TWI763176B - System and method for identity authentication - Google Patents

Abstract

A method and system for identity authentication are provided. The identity authentication system includes a storage device, a first server, and a user equipment. The storage device stores a first session initiation protocol account. The user equipment obtains the first session initiation protocol account from the storage device. The user equipment and the first server establish a transmission layer channel, and the first server obtains the first session initiation protocol account from the user equipment by the transmission layer channel. The user equipment and the first server establish an application layer channel, and the first server obtains a second session initiation protocol account from the user equipment by the application layer channel. The first server determines whether the user equipment passes an identity authentication according to whether the first session initiation protocol account matches with the second session initiation protocol account.

Description

Identity authentication method and identity authentication system

The present disclosure relates to an identity authentication method and an identity authentication system.

The traditional Voice over Internet Protocol (Voice over Internet Protocol, VoIP) identity authentication and login method is that the operator sends the user a clear account and password. After the user enters the account number and password into the user device, the user device sends it to the operator's server for verification. Accounts and passwords in this way may be at risk of being stolen. In addition, if the user needs to change the password based on information security considerations, the user also needs to manually input the new password, causing inconvenience to the user.

The present disclosure provides an identity authentication method and an identity authentication system, which can provide a secure identity authentication method for a user device.

The identity authentication method of the present disclosure is applicable to Voice over Internet Protocol, and the identity authentication method includes: storing a first session initiation agreement account in a storage device, and obtaining the first session initiation agreement account from the storage device by a user device; The server establishes a transport layer channel between the user device and the first server; the first server obtains the first session activation agreement account from the user device through the transport layer channel; the user device and the first server establish the user device and the first server. an application layer channel between the first servers; the first server obtains a second session activation agreement account from the user device through the application layer channel; and is activated by the first server according to the first session activation agreement account and the second session Whether the agreement accounts match to determine whether the user device is authenticated.

The identity authentication system of the present disclosure is applicable to the Voice over Internet Protocol, and the identity authentication system includes: a storage device, a first server and a user device. The storage device stores the first session activation agreement account. The user device is communicatively connected to the storage device, and obtains a first session activation agreement account from the storage device, wherein the user device and the first server establish a transport layer channel between the user device and the first server, wherein the first server passes the transport layer The channel is to obtain the first session initiation agreement account from the user device, wherein the user device and the first server establish an application layer channel between the user device and the first server, wherein the first server obtains from the user device through the application layer channel The second session initiation agreement account, wherein the first server determines whether the user device passes the identity authentication according to whether the first session initiation agreement account matches the second session initiation agreement account.

Based on the above, in the identity authentication method and the identity authentication system of the present disclosure, the user device can obtain the session activation agreement account stored in the storage device, and the server can compare the session activation agreement account with the second session activation agreement account to determine whether the user device passes the identity Authentication increases the safety and convenience of users.

In order to make the above-mentioned features and advantages of the present disclosure more obvious and easy to understand, the following embodiments are given and described in detail in conjunction with the accompanying drawings as follows.

FIG. 1 is a schematic diagram illustrating an identity authentication system 100 according to an embodiment of the present disclosure. The identity authentication system 100 may include a storage device 110 , a user device 120 , a first server 130 and a second server 140 .

The storage device 110 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (ROM), and flash memory (flash memory). , hard disk drive (HDD), solid state drive (SSD) or similar components or a combination of the above components. In this embodiment, the storage device 110 may store a first session initiation protocol (session initiation protocol, SIP). The first session initiation agreement account may be a Voice over Internet Protocol account.

The user device 120 may have a processing unit (eg, but not limited to, a processor), a communication unit (eg, various communication chips, mobile communication chips, Bluetooth chips, WiFi chips, etc., but not limited thereto), and a storage unit (eg: Removable random access memory, flash memory, hard disk, etc., but not limited thereto, are necessary components to run the user equipment 120 . User equipment 120 may include devices with IP addresses or networking capabilities, such as desktop computers, notebook computers, personal digital assistants (PDAs), smart phones, or thin clients. The user device 120 can be communicatively connected to the storage device 110 and the first server 130 .

The first server 130 may have a processing unit (eg, but not limited to, a processor), a communication unit (eg, various communication chips, mobile communication chips, Bluetooth chips, WiFi chips, etc., but not limited to), and a storage unit ( For example, removable random access memory, flash memory, hard disk, etc., but not limited thereto, are necessary components to run the first server 130 . The first server 130 may include, for example, a mobile station, an advanced mobile station (AMS), a client, a desktop computer, a notebook computer, a personal digital assistant or a workstation, and other devices with IP addresses or networking capabilities . The first server 130 can be communicatively connected to the user device 120 and the second server 140 .

The second server 140 may have a processing unit (eg, but not limited to, a processor), a communication unit (eg, various communication chips, mobile communication chips, bluetooth chips, WiFi chips, etc., but not limited thereto), and a storage unit ( For example, removable random access memory, flash memory, hard disk, etc., but not limited thereto, are necessary components to run the second server 140 . The second server 140 may include devices with IP addresses or networking capabilities, such as mobile stations, advanced mobile stations, clients, desktop computers, notebook computers, personal digital assistants, or workstations. The second server 140 can be communicatively connected to the first server 130 .

FIG. 2 is a signaling diagram for determining whether a user equipment passes identity authentication according to an embodiment of the present disclosure. In step S201 , the user device 120 may obtain the first session initiation agreement account from the storage device 110 .

In step S202 , the user device 120 and the first server 130 may establish a transport layer channel between the user device 120 and the first server 130 . Specifically, the user device 120 may send a message to the first server 130 to request the first server 130 to establish a Secure Sockets Layer (SSL) connection, wherein the secure data transport layer connection may include a transport layer aisle.

In step S203, the first server 130 may transmit the server certificate to the user device 120 in response to the establishment of the secure data transport layer connection.

In step S204, the user device 120 may check the server certificate. For example, the user device 120 may pre-store the reference server certificate. The user device 120 may determine that the first server 130 is authenticated in response to the server certificate matching the pre-stored reference server certificate.

In step S205 , after sending the server certificate to the user device 120 , the first server 130 may send a message to the user device 120 to request the user device 120 to send the user certificate including the first session activation agreement account to the first server 130 .

In step S206 , in response to receiving the request from the first server 130 , the user device 120 may transmit the user credential including the first session initiation protocol account to the first server 130 through the transport layer channel of the secure data transport layer connection.

In step S207, the first server 130 may check the first session initiation agreement account. For example, the first server 130 may pre-store the reference session activation agreement account. The user device 120 may determine that the user device 120 is authenticated in response to the first session initiation agreement account in the user credential and the pre-stored reference session initiation agreement account.

In step S208, the user device 120 may transmit a SIP Register to the first server 130 to establish an application layer channel between the user device 120 and the first server 130, wherein the SIP register may include the first The second session starts the protocol account. In other words, the first server 130 can obtain the second session initiation agreement account from the user device 120 through the application layer channel.

In step S209, the first server 130 may determine whether the user device 120 has passed the identity authentication according to whether the first session initiation agreement account matches the second session initiation agreement account. If the first session initiation agreement account does not match the second session initiation agreement account, the first server 130 may determine that the user device 120 has not passed the identity authentication. Accordingly, the first server 130 can interrupt the application layer channel between the user device 120 and the first server 130 . If the first session initiation agreement account matches the second session initiation agreement account, the first server 130 may proceed to the subsequent steps to determine whether the user device 120 is authenticated.

In one embodiment, the second server 140 may store the credential status of the second session activation agreement account. For example, the voucher status can be "Voucher Not Expired" or "Voucher Expired". In step S210, the first server 130 may query the second server 140 for the certificate status of the second session activation agreement account.

In step S211 , the second server 140 may transmit the certificate status of the second session activation agreement account to the first server 130 .

In step S212, the first server 130 may determine whether the user device 120 has passed the identity authentication according to whether the certificate status is valid. For example, if the certificate status is “the certificate has expired”, the first server 130 can determine that the user device 120 has not passed the identity authentication, and can disconnect the connection between the first server 130 and the user device 120 . If the first server 130 determines that the user device 120 has not passed the identity authentication, the first server 130 may interrupt the transport layer and application layer channels between the first server 130 and the user device 120 . If the certificate status is "the certificate has not expired", the first server 130 may proceed to the subsequent steps to determine whether the user device 120 has passed the identity authentication.

In one embodiment, the first server 130 may pre-store the third session activation agreement account. In step S213, the first server 130 may determine whether the user device 120 passes the identity authentication according to whether the second session initiation agreement account matches the third session initiation agreement account. If the second session initiation agreement account does not match the third session initiation agreement account, the first server 130 may determine that the user device 120 has not passed the identity authentication. Accordingly, the first server 130 can interrupt the transport layer and application layer channels between the first server 130 and the user device 120 . If the second session initiation agreement account matches the third session initiation agreement account, the first server 130 may proceed to the subsequent steps to determine whether the user device 120 has passed the identity authentication.

In step S214, the first server 130 may generate a nonce in response to receiving the session initiation protocol registration.

In step S215, the first server 130 may transmit a session initiation protocol code 401 (SIP Code 401) to the user device 120, wherein the session initiation protocol code 401 may include a random number.

In step S216, the user device 120 may generate a digital signature according to the random number.

In step S217 , the user device 120 may transmit the digital signature to the first server 130 .

In step S218, the first server 130 can determine whether the digital signature is correct according to the random number and the second session activation agreement account number, so as to determine whether the user device 120 has passed the identity authentication. If the digital signature is wrong, the first server 130 may determine that the user device 120 has not passed the identity authentication. Accordingly, the first server 130 can interrupt the transport layer and application layer channels between the first server 130 and the user device 120 . If the digital signature is correct, the first server 130 can match the first session activation agreement account with the second session activation agreement account, the certificate status of the second session activation agreement account is "certificate not expired", and the second session The user device 120 is authenticated if the activation agreement account matches the third session activation agreement account and the digital signature is correct.

In step S219, the first server 130 may transmit a session initiation protocol code 200 (SIP code 200) to the user device 120 to notify the user device 120 that it has passed the identity authentication.

It is worth noting that multiple steps such as "step S209", "steps S210-S212", "step S213", and "steps S214-S218" can be executed simultaneously or the order of these steps can be adjusted by the user according to requirements. The disclosure is not limited to this.

FIG. 3 is a flowchart illustrating an identity authentication method according to an embodiment of the present disclosure, wherein the identity authentication method can be implemented by the identity authentication system 100 shown in FIG. 1 .

In step S301, the storage device stores the first session initiation agreement account, and the user device obtains the first session initiation agreement account from the storage device.

In step S302, a transport layer channel between the user device and the first server is established by the user device and the first server.

In step S303, the first server obtains the first session activation agreement account from the user device through the transport layer channel.

In step S304, an application layer channel between the user device and the first server is established by the user device and the first server.

In step S305, the first server obtains the second session activation agreement account from the user device through the application layer channel.

In step S306, the first server determines whether the user device has passed the identity authentication according to whether the first session activation agreement account matches the second session activation agreement account.

To sum up, the identity authentication method and the identity authentication system of the present disclosure can allow the user device to obtain the session activation agreement account stored in the storage device. The user device can transmit the session initiation protocol account to the server through the transport layer channel and the application layer channel, respectively. The server can compare whether the two session initiation agreement accounts received through the transport layer channel and the application layer channel respectively match, and determine whether the user device has passed the identity authentication according to the matching result. In addition, the server can also confirm the certificate status of the session activation agreement account with the second server, and the security of the identity authentication can be effectively improved.

Although the present disclosure has been disclosed above with examples, it is not intended to limit the present disclosure. Anyone with ordinary knowledge in the technical field may make some changes and modifications without departing from the spirit and scope of the present disclosure. The scope of protection of the present disclosure shall be determined by the scope of the appended patent application.

100: Identity Authentication System 110: Storage device 120: User device 130: First server 140: Second server S201, S202, S203, S204, S205, S206, S207, S208, S209, S210, S211, S212, S213, S214, S215, S216, S217, S218, S219, S301, S302, S303, S304, S305, S306: step

FIG. 1 is a schematic diagram illustrating an identity authentication system according to an embodiment of the present disclosure. FIG. 2 is a signaling diagram for determining whether a user equipment passes identity authentication according to an embodiment of the present disclosure. FIG. 3 is a flowchart illustrating an identity authentication method according to an embodiment of the present disclosure.

100: Identity Authentication System

110: Storage device

120: User device

130: First server

140: Second server

Claims (14)

An identity authentication method suitable for Voice over Internet Protocol (VoIP), the identity authentication method comprising: storing a first session initiation agreement account in a storage device, and obtaining the first session activation agreement account by a user device from the storage device A session activation agreement account; establishing a transport layer channel between the user device and the first server by the user device and the first server; passing the transport layer channel by the first server obtaining the first session activation agreement account from the user device; establishing an application layer channel between the user device and the first server by the user device and the first server; The first server obtains a second session activation agreement account from the user device through the application layer channel; and the first server obtains a second session activation agreement account according to the first session activation agreement account and the second session activation agreement account Match to determine whether the user device is authenticated. The identity authentication method according to claim 1, further comprising: storing, by a second server, the certificate status of the second session activation agreement account; inquiring, by the first server, to the second server for the first 2. The certificate status of the session activation agreement account; and the first server determines whether the user device has passed the identity authentication according to whether the certificate status is valid. The identity authentication method according to claim 1, wherein the step of obtaining the first session initiation agreement account from the user device by the first server through the transport layer channel comprises: sending the user device to the user device. The first server requests the establishment of a secure data transport layer connection, and transmits the first session initiation protocol account to the first server through the transport layer channel of the secure data transport layer connection. The identity authentication method of claim 1, wherein the step of obtaining the second session initiation agreement account from the user device by the first server through the application layer channel comprises: transmitting by the user device A session initiation agreement is registered with the first server to establish the application layer channel, wherein the session initiation agreement registration includes the second session initiation agreement account. The identity authentication method of claim 4, further comprising: in response to receiving the session initiation protocol registration, transmitting, by the first server, a session initiation protocol code to the user device, wherein the session initiation protocol code including a random number; generating a digital signature by the user device according to the random number, and transmitting the digital signature to the first server; and by the first server according to the random number and the The second session initiation agreement account determines whether the digital signature is correct, so as to determine whether the user device passes the identity authentication. The identity authentication method according to claim 1, further comprising: A third session initiation agreement account number is pre-stored by the first server; and the first server determines whether the user device is not based on whether the second session initiation agreement account number matches the third session initiation agreement account number Authenticated by said identity. The identity authentication method of claim 1, further comprising: interrupting, by the first server, the transport layer and the application layer channel in response to the user device failing the identity authentication. An identity authentication system suitable for voice over Internet protocol, the identity authentication system comprising: a storage device for storing a first session initiation agreement account number; a first server; and a user device for communicating with the storage device, from the storage device The device obtains the first session initiation agreement account, wherein the user device and the first server establish a transport layer channel between the user device and the first server, wherein the first server passes the transport layer channel to obtain the first session initiation agreement account from the user device, wherein the user device and the first server establish an application layer between the user device and the first server a channel, wherein the first server obtains a second session initiation agreement account from the user device through the application layer channel, wherein The first server determines whether the user device passes the identity authentication according to whether the first session initiation agreement account matches the second session initiation agreement account. The identity authentication system according to claim 8, further comprising: a second server, communicatively connected to the first server, the second server storing the certificate state of the second session activation agreement account, wherein the first server A server queries the second server for the certificate status of the second session initiation agreement account, wherein the first server determines whether the user device is authenticated according to whether the certificate status is valid or not Certification. The identity authentication system of claim 8, wherein the user device requests the first server to establish a secure data transport layer connection, and transmits the data through the transport layer channel of the secure data transport layer connection The first session activates a protocol account to the first server. The identity authentication system of claim 8, wherein the user device transmits a session initiation protocol registration to the first server to establish the application layer channel, wherein the session initiation protocol registration includes the second session initiation Agreement account. The identity authentication system of claim 11, wherein in response to receiving the session initiation protocol registration, the first server transmits a session initiation protocol code to the user device, wherein the session initiation protocol code includes a random number ,in The user device generates a digital signature according to the random number, and transmits the digital signature to the first server, wherein the first server initiates an agreement according to the random number and the second session The account determines whether the digital signature is correct, so as to determine whether the user device has passed the identity authentication. The identity authentication system of claim 8, wherein the first server pre-stores a third session initiation agreement account, wherein the first server and the third session initiation agreement are based on the second session initiation agreement account Whether the account numbers match to determine whether the user device is authenticated by the identity. The identity authentication system of claim 8, wherein the first server interrupts the transport layer and the application layer channel in response to the user device failing the identity authentication.

Images