key is the encryption key between the identity verification server and the identity management server; the first timestamp is the service requesting device and the identity verification server time stamp between; the first time stamp is used to indicate that the authentication server generates the first encryption key, the first authentication token, and encrypts the the point in time of the first authentication token;

The service requesting device is further configured to: send the first request carrying the identity information of the service requesting device, the first authentication token encrypted by the first encryption key, and the service providing device The identity information and the second timestamp generated by the service requesting device are sent to the identity management server; the second timestamp is used to indicate the first authentication token encrypted by the first encryption key. , the acquisition time point of the identity information of the service providing device;

The identity management server is specifically used for: verifying whether the first request is sent by a legitimate authorized device, and if the verification is passed, the second identity verification token encrypted by the second encryption key, the random encryption secret key, the third timestamp and the identity information of the service providing device are sent to the service requesting device; wherein, the second encryption key is the encryption key between the service requesting device and the identity management server ; the random encryption key is the encryption key between the service requesting device and the service providing device; the third time stamp is used to indicate that the identity management server generates the second encryption key and the time point of the second authentication token;

The identity verification server is specifically configured to: verify the identity information of the service providing device, and if the verification is passed, send the first identity verification token encrypted by the first encryption key and the obtained fourth time and the user identity information of the service providing device to the service providing device; the fourth time stamp is used to indicate that the authentication server generates the first encryption key, the first authentication token and the time point at which the first authentication token is encrypted by the first encryption key;

The service providing device is further configured to: convert the second request carrying the identity information of the service providing device, the first authentication token encrypted by the first encryption key, and the service request The identity information of the device and the obtained fifth timestamp are sent to the identity management server; the fifth timestamp is used to indicate the first authentication token encrypted by the first encryption key, the service request The time of obtaining the device's identity information;

The identity management server is further configured to: verify the second request, and if the verification is passed, send the random decryption key, the second decryption key and the sixth timestamp to the service providing device; The sixth time stamp is used to indicate the random decryption key and the generation time point of the second decryption key;

The service providing device is specifically configured to: use the random decryption key and the second decryption key to encrypt the student private data encrypted by the random encryption key and the encrypted data by the second encryption key. After the second authentication token is parsed, the private data of the student is obtained.

In conjunction with the first aspect, in some optional embodiments,

The service request device is specifically used for:

sending the first request Request ₁ carrying the identity information ID of the service requesting device to the authentication server; or,

The authentication server is specifically used for:

Verify the identity information ID _A of the service requesting device, and if the verification is passed, the first identity verification token E k(AS- _{IDS) encrypted by the first encryption key E k( AS-IDS)} (Token ₁ ) , the acquired first timestamp T1 and the identity information ID _A of the service requesting device are sent to the service requesting device _.

In conjunction with the first aspect, in some optional embodiments,

The service requesting device is also specifically used for:

The first request Request ₁ carrying the identity information ID _A of the service requesting device, the first identity verification token E _{k (AS-IDS) encrypted by the first encryption key E k (AS-IDS) IDS)} (Token ₁ ), the identity information ID _B of the service providing device and the _second timestamp T2 generated by the service requesting device are sent to the identity management server; or,

The identity management server is specifically used for:

Verify whether the first request Request ₁ is sent by a legitimate authorized device, and if the verification is passed, the second authentication token E _K encrypted by the second encryption key E _{K-SAML (IDS-B) -SAML(IDS-B)} (Token ₂ ), random encryption key E _RK(AB) , third time stamp T ₃ , identity information ID _A of the service requesting device, and identity information ID _B of the service providing device sent to the service requesting device.

In conjunction with the first aspect, in some optional embodiments,

The service requesting device is also specifically used for:

The student private data Msg encrypted by the random encryption key RK _(AB) and the second authentication token E _{K- SAML (IDS-B) encrypted by the second encryption key E K-SAML (IDS-B) B)} (Token ₂ ) provides the service to the device; wherein, the second encryption key E _{K-SAML (IDS-B)} is generated based on the SAML protocol;

The service providing equipment is specifically used for:

In response to receiving the student privacy data Msg and the second authentication token _{EK-SAML(IDS-B)} encrypted by the second encryption key EK _-SAML(IDS-B) (Token ₂ ) , sending a second request Request ₂ carrying the identity information ID _B of the service providing device to the authentication server;

The authentication server is also specifically used for:

Verify the identity information ID _B of the service providing device, and if the verification is passed, the first identity verification token E k (AS- _{IDS) encrypted by the first encryption key E k ( AS-IDS)} (Token ₁ ), the acquired _fourth timestamp T4 and the user identity information ID _B of the service providing device are sent to the service providing device;

The service providing equipment is also specifically used for:

The second request Request ₂ carrying the identity information ID _B of the service providing device, the first identity verification token E _{k ( AS-IDS)} (Token ₁ ), the identity information ID _A of the service requesting device and the obtained _fifth timestamp T5 are sent to the identity management server;

The identity management server is further used for:

Verify the second request Request ₂ , and if the verification is passed, send the random decryption key RK(AB) and the second decryption key K-SAML(IDS-B) to the service providing device; The second decryption key K-SAML (IDS-B) is generated based on the SAML protocol;

The service providing equipment is also specifically used for:

Use the random decryption key RK(AB) and the second decryption key K-SAML(IDS-B) to encrypt the student private data E _RK encrypted by the random encryption key E _{RK(AB) (AB)} (Msg) and the second authentication token E _{K-SAML (IDS-B)} (Token ₂ ) encrypted by the second encryption key E _{K-SAML (IDS-B} ) are parsed to obtain The Student Privacy Data Msg.

In conjunction with the first aspect, in some optional embodiments,

The service requesting device, the authentication server, and the identity management server are deployed in a fog computing environment, and the service providing device is deployed in a cloud computing environment;

or,

The service requesting device and the authentication server are deployed in the fog computing environment, and the identity management server and the service providing device are deployed in the cloud computing environment.

In conjunction with the first aspect, in some optional embodiments,

The identity management server is further used for:

After the second authentication token E _{K-SAML(IDS-B)} (Token ₂ ) encrypted by the second encryption key E _K-SAML(IDS-B ), the random encryption key E _RK(AB) , the first Before the _three time stamps T3, the identity information ID _A of the service requesting device and the identity information ID _B of the service providing device are sent to the service requesting device,

The random encryption key E _RK(AB) is generated by an elliptic curve cryptographic algorithm.

In conjunction with the first aspect, in some optional embodiments,

The identity management server is further used for:

Before sending the random decryption key RK(A-B) and the second decryption key K-SAML(IDS-B) to the service providing device,

The random decryption key RK(A-B) is generated by an elliptic curve cryptographic algorithm.

In conjunction with the first aspect, in some optional embodiments,

The authentication server is specifically used for:

Verifying whether the identity information of the service requesting device exists in the local database of the identity verification server or the memory of the identity verification server, and if so, determining that the identity information of the service requesting device has been verified;

or,

The authentication server is specifically used for:

Verify whether the identity information of the service providing device exists in the local database of the identity verification server or the memory of the identity verification server, and if so, it is determined that the identity information of the service providing device has been verified.

In conjunction with the first aspect, in some optional embodiments,

The identity management server is specifically used for:

Decrypt the first identity verification token encrypted by the first encryption key, and according to the obtained first identity verification token, verify that the service requesting device is the one that legally communicates with the identity management server. Authorizing device, the first request is actually sent by the service requesting device;

or,

The identity management server is specifically used for:

Decrypt the first identity verification token encrypted by the first encryption key, and verify that the service providing device is legally communicating with the identity management server according to the obtained first identity verification token the authorized device, the second request is actually sent by the service providing device.

This application provides an IDaaS system based on a double verification mechanism, the system includes: a service requesting device, an identity verification server, an identity management server and a service providing device; Connect through a network; wherein, after the service requesting device sends the first request carrying the identity information of the service requesting device to the identity verification server, it obtains the first identity verification token encrypted by the first encryption key and the identity of the service providing device information, and based on the above-mentioned first identity verification token, to pass the verification of the identity management server, if the verification is passed, the random encryption key sent by the identity management server and the second identity encrypted by the second encryption key will be received. The token is verified, and the student's private data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key are sent to the service providing device. In response to the received student privacy data encrypted by the random encryption key and the second identity verification token encrypted by the second encryption key, the service providing device sends a second request carrying the identity information of the service providing device to The identity verification device, if the identity information is verified and passed, the service providing device will receive the first identity verification token encrypted by the first encryption key and the above-mentioned second request sent by the identity verification server to pass the identity verification. The authenticity verification of the second request by the management server, if the verification is passed, the service providing device will receive the random decryption key and the second decryption key sent by the identity management server, so as to realize the encryption of the student's private data by the random encryption key. And the second authentication token encrypted by the second encryption key is parsed to recover the student's private data. By adopting the present application, the information security in the IDaaS system can be improved by using the identity verification server and the identity management server to double-verify the identity information of the communication device to resist identity authentication attacks or identity theft attacks.

Description of drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. For those of ordinary skill, other drawings can also be obtained from these drawings without any creative effort.

Fig. 1 is the structural representation of a kind of IDaaS system based on double verification mechanism provided by this application;

2 is a schematic structural diagram of another IDaaS system based on a double verification mechanism provided by the application;

3 is a schematic structural diagram of another IDaaS system based on a double verification mechanism provided by the application;

FIG. 4 is a schematic structural diagram of another IDaaS system based on a double verification mechanism provided by the present application.

Detailed ways

The technical solutions in the present application will be clearly and completely described below with reference to the accompanying drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

In order to improve the security of data in the IDaaS system and resist forgery attacks, identity theft attacks and identity authentication attacks, the present application provides an IDaaS system based on a double verification mechanism. Specifically, referring to Fig. 1, it is a structural flow chart of an IDaaS system based on a two-factor authentication mechanism provided by the present application. As shown in Fig. 1, the system may include, but is not limited to:

Service requesting equipment, authentication server (Authentication Server, AD), identity management server (Identity Management Server, IDS) and service providing equipment; service requesting equipment, authentication server, identity management server and service providing equipment are connected through a communication network ;

Optionally, the above-mentioned service requesting device, the authentication server, and the identity management server are deployed in a fog computing environment, and the above-mentioned service providing device is deployed in a cloud computing environment; or,

Optionally, the above service requesting device and the authentication server are deployed in a fog computing environment, and the identity management server and the service providing device are deployed in a cloud computing environment.

It should be noted that service request devices may include but are not limited to: classroom-specific cameras that can be used for student privacy data collection, AI smart boxes that can be used for student privacy data collection, cameras that can be used for student privacy data collection, or other that can be used for student privacy data. equipment for data collection.

Service providing equipment may include, but is not limited to, a server that may be used to process student private data.

It should be noted that the above-mentioned communication network may include but not be limited to the following methods:

Mode 1: Communication network in wired mode (such as network cable or optical fiber);

Mode 2: wireless communication network (such as: WIFI6 or 5G);

Mode 3: a communication network in which the above wired mode and wireless mode are combined.

The service requesting device may be configured to: send the first request carrying the identity information of the service requesting device to the authentication server; wherein,

The identity information of the service requesting device, which may include but is not limited to: the geographic location of the service requesting device and/or the unique identification code of the device;

The device unique identification code may include, but is not limited to: the unique device identifier (UDID) of the service requesting device, the IMEI code (International Mobile Equipment Identity), the manufacturer identifier (IDFV), the universal unique identification code, the MAC address , IP address or other unique identifier.

The identity verification server can be used to: verify the identity information of the service requesting device, and if the identity information is verified, send the first identity verification token encrypted by the first encryption key to the service requesting device; wherein, the first identity verification token The card can be used for: the identity management server to authenticate the service requesting device as an authorized device legitimately communicating with the identity management server;

The first encryption key may include, but is not limited to: a public key in an asymmetric encryption algorithm, or a key in a symmetric encryption algorithm.

It should be noted that the specific process used by the identity verification server to verify the identity information of the service requesting device is as follows:

The identity verification server can be specifically used to: verify whether the identity information exists in the local database of the identity verification server or the memory of the identity verification server, and if so, determine that the identity information of the service requesting device has been verified.

It should be noted that the service requesting device can also be used to: send the first request carrying the identity information of the service requesting device, the first identity verification token encrypted by the first encryption key, and the acquired identity information of the service providing device to the service requesting device. An identity management server; wherein, the first request can be used for: a service requesting device requests an identity verification server and an identity management server to provide a verification token to implement information communication such as student privacy data between the service requesting device and the service providing device;

The identity management server can be used to: verify the first request, and if the verification passes, send the second identity verification token encrypted by the second encryption key and the random encryption key to the service requesting device;

Specifically, the identity management server can be specifically used to: decrypt the second identity verification token encrypted by the second encryption key to verify whether the first request is sent by a legitimate authorized device, and if the verification is passed, the The second identity verification token encrypted by the second encryption key and the random encryption key are sent to the service requesting device. The second authentication token is used for: the service requesting service device communicates with the service providing device;

The service requesting device can also be used for: sending the student private data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key to the service providing device; wherein, the student private data may include but not limited to : The student's face image, the student's test score, the student's class score, the student's attendance score, the student's growth profile, or the student's family background, etc.

The service providing device may be configured to: in response to receiving the student privacy data and the second identity verification token, send a second request carrying the identity information of the service providing device to the identity verification server;

The identity verification server is also used to: verify whether the identity information of the service providing device exists in the local database of the identity verification server or the memory of the identity verification server, and if so, determine that the identity information of the service providing device is verified and passed, if If the verification is passed, the first authentication token encrypted by the first encryption key is sent to the service providing device;

The service providing device can also be used for: sending the second request carrying the identity information of the service providing device and the first authentication token encrypted by the first encryption key to the identity management server;

The identity management server is also used for: decrypting the first identity verification token encrypted by the first encryption key through the first decryption key, to verify whether the second request is sent by a legitimate authorized device, to verify The second request, if the verification is passed, send the random decryption key and the second decryption key to the service providing device; wherein, the second request can be used for: the service requesting device requests the identity verification server and the identity management server to provide verification Tokens to enable student privacy data communication between the service providing device and the service requesting device;

The first decryption key and the above-mentioned first encryption key are a pair of keys, wherein the first decryption key may include but is not limited to: a private key in an asymmetric encryption algorithm, or a key in a symmetric encryption algorithm .

The service providing device is used to: parse the student's private data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key through the random decryption key and the second decryption key, so as to obtain the above-mentioned Student privacy data; wherein, the second encryption key and the second decryption key are a pair of keys, and the random encryption key and the random decryption key are a pair of keys. It should be noted that the identity information of the service providing device may include, but is not limited to: the geographic location where the service providing device is located and/or the unique identification code of the device;

Wherein, the device unique identification code may include, but is not limited to: Unique Device Identifier (UDID), IMEI (International Mobile Equipment Identity), Vendor Identifier (IDFV), Universal Unique Identification Code, MAC address of the service providing device , IP address or other unique identifier.

In this application, after the service requesting device sends the first request carrying the identity information of the service requesting device to the identity verification server, it obtains the first identity verification token encrypted by the first encryption key and the identity information of the service providing device, And based on the above-mentioned first identity verification token, to pass the verification of the identity management server, if the verification is passed, the random encryption key sent by the identity management server and the second identity verification order encrypted by the second encryption key will be received. card, and send the student's private data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key to the service providing device; it should be noted that the identity management server can be based on the shared attribute. The first authentication token encrypted with an encryption key is decrypted.

In response to the received student privacy data encrypted by the random encryption key and the second identity verification token encrypted by the second encryption key, the service providing device sends a second request carrying the identity information of the service providing device to The identity verification device, if the identity information is verified and passed, the service providing device will receive the first identity verification token encrypted by the first encryption key and the above-mentioned second request sent by the identity verification server to pass the identity management server. For the authenticity verification of the second request, if the verification is passed, the service providing device will receive the random decryption key and the second decryption key sent by the identity management server, so as to realize the encryption of the student's private data encrypted by the random encryption key and the The second authentication token encrypted by the second encryption key is parsed to recover the student's private data.

In order to improve the security of data in the IDaaS system and resist forgery attacks, identity theft attacks and identity authentication attacks, this application provides another IDaaS system based on a double verification mechanism. specific,

Referring to FIG. 2, it is a schematic structural diagram of an IDaaS system based on a double verification mechanism provided by the present application. As shown in FIG. 2, the system may include but is not limited to:

Service requesting device, authentication server, identity management server, and service providing device; wherein, the service requesting device, the authentication server, the identity management server and the service providing device are connected through a communication network. It is not repeated here.

The service requesting device can be used for: sending a first request carrying the identity information of the service requesting device to the authentication server; wherein, the first request can be used for: the service requesting device requests the authentication server and the identity management server to provide a verification token to realize the service The requesting device communicates with the service providing device;

It should be noted that the service request equipment can be specifically used for:

Send the first request Request ₁ carrying the identity information ID (Identity) of the service requesting device to the authentication server;

The identity verification server can be used to: verify the identity information of the service requesting device, and if the identity information verification is passed, send the first identity verification token encrypted by the first encryption key, the obtained first timestamp and the identity of the service requesting device information to the service requesting device; wherein, the first encryption key is the encryption key between the identity verification server and the identity management server; the first timestamp is the timestamp between the service requesting device and the authentication server. The first timestamp may be generated by the identity verification server based on a digital signature technology, or generated by other timestamp service center devices. The first timestamp is used to indicate the time point when the authentication server generates the first encryption key, the first authentication token, and encrypts the first authentication token by using the first encryption key.

For example, an authentication server can specifically be used to:

Verify the identity information ID _A of the service requesting device, if the identity information ID _A exists in the service requesting device, that is, the identity information ID _A is verified and passed, then send the first encrypted by the first encryption key E _{k (AS-IDS)} . An identity verification token E _{k (AS-IDS)} (Token ₁ ), the acquired first timestamp T ₁ and the identity information ID _A of the service requesting device are given to the service requesting device.

The service requesting device may also be configured to: send the first request carrying the identity information of the service requesting device, the first authentication token encrypted by the first encryption key, the identity information of the service providing device, and the acquired second timestamp. To the identity management server; the first identity token here can be used for the service requesting device to communicate with the identity management server. The second time stamp may be generated by the service requesting device based on a digital signature technology, or may be generated by other time stamping service center devices. The second timestamp is used to indicate the acquisition time point of the first identity verification token encrypted by the first encryption key and the identity information of the service providing device.

For example, the service request device can also be used specifically to:

The first request Request ₁ carrying the identity information ID _A of the service requesting device and the first authentication token E _k(AS-IDS) (Token ₁ ) encrypted by the first encryption key E _{k (AS-IDS} ) , the identity information ID _B of the service providing device and the acquired second time stamp T ₂ are sent to the identity management server;

The identity management server can be used to: verify whether the first request is sent by a legitimate authorized device, and if the verification is passed, the second identity verification token encrypted by the second encryption key, the random encryption key, the third time The stamp, the identity information of the service requesting device and the identity information of the service providing device are sent to the service requesting device; wherein, the second encryption key is the encryption key between the service requesting device and the identity management server; the random encryption key is the service request The encryption key between the device and the service providing device; the second identity token is used for the service requesting device to communicate with the service providing device. The third timestamp may be generated by the identity management server based on the digital signature technology, or generated by other timestamp service center devices. The third timestamp is used to indicate the time point when the identity management server generates the second encryption key and the second authentication token.

For example, the identity management server can be specifically used to verify whether the first request Request ₁ is sent by a legitimate authorized device, and if the first request Request ₁ is verified and passed, the second encryption key E _{K-SAML ( IDS-B)} encrypted second authentication token E _{K-SAML(IDS-B)} (Token ₂ ), random encryption key E _RK(AB) , third time stamp T ₃ , identity information of the service requesting device ID _A and ID _B of the service providing device are sent to the service requesting device.

Identity Management Server can also be used to:

After the second authentication token E _{K-SAML(IDS-B)} (Token ₂ ) encrypted by the second encryption key E _K-SAML(IDS-B ), the random encryption key E _RK(AB) , the first Before the _three time stamps T3, the identity information ID _A of the service requesting device and the identity information ID _B of the service providing device are sent to the service requesting device,

A random encryption key E _{RK(AB) is generated by elliptic curve cryptography (ECC)} .

It should be noted that the identity management server can also be used to: encrypt the second authentication token encrypted by the second encryption key, the random encryption key, the third timestamp, the identity information of the service requesting device and the identity information of the service providing device. Before sending to the service requesting device,

A random encryption key will also be generated by elliptic curve cryptography.

The service requesting device can also be used for: sending the student private data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key to the service providing device.

For example, the service request device can also be used specifically to:

The student private data Msg encrypted by the random encryption key RK _(AB) and the second authentication token E K-SAML (IDS- _{B) encrypted by the second encryption key E K-SAML (IDS-B)} (Token ₂ ) is sent to the service providing device; wherein, the second encryption key E _{K-SAML (IDS-B)} is generated based on the SAML protocol.

The service providing device may be specifically configured to: in response to receiving the student privacy data and the second identity verification token, send a second request carrying the identity information of the service providing device to the identity verification server.

For example, the service providing device is specifically configured to: in response to receiving the student privacy data Msg encrypted by the random key and the second authentication token encrypted by the second encryption key E _{K-SAML (IDS-B)} E _{K-SAML(IDS-B)} (Token ₂ ), sending a second request Request ₂ carrying the identity information of the service providing device to the authentication server.

The identity verification server can be specifically used for: verifying the identity information of the service providing device, if the identity information of the above-mentioned service providing device exists in the database of the identity verification server, the verification is passed, and if the verification is passed, the first encryption key encrypted by the first encryption key is sent. An identity verification token, a fourth timestamp generated by the identity verification server, and user identity information of the service providing device are sent to the service providing device; wherein, the fourth timestamp can be generated by the identity verification server based on a digital signature technology, or Generated by other timestamp service center equipment. The fourth timestamp is used to indicate the time point when the authentication server generates the first encryption key, the first authentication token, and encrypts the first authentication token by using the first encryption key.

For example, the identity verification server can be specifically used to: verify the identity information ID _B of the service providing device, and if the verification passes, send the first identity verification token encrypted by the first encryption key E _{k (AS-IDS)} E _k(AS-IDS) (Token ₁ ), the fourth timestamp T ₄ generated by the authentication server, and the user identity information ID _B of the service providing device are sent to the service providing device.

Specifically, the service providing device can also be used to: send the second request carrying the identity information of the service providing device, the first authentication token encrypted by the first encryption key, the identity information of the service requesting device, and the first request generated by the service providing device. Five time stamps are sent to the identity management server; wherein, the fifth time stamp may be generated by the service providing device based on digital signature technology, or generated by other time stamp service center devices. The fifth timestamp is used to indicate the acquisition time point of the first identity verification token encrypted by the first encryption key and the identity information of the service requesting device.

For example, the service providing device is further configured to: send the second request Request ₂ carrying the identity information ID _B of the service providing device, the first authentication token encrypted by the first encryption key E _{k (AS-IDS)} E _k(AS-IDS) (Token ₁ ), the identity information ID _A of the service requesting device, and the fifth time stamp T ₅ generated by the service providing device are sent to the identity management server.

The identity management server can also be specifically used for: decrypting the first identity verification token encrypted by the first encryption key, and confirming that the service providing device is sent by a legitimate authorized device according to the first identity verification token, then The verification is passed, and the random decryption key, the second decryption key, the sixth timestamp, the identity information of the service requesting device and the identity information of the service providing device are sent to the service providing device. The sixth timestamp may be generated by the identity management server based on the digital signature technology, or generated by other timestamp service center devices. The sixth time stamp is used to indicate the generation time point of the random decryption key and the second decryption key.

For example, the identity management server is further configured to: verify the second request Request ₂ , and if the verification is passed, the random decryption key RK(AB), the second decryption key K-SAML(IDS-B), The sixth timestamp T ₆ , the identity information ID _{A of the service requesting device and the identity information ID B of} the service providing device are sent to the service providing device; the second decryption key K-SAML (IDS-B) is generated based on the SAML protocol.

The identity management server is also used specifically to:

Before sending the random decryption key RK(A-B) and the second decryption key K-SAML(IDS-B) to the service providing device,

A random decryption key RK(A-B) is generated by Elliptic Curve Cryptography (ECC).

The service providing device can be used to: parse the student privacy data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key by using the random decryption key and the second decryption key to obtain the student's privacy data.

For example, the service providing device is specifically used for: using the random decryption key RK(AB) and the second decryption key K-SAML(IDS-B) to encrypt the student's private data encrypted by the random encryption key E _RK(AB) E _RK(AB) (Msg) and the second authentication token E _{K-SAML(IDS-B)} (Token ₂ ) encrypted by the second encryption key E _K-SAML(IDS-B ) are parsed and recovered Out student privacy data Msg.

It should be noted that, for definitions or descriptions that are not explained in detail in the embodiment of FIG. 2 , reference may be made to the embodiment of FIG. 1 .

Referring to FIG. 3, it is a schematic structural diagram of another IDaaS system based on a two-factor authentication mechanism provided by the present application. The system may include, but is not limited to: a service requesting device, an identity verification server, an identity management server, and a service providing device; wherein, The service requesting device, the authentication server, the identity management server and the service providing device are connected through a communication network;

It should be noted that the service requesting device, the authentication server, and the identity management server are deployed in a fog computing environment, and the above-mentioned service providing device is deployed in a cloud computing environment.

It should be noted that, for the realization of the specific functions of the service requesting device, the identity verification server, the identity management server, and the service providing device, reference may be made to the embodiments in FIGS. 1-2 , which will not be repeated here.

Referring to FIG. 4, it is a schematic structural diagram of another IDaaS system based on a two-factor authentication mechanism provided by the present application. The system may include, but is not limited to: a service requesting device, an authentication server, an identity management server, and a service providing device; wherein, The service requesting device, the authentication server, the identity management server and the service providing device are connected through a communication network;

It should be noted that the above service requesting device, the authentication server and the identity management server are deployed in a fog computing environment, and the above service providing device is deployed in a cloud computing environment.

It should be noted that, for the realization of the specific functions of the service requesting device, the identity verification server, the identity management server, and the service providing device, reference may be made to the embodiments in FIGS. 1-2 , which will not be repeated here.

Those of ordinary skill in the art can realize that the content of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, computer software or a combination of the two, in order to clearly illustrate the interoperability of hardware and software Alternatively, the components and steps of each example have been described generally in terms of functionality in the foregoing description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, for the specific working process of the above-described device and system, reference may be made to the corresponding process in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed device or system may be implemented in other manners. Whether these functions of the system or device are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different ways to implement the functionality of the described devices for each particular application, but such implementations should not be considered beyond the scope of this application.

Claims (10)

1. An IDaaS system based on a dual authentication mechanism, comprising:

the system comprises service request equipment, an identity authentication server, an identity management server and service providing equipment; the service request equipment, the identity authentication server, the identity management server and the service providing equipment are connected through a network; wherein,

the service request device is configured to: sending a first request carrying identity information of the service request device to the identity authentication server;

the authentication server is configured to: verifying the identity information of the service request equipment, and if the identity information passes the verification, sending a first identity verification token encrypted by a first encryption key to the service request equipment; the first authentication token is to: the identity management server verifies the service request equipment as authorized equipment which is legal and communicates with the identity management server;

the service request device is further configured to: sending the first request, the first authentication token encrypted by the first encryption key and the acquired identity information of the service providing equipment to the identity management server;

the identity management server is configured to: the first request is verified, and if the first request passes the verification, a second identity verification token and a random encryption key which are encrypted by a second encryption key are sent to the service request equipment;

the service request device is further configured to: the student privacy data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key are sent to the service providing equipment; the second authentication token is to: the service request service device communicates with the service providing device; the service providing device is configured to: in response to receiving the student privacy data and the second authentication token, sending a second request carrying identity information of the service providing device to the authentication server;

the authentication server is further configured to: verifying the identity information of the service providing equipment, and if the identity information passes the verification, sending the first identity verification token encrypted by the first encryption key to the service providing equipment;

the service providing device is further configured to: sending the second request carrying the identity information of the service providing equipment and the first identity authentication token encrypted by the first encryption key to the identity management server;

the identity management server is further configured to: verifying the second request, and if the second request passes the verification, sending the random decryption key and the second decryption key to the service providing equipment;

the service providing device is configured to: analyzing the student privacy data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key through the random decryption key and the second decryption key to obtain the student privacy data; the second encryption key and the second decryption key are a pair of keys, and the random encryption key and the random decryption key are a pair of keys.

2. The dual authentication mechanism-based IDaaS system of claim 1,

the first request is to: the service request equipment requests the identity authentication server and the identity management server to provide authentication tokens so as to realize the communication between the service request equipment and the service providing equipment;

the authentication server is specifically configured to: verifying the identity information of the service request equipment, and if the identity information passes the verification, sending a first identity verification token encrypted by a first encryption key and the acquired first timestamp to the service request equipment; the first encryption key is an encryption key between the authentication server and the identity management server; the first timestamp is a timestamp between the service request device and the authentication server; the first timestamp is used to indicate a point in time at which the authentication server generated the first encryption key, the first authentication token, and encrypted the first authentication token with the first encryption key;

the service request device is further specifically configured to: sending the first request carrying the identity information of the service request device, the first authentication token encrypted by the first encryption key, the identity information of the service providing device and a second timestamp generated by the service request device to the identity management server; the second timestamp is used for indicating the acquisition time point of the first authentication token encrypted by the first encryption key and the identity information of the service providing equipment;

the identity management server is specifically configured to: verifying whether the first request is sent by a legal authorized device, and if the first request is passed through the verification, sending a second identity verification token, a random encryption key, a third timestamp and the identity information of the service providing device to the service request device, wherein the second identity verification token, the random encryption key and the third timestamp are encrypted by a second encryption key; wherein the second encryption key is an encryption key between the service request device and the identity management server; the random encryption key is an encryption key between the service request device and the service providing device; the third timestamp is used to indicate a point in time at which the identity management server generates the second encryption key and the second authentication token;

the authentication server is specifically configured to: verifying the identity information of the service providing equipment, and if the identity information passes the verification, sending the first identity verification token encrypted by the first encryption key, the obtained fourth timestamp and the user identity information of the service providing equipment to the service providing equipment; the fourth timestamp is used to indicate a point in time at which the authentication server generated the first encryption key, the first authentication token, and encrypted the first authentication token with the first encryption key;

the service providing device is further configured to: sending the second request carrying the identity information of the service providing device, the first authentication token encrypted by the first encryption key, the identity information of the service requesting device and the acquired fifth timestamp to the identity management server; the fifth timestamp is used for indicating the first authentication token encrypted by the first encryption key and the acquisition time point of the identity information of the service request device;

the identity management server is further specifically configured to: verifying the second request, and if the second request passes the verification, sending the random decryption key, the second decryption key and a sixth timestamp to the service providing equipment; the sixth timestamp is used for indicating a generation time point of the random decryption key and the second decryption key;

the service providing device is specifically configured to: and analyzing the student privacy data encrypted by the random encryption key and the second authentication token encrypted by the second encryption key through the random decryption key and the second decryption key to obtain the student privacy data.

3. The dual authentication mechanism-based IDaaS system of claim 2,

the service request device is specifically configured to:

a first Request carrying the identity information ID of the service Request equipment₁Sending the information to the identity authentication server; or,

the identity authentication server is specifically configured to:

verifying the identity information ID of the service request device_AIf the verification is passed, the first encryption key E is used_k(AS-IDS)Encrypted first authentication token E_k(AS-IDS)(Token₁) The first time stamp T obtained₁And identity information ID of the service request device_AAnd sending the request message to the service request device.

4. The dual authentication mechanism-based IDaaS system of claim 3,

the service request device is further specifically configured to:

the ID carrying the identity information of the service request equipment_AFirst Request of₁Said first encryption key E_k(AS-IDS)Encrypted first authentication token E_k(AS-IDS)(Token₁) Identity information ID of the service providing apparatus_BAnd a second time stamp T generated by the service request device₂Sending the information to the identity management server; or,

the identity management server is specifically configured to:

verifying the first Request₁Whether it is sent by a legitimate authorized device, and if the authentication is passed, it will be sent by a second encryption key E_{K-SAML(IDS-B)}Encrypted second authentication token E_{K-SAML(IDS-B)}(Token₂) Random encryption key E_RK(A-B)A third time stamp T₃Identity information ID of the service request device_AAnd identity information ID of the service providing apparatus_BAnd sending the request message to the service request device.

5. The dual authentication mechanism-based IDaaS system of claim 4,

the service request device is further specifically configured to:

will be encrypted by a random encryption key RK_(A-B)Encrypted student privacy data Msg and second encryption secretKey E_{K-SAML(IDS-B)}Encrypted second authentication token E_{K-SAML(IDS-B)}(Token₂) Providing the service providing device; wherein the second encryption key E_{K-SAML(IDS-B)}Generated based on the SAML protocol;

the service providing device is specifically configured to:

in response to receiving the student privacy data Msg and the second encryption key E_{K-SAML(IDS-B)}Encrypted second authentication token E_{K-SAML(IDS-B)}(Token₂) Sending ID carrying the service providing device_BSecond Request of₂Providing the identity authentication server;

the identity authentication server is specifically further configured to:

verifying the identity information ID of the service providing device_BIf the verification is passed, the first encryption key E is used_k(AS-IDS)Encrypted first authentication token E_k(AS-IDS)(Token₁) The fourth timestamp T of the acquisition₄And user identity information ID of the service providing apparatus_BSending the service request to the service providing equipment;

the service providing device is further specifically configured to:

the ID carrying the identity information of the service providing equipment_BSecond Request of₂Said first encryption key E_k(AS-IDS)Encrypted first authentication token E_k(AS-IDS)(Token₁) Identity information ID of the service request device_AAnd the acquired fifth time stamp T₅Sending the information to the identity management server;

the identity management server is further specifically configured to:

verifying the second Request₂Transmitting a random decryption key RK (A-B) and the second decryption key K-SAML (IDS-B) to the service providing apparatus if the authentication is passed; the second decryption key K-SAML (IDS-B) is generated based on a SAML protocol;

the service providing device is further specifically configured to:

the random encryption key E is encrypted by the random decryption key RK (A-B) and the second decryption key K-SAML (IDS-B)_RK(A-B)Encrypted private data E of students_RK(A-B)(Msg) and said second encryption key E_{K-SAML(IDS-B)}Encrypted second authentication token E_{K-SAML(IDS-B)}(Token₂) And analyzing to obtain the student privacy data Msg.

6. The dual authentication mechanism-based IDaaS system of claim 5,

the service request device, the authentication server and the identity management server are deployed in a fog computing environment, and the service providing device is deployed in a cloud computing environment;

or,

the service request device, the authentication server are deployed in the fog computing environment, and the identity management server and the service providing device are deployed in the cloud computing environment.

7. The dual authentication mechanism-based IDaaS system of claim 5,

the identity management server is further specifically configured to:

will be encrypted by the second encryption key E_{K-SAML(IDS-B)}Encrypted second authentication token E_{K-SAML(IDS-B)}(Token₂) Random encryption key E_RK(A-B)A third time stamp T₃Identity information ID of the service request device_AAnd identity information ID of the service providing apparatus_BBefore being sent to the service request device,

generating the random encryption key E by an elliptic curve cryptographic algorithm_RK(A-B)。

8. The dual authentication mechanism-based IDaaS system of claim 5,

the identity management server is further specifically configured to:

before sending the random decryption key RK (a-B) and the second decryption key K-SAML (IDS-B) to the service providing device,

and generating the random decryption key RK (A-B) by an elliptic curve cryptography algorithm.

9. The dual authentication mechanism-based IDaaS system of claim 1,

the authentication server is specifically configured to:

verifying whether the identity information of the service request equipment exists in a local database of the identity verification server or a memory of the identity verification server, and if so, determining that the identity information of the service request equipment passes verification;

or,

the authentication server is specifically configured to:

and verifying whether the identity information of the service providing equipment exists in a local database of the identity verification server or a memory of the identity verification server, and if so, determining that the identity information of the service providing equipment passes verification.

10. The dual authentication mechanism-based IDaaS system of claim 1,

the identity management server is specifically configured to:

decrypting the first authentication token encrypted by the first encryption key, and verifying that the service request device is an authorized device which is legal to communicate with the identity management server and the first request is really sent by the service request device according to the obtained first authentication token;

or,

the identity management server is specifically configured to:

and decrypting the first authentication token encrypted by the first encryption key, and verifying that the service providing equipment is authorized equipment which is legally communicated with the identity management server and the second request is really sent by the service providing equipment according to the obtained first authentication token.

Images