CN1855814A - Safety uniform certificate verification design - Google Patents

Abstract

In a distributed network environment, users need to present their identity authentication credentials multiple times to log in to the system when accessing network resources across domains, which brings low efficiency and many security risks. The present invention is a safe and practical unified identity authentication scheme, which provides a unified identity authentication mechanism in a distributed network environment, utilizes the cookie mechanism and redirection function of standard browsers, centrally authenticates users at portal sites, and securely transmits user authentication credentials to the resource site, and the resource site interprets the user's access rights and responds to their access requests. The invention realizes the function that the user can safely visit all resource sites for multiple times only by logging in once.

Description

A Secure Unified Identity Authentication Scheme

1. Technical field

The invention belongs to the field of computer network security and password technology, and is a security authentication scheme based on a WEB mode to realize cross-domain identity authentication, and realizes a security authentication mechanism for single login and multiple visits. It is suitable for application scenarios requiring unified identity authentication and cross-domain security authentication that requires single sign-on.

2. Background technology

At present, user identity authentication in distributed systems generally adopts decentralized login and decentralized management. Due to the lack of good commonality among subsystems, frequent identity registration and hidden security risks have become prominent problems. Among the many management systems that need to log in, our most common method is to register a common user name and password. However, because the security mechanisms of different systems are different, once the user's registration information in one system is lost, it means that the security mechanisms of other systems are lost; if different systems register with different identities, it is necessary to remember too many information. Therefore, the information system needs a unified identity verification system with high security control to ensure data security and user convenience.

3. Brief introduction of the invention

In order to overcome the deficiencies of the existing user identity authentication mechanism, the present invention provides a secure user identity authentication mechanism, which can not only identify the user identity, but also conveniently realize the user's cross-domain automatic identification of the user identity, that is, the user accesses the When accessing resources, you only need to present your credentials once to securely log in to multiple domains to access resources.

4. Contents of the invention

We will introduce the technical solution adopted by this program to solve its technical problems in three parts. In section 4.1 we introduce the overall framework of the program, in section 4.2 we introduce the details of the program operation, in section 4.3 we introduce its security; in section 4.4 we introduce The application scenario of this program.

Terms and Descriptions

●Portal: a WEB site, responsible for the management and authentication of all users, providing a list of resources selected by users, requiring an X.509 digital certificate issued by an authority, capable of establishing HTTPS connections with other entities, capable of performing DES encryption and decryption algorithms, and saving There is a key for DES encryption and decryption, and the private key corresponding to the X.509 digital certificate can be used for digital signature calculation.

●Resource site: WEB site, trusted portal, accepts the authentication certificate issued by the portal to the user, and can use the portal's X.509 digital certificate to verify the digital signature calculation. A server-side setup that supports HTTPS connections is recommended.

●Client: a standard browser that supports cookies and redirection.

● UID: The user name of the user who logs in to the portal.

● passwd: the password for the user to log in to the portal.

●UIP: The IP address of the user client when logging in to the portal.

●RoleID: The role number obtained by the user on the portal, which indicates the type of the user. When the user registers, it is determined by the administrator of the portal according to the user's characteristics. It is up to the resource site to interpret its meaning when passed to the resource site.

●timeInterval: The validity period of user credentials defined by the portal.

●WebServerURL: URL for users to access resource sites.

●Pcookie: Its content is the relevant information after the user has passed the authentication. Its structure is Ek(UID+RoleID+timeInterval+UIP), which means that k is used as the encryption key, DES is used as the encryption algorithm, and UID+RoleID+timeInterval+ is encrypted. The result obtained from the UIP information, where k is a random password generated by the portal for encrypting the Pcookie, which is secretly stored in the portal's local storage device in the form of a file. The portal writes Pcookie as a cookie to the client browser.

● timeStamp: the current portal system time (timestamp) when the portal generates user credentials.

●Credential: The credential issued by the portal to legal users, its structure is: RoleID+timeInterval+timeStamp+UIP+WebServerURL.

4.1 Program introduction

As shown in Figure 1, (a) under the protection of SSL, the user enters UID and passwd to log in to the portal, and the portal checks whether the user's UID and passwd are legal. If it is legal, (b) generates a Pcookie and stores it in the user's browser. Otherwise, the user is prompted to log in illegally.

①The user visits the corresponding resource site, ②The access control program of the resource site automatically redirects the user's access request back to the portal. RoleID, timeInterval, UIP, and the obtained timeStamp and WebServerURL construct Credential, ③ the portal uses the private key of its digital certificate to digitally sign the Credential, and ④ sends the Credential and its signature to the access control of the resource site through redirection of the user browser program, the resource site verifies the signature of the Credential, and at the same time verifies the plaintext content of the user's Credential; if the Credential received by the resource site is legal, ⑤ the resource site returns the resource requested by the user.

4.2 Operation details of the scheme

As shown in Figure 2, the operation process of the scheme is divided into three stages, initialization stage, portal authentication stage and resource site authentication stage.

4.2.1 Initialization phase

First, the portal obtains the X.509 digital certificate issued by the authority and stores it in the corresponding location. The web service program of the portal recognizes the X.509 digital certificate and prepares to establish a one-way server-authenticated SSL connection with any user's browser. At the same time, the certificate is used to digitally sign user credentials sent to the resource site. Second, the resource site needs to download the portal certificate from the portal to verify the signature of the received user credentials. Finally, the user needs to register user information on the portal, mainly including UID, passwd, etc., and the portal administrator assigns a RoleID to the user according to the characteristics of the user registration information.

4.2.2 Portal authentication stage

This stage is divided into two processes: the user logs in to the portal to obtain the legal user identity certificate, that is, the Pcookie stored in the client browser; the other process is the user authentication process during the user's access to the resource site.

(1) The user establishes an SSL-based secure connection with the portal through a browser, and at the same time authenticates the identity of the portal.

(2) The user enters the UID and passwd to log in to the portal.

(3) After the user logs in successfully, the portal searches for the RoleID corresponding to the UID. The portal constructs the Pcookie to be written to the client. The plaintext content of Pcookie is: UID+RoleID+timeInterval+UIP, this structure is encrypted with DES and stored as a cookie on the client.

(4) Users can access protected resource sites in two ways, one is to select resource sites from the "resource list" provided by the portal; the other is to directly access resource sites. In either case, resource The site program will redirect the user to the portal and submit the WebServerURL to the portal.

(5) The portal checks whether Pcookie exists in the client browser:

a) If the Pcookie does not exist, return to the portal login interface and require the user to log in to the portal.

b) If the Pcookie exists, perform DES decryption on it, if the effective UID+RoleID+timeInterval+UIP structure cannot be separated, then consider the Pcookie invalid, give an error message and end the user visit. Pcookies are valid if they can be detached correctly. The portal constructs a Credential with a structure of: RoleID+timeInterval+timeStamp+UIP+WebServerURL, and signs the Credential with the portal certificate. The default signature algorithm is: SHA1withRSA. So far, the user has obtained the credentials of the user to access resources and the portal signature of the credentials.

4.2.3 Resource site authentication stage

At this stage, the resource site checks the legitimacy of the user's access to resources based on the Credential and its portal signature obtained in the previous stage, and gives correct responses to legal requests.

(1) The portal redirects the user to the resource site, and submits the Credential and its signature to the resource site's access control program in the form of a form.

(2) The resource site receives the portal's redirection request, takes out the Credential, and uses the portal's X.509 digital certificate to verify its signature:

a) If the signature verification fails, the redirection request is considered illegal, an error message is given, and the user access is terminated.

b) If the signature verification is passed, take out the RoleID, UIP, timeInterval, timeStamp and WebServerURL in the Credential;

c) Validate the user credentials.

●Comparing the UIP in Credential with the current user IP, if they are different, the user is illegal and the access is terminated;

●If they are the same, compare whether the difference between the current time of the resource site and timeStamp is less than timeInterval, if it is greater, it means that the validity period of the Credential has expired, and the access is terminated;

●Otherwise, compare whether the domain name of the resource site is included in the WebServerURL, and if not, terminate the user access;

• Otherwise, the verification process of the user credentials is passed.

d) Use the obtained RoleID to perform local user access control.

4.3 Security of the scheme

4.3.1 Replay attack

In each authentication process, we require the resource site to compare the current IP address of the user with the UIP in the Credential, and the UIP in the Credential comes from the user IP when the user logs in to the portal. If it is a replay attack, the attacker's IP If it is different from the IP in Credential, it will be rejected by the resource site. At the same time, since Credential's portal signature is unforgeable, it ensures that the UIP in Credential cannot be forged. In addition, the lifetime of Credential is determined by the portal's timestamp and timeInterval, and the validity period of replay attacks is also greatly limited.

4.3.2 For DoS attack (denial of service attack)

Since this system does not involve technologies to prevent DoS attacks such as intrusion detection, it cannot resist DOS attacks, and requires each implementation site to deploy corresponding hardware and software means to prevent DoS attacks.

4.3.3 Security of SSL connections

It is required that the portal must have a certificate issued by an authority, and the client recognizes its legitimacy in order to establish a secure SSL-based connection between the client and the portal site.

4.4 Application Scenarios of the Solution

The present invention is aimed at the application scenario where users access resources across domains in a distributed network environment. By using the portal to manage user identity information in a centralized and unified manner, the DES encryption and decryption method is used to store the legal identity of the user after authentication in the user's browser, ensuring that the user's legal identity is not leaked; The resource site of the present invention does not need to participate in the user authentication process again, thereby realizing safe and convenient user authentication and resource access. With the development of e-commerce and the process of enterprise globalization, network users have an urgent need to access resources across multiple domains. The present invention is suitable for multiple related industries, related enterprises, or network domain environments that form alliances in other forms. User authentication management scenario. The invention has already been used in the "National Science and Technology Fundamental Conditions Platform" project hosted by the Ministry of Science and Technology to share national science and technology resources, showing great advantages.

According to this scheme, a unified user identity authentication framework can be constructed, existing resource systems can be integrated, and standardized procedures can be provided for the migration of new resource systems in the future. On the one hand, from the perspective of the user, the user only maintains a single identity credential, and only needs to present it once to access all domain resources in the framework; on the other hand, from the perspective of each resource domain, it is no longer necessary to independently maintain a complete set of user management processes, only It is necessary to recognize the legitimacy of the portal user to realize the identity authentication process of the user. The potential huge social effect of the present invention is that it can promote the popularization and dailyization of network applications.

5. Description of drawings

Accompanying drawing 1 is the overall plan diagram of this scheme

Accompanying drawing 2 is the program flowchart of this scheme.

Claims (2)

1. the unified identity authentication scheme of a safety, in distributed network environment, Cookie technology based on standard browser, Collective qualification user on door, voucher behind the safe transfer authentification of user is to the resource website, resource website interpreting user role number also responds its access request, and it is characterized in that: the user only shows identity documents information one time, all the resource websites in can the secure access scheme.

2. as the scheme as described in the above-mentioned claim 1, the form of Credential in the scheme is: RoleID+timeInterval+timeStamp+UIP+WebServerURL, and door Credential and door utilize its X.509 certificate the result of Credential signature is made the as a whole resource website that is sent to.