TWM576680U - Authentication system using certificate through inter-domain portal server - Google Patents

Abstract

A system for authenticating a credential across a domain through an access server. After the connection between the management center and the portal server, if the connection data is verified by the portal server, the portal server uses the external service server. The digital certificate is transmitted back to the management center, so that the management center uses the digital certificate to judge the technical means of the identity authentication result, and the digital certificate can be stored on the server for management, and the technical effect of sharing the digital certificate across the server is achieved.

Description

System for authenticating credentials across the domain through the portal server

A system for authenticating credentials using credentials, in particular a system for authenticating credentials across a domain using an entry server.

An electronic voucher, also known as a digital voucher, is an identity recognition mechanism for computer systems. An electronic voucher is a file or group of computer files that record the identity of the owner and a set of public passwords. The owner of the electronic voucher can authenticate himself to the computer system to access or use a particular computer service.

In the early days, due to the lack of network security, the computer services that need to be accessed or used through electronic vouchers are mostly provided in the form of webpages attached to the security plug-in components, meaning that when users access or use these services, It is through the browser to perform related applications such as voucher application, renewal and inquiry to the remote server.

Nowadays, due to the increasing importance of network security in recent years, browsers have become more and more stringent in terms of security requirements and checks for web pages and plug-in components operating on them. The restrictions have increased dramatically and the support has decreased, resulting in a smooth browser in the past. The voucher-related work performed on the operation has a large increase in the number of operational failures, which in turn causes confusion for the user. In order to solve the above problems, there is currently a solution for separating the voucher related operations into an external server. This solution is to allow the transaction to be executed by the client to the service server, and the voucher related work is performed by the client. Wire to other servers for execution.

In addition, with the opening of government decrees, many businesses that need to be in the past have gradually opened up. They only need to use credentials to conduct identity authentication online, which can replace the traditional process of confirming identity and directly handle business online. This is a great boon for those who are not convenient.

However, as can be seen from the above, some credential solutions currently implement separate credential related operations from transaction operations on different servers. In order to avoid security concerns and management convenience, the owner of the voucher mostly chooses to store the voucher on the server. The voucher is not exported and stored in the device being used. As a result, the user's credentials cannot be used on other servers.

In summary, it can be seen that in the prior art, there has been a problem in the prior art that the voucher is stored on the server for convenient management, so that the voucher cannot be used on other servers, so it is necessary to propose an improved technical means to solve this problem. .

In view of the prior art problem of storing a voucher on a server, causing the voucher to be unusable on other servers, the present disclosure discloses a system for authenticating a credential across a domain using an entry server, wherein:

The system disclosed by the present invention for authenticating a certificate across a domain using a portal server includes at least a management center for generating connection data, and an application connected to the service host for requesting identity authentication from the management center; The server, corresponding to the service server, is configured to receive and verify the connection data, and is used to determine whether to store the digital certificate corresponding to the service server when the connection data passes the verification, and if the digital certificate is not stored, apply for the digital certificate And transmitting the digital certificate to the management center, wherein the management center is further configured to use the digital certificate to judge the authentication result when the digital certificate is stored, and transmit the authentication result to the service host.

The system disclosed in the present invention for authenticating a certificate across a domain using a portal server includes at least a client connected to the service host for executing an application and a management center, and the application is configured to request identity authentication from the management center; The entry server, corresponding to the service server, is configured to receive and verify the connection data, and to determine whether to store the digital certificate corresponding to the service server when the connection data is verified, and if the digital certificate is not stored, apply for the digital address The voucher and the digital voucher are sent to the management center, wherein the management center is further configured to use the digital voucher to judge the authentication result when the digital voucher has been stored, and transmit the authentication result to the service host.

The system disclosed in this creation is as above, and the difference from the prior art is that after the creation is connected to the portal server through the management center, if the connection data is verified by the portal server, the portal server will serve the external service. The digital certificate used by the device is sent back to the management center, so that the management center uses the digital certificate to judge the identity authentication result, thereby solving the problems existing in the prior art, and achieving the technical effect of using the same certificate across the server.

The features and implementations of the present invention will be described in detail below in conjunction with the drawings and the embodiments, which are sufficient to enable any skilled person to fully understand the technical means to which the present invention solves the technical problems and implement them accordingly. The achievable effect of this creation.

This creation allows the service host to which the application is connected to obtain the authentication result of the identity authentication through the digital certificate saved by the portal using the portal server.

The application can be a program executed on a client such as a computer, a mobile phone or a tablet, for example, a browser executed in various operating systems of various clients, or a program embedded with a browser, etc. Not limited to the above; the management center can be an identity identification server connected to the client executing the application and the portal server through the network, or a credential management program installed on the client executing the application.

The system architecture of this creation is illustrated by the following two system architecture diagrams for the authentication of the cross-domain use credentials by the portal server in "1A" and "1B". As shown in "1A" and "1B", the system of the present creation includes a service host 110, an application 121, a management center 130, and an entry server 150. In the "1A", the application 121 is executed in the client 120 and the management center 130 is the identity recognition server. In the "1B", the application 121 and the management center 130 are both available at the client 120. The program executed in .

The service host 110, the client 120, the identity recognition server, and the portal server 150 are all computing devices. The computing devices referred to in this creation include, but are not limited to, one or more processors, one or more memory modules, and components such as bus bars that connect different components, including memory modules and processors. Through the various components included, the computing device can load and execute the operating system to cause the operating system to run on the computing device.

The bus of the computing device proposed by the present application may include one or more types, for example, including a data bus, an address bus, a control bus, and an expansion bus ( Expansion bus), and / or local bus and other types of bus. Busbars for computing devices include, but are not limited to, side-by-side industry standard architecture (ISA) busses, peripheral component interconnect (PCI) busses, video electronic standards associations (VESA) local busses, and tandem universal sequence busses (USB), Fast Peripheral Component Interconnect (PCI-E) bus, etc.

The processor of the computing device proposed by the present invention is coupled to the bus bar. The processor includes a register group or a scratchpad space, and the scratchpad group or scratchpad space can be completely disposed on the processing wafer, or all or part of the processor is disposed outside the processing chip and via a dedicated electrical connection. And/or coupled to the processor via a bus. The processor can be a processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processors, the computing device includes the same or similar processors and is coupled and communicated through the bus.

The processor of the computing device can be coupled to the chip set or electrically connected to the chip set through the bus bar. The chipset is composed of one or more integrated circuits (ICs), including a memory controller and a peripheral input/output (I/O) controller, that is, the memory controller and the peripheral output controller can be included in In an integrated circuit, two or more integrated circuits can also be used. The chipset typically provides input and memory management functions, as well as providing a plurality of general purpose and/or dedicated registers, timers, etc., wherein the general purpose and/or dedicated registers and timers are coupled or One or more processors electrically coupled to the chip set are accessed or used.

The processor of the computing device can also access the data stored in the memory module and the large-capacity storage area of the computing device through the memory controller. The above memory module includes any type of volatile memory and/or non-volatile memory (NVRAM) memory, such as static random access memory (SRAM), dynamic random access. Memory (DRAM), flash memory (Flash), read-only memory (ROM), etc. The mass storage area described above may include any type of storage device or storage medium, such as a hard disk drive, a compact disc, a tape drive, a flash drive (flash memory), a solid state disk (SSD), or any Other storage devices, etc. That is to say, the memory controller can access data in the static random access memory, the dynamic random access memory, the flash memory, the hard disk drive, and the solid state hard disk.

The processor of the computing device can also communicate with the peripheral device or interface such as the peripheral output device, the peripheral input device, the communication interface, and the GPS receiver through the peripheral output/input bus through the peripheral output/input controller. The peripheral input device can be any type of input device, such as a keyboard, a mouse, a trackball, a trackpad, a rocker, etc., and the peripheral output device can be any type of output device, such as a display, a printer, etc., peripheral input device It can also be the same device as the peripheral output device, such as a touch screen. The communication interface can include a wireless communication interface and/or a wired communication interface, and the wireless communication interface can include a wireless communication network such as Wi-Fi, Zigbee, Bluetooth, infrared, near field communication (NFC), 3G/4G/5G, etc. The interface of the road or other wireless data transmission protocol, the wired communication interface can be an Ethernet device, an asynchronous transfer mode (ATM) device, a DSL data machine, a cable (data) data machine, and the like. The processor can periodically poll various peripheral devices and interfaces to enable the computing device to perform input and output of data, as well as to communicate with another computing device having the elements described above.

The service host 110 can provide an application 121 connection through the communication interface, and can receive data or signals transmitted by the application 121, and can also transmit data or signals to the application 121. The service host 110 can provide the application 121 connection through a wired manner such as Ethernet or a wireless method such as WiFi, Bluetooth, or 3G/4G/5G.

The service host 110 can provide various services of the application 121, including services requiring identity authentication, such as online tax filing, or online inquiry of securities transaction materials, but the creation is not limited thereto. When the service host 110 provides the application 121 identity verification service, if the management center 130 is an identity recognition server, the service host 110 can direct the application 121 to the identity recognition server; and if the management center 130 is a certificate management program, The service host 110 can transmit an instruction control application 121 to call the credential management program.

The application 121 can be connected to the service host 110 and/or the portal server 150 through the communication interface of the client 120, and can receive the data transmitted by the service host 110/the portal server 150, and transmit the data to the service host 110/entry servo. 150. If the management center 130 is an identity identification server, the application 121 can be connected to the management center 130 through the communication interface of the client 120, and can receive the data transmitted by the management center 130 and transmit the data to the management center 130; 130 is a program executed in the client 120, and the application 121 can transmit the data to the management center 130 by means of call or memory sharing or the like and obtain the information provided by the management center 130.

The application 121 is responsible for requesting identity authentication from the management center 130. In general, the application 121 is a service for requesting identity authentication from the management center 130 when identity authentication is required in the process of using the service provided by the service host 110.

In some embodiments, the application 121 can also receive the request message sent by the portal server 150 through the management center 130, and promptly input the login data according to the received request message. For example, the request message can include a signal or a picture. The application 121 can directly display the received screen or display a screen generated according to the received signal conversion, thereby prompting for the login data. The application 121 can also pass the completed login data back to the portal server 150. The login data includes, but is not limited to, an account password, a fingerprint, or a face information registered in advance in the service server 160.

The management center 130 is responsible for generating connection information. For example, the management center 130 may generate a verification parameter including a set of registration codes, and calculate the generated verification parameters using a specific hash function to generate a verification data, and then generate the verification parameters generated and the calculated parameters. Connection data for verification data. However, the manner in which the management center 130 generates connection information is not limited to the above.

The registration code in the verification parameter generated by the management center 130 is the data registered in advance to the portal server 150, and includes the key value and the corresponding value. In some embodiments, the verification parameters generated by the management center 130 may include metadata that needs to be transmitted to the portal server 150 in addition to the registration code.

The management center 130 is also responsible for transmitting connection data to the portal server 150. If the management center 130 is the identity identification server, when the service host 110 directs the application 121 to the identity recognition server, the identity recognition server can provide the user of the application 121 to select the portal server to connect through the application 121. 150, and connected to the selected portal server 150; and if the management center 130 is a credential management program, the credential management program can provide the user of the application 121 when the service host 110 controls the application 121 to call the credential management program. The entry server 150 to be connected is selected in the credential management program and connected to the selected entry server 150.

The management center 130 is also responsible for judging the authentication result of the identity authentication using the stored digital certificate, and transmitting the authentication result generated by the judgment to the application 121.

It is worth mentioning that the management center 130 can first determine whether the digital certificate of the portal server 150 to which the application 121 is to be connected is stored when the application 121 requests the identity authentication. If so, the management center 130 can directly use the digital certificate. The stored digital certificate determines the authentication result without connecting to the portal server 150 to obtain the digital certificate. If the management center 130 does not store the digital certificate of the portal server 150 to be connected, the management center 130 needs to connect to the portal server 150 to obtain the digital certificate, and after receiving the digital certificate transmitted by the portal server 150, use the received The digital certificate obtained determines the authentication result.

The management center 130 may also receive a request message for requesting login information transmitted by the portal server 150 to which the identity authentication application 121 is to be connected, and may guide the application 121 and the portal server 150 upon receiving the request message of the login data. connection.

The portal server 150 can be connected to the application 121, the management center 130, the service server 160, and the credential server 140 through the communication interface, and can receive the application 121, the management center 130, the service server 160, and/or the credential server. The data or signal transmitted by 140 may also be transmitted to the application 121, the management center 130, the service server 160, and/or the credential server 140. The portal server 150 can communicate with the client 120, the management center 130, the service server 160, and/or the credential server 140 through a wired manner such as Ethernet or a wireless method such as WiFi, Bluetooth, or 3G/4G/5G. connection.

The portal server 150 corresponds to the service server 160. In general, an ingress server can correspond to one or more service servers, wherein all service servers corresponding to the same ingress server can use the same digital voucher for identity authentication or online transactions.

The portal server 150 is responsible for receiving and verifying the connection information transmitted by the management center 130. For example, the portal server 150 can read the corresponding registration value according to the key value of the registration code included in the received connection data, and generate a key value including the metadata in the connection data, the registration code, And the data to be inspected of the registered value read out, and the same hash function used by the management center 130 for transmitting the connection data is used to calculate the data, thereby calculating the hash data, and then according to the received connection. Whether the verification data in the data is the same as the calculated hash data to determine whether the connection data has passed the verification. Wherein, if the verification data is the same as the hash data, it indicates that the connection data is verified, and if the verification data is different from the hash data, it indicates that the connection data has not passed the verification; in addition, if the portal server 150 determines the received connection The data does not contain the key value of the registration code, or the corresponding registration value cannot be read according to the key value of the registration code, which also indicates that the program connection data has not passed the verification. However, the manner in which the portal server 150 verifies the connection data is not limited to the above.

The portal server 150 is also responsible for determining whether to store the digital certificate corresponding to the corresponding service server 160 when the received connection data passes the verification. If the portal server 150 does not store the digital certificate corresponding to the service server 160, Then, the portal server 150 can connect to the credential server 140 such as the RA to apply for the digital certificate corresponding to the service server 160, and after completing the application of the digital certificate, store the applied digital certificate and the digital number applied for. The voucher is transmitted to the management center 130. In addition, the portal server 150 can also transmit the applied digital certificate to a browsing program (not shown) that has been connected to the service server 160, so that the browsing program stores the received digital certificate to the service server. The corresponding storage area (Local Storage) of the device 160.

The portal server 150 is also responsible for transmitting the request message of the login data to the management center 130 when the received connection data is not verified, thereby connecting to the application 121 guided by the management center 130, and requesting input from the application 121. Login information.

The portal server 150 can also receive the login data transmitted by the application 121 and determine whether the login data has passed the verification through the service server 160.

Next, the system operation of the present author is explained in the first embodiment, and please refer to the flowchart of the method for authenticating the cross-domain using credentials by the portal server in the "Phase 2A". In this embodiment, it is assumed that the application 121 is a browsing program executed in the client 120, and the management center 130 is an identity recognition server, but the creation is not limited thereto.

When the user operates the application 121 on the client 120 to use the service provided by the service host 110, if the service host 110 requests the application 121 to perform the identity verification, the application 121 may request the identity authentication from the management center 130 (step 201). . In the present embodiment, it is assumed that the service host 110 provides a tax return service, and the service host 110 can direct the application 121 to the management center 130 when requesting the application 121 to perform identity verification.

After the application 121 is connected to the management center 130, the management center 130 can provide the application 121 to select the portal server 150 (step 211). In this embodiment, it is assumed that the management center 130 can transmit the web page of the selected business unit to the application 121, and the selected business unit is provided with the portal server 150 to prompt the user of the application 121 to operate the application. 121 selects an entry server 150 provided by a business unit. Wherein, the business unit includes but is not limited to each broker, and the portal server 150 may be a transaction server provided by each broker.

After the application 121 selects the portal server 150, the management center 130 can determine whether to store the digital certificate corresponding to the portal server 150 selected by the application 121 (step 215). If so, the management center 130 can directly use the stored digital certificate to determine the authentication result of the identity authentication, and transmit the generated authentication result back to the service host 110 (step 290).

If the management center 130 determines that the digital certificate corresponding to the portal server 150 selected by the application 121 is not stored, the management center 130 may generate the connection data and transmit the generated connection data to the portal server 150 (step 220). In this embodiment, it is assumed that the connection data generated by the management center 130 may be a link that will be directed to the portal server 150, so that the application 121 is directed to the portal server 150 according to the connection, thereby transmitting the connection data to the portal. Server 150.

After the portal server 150 receives the connection data, the portal server 150 can determine whether the received connection data has passed verification (step 230). In this embodiment, it is assumed that the portal server 150 can first determine whether the connection code and the verification data are included in the connection data. If not, it indicates that the connection data has not passed the verification; if the connection data includes the registration code and the verification For the data, the portal server 150 may further extract the metadata and the registration code from the connection data, and read the corresponding registration value according to the key value in the registration code, and then generate the metadata, the key value and the registration value. After the data is verified, the hash function is used to calculate the data to calculate the hash data, and when the verification data in the received connection data is the same as the calculated data to be verified, the connection data is verified. When the verification data in the received connection data is different from the calculated verification data, it is judged that the connection data has not passed the verification.

If the portal server 150 determines that the connection data has passed the verification, the portal server 150 can determine whether to store the digital certificate corresponding to the service server 160 (step 260).

If the portal server 150 determines that the connection data has not passed the verification, the portal server 150 can transmit the request message of the login data to the management center 130. After receiving the request message of the login data, the management center 130 guides the application 121 and the portal. The server 150 is connected, and the portal server 150, after being connected to the application 121, requests the application 121 to input the login data (step 240). In this embodiment, it is assumed that the portal server 150 can transmit the webpage 300 for inputting the login information to the application 121, thereby prompting the user of the application 121 to input the account and password registered in the previously selected business unit, such as " 3 shows.

After the user operates the application 121 to complete the input of the login data, the application 121 can transmit the entered login data to the portal server 150, and the portal server 150 can pass the service server 160 of the business unit previously selected by the user. The login data transmitted by the application 121 is verified to determine whether the login data received from the application 121 has passed the verification (step 250). If the login data does not pass the verification, the portal server 150 may request the application 121 to input the login data again (step 240), or notify the management center 130 to cause the management center 130 to reject the identity verification request of the application 121.

If the portal server 150 determines that the login data transmitted by the application 121 has been verified by the service server 160, the portal server 150 can determine whether to store the digit corresponding to the service server 160 as shown in the flow of "FIG. 2B". Voucher (step 260).

When the portal server 150 determines that the digital certificate corresponding to the service server 160 is stored, the portal server 150 may transmit the digital certificate corresponding to the service server 160 to the management center 130 (step 280). If the portal server 150 determines that the digital certificate corresponding to the service server 160 is not stored, the portal server 150 can connect to the credential server 140 to apply for the digital certificate corresponding to the service server 160 (step 270), and is completed. After the application of the digital certificate, the applied digital certificate can be stored, and the applied digital certificate can be transmitted to the management center 130 (step 280).

After receiving the digital certificate transmitted by the portal server 150, the management center 130 may store the received digital certificate, and may use the received digital certificate to determine the authentication result of the identity authentication, and transmit the authentication result generated by the determination. The service host 110 is provided (step 290).

Continuing with the second embodiment to illustrate the operation of the system of this creation, please continue to refer to "Figure 2A". In this embodiment, it is assumed that the application 121 is a specific program installed on the mobile device (the client 120), and the management center 130 is a credential management program installed on the same mobile device, but the present invention is not limited thereto.

When the user operates the application 121 to use the service provided by the service host 110, if the service host 110 requests the application 121 to perform identity verification, the application 121 may request identity authentication from the management center (step 201). In the present embodiment, it is assumed that the service host 110 provides a query service for the securities transaction, and the service host 110 can call the management center 130 through the application 121 when requesting the application 121 to perform identity verification.

After the management center 130 begins execution, the management center 130 can provide a selection portal server 150 (step 211). In this embodiment, it is assumed that the management center 130 can display a user interface including a plurality of business units, wherein each business unit has a corresponding portal server 150, thereby prompting the user of the application 121 to select the portal server 150. .

After the management center 130 provides the selection portal server 150, the management center 130 can determine whether to store the digital certificate corresponding to the portal server 150 selected by the application 121 (step 215). If so, the management center 130 can directly use the stored digital certificate to determine the authentication result of the identity authentication, and return the generated authentication result to the application 121 (step 290).

If the management center 130 determines that the digital certificate corresponding to the portal server 150 selected by the application 121 is not stored, the management center 130 may generate the connection data and transmit the generated connection data to the portal server 150 (step 220). ). In this embodiment, it is assumed that the management center 130 can open the link containing the connection data through the embedded browser, so as to connect the connection data to the portal server 150 while connecting to the portal server 150.

After the management center 130 is connected to the portal server 150, the portal server 150 can determine whether the connection data received when establishing the connection with the management center 130 is verified (step 230). In this embodiment, if the connection data generated by the management center 130 does not include the registration code and/or the verification data, the portal server 150 can determine that the connection data has not passed the verification, and can transmit the request message of the login data. To the management center 130, the management center 130 guides the application 121 to connect with the portal server 150, thereby requesting the application 121 to input the login data (step 240).

After the user operates the application 121 to complete the input of the login data, the application 121 can transmit the entered login data to the portal server 150, and the portal server 150 can pass the service server 160 of the business unit previously selected by the user. The login data transmitted by the application 121 is verified to determine whether the login data received from the application 121 has passed the verification (step 250).

If the portal server 150 determines that the login data transmitted by the application 121 has been verified by the service server 160, the portal server 150 can determine whether to store the digit corresponding to the service server 160 as shown in the flow of "FIG. 2B". Voucher (step 260). In this embodiment, if the portal server 150 determines that the digital certificate corresponding to the service server 160 is stored, the portal server 150 may transmit the digital certificate corresponding to the service server 160 to the management center 130 (step 280).

If the portal server 150 determines that the digital certificate corresponding to the service server 160 is not stored, the portal server 150 can connect to the credential server 140 to apply for the digital certificate corresponding to the service server 160 (step 270), and is completed. After the application of the digital certificate, the applied digital certificate can be stored, and the applied digital certificate can be transmitted to the management center 130 (step 280).

After receiving the digital certificate transmitted by the portal server 150, the management center 130 may store the received digital certificate, and may use the received digital certificate to determine the authentication result of the identity authentication, and transmit the authentication result generated by the determination. The service host 110 is provided (step 290).

As with the above two embodiments, through the creation, the application 121 can perform identity authentication through the digital certificate used by the management server 130 in the external service server 160.

In summary, it can be seen that the difference between the present creation and the prior art is that after the connection between the management center and the portal server, if the connection data is verified by the portal server, the portal server uses the external service server. The digital voucher is sent back to the management center, so that the management center uses the digital voucher to judge the technical means of the identity authentication result. By means of this technical means, the prior art exists to save the voucher on the server for facilitating management, so that the voucher cannot be in other servos. The problem with the use of the same credential across the server.

Furthermore, the system for authenticating credentials using the credentials of the portal server across the domain can be implemented in a centralized manner in a computer system or in a decentralized manner in which different components are interspersed among several interconnected computer systems.

Although the embodiments disclosed in the present disclosure are as above, the contents are not intended to directly limit the scope of the patent protection of the present invention. Anyone who has the usual knowledge in the technical field of this creation, without any departure from the spirit and scope disclosed in this creation, makes some modifications to the form and details of the implementation of this creation, which are the patent protection of this creation. range. The scope of patent protection of this creation must be determined by the scope of the attached patent application.

110‧‧‧Service Host

120‧‧‧Client

121‧‧‧Application

130‧‧‧Management Center

140‧‧‧Certificate Server

150‧‧‧Entry server

160‧‧‧Business Server

300‧‧‧Webpage

Step 201‧‧‧Applications request identity authentication from the Management Center

Step 211‧‧‧Management Center provides selection of portal server

Step 215‧‧‧ The management center determines whether to store the digital certificate corresponding to the service server

Step 220‧‧‧ Management Center generates connection data and transmits connection data to the portal server

Step 230‧‧‧ The portal server determines whether the connection data has passed the verification

Step 240‧‧‧ The portal server requests the application to enter the login data

Step 250‧‧‧ The portal server determines whether the login data has passed the verification through the service server.

Step 260‧‧‧ The portal server determines whether to store the digital certificate corresponding to the service server

Step 270‧‧‧Entry server to apply for digital certificate

Step 280‧‧‧ The portal server sends the digital certificate to the management center

Step 290‧‧‧ The management center uses the digital certificate to judge the authentication result and transmits the authentication result to the service host.

Figure 1A is a system architecture diagram of the author's authentication through the use of credentials by the portal server across the domain. Figure 1B is another system architecture diagram of the author's authentication through the portal server using credentials across the domain. Figure 2A is a flow chart of the method for authenticating through the portal server using credentials by the author. Figure 2B is a flow chart of the method for applying for the voucher of the portal server proposed by the author. FIG. 3 is a schematic diagram of a webpage proposed by the present embodiment.

Claims (10)

A system for authenticating a certificate by using an entry server across a domain, the system comprising: at least one management center for generating a connection data; and a client connected to a service host for executing an application, The application is configured to request identity authentication from the management center; and an portal server corresponding to a service server for receiving and verifying the connection data, and for determining whether to store and verify the connection data when verifying The service server corresponds to one of the digital certificates. If the digital certificate is not stored, the digital certificate is applied, and the digital certificate is transmitted to the management center, so that the management center uses the digital certificate to determine an authentication result, and transmits the authentication. The result is to the service host. A system for authenticating a certificate across a domain using a portal server as described in claim 1, wherein the management center is further configured to determine whether the digital certificate is stored when the application requests identity authentication, and When the digital certificate has been stored, the digital certificate is used to judge the authentication result, and the authentication result is transmitted to the service host. The system for authenticating the certificate across the domain using the portal server as described in claim 1, wherein the portal server is further configured to require the application to input a login data when the connection data fails to pass the verification. And determine whether the login data has passed verification through a service server. A system for authenticating a certificate across a domain using a portal server as described in claim 1, wherein the management center generates an authentication parameter including one of a group registration code obtained in advance by the portal server, and The hash function calculates the authentication parameter to generate a verification data, and generates the connection data including the authentication parameter and the verification data, and the portal server calculates the hash data by using the authentication parameter and the hash function. According to whether the verification data is the same as the hash data, whether the connection data is verified or not. A system for authenticating a certificate across a domain using a portal server as described in claim 1, wherein the management center is an identity identification server, and the service host directs an application requesting identity authentication to the Identity identification server. A system for authenticating a certificate by using an entry server across a domain, the system comprising: a client connected to a service host for executing an application and a management center, the application being used for the management center Requesting identity authentication; and an entry server corresponding to a service server for receiving and verifying the connection data, and for determining whether to store one digit corresponding to the service server when the connection data is verified If the digital certificate is not stored, the digital certificate is applied, and the digital certificate is transmitted to the management center, so that the management center uses the digital certificate to determine an authentication result, and transmits the authentication result to the service host. The system for authenticating a certificate across a domain using a portal server as described in claim 6, wherein the management center is further configured to determine whether the digital certificate is stored when the application requests the identity authentication, and When the digital certificate has been stored, the digital certificate is used to judge the authentication result, and the authentication result is transmitted to the service host. The system for authenticating the certificate across the domain using the portal server as described in claim 6, wherein the portal server is further configured to require the application to input a login data when the connection data fails to pass the verification. And determine whether the login data has passed verification through a service server. A system for authenticating a certificate across a domain using a portal server as described in claim 6 wherein the application includes one of a set of registration codes previously obtained by the portal server, and The hash function calculates the authentication parameter to generate a verification data, and generates the connection data including the authentication parameter and the verification data, and the portal server calculates the hash data by using the authentication parameter and the hash function. According to whether the verification data is the same as the hash data, whether the connection data is verified or not. A system for authenticating a certificate across a domain using a portal server as described in claim 6 wherein the management center is a credential management program, and the service host is an application that controls the request identity authentication to call the credential management. Program.