WO2022179115A1

WO2022179115A1 - User authentication method and apparatus, server and storage medium

Info

Publication number: WO2022179115A1
Application number: PCT/CN2021/123635
Authority: WO
Inventors: 郑如刚
Original assignee: 深圳壹账通智能科技有限公司
Priority date: 2021-02-25
Filing date: 2021-10-13
Publication date: 2022-09-01
Also published as: CN112948851A

Abstract

A user authentication method and apparatus, a server and a storage medium. The method comprises: when an access requirement sent by a client is received, generating, according to the access requirement, a first key pair corresponding to the client, and sending a first public key in the first key pair to the client (S10); receiving a data acquisition request generated by the client on the basis of the first public key, and verifying the data acquisition request by using a private key in the first key pair (S11); if the verification is successful, determining, from the data acquisition request, a system to be accessed, and acquiring a second key pair corresponding to said system (S12); acquiring an access instruction from the data acquisition request, and encrypting the access instruction by using a second public key in the second key pair, so as to obtain access ciphertext (S13); and sending the access ciphertext to said system (S14). By means of the method, the security of data in a service system can be improved. In addition, the method further relates to blockchain technology. The second key pair can be stored in a blockchain.

Description

User authentication method, device, server and storage medium

This application claims the priority of the Chinese patent application filed on February 25, 2021 with the application number 202110215281.2 and the invention titled "User Authentication Method, Device, Server and Storage Medium", the entire contents of which are incorporated by reference in in this application.

technical field

The present application relates to the technical field of security protection, and in particular, to a user authentication method, device, server and storage medium.

Background technique

With the increasing demand for information security, usually when the client requests data in the business system, the business system will perform user authentication on the client. However, the inventor realized that when the business system receives data from multiple clients at the same time When requesting data acquisition, multiple clients need to be authenticated, so that the threads of the business system are occupied and the business system cannot process other requests. In addition, since the token sent by the business system to the client is stored in the client's local file, and the client's local file is easily attacked maliciously, the token is easily leaked, thereby reducing the data security in the business system.

SUMMARY OF THE INVENTION

In view of the above content, it is necessary to provide a user authentication method, device, server and storage medium, which can improve the security of data in the business system.

A first aspect of the present application provides a user authentication method, which is applied to a server, where the server communicates with a client and a plurality of business systems respectively, and the user authentication method includes:

When receiving the access requirement sent by the client, generate a first key pair corresponding to the client according to the access requirement, and send the first public key in the first key pair to the the client;

receiving a data acquisition request generated by the client based on the first public key, and verifying the data acquisition request by using the private key in the first key pair;

If the verification of the data acquisition request by the private key is successful, determine the system to be accessed from the data acquisition request, and acquire a second key pair corresponding to the system to be accessed;

Obtain an access instruction from the data acquisition request, and encrypt the access instruction with the second public key in the second key pair to obtain an access ciphertext;

Send the access ciphertext to the system to be accessed.

A second aspect of the present application provides a server including a processor and a memory, the processor being configured to execute computer-readable instructions stored in the memory to implement the following steps:

Send the access ciphertext to the system to be accessed.

A third aspect of the present application provides a computer-readable storage medium having at least one computer-readable instruction stored thereon, the at least one computer-readable instruction being executed by a processor to implement the following steps:

Send the access ciphertext to the system to be accessed.

A fourth aspect of the present application provides a user authentication device, which runs in a server, and the server communicates with a client and a plurality of business systems respectively, and the user authentication device includes:

The generating unit is configured to, when receiving the access requirement sent by the client, generate a first key pair corresponding to the client according to the access requirement, and generate the first key pair in the first key pair The public key is sent to the client;

a verification unit, configured to receive a data acquisition request generated by the client based on the first public key, and to verify the data acquisition request by using the private key in the first key pair;

an acquisition unit, configured to determine a system to be accessed from the data acquisition request, and acquire a second key pair corresponding to the system to be accessed if the private key is successfully verified against the data acquisition request;

an encryption unit, configured to obtain an access instruction from the data acquisition request, and encrypt the access instruction with the second public key in the second key pair to obtain an access ciphertext;

A sending unit, configured to send the access ciphertext to the system to be accessed.

It can be seen from the above technical solutions that the application does not need to verify the data acquisition request through the business system, which avoids the occupation of threads of the business system and improves the high availability of the business system. The data acquisition request is verified by using the private key. Since the private key is different from the first public key sent to the client, it is ensured that the client has access to the system to be accessed. There is an access right, and at the same time, after the private key successfully verifies the data acquisition request, the second public key is used to encrypt the acquired access instruction, which can prevent the access instruction from being tampered with, thereby improving the The security of the business system ensures data security in the business system.

Description of drawings

FIG. 1 is an application environment diagram of a preferred embodiment of the user authentication method of the present application.

FIG. 2 is a flowchart of a preferred embodiment of the user authentication method of the present application.

FIG. 3 is a functional block diagram of a preferred embodiment of the user authentication device of the present application.

FIG. 4 is a schematic structural diagram of a server implementing a preferred embodiment of the user authentication method of the present application.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be described in detail below with reference to the accompanying drawings and specific embodiments.

As shown in FIG. 1 , it is an application environment diagram of a preferred embodiment of the user authentication method of the present application. The application environment diagram includes a server 1 , a client 2 and a business system 3 . The server 1 communicates with a client 2, and the client 2 is used to generate a request. The server 1 communicates with a plurality of business systems 3, and each business system stores a variety of business data.

As shown in FIG. 2 , it is a flowchart of a preferred embodiment of the user authentication method of the present application. According to different requirements, the order of the steps in this flowchart can be changed, and some steps can be omitted.

The user authentication method is applied in a smart security scenario, thereby promoting the construction of a smart city. The user authentication method is applied to one or more servers, the server is a device that can automatically perform numerical calculation and/or information processing according to pre-set or stored computer-readable instructions, and its hardware includes but not Limited to microprocessors, application specific integrated circuits (ASICs), programmable gate arrays (Field-Programmable Gate Arrays, FPGAs), digital signal processors (Digital Signal Processors, DSPs), embedded devices, etc.

The server can be any electronic product that can interact with users, such as personal computers, tablet computers, smart phones, personal digital assistants (Personal Digital Assistant, PDA), game consoles, interactive network televisions (Internet Protocol Television, IPTV), smart wearable devices, etc.

The server may include network equipment and/or user equipment. Wherein, the network device includes, but is not limited to, a single network server, a server group formed by multiple network servers, or a cloud formed by a large number of hosts or network servers based on cloud computing (Cloud Computing).

The network where the server is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (Virtual Private Network, VPN), and the like.

S10, when receiving the access requirement sent by the client, generate a first key pair corresponding to the client according to the access requirement, and send the first public key in the first key pair to the client.

In at least one embodiment of the present application, the information carried in the access requirement includes, but is not limited to, an access object and the like.

The first key pair includes the first public key and the private key. The first key pair refers to a key between the server and the client.

In at least one embodiment of the present application, generating, by the server according to the access requirement, a first key pair corresponding to the client includes:

obtaining a permission list, where device information of multiple devices is stored in the permission list, and the multiple devices have permissions to access the business system, and the business system includes multiple systems connected to the server;

Detecting whether the client exists in the permission list;

If the client exists in the permission list, determine the serial number of the client in the permission list;

generating a first random number with the number of digits being the serial number, and generating a second random number with the number of digits being the serial number;

The first key pair is generated according to the first random number and the second random number.

Through the permission list, it can be detected whether the client has the permission to access the business system, and then when the client has the permission to access the business system, the first random number is generated according to the serial number and the second random number, since the order of different devices in the permission list is different, the unique first key pair can be generated.

Specifically, generating the first key pair by the server according to the first random number and the second random number includes:

detecting whether the first random number is a prime number, and detecting whether the second random number is a prime number;

When both the first random number and the second random number are prime numbers, calculating the product of the first random number and the second random number to obtain a target value;

calculating the least common multiple of the first random number and the second random number;

generating a first candidate value greater than a preset value and less than the least common multiple, and determining the greatest common divisor of the first candidate value and the least common multiple;

When the greatest common divisor is the preset value, the first candidate value is determined as the first value, and the target value and the first value are concatenated to obtain the first key pair in the public key;

generating a second candidate value greater than the preset value and less than the least common multiple, and performing a remainder operation on the product of the second candidate value and the first value and the least common multiple to obtain a remainder;

When the remainder is the preset value, the second candidate value is determined as the second value, and the target value and the second value are concatenated to obtain the private key in the first key pair .

The preset value refers to a preset value, and the present application does not limit the specific value of the preset value.

According to the above-mentioned embodiment, the first key pair is generated according to the first random number and the second random number, and the security of the first key pair can be improved.

In at least one embodiment of the present application, the method further includes:

If the client does not exist in the permission list, generate alarm information;

Send the alarm information to the client.

S11: Receive a data acquisition request generated by the client based on the first public key, and verify the data acquisition request by using the private key in the first key pair.

In at least one embodiment of the present application, the information carried in the data acquisition request includes, but is not limited to, the access object and the like.

In at least one embodiment of the present application, before receiving the data acquisition request generated by the client based on the first public key, the method further includes:

Obtain the first sending address of the access request, and obtain the second sending address of the data acquisition request;

Detecting whether the second sending address is the same as the first sending address;

If the second sending address is the same as the first sending address, receive the data acquisition request.

Through the above-mentioned embodiments, it can be ensured that the data acquisition request and the access requirement are sent by the same client, and the verification failure of the data acquisition request caused by different clients is avoided.

In at least one embodiment of the present application, the server using the private key in the first key pair to verify the data acquisition request includes:

Decrypt the data acquisition request by using the private key to obtain decryption information;

Detecting whether the decrypted information is garbled;

If the decryption information is not garbled, it is determined that the verification of the data acquisition request by the private key is successful.

According to the above-mentioned embodiment, since it is not necessary to perform the verification using the verification rule, the verification efficiency can be improved.

If the decryption information is garbled, determine that the private key fails to verify the data acquisition request, and generate a prompt message for the data acquisition request;

Send the prompt information to the client.

Through the above embodiment, after the private key fails to verify the data acquisition request, the prompt information can be generated in time to remind the client to learn the response of the data acquisition request.

S12, if the verification of the private key for the data acquisition request is successful, determine the system to be accessed from the data acquisition request, and acquire a second key pair corresponding to the system to be accessed.

It should be emphasized that, in order to further ensure the privacy and security of the second key pair, the second key pair may also be stored in a node of a blockchain.

In at least one embodiment of the present application, the system to be accessed refers to a system to which the data acquisition request acquires business data.

The second key pair refers to a key between the server and the system to be accessed.

In at least one embodiment of the present application, the server determining the system to be accessed from the data acquisition request includes:

Parsing the decryption information to obtain data information carried by the decryption information;

Obtain the identification indicating the system from the data information as the system code;

A system corresponding to the system code is determined as the system to be accessed.

Wherein, the system code can uniquely identify the system.

The system to be accessed can be quickly determined through the mapping relationship between the system code and the system.

In at least one embodiment of the present application, obtaining, by the server, the second key pair corresponding to the system to be accessed includes:

Obtain a key list, where key pairs of multiple systems are stored in the key list;

The key pair corresponding to the system code is obtained from the key list as the second key pair.

Through the foregoing implementation manner, the second key pair can be accurately acquired from the system to be accessed.

S13: Acquire an access instruction from the data acquisition request, and encrypt the access instruction with the second public key in the second key pair to obtain an access ciphertext.

In at least one embodiment of the present application, the access instruction refers to a message of the data acquisition request, and the access instruction includes a label of service data in the system to be accessed.

In at least one embodiment of the present application, the obtaining, by the server, the access instruction from the data obtaining request includes:

obtaining the message location of the message in the data obtaining request;

The information corresponding to the message location is acquired from the data acquisition request as the access instruction.

Through the message location, the access instruction can be quickly acquired from the data acquisition request.

In at least one embodiment of the present application, the server encrypts the access instruction by using the second public key in the second key pair, and obtaining the access ciphertext includes:

Calculate the instruction quantity of the access instruction, and detect whether the instruction quantity is greater than the configuration value;

If the number of instructions is greater than the configuration value, divide the access instructions according to the configuration value to obtain a plurality of instruction blocks, and each instruction block includes the access instructions in the number of the configuration value;

Encrypting the multiple instruction blocks in parallel to obtain multiple sub-ciphertexts corresponding to the multiple instruction blocks;

The multiple sub-ciphertexts are spliced to obtain the access ciphertext.

The configuration value is determined according to hardware configuration resources of the server.

Through the above-mentioned embodiments, the generation efficiency of the access ciphertext can be improved without affecting the operation of the server.

S14: Send the access ciphertext to the system to be accessed.

In at least one embodiment of the present application, the sending, by the server, the access ciphertext to the system to be accessed includes:

Obtain the system address of the system to be accessed;

Send the access ciphertext to the system address.

Through the system address, the access ciphertext can be accurately sent to the system to be accessed.

In at least one embodiment of the present application, after sending the access ciphertext to the system to be accessed, the method further includes:

generating a feedback package for the data acquisition request;

Send the feedback packet to the client.

Through the above-mentioned embodiments, after the access ciphertext is sent, it can be fed back to the client in time.

As shown in FIG. 3 , it is a functional block diagram of a preferred embodiment of the user authentication device of the present application. The user authentication device 11 includes a generation unit 110 , a verification unit 111 , an acquisition unit 112 , an encryption unit 113 , a transmission unit 114 , a detection unit 115 and a reception unit 116 . The module/unit referred to in this application refers to a series of computer-readable instruction segments that can be acquired by the processor 13 and can perform fixed functions, and are stored in the memory 12 . In this embodiment, the functions of each module/unit will be described in detail in subsequent embodiments.

When receiving the access requirement sent by the client, the generating unit 110 generates a first key pair corresponding to the client according to the access requirement, and generates the first public key in the first key pair sent to the client.

In at least one embodiment of the present application, the generating unit 110 generating the first key pair corresponding to the client according to the access requirement includes:

Detecting whether the client exists in the permission list;

Specifically, the generating unit 110 generating the first key pair according to the first random number and the second random number includes:

The verification unit 111 receives the data acquisition request generated by the client based on the first public key, and uses the private key in the first key pair to verify the data acquisition request.

In at least one embodiment of the present application, before receiving the data acquisition request generated by the client based on the first public key, the acquisition unit 112 acquires the first sending address of the access request, and acquires the data acquisition request the second sending address of the request;

The detection unit 115 detects whether the second sending address is the same as the first sending address;

If the second sending address is the same as the first sending address, the receiving unit 116 receives the data acquisition request.

In at least one embodiment of the present application, the verification unit 111 using the private key in the first key pair to verify the data acquisition request includes:

Detecting whether the decrypted information is garbled;

In at least one embodiment of the present application, if the decryption information is garbled, the generating unit 110 determines that the private key fails to verify the data acquisition request, and generates prompt information for the data acquisition request;

The sending unit 114 sends the prompt information to the client.

If the verification of the data acquisition request by the private key is successful, the acquisition unit 112 determines the system to be accessed from the data acquisition request, and acquires a second key pair corresponding to the system to be accessed.

In at least one embodiment of the present application, the obtaining unit 112 determines from the data obtaining request that the system to be accessed includes:

Wherein, the system code can uniquely identify the system.

In at least one embodiment of the present application, the acquiring unit 112 acquiring the second key pair corresponding to the system to be accessed includes:

The encryption unit 113 acquires the access instruction from the data acquisition request, and encrypts the access instruction with the second public key in the second key pair to obtain the access ciphertext.

In at least one embodiment of the present application, obtaining the access instruction from the data obtaining request by the encryption unit 113 includes:

obtaining the message location of the message in the data obtaining request;

In at least one embodiment of the present application, the encryption unit 113 encrypts the access instruction by using the second public key in the second key pair, and obtaining the access ciphertext includes:

The multiple sub-ciphertexts are spliced to obtain the access ciphertext.

The sending unit 114 sends the access ciphertext to the system to be accessed.

In at least one embodiment of the present application, the sending unit 114 sending the access ciphertext to the system to be accessed includes:

Obtain the system address of the system to be accessed;

Send the access ciphertext to the system address.

In at least one embodiment of the present application, after sending the access ciphertext to the system to be accessed, the generating unit 110 generates a feedback packet of the data acquisition request;

The sending unit 114 sends the feedback packet to the client.

As shown in FIG. 4 , it is a schematic structural diagram of a server implementing a preferred embodiment of the user authentication method of the present application.

In one embodiment of the present application, the server 1 includes, but is not limited to, a memory 12, a processor 13, and computer-readable instructions stored in the memory 12 and executable on the processor 13, such as user authentication procedures.

Those skilled in the art can understand that the schematic diagram is only an example of the server 1, and does not constitute a limitation on the server 1. It may include more or less components than the one shown in the figure, or combine some components or For example, the server 1 may further include input and output devices, network access devices, buses, and the like.

The processor 13 may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The processor 13 is the computing core and control center of the server 1, and uses various interfaces and lines to connect the entire server 1. Each part, and the operating system that executes the server 1 and various installed applications, program codes, and the like.

Exemplarily, the computer-readable instructions may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 12 and executed by the processor 13 to Complete this application. The one or more modules/units may be a series of computer-readable instruction segments capable of accomplishing specific functions, and the computer-readable instruction segments are used to describe the execution process of the computer-readable instructions in the server 1 . For example, the computer-readable instructions may be divided into a generating unit 110 , a checking unit 111 , an obtaining unit 112 , an encryption unit 113 , a sending unit 114 , a detecting unit 115 and a receiving unit 116 .

The memory 12 can be used to store the computer-readable instructions and/or modules, and the processor 13 executes or executes the computer-readable instructions and/or modules stored in the memory 12 and invokes the computer-readable instructions and/or modules stored in the memory 12. The data in the server 1 realizes various functions of the server 1. The memory 12 may mainly include a stored program area and a stored data area, wherein the stored program area may store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), and the like; the storage data area may Stores data etc. created according to the usage of the server. The memory 12 may include non-volatile and volatile memory such as: hard disk, internal memory, plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, Flash memory card (Flash) Card), at least one disk storage device, flash memory device, or other storage device.

The memory 12 may be an external memory and/or an internal memory of the server 1 . Further, the storage 12 may be a storage in physical form, such as a memory stick, a TF card (Trans-flash Card) and the like.

If the modules/units integrated in the server 1 are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium, and the computer-readable storage medium may be non-volatile. It can also be a volatile storage medium. Based on this understanding, the present application can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. The computer-readable instructions, when executed by the processor, can implement the steps of the above-mentioned method embodiments.

Wherein, the computer-readable instructions include computer-readable instruction codes, and the computer-readable instruction codes may be in source code form, object code form, executable file, or some intermediate form, and the like. The computer-readable medium may include: any entity or device capable of carrying the computer-readable instruction code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only). Memory), random access memory (RAM, Random Access Memory).

The blockchain referred to in this application is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information to verify its Validity of information (anti-counterfeiting) and generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

2, the memory 12 in the server 1 stores computer-readable instructions to implement a user authentication method, and the processor 13 can execute the computer-readable instructions to implement:

Send the access ciphertext to the system to be accessed.

Specifically, for the specific implementation method of the above-mentioned computer-readable instruction by the processor 13, reference may be made to the description of the relevant steps in the corresponding embodiment of FIG. 2 , which is not repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the modules is only a logical function division, and there may be other division manners in actual implementation.

The computer-readable storage medium stores computer-readable instructions, wherein the computer-readable instructions are used to implement the following steps when executed by the processor 13:

Send the access ciphertext to the system to be accessed.

The modules described as separate components may or may not be physically separated, and components shown as modules may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional module in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or can be implemented in the form of hardware plus software function modules.

Accordingly, the embodiments are to be regarded in all respects as illustrative and not restrictive, and the scope of the application is to be defined by the appended claims rather than the foregoing description, which is therefore intended to fall within the scope of the claims. All changes within the meaning and scope of the equivalents of , are included in this application. Any reference signs in the claims shall not be construed as limiting the involved claims.

Furthermore, it is clear that the word "comprising" does not exclude other units or steps and the singular does not exclude the plural. The multiple units or devices described may also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to denote names and do not denote any particular order.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application rather than limitations. Although the present application has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present application can be Modifications or equivalent substitutions can be made without departing from the spirit and scope of the technical solutions of the present application.

Claims

A user authentication method, wherein, applied in a server, the server communicates with a client and a plurality of business systems respectively, and the user authentication method comprises:

When receiving the access requirement sent by the client, generate a first key pair corresponding to the client according to the access requirement, and send the first public key in the first key pair to the the client;

receiving a data acquisition request generated by the client based on the first public key, and verifying the data acquisition request by using the private key in the first key pair;

If the verification of the data acquisition request by the private key is successful, determine the system to be accessed from the data acquisition request, and acquire a second key pair corresponding to the system to be accessed;

Obtain an access instruction from the data acquisition request, and encrypt the access instruction with the second public key in the second key pair to obtain an access ciphertext;

Send the access ciphertext to the system to be accessed.
The user authentication method according to claim 1, wherein the generating the first key pair corresponding to the client according to the access requirement comprises:

obtaining a permission list, where device information of multiple devices is stored in the permission list, and the multiple devices have permissions to access the business system, and the business system includes multiple systems connected to the server;

Detecting whether the client exists in the permission list;

If the client exists in the permission list, determine the serial number of the client in the permission list;

generating a first random number with the number of digits being the serial number, and generating a second random number with the number of digits being the serial number;

The first key pair is generated according to the first random number and the second random number.
The user authentication method according to claim 2, wherein the generating the first key pair according to the first random number and the second random number comprises:

detecting whether the first random number is a prime number, and detecting whether the second random number is a prime number;

When both the first random number and the second random number are prime numbers, calculating the product of the first random number and the second random number to obtain a target value;

calculating the least common multiple of the first random number and the second random number;

generating a first candidate value greater than a preset value and less than the least common multiple, and determining the greatest common divisor of the first candidate value and the least common multiple;

When the greatest common divisor is the preset value, the first candidate value is determined as the first value, and the target value and the first value are spliced together to obtain the first candidate value in the first key pair. public key;

generating a second candidate value greater than the preset value and less than the least common multiple, and performing a remainder operation on the product of the second candidate value and the first value and the least common multiple to obtain a remainder;

When the remainder is the preset value, the second candidate value is determined as the second value, and the target value and the second value are concatenated to obtain the private key in the first key pair .
The user authentication method according to claim 1, wherein before receiving the data acquisition request generated by the client based on the first public key, the user authentication method further comprises:

Obtain the first sending address of the access request, and obtain the second sending address of the data acquisition request;

Detecting whether the second sending address is the same as the first sending address;

If the second sending address is the same as the first sending address, receive the data acquisition request.
The user authentication method according to claim 1, wherein the verifying the data acquisition request by using the private key in the first key pair comprises:

Decrypt the data acquisition request by using the private key to obtain decryption information;

Detecting whether the decrypted information is garbled;

If the decryption information is not garbled, it is determined that the verification of the data acquisition request by the private key is successful.
The user authentication method according to claim 5, wherein the determining the system to be accessed from the data acquisition request comprises:

Parsing the decryption information to obtain data information carried by the decryption information;

Obtain the identification indicating the system from the data information as the system code;

A system corresponding to the system code is determined as the system to be accessed.
The user authentication method according to claim 1, wherein the encrypting the access instruction by using the second public key in the second key pair to obtain the access ciphertext comprises:

Calculate the instruction quantity of the access instruction, and detect whether the instruction quantity is greater than the configuration value;

If the number of instructions is greater than the configuration value, divide the access instructions according to the configuration value to obtain a plurality of instruction blocks, and each instruction block includes the access instructions whose number is the configuration value;

Encrypting the multiple instruction blocks in parallel to obtain multiple sub-ciphertexts corresponding to the multiple instruction blocks;

The multiple sub-ciphertexts are spliced to obtain the access ciphertext.
A user authentication device, which runs in a server, the server communicates with a client and a plurality of business systems respectively, and the user authentication device includes:

The generating unit is configured to, when receiving the access requirement sent by the client, generate a first key pair corresponding to the client according to the access requirement, and generate the first key pair in the first key pair The public key is sent to the client;

a verification unit, configured to receive a data acquisition request generated by the client based on the first public key, and to verify the data acquisition request by using the private key in the first key pair;

an acquisition unit, configured to determine a system to be accessed from the data acquisition request, and acquire a second key pair corresponding to the system to be accessed if the private key is successfully verified against the data acquisition request;

an encryption unit, configured to obtain an access instruction from the data acquisition request, and encrypt the access instruction with the second public key in the second key pair to obtain an access ciphertext;

A sending unit, configured to send the access ciphertext to the system to be accessed.
A server, wherein the server communicates with a client and a plurality of business systems respectively, the server includes a processor and a memory, the processor is configured to execute at least one computer-readable instruction stored in the memory to implement the following steps :

When receiving the access requirement sent by the client, generate a first key pair corresponding to the client according to the access requirement, and send the first public key in the first key pair to the the client;

receiving a data acquisition request generated by the client based on the first public key, and verifying the data acquisition request by using the private key in the first key pair;

If the verification of the data acquisition request by the private key is successful, determine the system to be accessed from the data acquisition request, and acquire a second key pair corresponding to the system to be accessed;

Obtain an access instruction from the data acquisition request, and encrypt the access instruction with the second public key in the second key pair to obtain an access ciphertext;

Send the access ciphertext to the system to be accessed.
The server of claim 9, wherein, when the first key pair corresponding to the client is generated according to the access requirement, the processor executes the at least one computer-readable instruction to implement the following step:

obtaining a permission list, where device information of multiple devices is stored in the permission list, and the multiple devices have permissions to access the business system, and the business system includes multiple systems connected to the server;

Detecting whether the client exists in the permission list;

If the client exists in the permission list, determine the serial number of the client in the permission list;

generating a first random number with the number of digits being the serial number, and generating a second random number with the number of digits being the serial number;

The first key pair is generated according to the first random number and the second random number.
11. The server of claim 10, wherein, when the first key pair is generated from the first random number and the second random number, the processor executes the at least one computer-readable instructions to implement the following steps:

detecting whether the first random number is a prime number, and detecting whether the second random number is a prime number;

When both the first random number and the second random number are prime numbers, calculating the product of the first random number and the second random number to obtain a target value;

calculating the least common multiple of the first random number and the second random number;

generating a first candidate value greater than a preset value and less than the least common multiple, and determining the greatest common divisor of the first candidate value and the least common multiple;

When the greatest common divisor is the preset value, the first candidate value is determined as the first value, and the target value and the first value are concatenated to obtain the first key pair in the public key;

generating a second candidate value greater than the preset value and less than the least common multiple, and performing a remainder operation on the product of the second candidate value and the first value and the least common multiple to obtain a remainder;

When the remainder is the preset value, the second candidate value is determined as the second value, and the target value and the second value are concatenated to obtain the private key in the first key pair .
The server of claim 9, wherein before receiving a data acquisition request generated by the client based on the first public key, the processor further executes the at least one computer-readable instruction to implement the following steps:

Obtain the first sending address of the access request, and obtain the second sending address of the data acquisition request;

Detecting whether the second sending address is the same as the first sending address;

If the second sending address is the same as the first sending address, receive the data acquisition request.
10. The server of claim 9, wherein the processor executes the at least one computer-readable instruction upon verifying the data acquisition request with a private key in the first key pair to implement the following steps:

Decrypt the data acquisition request by using the private key to obtain decryption information;

Detecting whether the decrypted information is garbled;

If the decryption information is not garbled, it is determined that the verification of the data acquisition request by the private key is successful.
The server according to claim 9, wherein when the access instruction is encrypted with the second public key in the second key pair to obtain the access ciphertext, the processor executes the at least one computer Readable instructions to implement the following steps:

Calculate the instruction quantity of the access instruction, and detect whether the instruction quantity is greater than the configuration value;

If the number of instructions is greater than the configuration value, divide the access instructions according to the configuration value to obtain a plurality of instruction blocks, and each instruction block includes the access instructions in the number of the configuration value;

Encrypting the multiple instruction blocks in parallel to obtain multiple sub-ciphertexts corresponding to the multiple instruction blocks;

The multiple sub-ciphertexts are spliced to obtain the access ciphertext.
A computer-readable storage medium, wherein the computer-readable storage medium stores at least one computer-readable instruction, and the at least one computer-readable instruction implements the following steps when executed by a processor:

When receiving the access requirement sent by the client, generate a first key pair corresponding to the client according to the access requirement, and send the first public key in the first key pair to the client end;

receiving a data acquisition request generated by the client based on the first public key, and verifying the data acquisition request by using the private key in the first key pair;

If the verification of the data acquisition request by the private key is successful, determine the system to be accessed from the data acquisition request, and acquire a second key pair corresponding to the system to be accessed;

Obtain an access instruction from the data acquisition request, and encrypt the access instruction with the second public key in the second key pair to obtain an access ciphertext;

Send the access ciphertext to the system to be accessed.
16. The storage medium of claim 15, wherein, when the first key pair corresponding to the client is generated according to the access requirement, the at least one computer-readable instruction is executed by a processor to implement the following: step:

obtaining a permission list, where the device information of multiple devices is stored in the permission list, and the multiple devices have the permission to access the business system, and the business system includes multiple systems connected to the server;

Detecting whether the client exists in the permission list;

If the client exists in the permission list, determine the serial number of the client in the permission list;

generating a first random number with the number of digits being the serial number, and generating a second random number with the number of digits being the serial number;

The first key pair is generated according to the first random number and the second random number.
17. The storage medium of claim 16, wherein the at least one computer-readable instruction is executed by a processor when the first key pair is generated from the first random number and the second random number Execute to achieve the following steps:

detecting whether the first random number is a prime number, and detecting whether the second random number is a prime number;

When both the first random number and the second random number are prime numbers, calculating the product of the first random number and the second random number to obtain a target value;

calculating the least common multiple of the first random number and the second random number;

generating a first candidate value greater than a preset value and less than the least common multiple, and determining the greatest common divisor of the first candidate value and the least common multiple;

When the greatest common divisor is the preset value, the first candidate value is determined as the first value, and the target value and the first value are concatenated to obtain the first key pair in the public key;

generating a second candidate value greater than the preset value and less than the least common multiple, and performing a remainder operation on the product of the second candidate value and the first value and the least common multiple to obtain a remainder;

When the remainder is the preset value, the second candidate value is determined as the second value, and the target value and the second value are concatenated to obtain the private key in the first key pair .
16. The storage medium of claim 15, wherein before receiving a data acquisition request generated by the client based on the first public key, the at least one computer-readable instruction is executed by a processor to implement the following steps:

Obtain the first sending address of the access request, and obtain the second sending address of the data acquisition request;

Detecting whether the second sending address is the same as the first sending address;

If the second sending address is the same as the first sending address, receive the data acquisition request.
16. The storage medium of claim 15, wherein the at least one computer-readable instruction is executed by a processor upon verification of the data acquisition request using a private key in the first key pair to achieve the following steps:

Decrypt the data acquisition request by using the private key to obtain decryption information;

Detecting whether the decrypted information is garbled;

If the decryption information is not garbled, it is determined that the verification of the data acquisition request by the private key is successful.
The storage medium of claim 15, wherein when the access instruction is encrypted with the second public key in the second key pair to obtain an access ciphertext, the at least one computer-readable instruction is The processor performs the following steps:

Calculate the instruction quantity of the access instruction, and detect whether the instruction quantity is greater than the configuration value;

If the number of instructions is greater than the configuration value, divide the access instructions according to the configuration value to obtain a plurality of instruction blocks, and each instruction block includes the access instructions in the number of the configuration value;

Encrypting the multiple instruction blocks in parallel to obtain multiple sub-ciphertexts corresponding to the multiple instruction blocks;

The multiple sub-ciphertexts are spliced to obtain the access ciphertext.