WO2017020452A1

WO2017020452A1 - Authentication method and authentication system

Info

Publication number: WO2017020452A1
Application number: PCT/CN2015/095767
Authority: WO
Inventors: 邓小超
Original assignee: 北京百度网讯科技有限公司
Priority date: 2015-08-04
Filing date: 2015-11-27
Publication date: 2017-02-09
Also published as: CN105007279B; CN105007279A

Abstract

Disclosed are an authentication method and an authentication system. The authentication method comprises: a client sends first-temporary-key allocation request information to a server; after verifying the allocation request information, the server generates first response information comprising a user key account, a first temporary key, and session strategy information, and sends the first response information to the client; the client sends a cloud service request information that is generated based on the first response information, to a cloud server, the cloud service request information carrying the user key account, the session strategy information, and a signature of the cloud service request information that is generated by using the first temporary key; and the cloud server authenticates, based on the user key account and the session strategy information, the signature of the cloud service request information, and sends second response information for responding to the cloud service request information, to the client after authentication succeeds. By using the authentication method in the implementation manners of the present application, an interaction procedure between a server and a cloud server is simplified, and an authentication pressure on the cloud server is reduced.

Description

Certification method and authentication system

Cross-reference to related applications

The present application claims priority to Chinese Patent Application No. 201510471383.5, filed on Aug.

Technical field

The present application relates to the field of computer network technologies, and in particular, to the field of computer network authentication technologies, and in particular, to an authentication method and an authentication system.

Background technique

In public cloud services, customers (such as website owners) need to provide direct access to resources (such as audio and video) stored in the cloud to users (such as Internet users) in web pages or applications, so as to avoid unnecessary data transfer through the client's server. Network transmission. The application programming interface provided by the cloud storage is implemented by signing the request through the public and private keys to ensure security. When the webpage or the application accesses, the public and private keys need to be configured. However, the webpage or application is distributed to the user (netizen), and there is a risk that the malicious user will decipher the client's key and get the identity of the client to destroy.

In the prior art, the client key may be prevented from being leaked in the public cloud service in two ways: 1. The client is allowed to distribute the fragment of the key to the webpage or the application, and the cloud storage server is the interface required for such webpage or application access. Open a special authentication mechanism, the web page or application can access the resource only when the request is signed by the key-based fragment. 2. The temporary key mechanism is used, that is, the webpage or the application first requests the client's server to obtain a short-term valid key, and based on the short-term key, the resource access is performed to the cloud service.

However, the above two technologies have the following risks: 1. Based on the key fragment-based authorization mechanism, the interface that supports the key fragment signature opened by the cloud service is fixed, and when the customer has new requirements and needs to increase the temporary access of the interface. , the cloud server needs to be upgraded and configured; at the same time, after the malicious user obtains the key fragment, these open interfaces are equivalent to Fully open, there is still the problem that customer data will be destroyed. 2. Temporary key mechanism Since the webpage or application requests the temporary key from the client every time, the client needs to apply to the cloud identity identification and access management system IAM, the customer service rises or the customer business logic is improper (such as repeated application for temporary When the key), IAM's own pressure is too large, affecting the basic authentication service.

Summary of the invention

In view of the above-mentioned drawbacks or deficiencies in the prior art, it is desirable to provide a solution with good security, cloud service and small authentication pressure. To achieve one or more of the above objectives, the present application provides an authentication method and an authentication system.

In a first aspect, the application provides an authentication method for a client of an authentication system, where the authentication system includes: a client, a client server, and a cloud server, the method includes: sending a first to the client server The allocation request information of the temporary key, the allocation request information carries a session identity for verifying the identity of the user; and receiving the first response information of the allocation request information sent by the client server in response to the identity of the user by the verification, The first response information includes: a user key account for confirming the identity of the client to the cloud server, signing a first temporary key obtained by using the first session key to describe an access control list of the user right, and using the The session key information obtained by the access control list is encrypted by the first session key, wherein the first session key is a session key held by the client server and the session with the cloud server; and sent to the cloud server The cloud service request information carried by the first response information, the cloud service request information carrying a user key account, the session policy information, and a signature of the cloud service request information generated by using the first temporary key; receiving second response information of the cloud service request information sent by the cloud server, where The second response information is obtained by the following steps: the cloud server authenticates the signature of the received cloud service request information based on the user key account number and the session policy information, and responds to the authentication, Sending, to the client, second response information that is responsive to the cloud service request information.

In a second aspect, the present application provides a method for generating first response information for a client server of an authentication system, where the authentication system includes: a client, a client, and a cloud. End server, the method includes: receiving allocation request information of a first temporary key sent by the user end, where the allocation request information carries a session identity identifier for verifying a user identity; and the user is based on the session identity identifier The identity is verified; in response to the identity of the user, the first response information is generated in response to the allocation request information, where the first response information includes: a user key account used to confirm the identity of the client to the cloud server, using the first a session key signature for describing a first temporary key obtained by an access control list of a user right, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session The key is a session key held by the client server and the session of the cloud server; and the first response information is sent to the client.

In a third aspect, the present application provides an authentication method for a cloud server of an authentication system, where the authentication system includes: a client, a client server, and a cloud server, and the method includes: receiving a user sent by the client a key account, session policy information, and cloud service request information signed using the first temporary key, wherein the first temporary key is used by the client server to use the first session key pair to describe access to the user right The control list is signed, the user key account is generated by the client server to confirm the identity of the client to the cloud server, and the session policy information is encrypted by the client server using the first session key. Obtaining, the first session key is a session key held by the client server and a session with the cloud server; and based on the user key account and the session policy information, the received session Declaring the signature of the cloud service request information for authentication; and transmitting, in response to the authentication, to the client, the response to the cloud A second service request message response information.

In a fourth aspect, the present application provides an authentication method for an authentication system, where the authentication system includes: a client, a client server, and a cloud server, the method includes: the client sends the client to the client server An allocation request information of the first temporary key, the allocation request information carrying a session identity identifier for verifying the identity of the user; the client server receiving the allocation request information, and verifying the identity of the user based on the session identity identifier And generating, by the verification, the first response information in response to the allocation request information, and sending the first response information to the user end, wherein the first response information comprises: for using the cloud server The user key account that confirms the identity of the client, using the first session key to sign the first access control list used to describe the user rights a temporary key, and session policy information obtained by encrypting the access control list by using the first session key, wherein the first session key is a session secret held by the client server and the session of the cloud server The client sends the cloud service request information generated based on the first response information to the cloud server, where the cloud service request information carries the user key account, in response to receiving the first response information. And the session policy information and the signature of the cloud service request information generated by using the first temporary key; the cloud server is based on the received user key account number and the session policy information, and the received The signature of the cloud service request information is authenticated, and in response to the authentication being passed, the second response information that is responsive to the cloud service request information is sent to the client.

In a fifth aspect, the application provides a client for an authentication system, where the client is configured to: send, to the client server, allocation request information of a first temporary key, where the allocation request information is carried a session identifier for verifying the identity of the user; receiving, by the client server, the first response information that is sent by the user in response to the identity of the user, and the first response information includes: determining the identity of the client to the cloud server a user key account, using a first session key to sign a first temporary key obtained by using an access control list for describing a user right, and session policy information obtained by encrypting the access control list using the first session key The first session key is a session key held by the client server and the cloud server session, and the cloud service request information generated based on the first response information is sent to the cloud server, The cloud service request information carries the user key account, the session policy information, and is generated by using the first temporary key a signature of the cloud service request information; receiving second response information of the cloud service request information sent by the cloud server, where the second response information is obtained by: the cloud server is based on the user key The account and the session policy information are used to authenticate the signature of the received cloud service request information, and in response to the authentication pass, send the second response information in response to the cloud service request information to the client.

In a sixth aspect, the application provides a client server for an authentication system, where the client server is configured to: receive allocation request information of a first temporary key sent by the client, where the allocation request information is carried Session identity used to authenticate the user; based on The session identifier is used to verify the identity of the user; the first response information is generated in response to the user's identity, and the first response information is used to confirm the identity of the client to the cloud server. a user key account, using a first session key to sign a first temporary key obtained by using an access control list for describing a user right, and session policy information obtained by encrypting the access control list using the first session key The first session key is a session key held by the client server and the session of the cloud server; and the first response information is sent to the client.

In a seventh aspect, the application provides a cloud server for an authentication system, where the cloud server is configured to: receive a user key account sent by the client, session policy information, and a cloud signed by using a first temporary key. Service request information, wherein the first temporary key is obtained by the client server by using a first session key to sign an access control list for describing user rights, and the user key account is served by the client Generating to confirm the identity of the client to the cloud server, the session policy information obtained by the client server using the first session key to encrypt the access control list, the first session key being the client server Holding a session key for a session with the cloud server; authenticating a signature of the received cloud service request information based on the user key account number and the session policy information; and passing the authentication in response to the authentication Sending, to the user terminal, second response information that is responsive to the cloud service request information.

In an eighth aspect, the application provides an authentication system, where the authentication system includes: a user end, configured to send, to the client server, allocation request information of a first temporary key, where the allocation request information is carried for verification a session identifier of the user identity; receiving, by the client server, the first response information that is sent by the user in response to the user identity, and the first response information includes: confirming the identity of the client to the cloud server a user key account, using a first session key to sign a first temporary key obtained by using an access control list for describing a user right, and session policy information obtained by encrypting the access control list using the first session key, The first session key is a session key held by the client server and the cloud server, and the cloud service request information generated based on the first response information is sent to the cloud server, where the cloud The service request information carries the user key account, the session policy information, and uses the first temporary key to generate The cloud of the signature information service request; the client server, with Receiving the allocation request information, verifying the user identity based on the session identity identifier; and generating, by the verification, the first response information in response to the allocation request information and transmitting the a first response information, where the cloud server is configured to authenticate the received signature of the cloud service request information based on the received user key account and the session policy information, and respond to the authentication, Sending, to the client, second response information that is responsive to the cloud service request information.

The authentication method and the authentication system provided by the application send the first temporary key allocation request information to the client server through the client, and after the client server verifies the allocation request information, generate and send the user key account to the client. And the first response information of the first temporary key and the session policy information, and the cloud service request information generated by the first response information is sent by the user end to the cloud server, where the cloud service request information carries the user key account, the session policy information, and the use The signature of the cloud service request information generated by the first temporary key is authenticated by the cloud server based on the user key account number and the session policy information, and the second response of the cloud service request information is sent to the user end after the authentication is passed. information. The authentication method of the embodiment of the present application reduces the interaction process between the client server and the cloud server, and reduces the authentication pressure of the cloud server.

DRAWINGS

Other features, objects, and advantages of the present application will become more apparent from the detailed description of the accompanying drawings.

FIG. 1 illustrates an exemplary system architecture to which embodiments of the present application may be applied;

2 is a schematic flowchart of an authentication method for a UE of an authentication system according to an embodiment of the present application;

FIG. 3 is a schematic flowchart of a method for generating first response information for a client server of an authentication system according to an embodiment of the present application; FIG.

FIG. 4 is a schematic flowchart of an authentication method of a cloud server for authenticating a system according to an embodiment of the present application;

FIG. 5 illustrates an exemplary flowchart of a method of authenticating a signature of cloud service request information according to an embodiment of the present application;

FIG. 6 illustrates one of authentication methods for an authentication system according to an embodiment of the present application. Exemplary flow chart;

FIG. 7 illustrates an exemplary flowchart of a specific application scenario of an authentication method for an authentication system according to an embodiment of the present application;

FIG. 8 shows an exemplary structural diagram of an authentication system according to an embodiment of the present application;

FIG. 9 is a block diagram showing the structure of a computer system suitable for implementing the terminal device or server of the embodiment of the present application.

detailed description

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention, rather than the invention. It is also to be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings.

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings.

FIG. 1 illustrates an exemplary system architecture 100 in which embodiments of the present application may be applied.

As shown in FIG. 1, the system architecture 100 can include

terminal devices

101, 102, network 103 and client server 104, and cloud server 105. The network 103 is used to provide a medium for communication links between the

terminal devices

101, 102, the client server 104, and the cloud server 105. Network 103 may include various types of connections, such as wired, wireless communication links, fiber optic cables, and the like.

The user 110 can interact with the client server 104 and the cloud server 105 via the network 103 using the

terminal devices

101, 102 to transmit information or receive information and the like. Various web pages or applications, such as a video player, a web game application, and the like, may be installed on the

terminal devices

101, 102.

The

terminal devices

101, 102 can be various electronic devices including, but not limited to, personal computers, smart phones, smart watches, tablets, personal digital assistants, and the like.

The client server 104 and the cloud server 105 may be servers that provide various services. The server can store, analyze, and the like the received data, and feed back the processing result to other servers or terminal devices.

It should be noted that the authentication method and the authentication system provided by the embodiments of the present application may be performed by the

terminal device

101, 102 as an authentication method and a client in the authentication system, and the client server 104 serves as an authentication method and a client in the authentication system. The server executes, and is executed by the cloud server 105 as an authentication method and a cloud server in the authentication system. It should be understood that the number of terminal devices, networks, and servers in Figure 1 is merely illustrative. Depending on the implementation needs, there can be any number of terminal devices, networks, and servers.

The authentication method for the authentication system of the embodiment of the present application will be described below with reference to FIG. 2 to FIG. 7. In an embodiment of the present application, the authentication system may include a client, a client server, and a cloud server.

Please refer to FIG. 2. FIG. 2 is a schematic flowchart of an authentication method for a UE of an authentication system according to an embodiment of the present application.

As shown in FIG. 2, the authentication method for the client of the authentication system may include:

First, in step 201, the allocation request information of the first temporary key is sent to the client server, and the allocation request information carries the session identity for verifying the identity of the user.

In this embodiment, the allocation request information of the first temporary key is used to request the client server to allocate a set of temporary keys. The allocation request information carries a session identifier (sessionid) for providing a valid identity of the user to the client server.

Next, in step 202, the first response information of the response allocation request information sent by the client server in response to the user identity by the verification is received.

In this embodiment, the client server verifies the user identity based on the session identity identifier carried in the received distribution request information. After the verification is passed, it is determined that the allocation request information sent by the client is valid, and is allocated for the user to be confirmed to the cloud server. The user key account (access key id, abbreviated as ak) of the customer identity, and the access control list (ACL, ACL describes the effective expiration time) used to describe the user authority is determined according to the user identity, and the client server holds the The session key (first session key) of the cloud server session signs the access control list to obtain a first temporary key (accesse key secret, abbreviated as sk), and uses the session key to encrypt the access control list to obtain session policy information. (session policy), finally sending the user key account, the first temporary key, and the session policy information as the first response information to the client. Wherein, the signature of the access control list can be implemented by a digital signature algorithm, for example, using a secure hash algorithm SHA. A series of cryptographic hash functions are implemented; the encrypted access control list can use digital encryption standards, such as the data encryption standard DES, the data encryption standard 3DES and the advanced encryption standard AES, which use three 64-bit keys to encrypt the data three times. .

After the client server sends the first response message, the client may receive the first response information (including ak, sk, session policy).

Then, in step 203, the cloud service request information generated based on the first response information is sent to the cloud server, where the cloud service request information carries the user key account, the session policy information, and the cloud service request information generated by using the first temporary key. signature.

In this embodiment, the cloud service request information is used to request a resource from the cloud, and the user end (the body that sends the request may be a webpage or an application in the user end) uses the first temporary key to sign the cloud service request information, and carries the user secret. The key account confirms the identity of the user, and carries the session policy information as additional authentication data and sends it to the cloud server.

Then, in step 204, the second response information sent by the cloud server in response to the cloud service request information is received.

In this embodiment, after receiving the cloud service request, the cloud server sends the first response information to the user end by using the following steps: the cloud server performs the signature of the received cloud service request information based on the user key account number and the session policy information. The authentication, in response to the passing of the authentication, sends the second response information that responds to the cloud service request information to the client.

When the cloud server authenticates the signature of the received cloud service request information based on the user key account and the session policy information, the cloud service authenticates the first temporary secret to the Identity and Access Management (IAM). The signature of the key, the IAM calculates the second temporary key based on the user key account and the session policy information, and calculates the signature using the second temporary key, and compares the calculated signature with the received signature when the comparison result is the same. The received signature passes the authentication, and the authentication result is returned to the cloud service, and the cloud service responds to the cloud service request, and sends the second response information to the client.

The client then receives the second response information of the cloud service request information sent by the cloud server to the client.

The authentication method for the client of the authentication system provided by the foregoing embodiment of the present application receives the client service server by sending the first temporary key allocation request information to the client server. Sending the first response information of the response allocation request information, and sending the cloud service request information generated based on the first response information to the cloud server, where the cloud service request information carries the user key account, the session policy information, and the generated by using the first temporary key. The signature of the cloud service request information receives the second response information sent by the cloud server to the client in response to the cloud service request information, which reduces the interaction process between the client server and the cloud server, reduces the pressure on the cloud server, and the cloud server does not need to be deployed. High-performance services that are under heavy traffic pressure and avoid the performance damage to the cloud's IAM service when there are too many temporary key requests.

Please refer to FIG. 3. FIG. 3 is a schematic flowchart of a method for generating first response information for a client server of an authentication system according to an embodiment of the present application.

As shown in FIG. 3, the method for generating the first response information of the client server for the authentication system may include:

First, in step 301, the allocation request information of the first temporary key sent by the user end is received, and the allocation request information carries a session identity identifier for verifying the identity of the user.

In this embodiment, the allocation request information of the first temporary key is used to request the client server to allocate a set of temporary keys. The session identifier (sessionid) carried in the allocation request information is used to provide the client server with the valid identity of the user.

Next, in step 302, the user identity is verified based on the session identity.

In this embodiment, the session identity can provide a valid identity of the user, and the client server compares the provided valid identity of the user with the identity of the reserved user. If the comparison result is the same, the user identity passes. verification.

In the actual authentication, if the session identity is marked as not logged in, you can log in to the login page provided by the client server or the third-party login page to log in.

Thereafter, in step 303, first response information in response to the allocation request information is generated in response to the identity of the user.

The first response information includes: a user key account used to confirm the identity of the client to the cloud server, a first temporary key obtained by using the first session key to sign the access control list for describing the user right, and using the first The session key encrypts the session policy information obtained by the access control list, where the first session key is a session key held by the client server and communicated with the cloud server.

In this embodiment, the client server verifies the user identity based on the session identity identifier carried in the received distribution request information. After the verification is passed, it is determined that the allocation request information sent by the client is valid, and is allocated for the user to be confirmed to the cloud server. The user key account (access key id, abbreviated as ak) of the customer identity, and the access control list (ACL, ACL should describe the effective expiration time) used to describe the user authority according to the identity of the user, is held by the client server. The session key of the cloud server session signs the access control list to obtain the first temporary key (accesse key secret, abbreviated as sk), and uses the session key to encrypt the access control list to obtain session policy information (session policy). The user key account, the first temporary key, and the session policy information are sent to the client as the first response information. Wherein, the signature of the access control list can be implemented by a digital signature algorithm, for example, using a series of cryptographic hash functions of the secure hash algorithm SHA; the encrypted access control list can use a digital encryption standard, such as the data encryption standard DES, use Three 64-bit keys are used to encrypt data three times with data encryption standard 3DES and advanced encryption standard AES.

Then, in step 304, the first response information is sent to the UE.

The method for generating the first response information of the client server for the authentication system provided by the foregoing embodiment of the present application receives the request information of the first temporary key sent by the user end, and the allocation request information carries the session for verifying the identity of the user. The identity identifier is based on the session identity identifier, and the user identity is verified, and the first response information of the response allocation request information is generated in response to the user identity, thereby providing the client with the credentials for accessing the cloud service, and the cloud server deployment is not required to be undertaken. High-performance services with traffic pressure, and avoiding performance damage to the cloud's IAM service when there are too many temporary key requests.

Please refer to FIG. 4. FIG. 4 is a schematic flowchart of an authentication method of a cloud server for authenticating a system according to an embodiment of the present application.

As shown in FIG. 4, the authentication method of the cloud server for authenticating the system may include:

First, in step 401, receiving a user key account and a session policy sent by the client The information and the cloud service request information signed using the first temporary key.

The first temporary key is obtained by the client server using the first session key to sign the access control list for describing the user right, and the user key account is generated by the client server to confirm the identity of the client to the cloud server, and the session policy The information is obtained by the client server using the first session key to encrypt the access control list, and the first session key is a session key held by the client server for the session with the cloud server.

Next, in step 402, the signature of the received cloud service request information is authenticated based on the user key account number and the session policy information.

When the cloud server authenticates the signature of the received cloud service request information based on the user key account and the session policy information, the cloud service authenticates the first temporary secret to the Identity and Access Management (IAM). The signature of the key, the IAM calculates the second temporary key based on the user key account and the session policy information, and calculates the signature using the second temporary key, and compares the calculated signature with the received signature when the comparison result is the same. The received signature is authenticated.

Then, in step 403, in response to the authentication being passed, the second response information in response to the cloud service request information is sent to the UE.

In this embodiment, in response to the signature of the IAM authentication cloud service request information, the authentication result is returned to the cloud service, and the cloud service sends the second response information generated in response to the cloud service request to the client.

The authentication method of the cloud server for the authentication system provided by the foregoing embodiment of the present application authenticates the signature of the received cloud service request information by using the received user key account and session policy information, and responds to the authentication, to the client. Sending the second response information in response to the cloud service request information, thereby providing services for the client, reducing the interaction process between the cloud server and the client server, eliminating the need for the cloud server to deploy high-performance services under heavy traffic pressure, and avoiding temporary key requests Too much performance damage to the cloud's IAM service, which reduces the performance requirements for the cloud server.

With further reference to FIG. 5, FIG. 5 illustrates an exemplary flowchart of a method of authenticating a signature of cloud service request information in accordance with an embodiment of the present application.

As shown in FIG. 5, the method for authenticating the signature of the cloud service request information includes:

First, in step 501, the identity of the client is verified based on the user key account number.

Next, in step 502, in response to the identity of the client, the second temporary key is obtained based on the session policy information and the second session key, wherein the second session key is a session held by the cloud server with the client server. Session key.

In this embodiment, the method step of obtaining the second temporary key based on the session policy information and the second session key is the same as the step of the client server generating the first temporary key, that is, first decrypting using the second session key. The session policy information is obtained, and the access control list is obtained; then the obtained access control list is signed by using the second session key to obtain a second temporary key.

Thereafter, in step 503, the signature of the cloud service request information is calculated using the second temporary key.

In this embodiment, the process of calculating the signature of the cloud service request information by using the second temporary key is the same as the process of signing the cloud service request information by the user end using the first temporary key. Signatures can be implemented using a variety of signature methods, such as RSA signatures and hash hash signatures.

Then, in step 504, the signature of the received cloud service request information and the calculated signature of the cloud service request information are compared.

Then, in step 505, in response to the result of the comparison being the same, it is determined that the authentication result is the authentication pass.

The method for authenticating the signature of the cloud service request information provided by the above example, after verifying the identity of the client by using the user key account, obtaining a second temporary key based on the session policy information and the second session key, wherein the second session is dense The key is a session key held by the cloud server and communicated with the client server, and then the second temporary key is used to calculate the signature of the cloud service request information, and then the received signature and the calculated signature are compared with the calculated result. In the same way, it is determined that the authentication result is the certification pass, and the authentication of the signature is realized simply and quickly, and the authentication efficiency is improved.

Please refer to FIG. 6. FIG. 6 shows an exemplary flowchart of an authentication method for an authentication system according to an embodiment of the present application.

As shown in FIG. 6, the authentication method for the authentication system includes:

First, in step 601, the UE sends the first temporary key allocation request information to the client server, and the allocation request information carries the session identity used to verify the identity of the user.

Next, in step 602, the client server receives the allocation request information, and verifies the user identity based on the session identity identifier; and generates the first response information in response to the allocation request information and sends the generated response message to the client according to the identity of the user. The first response message.

In the actual authentication, if the session identity is marked as not logged in, you can skip Go to the login page provided by the client server or the third-party login page to log in.

Then, in step 603, the UE sends the cloud service request information generated based on the first response information to the cloud server in response to receiving the first response information, where the cloud service request information carries the user key account, the session policy information, and the usage The signature of the cloud service request information generated by a temporary key.

In this embodiment, the cloud service request information is used to request a resource from the cloud, and the user end (the execution body may be a webpage or an application existing in the user end) uses the first temporary key to sign the cloud service request information, and carries the user key. The account confirms the identity of the user, and carries the session policy information as additional authentication data and sends it to the cloud server.

Then, in step 604, the cloud server authenticates the signature of the received cloud service request information based on the received user key account and session policy information, and sends a response to the cloud service request information to the client in response to the authentication pass. Second response information.

In this embodiment, when the signature of the received cloud service request information is authenticated, the method for authenticating the signature of the cloud service request information described in FIG. 5 is the same. I will not repeat them here.

As shown in FIG. 7, in a specific application scenario of the embodiment, the authentication method may include the following steps:

Step 701: The user sends, by using the user end, request information for requesting the first temporary key to the client server, where the request information carries a session identity identifier for verifying the identity of the user.

Step 702: The client server receives the allocation request information, and after the user identity is verified based on the session identity identifier carried in the distribution request information, the first response information is generated, where the first response information includes: a user secret used to confirm the identity of the client to the cloud server. a key account, using a first session key to sign a first temporary key obtained by using an access control list for describing a user right, and session policy information obtained by encrypting an access control list using the first session key, wherein the first session is confidential The key is the session key held by the client server and the session with the cloud server;

Step 703, the client server returns the first response information to the client;

Step 704: The UE sends a user key account, session policy information, and cloud service request information signed by using the first temporary key to the cloud service of the cloud server.

Step 705, the cloud service is based on the user key account, session policy information, and usage first. The cloud service request information of the temporary key signature is authenticated to the IAM;

Step 706: The IAM returns a result of successful authentication to the cloud service.

Step 707: The cloud service returns, to the UE, second response information that is in response to the cloud service request information.

The authentication method for the authentication system provided by the foregoing embodiment of the present application sends the first temporary key allocation request information to the client server through the client, and the user identity server identifies the user according to the session identity in the received distribution request information. The identity is verified, and the first response information corresponding to the distribution request information is generated and sent to the user end, and the first end response information sent by the client server to the cloud server is sent to the cloud server. The cloud service request information generated by the first response information, the cloud service request information carries the user key account, the session policy information, and the signature of the cloud service request information generated by using the first temporary key, and the cloud server is based on the user key account and the session. The policy information is used to authenticate the signature of the received cloud service request information, and send the second response information that responds to the cloud service request information to the user end in response to the authentication, and receive the response cloud service sent by the cloud server to the user end through the user end. Request information The second response information reduces the interaction process between the client server and the cloud server, reduces the pressure on the cloud server, and the cloud server does not need to deploy a high-performance service that bears heavy traffic pressure, and avoids the temporary key request to the cloud. Performance damage caused by IAM services.

Please refer to FIG. 8. FIG. 8 shows an exemplary structural diagram of an authentication system according to an embodiment of the present application.

As shown in FIG. 8, the authentication system includes: a client 810, a client server 820, and a cloud server 830.

The client 810 is configured to send, to the client server, the allocation request information of the first temporary key, where the allocation request information carries the session identity identifier used to verify the identity of the user; and the response sent by the client server in response to the identity of the user is verified. And allocating the first response information of the request information, where the first response information includes: a user key account used to confirm the identity of the client to the cloud server, and the first session key is used to sign the access control list for describing the user right. a temporary key, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session key is the client service a session key held by the server for the session with the cloud server; sending cloud service request information generated based on the first response information to the cloud server, where the cloud service request information carries the user key account, the session policy information, and the first use The signature of the cloud service request information generated by the temporary key.

In this embodiment, the first response information is used by the client server to verify the allocation request information, and in response to the verification, the access control list for describing the user authority is generated, based on the access control list and the cloud held by the client server. The session key of the server session, and the first response information of the response allocation request information generated and sent to the client.

After the cloud service request information generated by the first response information is sent to the cloud server, and the cloud service request information carries the user key account, the session policy information, and the signature of the cloud service request information generated by using the first temporary key, the client 810 Receiving second response information that the cloud server responds to the allocation request information

The client server 820 is configured to receive the allocation request information, verify the user identity based on the session identity carried by the distribution request information, and generate the first response information in response to the allocation request information and send the response to the user according to the identity of the user. The terminal sends the generated first response information.

In this embodiment, the first response information of the response allocation request information generated and sent is the same information as the first response information received by the client 810, and the first response information includes: a user secret for confirming the identity of the client to the cloud server. a key account, using a first session key to sign a first temporary key obtained by using an access control list for describing a user right, and session policy information obtained by encrypting an access control list using the first session key, wherein the first The session key is a session key held by the client server for a session with the cloud server.

The cloud server 830 is configured to authenticate the signature of the received cloud service request information based on the received user key account and session policy information, and send a second response to the cloud service request information to the client in response to the authentication pass. information.

In this embodiment, the cloud server 830 is further configured to verify the identity of the client based on the user key account; in response to the identity of the client, the second temporary key is obtained based on the session policy information and the second session key. The second session key is a session key held by the cloud server and communicated with the client server; the second temporary key is used to calculate the cloud Signing of the service request information; comparing the signature of the received cloud service request information with the calculated signature of the cloud service request information; in response to the result of the comparison, determining that the authentication result is the authentication pass.

The cloud server 830 is further configured to decrypt the session policy information using the second session key to obtain an access control list; and use the second session key to sign the obtained access control list to obtain a second temporary key.

It should be understood that the client, the client server and the cloud server described in the device 800 correspond to the operation steps of the client, the client server and the cloud server described in the methods described in reference to FIGS. 2 to 7. Thus, the operations and features described above for the authentication method are equally applicable to the apparatus 800 and the units contained therein, and are not described herein.

The authentication system provided by the foregoing embodiment of the present application sends the first temporary key allocation request information to the client server through the client, and after the client server verifies the allocation request information, generates and sends the user key account to the client. And the first response information of the first temporary key and the session policy information, and the cloud service request information generated by the first response information is sent by the user end to the cloud server, where the cloud service request information carries the user key account, the session policy information, and the use The signature of the cloud service request information generated by the first temporary key is authenticated by the cloud server based on the user key account number and the session policy information, and the second response of the cloud service request information is sent to the user end after the authentication is passed. information. The authentication method of the embodiment of the present application reduces the interaction process between the client server and the cloud server, and reduces the authentication pressure of the cloud server.

It should be understood by those skilled in the art that in the above embodiment of the present application, the first temporary key and the second temporary key represent two different key generation methods used by different execution entities according to the session key they hold. The temporary key obtained is used to verify the signature of the cloud service request information; and the first response information and the second response information are respectively response information of the user terminal responding to the first temporary key allocation request information and the cloud server responding to the client end The response information of the cloud service request information is not the same; the first session key and the second session key are the session key held by the client server and the cloud server session, and the latter is the cloud server hold. The session key for the session with the client server, both symmetric keys, using the same key for encryption and decryption.

Referring now to FIG. 9, there is shown a terminal device suitable for implementing the embodiments of the present application. Or a schematic diagram of the structure of the computer system 900 of the server.

As shown in FIG. 9, computer system 900 includes a central processing unit (CPU) 901 that can be loaded into a program in random access memory (RAM) 903 according to a program stored in read only memory (ROM) 902 or from storage portion 908. And perform various appropriate actions and processes. In the RAM 903, various programs and data required for the operation of the system 900 are also stored. The CPU 901, the ROM 902, and the RAM 903 are connected to each other through a bus 904. An input/output (I/O) interface 905 is also coupled to bus 904.

The following components are connected to the I/O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a storage portion 908 including a hard disk or the like. And a communication portion 909 including a network interface card such as a LAN card, a modem, or the like. The communication section 909 performs communication processing via a network such as the Internet. Driver 910 is also connected to I/O interface 905 as needed. A removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 910 as needed so that a computer program read therefrom is installed into the storage portion 908 as needed.

In particular, the processes described above with reference to the flowcharts may be implemented as a computer software program in accordance with an embodiment of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a machine readable medium, the computer program comprising program code for executing the method illustrated in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication portion 909, and/or installed from the removable medium 911.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems and methods in accordance with various embodiments of the present invention. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a portion of code, and a module, a program segment, or a portion of code includes one or more Executable instructions. It should also be noted that in some alternative implementations, the functions noted in the blocks may also occur in a different order than that illustrated in the drawings. For example, two successively represented blocks may in fact be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts The function or operation is implemented by a dedicated hardware-based system, or it can be implemented in a combination of dedicated hardware and computer instructions.

In another aspect, the present application further provides a computer readable storage medium, which may be a computer readable storage medium included in the apparatus in the foregoing embodiment, or may exist separately and not assembled. A computer readable storage medium in the terminal. The computer readable storage medium stores one or more programs that are used by one or more processors to perform the authentication methods described herein.

The above description is only a preferred embodiment of the present application and a description of the principles of the applied technology. It should be understood by those skilled in the art that the scope of the invention referred to in the present application is not limited to the specific combination of the above technical features, and should also be covered by the above technical features or Other technical solutions formed by arbitrarily combining the features. For example, the above features are combined with the technical features disclosed in the present application, but are not limited to the technical features having similar functions.

Claims

An authentication method for a client of an authentication system, the authentication system includes: a client, a client server, and a cloud server, wherein the method includes:

Sending, to the client server, allocation request information of a first temporary key, where the allocation request information carries a session identity identifier for verifying a user identity;

Receiving, by the client server, the first response information that is sent by the user in response to the user identity, and the first response information includes: a user key account used to confirm the identity of the client to the cloud server, using the first a session key signature for describing a first temporary key obtained by an access control list of a user right, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session The key is a session key held by the client server and the session with the cloud server;

Sending cloud service request information generated based on the first response information to the cloud server, where the cloud service request information carries the user key account, the session policy information, and generated by using the first temporary key The signature of the cloud service request information;

And receiving the second response information that is sent by the cloud server to respond to the cloud service request information, where the second response information is obtained by: the cloud server is based on the user key account number and the session policy information, The received signature of the cloud service request information is authenticated, and in response to the authentication being passed, the second response information that is responsive to the cloud service request information is sent to the user end.
A method for generating a first response message for a client server of an authentication system, the authentication system includes: a client, a client server, and a cloud server, wherein the method includes:

Receiving, by the user end, allocation request information of the first temporary key, where the allocation request information carries a session identity identifier for verifying the identity of the user;

Verifying the identity of the user based on the session identity;

Generating, in response to the identity of the user, first response information in response to the allocation request information, wherein the first response information comprises: confirming a client to the cloud server An identity user account account, a first temporary key obtained by using an address control list for describing a user right using a first session key, and a session policy obtained by encrypting the access control list using the first session key Information, wherein the first session key is a session key held by the client server and the session with the cloud server;

Sending the first response information to the client.
An authentication method for a cloud server of an authentication system, the authentication system includes: a client, a client server, and a cloud server, wherein the method includes:

Receiving a user key account, session policy information, and cloud service request information signed by the first temporary key, where the first temporary key is used by the client server to use the first session key Signing an access control list for describing user rights, the user key account is generated by the client server to confirm a customer identity to a cloud server, and the session policy information is used by the client server Encrypting the access control list by a session key, where the first session key is a session key held by the client server and a session with the cloud server;

And authenticating the received signature of the cloud service request information based on the user key account number and the session policy information;

And responding to the authentication, sending, by the client, second response information that is responsive to the cloud service request information.
The method according to claim 3, wherein the authenticating the signature of the received cloud service request information based on the user key account number and the session policy information comprises:

Verifying the identity of the client based on the user key account number;

Retrieving, according to the client identity, a second temporary key based on the session policy information and the second session key, wherein the second session key is held by the cloud server and the client The session key of the server session;

Calculating a signature of the cloud service request information by using the second temporary key;

And comparing the signature of the received cloud service request information with the calculated signature of the cloud service request information;

In response to the same result of the comparison, it is determined that the authentication result is the authentication pass.
The method according to claim 4, wherein the obtaining the second temporary key based on the session policy information and the second session key comprises:

Decrypting the session policy information by using the second session key to obtain the access control list;

And signing the obtained access control list by using the second session key to obtain a second temporary key.
An authentication method for an authentication system, the authentication system includes: a client, a client server, and a cloud server, wherein the method includes:

The user end sends the first temporary key allocation request information to the client server, where the allocation request information carries a session identity identifier for verifying the identity of the user;

Receiving, by the client server, the allocation request information, verifying the identity of the user based on the session identity identifier, and generating, by the verification, the first response information in response to the allocation request information to the user Sending, by the terminal, the first response information, where the first response information includes: a user key account for confirming the identity of the client to the cloud server, and the access control list for describing the user right is obtained by using the first session key. a first temporary key, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session key is a session held by a client server with the cloud server Session key

Sending, by the user end, the cloud service request information generated by the first response information to the cloud server, where the cloud service request information carries the user key account and the a session policy information and a signature of the cloud service request information generated using the first temporary key;

The cloud server authenticates the received signature of the cloud service request information based on the received user key account and the session policy information, and sends a response to the client in response to the authentication being passed. The second response information of the cloud service request information.
The method according to claim 6, wherein the authenticating the signature of the received cloud service request information based on the user key account number and the session policy information comprises:

Verifying the identity of the client based on the user key account number;

Retrieving, according to the client identity, a second temporary key based on the session policy information and the second session key, wherein the second session key is held by the cloud server and the client The session key of the server session;

Calculating a signature of the cloud service request information by using the second temporary key;

And comparing the signature of the received cloud service request information with the calculated signature of the cloud service request information;

In response to the same result of the comparison, it is determined that the authentication result is the authentication pass.
The method according to claim 6, wherein the obtaining the second temporary key based on the session policy information and the second session key comprises:

Decrypting the session policy information by using the second session key to obtain the access control list;

And signing the obtained access control list by using the second session key to obtain a second temporary key.
A client for an authentication system, the authentication system includes: a client, a client server, and a cloud server, wherein the client is configured to:

Sending, to the client server, allocation request information of a first temporary key, where the allocation request information carries a session identity identifier for verifying a user identity;

Receiving, by the client server, the first response information that is sent by the user in response to the user identity, and the first response information includes: a user key account used to confirm the identity of the client to the cloud server, using the first a session key signature for describing a first temporary key obtained by an access control list of a user right, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session The key is a session key held by the client server and the session with the cloud server;

Sending a cloud service generated based on the first response information to the cloud server Obtaining information, the cloud service request information carrying the user key account, the session policy information, and a signature of the cloud service request information generated by using the first temporary key;

And receiving the second response information that is sent by the cloud server to respond to the cloud service request information, where the second response information is obtained by: the cloud server is based on the user key account number and the session policy information, The received signature of the cloud service request information is authenticated, and in response to the authentication being passed, the second response information that is responsive to the cloud service request information is sent to the user end.
A client server for an authentication system, the authentication system includes: a client, a client server, and a cloud server, wherein the client server is configured to:

Receiving, by the user end, allocation request information of the first temporary key, where the allocation request information carries a session identity identifier for verifying the identity of the user;

Verifying the identity of the user based on the session identity;

Generating, in response to the identity of the user, the first response information in response to the allocation request information, wherein the first response information comprises: a user key account for confirming the identity of the client to the cloud server, using the first session key Signing a first temporary key obtained by using an access control list describing a user right, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session key is a client a session key held by the server and the session with the cloud server;

Sending the first response information to the client.
A cloud server for an authentication system, the authentication system includes: a client, a client server, and a cloud server, wherein the cloud server is configured to:

Receiving a user key account, session policy information, and cloud service request information signed by the first temporary key, where the first temporary key is used by the client server to use the first session key Signing an access control list for describing user rights, the user key account is generated by the client server to confirm a customer identity to a cloud server, and the session policy information is used by the client server Encrypting the access control list with a session key, the first session key being the client a session key held by the server to perform a session with the cloud server;

And authenticating the received signature of the cloud service request information based on the user key account and the session policy information;

And transmitting, in response to the authentication, the second response information that is responsive to the cloud service request information to the client.
The cloud server according to claim 11, wherein the cloud server is configured to authenticate the signature of the received cloud service request information based on the user key account number and the session policy information, including:

The cloud server is configured to verify the identity of the client based on the user key account; and obtain a second temporary key based on the session policy information and the second session key in response to the client identity being verified The second session key is a session key held by the cloud server to be in a session with the client server; and the signature of the cloud service request information is calculated by using the second temporary key; The signature of the cloud service request information and the calculated signature of the cloud service request information; in response to the result of the comparison being the same, determining that the authentication result is the authentication pass.
The cloud server according to claim 12, wherein the cloud server is configured to obtain the second temporary key based on the session policy information and the second session key, including:

The cloud server is configured to decrypt the session policy information by using the second session key to obtain the access control list, and use the second session key to sign the obtained access control list to obtain a second Temporary key.
An authentication system includes: a client, a client server, and a cloud server, wherein the authentication system includes:

a client, configured to send, to the client server, allocation request information of a first temporary key, where the allocation request information carries a session identity identifier for verifying a user identity; and receiving the client server to verify by responding to the identity of the user The first response information sent in response to the allocation request information, the first response information includes: used to confirm to the cloud server a user key account of the customer identity, a first temporary key obtained by using the first session key to identify an access control list for describing the user right, and a session obtained by encrypting the access control list using the first session key The policy information, wherein the first session key is a session key held by the client server and the cloud server session; and the cloud service request information generated based on the first response information is sent to the cloud server, The cloud service request information carries the user key account, the session policy information, and a signature of the cloud service request information generated by using the first temporary key;

The client server is configured to receive the allocation request information, verify the user identity based on the session identity identifier, and generate a first response message in response to the allocation request information by verifying the user identity and The user end sends the first response information;

The cloud server is configured to authenticate, according to the received user key account number and the session policy information, a signature of the received cloud service request information, and respond to the authentication, to the user end Sending second response information in response to the cloud service request information.
The authentication system according to claim 14, wherein the cloud server is configured to perform authentication on the received signature of the cloud service request information based on the received user key account number and the session policy information. :

The cloud server is configured to verify the identity of the client based on the user key account; and obtain a second temporary key based on the session policy information and the second session key in response to the client identity being verified The second session key is a session key held by the cloud server to be in a session with the client server; and the signature of the cloud service request information is calculated by using the second temporary key; The signature of the cloud service request information and the calculated signature of the cloud service request information; and in response to the result of the comparison being the same, determining that the authentication result is the authentication pass.
The authentication system according to claim 15, wherein the obtaining, by the cloud server, the second temporary key based on the session policy information and the second session key comprises:

The cloud server is configured to decrypt the session policy information by using the second session key to obtain the access control list, and use the second session key to sign the obtained access control list to obtain a second Temporary key.
A client device, comprising:

Processor; and

Memory,

The memory stores computer readable instructions executable by the processor, the processor being: when the computer readable instructions are executed:

Sending, to the client server, allocation request information of the first temporary key, where the allocation request information carries a session identity identifier for verifying the identity of the user;

Receiving, by the client server, the first response information that is sent by the user in response to the user identity, and the first response information includes: a user key account used to confirm the identity of the client to the cloud server, using the first a session key signature for describing a first temporary key obtained by an access control list of a user right, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session The key is a session key held by the client server and the session with the cloud server;

Sending cloud service request information generated based on the first response information to the cloud server, where the cloud service request information carries the user key account, the session policy information, and generated by using the first temporary key The signature of the cloud service request information;

And receiving the second response information that is sent by the cloud server to respond to the cloud service request information, where the second response information is obtained by: the cloud server is based on the user key account number and the session policy information, The received signature of the cloud service request information is authenticated, and in response to the authentication being passed, the second response information that is responsive to the cloud service request information is sent to the user equipment.
A client server device, including:

Processor; and

Memory,

The memory stores computer readable instructions executable by the processor, the processor being: when the computer readable instructions are executed:

Receiving, by the user end, allocation request information of the first temporary key, where the allocation request information carries a session identity identifier for verifying the identity of the user;

Verifying the identity of the user based on the session identity;

Generating, in response to the identity of the user, the first response information in response to the allocation request information, wherein the first response information comprises: a user key account for confirming the identity of the client to the cloud server, using the first session key Signing a first temporary key obtained by using an access control list describing a user right, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session key is a client a session key held by the server device and talking to the cloud server;

Sending the first response information to the client.
A cloud device, including:

Processor; and

Memory,

The memory stores computer readable instructions executable by the processor, the processor being: when the computer readable instructions are executed:

Receiving a user key account sent by the client, session policy information, and cloud service request information signed by using the first temporary key, wherein the first temporary key is used by the client server to describe the first session key pair The access control list of the user authority is signed, and the user key account is generated by the client server to confirm the identity of the client to the cloud device, and the session policy information is used by the client server to use the first session. The key is encrypted by the access control list, and the first session key is a session key held by the client server to perform a session with the cloud device;

And authenticating the received signature of the cloud service request information based on the user key account and the session policy information;

And transmitting, in response to the authentication, the second response information that is responsive to the cloud service request information to the client.
A non-volatile computer storage medium storing computer readable instructions executable by a processor of a client, when the computer readable instructions are executed by a processor, the processor:

Sending, to the client server, allocation request information of the first temporary key, where the allocation request information carries a session identity identifier for verifying the identity of the user;

Receiving, by the client server, the first response information that is sent by the user in response to the user identity, and the first response information includes: a user key account used to confirm the identity of the client to the cloud server, using the first a session key signature for describing a first temporary key obtained by an access control list of a user right, and session policy information obtained by encrypting the access control list using the first session key, wherein the first session The key is a session key held by the client server and the session with the cloud server;

Sending cloud service request information generated based on the first response information to the cloud server, where the cloud service request information carries the user key account, the session policy information, and generated by using the first temporary key The signature of the cloud service request information;

And receiving the second response information that is sent by the cloud server to respond to the cloud service request information, where the second response information is obtained by: the cloud server is based on the user key account number and the session policy information, The received signature of the cloud service request information is authenticated, and in response to the authentication being passed, the second response information that is responsive to the cloud service request information is sent to the user end.
A non-volatile computer storage medium storing computer readable instructions executable by a processor of a client server, when the computer readable instructions are executed by a processor, the processor:

Receiving, by the user end, allocation request information of the first temporary key, where the allocation request information carries a session identity identifier for verifying the identity of the user;

Verifying the identity of the user based on the session identity;

Generating, in response to the identity of the user, the first response information in response to the allocation request information, wherein the first response information comprises: a user key account for confirming the identity of the client to the cloud server, using the first session key Signature is used to describe the visit of user rights a first temporary key obtained by the control list, and session policy information obtained by encrypting the access control list by using the first session key, where the first session key is a client and a server The session key of the cloud server session;

Sending the first response information to the client.
A non-volatile computer storage medium storing computer readable instructions executable by a processor of a cloud server, the processor readable when the computer readable instructions are executed by a processor:

Receiving a user key account sent by the client, session policy information, and cloud service request information signed by using the first temporary key, wherein the first temporary key is used by the client server to describe the first session key pair The access control list of the user authority is obtained by signing, the user key account is generated by the client server to confirm the identity of the client to the cloud server, and the session policy information is used by the client server to use the first session key Encrypting the access control list, where the first session key is a session key held by the client server and a session with the cloud server;

And authenticating the received signature of the cloud service request information based on the user key account and the session policy information;

And transmitting, in response to the authentication, the second response information that is responsive to the cloud service request information to the client.