TW202314543A - Operating system login method, electronic equipment, and storage medium - Google Patents

Abstract

The present application provides an operating system login method, electronic equipment, and a storage medium. The operating system login method includes: in response to a login request of a user terminal, querying a distributed identity document corresponding to the login request from a blockchain; extracting a target public key from the distributed identity document; generating a first character string, and encrypting the first character string by using the target public key; sending the encrypted first character string to the user terminal; receiving a second character string sent by the user terminal, the second character string being a character string obtained by the user terminal using a private key to decrypt the encrypted first character string; determining whether to allow the user terminal to log into the operating system according to the first character string and the second character string. By utilizing this application, the security of users' personal information can be improved.

Description

Operating system login method, electronic device and storage medium

The invention relates to the field of information security, in particular to an operating system login method, electronic equipment and a storage medium.

When a user uses a shared computer in a public place, since the administrator of the shared computer will create a group of user accounts on the computer and let all users share this account to operate the shared computer, it is easy for the user to leak personal private information to others. For example, if you log in to your webmail on a shared computer, but do not log out correctly before leaving, your private information will be exposed to subsequent users. This method of logging in to the computer has low security and can easily cause information leakage.

In view of the above, it is necessary to provide an operating system login method, an electronic device and a storage medium, which can improve the security of the user's personal information.

The present application provides an operating system login method, the method comprising: in response to a login request of a user terminal, querying the distributed identity document corresponding to the login request from the block chain; from the distributed identity document extracting the target public key; generating a first character string, and encrypting the first character string with the target public key; sending the encrypted first character string to the user terminal; receiving the second character string sent by the user terminal string, the second string is the string obtained by the user terminal using the private key to decrypt the encrypted first string; according to the first string and the second string, determine whether to allow the The user terminal logs into the operating system.

In a possible implementation, the method further includes: generating and displaying an account registration QR code in response to the registration request of the user terminal; receiving the first account number generated by the user terminal by scanning the account registration QR code ; Write the first account number into the distributed identity document.

In a possible implementation manner, the method further includes: receiving a public key sent by the user terminal, where the public key is obtained by encrypting the first account by the user terminal, the The public key corresponds to the private key; the public key is written into the distributed identity document and associated with the first account.

In a possible implementation manner, the generating and displaying the account registration QR code includes: calling an API interface for account registration of the distributed identity identifier; generating and displaying the account registration QR code according to the API interface.

In a possible implementation manner, in response to the login request of the user terminal, querying the distributed identity document corresponding to the login request from the block chain includes: displaying the account login QR code; Scanning the account to log in to the second account generated by the QR code; querying the distributed identity document corresponding to the second account from the block chain.

In a possible implementation manner, the extracting the target public key from the distributed identity document includes: traversing the distributed identity document; finding the first account that is the same as the second account; The public key corresponding to the first account is used as the target public key.

In a possible implementation manner, the encrypting the first character string by using the target public key includes: using the target public key as an encryption key; using the encryption key to use an asymmetric encryption algorithm method to encrypt the first character string.

In a possible implementation manner, the judging whether to allow the user terminal to log in to the operating system according to the first character string and the second character string includes: judging the first character string and the second Whether the character strings are the same; if the first character string is the same as the second character string, allow the user terminal to log in to the operating system; if the first character string is not the same as the second character string, prohibit The user terminal logs into the operating system.

The present application also provides an electronic device, the electronic device includes a processor and a storage, and the processor is configured to implement the operating system login method when executing a computer program stored in the storage.

The present application also provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the operating system login method is implemented.

The operating system login method and related equipment disclosed in this application query the decentralized identity document corresponding to the login request from the blockchain according to the login request of the user terminal, and extract the distributed identity document from the distributed identity document. The target public key generates a first string, and encrypts the first string with the target public key. After the encryption is completed, the encrypted first string is sent to the user terminal, and the private key is used through the user terminal. decrypting the encrypted first character string to obtain a second character string, and judging whether to allow the user terminal to log in to the operating system according to the first character string and the second character string. Establishing the unique corresponding relationship between the user account and the public key through the distributed identity document not only ensures the reliability of the user identity information, but also improves the security of the user identity information and user computing metadata. In addition, by using the block chain to store data in a series of data blocks that have a priority relationship among them, data storage is provided in a decentralized manner, thereby improving data security.

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be described in detail below in conjunction with the accompanying drawings and specific embodiments.

Please refer to FIG. 1 , which is a schematic diagram of an electronic device according to an embodiment of the present application. Referring to FIG. 1, the electronic device 1 includes, but is not limited to, a storage 11 and at least one processor 12. The above-mentioned components can be connected through a bus (for example, 14 shown in FIG. 1 ), or can be directly connect.

The electronic device 1 may be a computer, a mobile phone, a tablet computer, a personal digital assistant (Personal Digital Assistant, PDA) and other devices installed with applications. Those skilled in the art can understand that the schematic diagram 1 is only an example of the electronic device 1, and does not constitute a limitation to the electronic device 1, and may include more or less components than those shown in the figure, or combine certain components, or be different For example, the electronic device 1 may also include input and output devices, network access devices, bus bars, and the like.

As shown in FIG. 2 , it is a flow chart of a preferred embodiment of the operating system login method of the present application. The operating system login method is applied in the electronic device 1 . According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted. In this implementation manner, the operating system login method includes:

S11. In response to the login request of the user terminal, query the distributed identity document corresponding to the login request from the blockchain.

In this embodiment, decentralized identifiers (Decentralized Identifiers, DID) are identification words composed of character strings, which are used to represent a digital identity, and global uniqueness can be achieved without a central registration authority. Usually, a user entity can have multiple identities, and each identity is assigned a unique DID value and an asymmetric key associated with it. Wherein the asymmetric key includes a public key and a private key. There is no associated information between different identities, which effectively protects the security of users' personal data.

In this embodiment, the DID is a decentralized and verifiable digital identifier, which has the characteristics of decentralization, autonomous controllability, and cross-chain multiplexing. User entities can independently complete DID registration, resolution, update or revocation operations. The DID is specifically resolved into a DID document, and the DID document includes the unique identification code of the DID, the public key list and detailed information of the public key, and other attribute descriptions of the DID user. The unique identification code of the DID is a DID user account.

In this embodiment, in response to the login request of the user terminal, querying the distributed identity document corresponding to the login request from the blockchain includes:

(1) Generate and display the account login QR code. During specific implementation, the user sends a request to log in to the operating system through the user terminal, and when receiving the log-in request, calls the second API interface of the distributed identity identification account login, and generates and displays it according to the first API interface The account registration QR code. For example, the second API interface is { "protocol": "http", "api_endpoint": "http://192.168.1.10:8080/user/login" }.

(2) receiving the second account number generated by the user terminal by scanning the account login QR code. During specific implementation, after scanning the account login QR code through the user terminal, the user can input a second DID string through the second API interface, and use the second DID string as the second account number, The second account is the login account of the user, which can be input according to the actual needs of the user. After the input is completed, the user terminal sends the second account number to the operating system.

(3) Query the DID document corresponding to the second account from the blockchain.

In some implementations, before the step S11, the method further includes: generating and displaying an account registration QR code in response to the registration request of the user terminal; receiving an account registration QR code generated by the user terminal by scanning the account registration QR code the first account number; write the first account number into the distributed identity document.

In order for a user to log into the operating system using a distributed identity, the user needs to register an account, and the account registered by the user is stored in the DID file.

During specific implementation, the user can send a DID account registration request to the electronic device 1 through the user terminal. After receiving the registration request, the first API interface for DID account registration can be called according to the user's registration request. An API interface generates the DID account registration QR code. The user scans the DID account registration QR code through the user terminal, and the QR code connects the user terminal to the first API interface. The user can input a first DID string on the first API interface, and the first DID string is a user account created by the user, wherein the first DID string can be set according to the actual needs of the user. The first DID string is used as the first account number. For example, the user sends a DID account registration request to the shared computer in the library through the official website of the library. After receiving the DID account registration request, the shared computer generates a library DID account registration QR code, and the user scans the QR code. Enter the library shared computer account registration interface after entering the QR code, and enter did:example:123456789abcdefg as the first account in the interface. After receiving the first account number, write the first account number into the DID file pre-stored on the block chain.

It should be noted that the blockchain provides data storage in a decentralized manner by storing data in a series of data blocks that have a priority relationship with each other, thereby improving data security.

By creating the DID file and writing the user's DID account into the DID file, the security and non-tampering of the data are guaranteed.

In some embodiments, the method further includes: receiving a public key sent by the user terminal, wherein the public key is obtained by encrypting the first account by the user terminal, and the public key The key corresponds to the private key; the public key is written into the distributed identity document and associated with the first account.

During specific implementation, the user terminal encrypts the first account through an asymmetric encryption algorithm, and the asymmetric algorithm can be set according to the actual needs of the user. After the user terminal encrypts the first account, a pair of public key and private key corresponding to the first account is obtained. Writing the public key into the distributed identity document and associating it with the first account. Wherein, the private key is used to decrypt the character string, which is stored by the user and does not need to be transmitted to other devices. The public key is used to encrypt the character string and can be made public. It should be noted that, after the public key is used for encryption, only the paired private key can be decrypted.

By using the first account to generate the paired public key and the private key, the public key and the private key form a unique corresponding relationship. Based on this unique corresponding relationship, it is convenient to subsequently authenticate the identity of the user. At the same time, by writing the public key into the DID file and establishing an association with the first account, each user account corresponds to a public key, which ensures the reliability of user identity information.

S12. Extract the target public key from the distributed identity document.

In this embodiment, the extracting the target public key from the distributed identity document includes: traversing the distributed identity document; finding the first account that is the same as the second account; A public key corresponding to an account is used as the target public key.

In this embodiment, since a unique correspondence is established between the user account, the public key and the private key, it can be determined whether the user has Permissions to log into the operating system.

S13. Generate a first string, and use the target public key to encrypt the first string.

In order to subsequently use the private key to verify the identity of the user logging into the operating system, it is necessary to generate a random first character string and encrypt the first character string with the target public key.

In this embodiment, the first character string is randomly generated by the operating system.

In this implementation manner, the encrypting the first character string by using the target public key includes: using the target public key as an encryption key; using the encryption key to encrypt using an asymmetric encryption algorithm The first string, wherein the asymmetric encryption algorithm can be set according to the actual needs of the user, for example, Elliptic Curves Cryptography (Elliptic Curves Cryptography, ECC).

S14. Send the encrypted first character string to the user terminal.

In this embodiment, since the private key is stored by the user terminal, it is necessary to send the encrypted first string to the user terminal.

S15. Receive a second string sent by the user terminal, where the second string is a string obtained by the user terminal decrypting the encrypted first string using a private key.

In this embodiment, after receiving the encrypted first character string, the user terminal uses the private key as a decryption key, and uses an asymmetric decryption algorithm to decrypt the encrypted first character string. The string is decrypted to obtain the second string.

S16. Determine whether to allow the user terminal to log in to the operating system according to the first character string and the second character string.

In this embodiment, whether the user identity is legal can be determined by comparing whether the first character string is the same as the second character string. When the first character string is the same as the second character string, it means that the private key of the user terminal is corresponding to the target public key, that is to say, the private key and the second Account is a corresponding relationship. When the first character string is different from the second character string, it means that the private key of the user terminal does not correspond to the target public key, and the private key and the second account number also There is no corresponding relationship, so the second account is invalid.

In this embodiment, the determining whether to allow the user terminal to log in to the operating system according to the first character string and the second character string includes: judging the first character string and the second character string Whether they are the same; if the first character string is the same as the second character string, allow the user terminal to log in to the operating system; if the first character string is not the same as the second character string, prohibit the The user terminal logs into the operating system.

By establishing a unique correspondence between the user account, the private key, and the public key, and using the correspondence to verify the identity of the user, it is possible to prevent the user account from being stolen, and it also ensures that the user is in the operating system. The security of the operation content on the website.

Please refer to FIG. 3 . FIG. 3 is a data flow chart of an operating system login method provided by an embodiment of the present application. According to different requirements, the sequence of steps in the data flow chart can be changed, and some steps can be omitted. The execution subject of the operating system login method may be the operating system.

S301. The operating system generates and displays an account registration QR code.

S302. The user terminal identifies the account registration QR code, and generates the first account.

S303. The user terminal encrypts the first account to obtain a corresponding public key and private key.

S304. The user terminal sends the first account and the public key to the operating system.

S305. The operating system writes the first account number and the public key into a DID file in a blockchain.

S306. The operating system generates and displays an account login QR code.

S307. The user terminal identifies the account login QR code, and generates the second account.

S308. The user terminal sends the second account to the operating system.

S309. The operating system extracts the target public key from the DID file in the blockchain.

S310. The operating system generates a first string, and encrypts the first string with the target public key.

S311. The user terminal receives the first character string.

S312. The user terminal encrypts the first character string through the private key to obtain a second character string.

S313. The user terminal sends the second character string to the operating system.

S314. The operating system determines whether the first character string is the same as the second character string.

S315. When the first character string is the same as the second character string, allow the user terminal to log in to the operating system.

S316. When the first character string is different from the second character string, prohibit the user terminal from logging into the operating system.

Please continue to refer to FIG. 1 , in this embodiment, the storage 11 may be an internal storage of the electronic device 1 , that is, a storage built in the electronic device 1 . In other embodiments, the storage 11 may also be an external storage of the electronic device 1 , that is, a storage external to the electronic device 1 .

In some embodiments, the storage 11 is used to store program codes and various data, and realize high-speed and automatic access to programs or data during the operation of the electronic device 1 .

The storage 11 may include a random access memory, and may also include a non-volatile storage, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital ( Secure Digital (SD) card, flash memory card (Flash Card), at least one magnetic disk storage element, flash memory element, or other volatile solid state storage elements.

In one embodiment, the processor 12 may be a central processing unit (Central Processing Unit, CPU), and may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic components, discrete gate or transistor logic components, discrete hardware components, etc. The general-purpose processor may be a microprocessor, or the processor may be any other conventional processor and the like.

If the program codes and various data in the storage 11 are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the methods of the above-mentioned embodiments, for example, the steps in the method of realizing the operating system login can also be completed by instructing related hardware through the computer program 13, the computer program 13 may be stored in a computer-readable storage medium, and when the computer program 13 is executed by a processor, the steps of the above-mentioned various method embodiments may be realized. Wherein, the computer program 13 includes computer program code, and the computer program code may be in the form of original code, object code, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, flash drive, mobile hard disk, magnetic disk, optical disk, computer storage, read-only memory (ROM, Read- Only Memory), etc.

It can be understood that the module division described above is a logical function division, and there may be another division method in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into the same processing unit, or each module may exist separately physically, or two or more modules may be integrated into the same unit. The above-mentioned integrated modules can be implemented in the form of hardware, or in the form of hardware plus software function modules.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application without limitation. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be Make modifications or equivalent replacements without departing from the spirit and scope of the technical solutions of the present application.

1: Electronic equipment 11: Storage 12: Processor 13: Computer program 14: busbar S11~S16: Steps S301~S316: Steps

In order to more clearly illustrate the technical solutions in the embodiments of the present application or in the prior art, the accompanying drawings that need to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present application, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

FIG. 1 is a schematic structural diagram of an electronic device implementing a preferred embodiment of an operating system login method according to the present application.

Fig. 2 is a flow chart of a preferred embodiment of an operating system login method disclosed in this application.

FIG. 3 is a data flow chart of an operating system login method disclosed in the present application.

S11~S16: Steps

Claims (10)

An operating system login method, wherein the operating system login method includes: In response to the login request of the user terminal, query the decentralized identity document corresponding to the login request from the block chain; extracting a target public key from said decentralized identity document; generating a first string, and encrypting the first string with the target public key; Send the encrypted first character string to the user terminal; receiving a second string sent by the user terminal, where the second string is a string obtained by the user terminal decrypting the encrypted first string using a private key; and judging whether to allow the user terminal to log in to the operating system according to the first character string and the second character string. The operating system login method as described in claim 1, wherein the method further includes: generating and displaying an account registration QR code in response to the registration request of the user terminal; receiving the first account number generated by the user terminal by scanning the account registration QR code; Writing the first account number into the distributed identity document. The operating system login method as described in claim 2, wherein the method further includes: receiving the public key sent by the user terminal, wherein the public key is obtained by encrypting the first account by the user terminal, and the public key corresponds to the private key; Writing the public key into the distributed identity document and associating it with the first account. The operating system login method as described in claim 2, wherein said generating and displaying the account registration QR code includes: Call the API interface for decentralized identity account registration; Generate and display the account registration QR code according to the API interface. The operating system login method according to claim 2, wherein, in response to the login request of the user terminal, querying the distributed identity document corresponding to the login request from the blockchain includes: Generate and display account login QR code; receiving the second account number generated by the user terminal by scanning the account login QR code; Querying the distributed identity document corresponding to the second account from the block chain. The operating system login method according to any one of claim items 1 to 5, wherein said extracting the target public key from the distributed identity document includes: traversing the distributed identity document; Find a first account that is identical to the second account; The public key corresponding to the first account is used as the target public key. The operating system login method according to any one of claim items 1 to 5, wherein said encrypting said first character string with said target public key comprises: using the target public key as an encryption key; Encrypt the first character string with an asymmetric encryption algorithm through the encryption key. The operating system login method according to any one of claim items 1 to 5, wherein the judging whether to allow the user terminal to log in to the operating system according to the first character string and the second character string includes: judging whether the first character string is the same as the second character string; If the first character string is the same as the second character string, allowing the user terminal to log in to the operating system; If the first character string is different from the second character string, the user terminal is prohibited from logging into the operating system. An electronic device, wherein the electronic device includes a processor and a memory, and the processor is used to execute a computer program stored in the memory to realize the operating system login as described in any one of claim 1 to claim 8 method. A computer-readable storage medium, wherein the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the operating system as described in any one of claim 1 to claim 8 is implemented login method.

Images