CN115134144A - Enterprise-level business system authentication method, device and system - Google Patents

Abstract

The application provides an enterprise-level business system authentication method, device and system, relates to the technical field of information authentication, can be used in the financial field, and comprises the following steps: receiving client login request authentication information sent by a service system server, verifying the login request, and returning a login page to a client browser terminal after the verification is passed; receiving account password information submitted by a client and carrying out validity verification on the client; and after the validity verification is passed, account number associated information of the multi-service system of the client is extracted, the account number associated information is encrypted and then sent to a service system server, and the service system server opens a transaction page for the client after the decryption verification is passed. According to the method and the system, the transaction function and the authentication function are decoupled by the plurality of service systems, and the authentication function is converged to the authentication server, so that the independence of the authentication system is enhanced, the module division and the responsibility are relatively clear, the influence of the change of the module on the transaction of other partner systems is minimized, and the flexibility of the service is ensured.

Description

Enterprise-level business system authentication method, device and system

technical field

The present application relates to the technical field of information authentication, which can be used in the financial field, and in particular, relates to an enterprise-level business system authentication method, device and system.

Background technique

At present, banks have more and more business systems for corporate customers, such as corporate online banking, corporate mobile banking, Ronge shopping B2B shopping malls, Ronge shopping merchant centers, and Rong e-link service management platforms. If a current enterprise customer needs to use the functions of a business system, they need to register user information in the current business system by the following methods: first open the business system page, enter the group name, business license or organization code, insert the u shield, mobile phone number, enter SMS verification code and other trusted authentication elements to complete the registration of the current business system. When the enterprise customer wants to use the function on another business system, it needs to go to another system and repeat the registration process again. This leads to the following problems in the current enterprise-level business system authentication: (1) When an enterprise customer uses the new system, the customer information needs to be re-registered for use, and the registration process is cumbersome. (2) Customers need to log in again when switching between multiple business systems, and the process of switching and logging in is cumbersome. (3) The customer needs to manage the user information of multiple business systems separately, and the management is complicated. (4) When the bank launched the system, its existing customer base could not quickly expand to the customers of the target new system. (5) The customer authentication information and basic customer information are coupled with the customer's business system information and authority information, and the scalability is poor. (6) The registration and authentication information of different business systems are managed by divisions, but the business tends to share information, which increases the complexity of the system.

SUMMARY OF THE INVENTION

In view of this, the present invention provides an enterprise-level business system authentication method, apparatus and system, which are used to solve at least one of the problems mentioned above.

In order to achieve the above object, the present invention adopts the following scheme:

According to a first aspect of the present invention, an enterprise-level business system authentication method is provided. The method includes: receiving authentication information of a client login request sent by a business system server; After the login request is verified, return the login page to the client browser; receive the account password information submitted by the client based on the login page; verify the validity of the client according to the account password information; After the verification is passed, the account association information of the multi-service system of the customer is extracted, and the account association information is encrypted and sent to the business system server, and the business system server opens the business for the customer after passing the decryption and verification. System transaction page.

According to a second aspect of the present invention, an enterprise-level business system authentication device is provided, the device includes: a first receiving unit for receiving authentication information of a client login request sent by a business system server; a login verification unit for The client login request authentication information is used to verify the login request, and in response to the login request passing the verification, a login page is returned to the client browser; the second receiving unit is configured to receive the account password information submitted by the client based on the login page; an account verification unit, configured to perform legality verification on the client according to the account password information; a log-in feedback unit, configured to extract the account associated information of the client's multi-service system in response to passing the legality verification, and The account associated information is encrypted and sent to the business system server, and the business system server opens the business system transaction page for the client after decryption and verification are passed.

According to a third aspect of the present invention, an enterprise-level business system authentication system is provided, the system includes: a client, a business system server and an authentication server, wherein the client is respectively connected in communication with the business system server and the authentication server, The business system server and the authentication server are connected in communication, and the authentication server includes the enterprise-level business system authentication device described above.

According to a fourth aspect of the present invention, there is provided an electronic device including a memory, a processor, and a debug program stored on the memory and executable on the processor, the processor implements the debug program when the processor executes the debug program The steps of the above enterprise-level business system authentication method.

According to a fifth aspect of the present invention, there is provided a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the above-mentioned enterprise-level business system authentication method.

According to a sixth aspect of the present invention, a computer program product is provided, comprising computer programs/instructions, which implement the steps of the above enterprise-level business system authentication method when the computer program/instructions are executed by a processor.

The enterprise-level business system authentication method, device, and system provided by the embodiments of the present invention decouple the transaction function and the authentication function from multiple business systems, and integrate the authentication function into the authentication server, thereby enhancing the independence of the authentication system. The module division and responsibilities are relatively clear, and the changes of the module itself will minimize the impact on the system transactions of other partners, which ensures the flexibility of the business.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts. In the attached image:

1 is a schematic flowchart of an enterprise-level business system authentication method provided by an embodiment of the present application;

FIG. 2 is a detailed flowchart of an enterprise-level business system authentication method provided by an embodiment of the present application;

3 is a schematic structural diagram of an enterprise-level business system authentication device provided by an embodiment of the present application;

4 is a schematic diagram of the composition of an enterprise-level business system authentication system provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention more clearly understood, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but not to limit the present invention.

It should be noted that an enterprise-level business system authentication method, device and system disclosed in this application can be used in the financial field, and can also be used in any field except the financial field. The application field of the device and system is not limited.

The following first briefly introduces some technical terms in the art involved in this application:

Term "SM4": is a block cipher algorithm commonly used in areas such as wireless Internet encryption.

Term "SM2": A public key algorithm whose encryption strength is 256 bits.

FIG. 1 is a schematic flowchart of an enterprise-level business system authentication method provided in an embodiment of the present application. The implementation subject of this embodiment is an authentication server. In specific implementation, the functions of the authentication server can be integrated into existing It can be implemented in the enterprise electronic communication certificate server, which can save the hardware cost of development. The method includes the following steps:

S101: Receive the authentication information of the client login request sent by the business system server.

In this embodiment, when the client initiates registration and account login through the browser, for example, clicks the registration and login buttons on the browser page, after the business system server receives the click message, it will send a client to the authentication server. Login to request authentication information.

Preferably, the login request authentication information in this step may be uploaded by the service system server in the form of interface request message information, and the login request authentication information may include: interface request message information after symmetric encryption by SM4, valid Timestamp and SM2 private key signature. Through the encrypted transmission of the national secret algorithm SM4 and SM2, the authentication information of the login request can be effectively prevented from being tampered with, and the effective time stamp can prevent the authentication information of the login request from being reused, which can protect the effective operation of the system.

S102: Perform login request verification according to the client login request authentication information, and return a login page to the client browser in response to passing the login request verification.

In this embodiment, the authentication of the login request may be performed according to the rules agreed between the service system server and the authentication server. For example, when the authentication information of the login request includes the interface request message information after symmetric encryption by SM4, the valid timestamp When signing with the SM2 private key, the login request verification can include the following methods: decrypt the interface packet information in the authentication information of the client login request according to the agreed symmetric key SM4, and use the SM2 public key reserved by the business system to verify sign.

When the login request is verified, the authentication center can directly return the login page to the client's browser without going through the business system to process the server, which shortens the system response time and avoids affecting the customer's experience due to excessive response time.

S103: Receive account password information submitted by the customer based on the login page.

S104: Perform legality verification on the client according to the account password information.

Preferably, in this step, the legality of the customer can be verified by comparing the account password information with the inventory information for consistency.

S105: In response to passing the legality verification, extract the account associated information of the customer's multi-service system, encrypt the account associated information and send it to the business system server, and the business system server decrypts and verifies that the pass is passed Then open the business system transaction page for the customer.

In this embodiment, an enterprise customer only needs one account in multiple business systems, and the staff can enter the account information into the authentication server by signing a unified access agreement at the counter. Therefore, the account association information in this embodiment is The following information may be included: information of the corresponding business system for account opening, and permission information of the account in the corresponding business system, and the like. In addition, if corporate customers have registered one or more business system accounts through the registration page, they can also sign a unified access agreement at the counter and reserve one of the accounts to activate other required business system login permissions. Through the association of multiple business system accounts in the authentication server, the authentication functions of the business system can be integrated together to improve the customer experience.

Preferably, in this step, encrypting the account associated information and sending it to the business system server may include: generating a unified token using SM4 symmetric encryption for the account associated information, and attaching a valid timestamp and an SM2 private key The signature is sent to the business system server together. Correspondingly, the decryption and verification of the business system server in this step includes: after the business system server decrypts with the symmetric key SM4 agreed upon by both parties, and then uses the SM2 public key to verify the signature.

Preferably, in this step, after receiving the unified token, the business system server may also perform an integrity check on the unified token after the token is restored, and if the integrity check fails, notify the authentication server to re-check Send a unified token. As can be seen from the above description, this embodiment adopts the two-way authentication based on the national secret unified token to ensure the integrity and consistency of the storage, transmission and verification of user information, and avoid the risk of unauthorized tampering of information.

In order to illustrate the present application more clearly, the method flow of the present application will be further described below with reference to FIG. 2 . FIG. 2 shows a detailed schematic flow chart of an enterprise-level business system authentication method provided by an embodiment of the present application, and the method includes the following Step process: the client browser initiates a login request authentication to the business system server; after the business system server receives the request, it sends the client login request authentication information to the enterprise electronic pass server by performing SM4 encryption and SM2 signature on the interface information; After receiving the login request interface information, the electronic pass server parses the interface information message, obtains the appid, ciphertext and signature, and then performs SM4 decryption according to the corresponding symmetric key, and performs the public key SM2 signature verification on the content. , open the authentication service page in the client browser page for the client; the client browser enters the account password in the authentication service page to log in, the account password information is sent to the enterprise electronic pass server through the network; the enterprise electronic pass server receives the After the account and password information, verify its validity. After the verification is passed, extract the account associated information of the customer's multi-service system, and use SM4 encryption and SM2 signature for the account associated information to generate a unified token and send it to the business system. Server; the business system server restores the received token and checks the integrity of the token. After the integrity check is passed, it continues to use the symmetric key for SM4 decryption, and performs the public key SM2 signature verification on the content, and the signature verification is passed. After that, open the business system transaction page for the client browser for the client to operate.

To sum up, the enterprise-level business system authentication method provided by the embodiment of the present invention enhances the independence of the authentication system by decoupling the transaction function and the authentication function from multiple business systems, and integrating the authentication function into the authentication server. , the module division and responsibilities are relatively clear, and the change of the module itself minimizes the impact on other partners' system transactions, ensuring the flexibility of the business.

FIG. 3 is a schematic structural diagram of an enterprise-level business system authentication device provided in an embodiment of the present application. The device includes a first receiving unit 310, a login verification unit 320, a second receiving unit 330, an account verification unit 340, and a In the login feedback unit 350, the first receiving unit 310 is connected with the login verification unit 320, and the account verification unit 340 is connected with the second reception unit 330 and the login feedback unit 350, respectively.

The first receiving unit 310 is configured to receive the authentication information of the client login request sent by the service system server.

Preferably, the authentication information of the client login request includes the interface request message information, the valid time stamp and the SM2 private key signature after symmetric encryption by SM4.

The login verification unit 320 is configured to verify the login request according to the authentication information of the client login request received by the first receiving unit 310, and return a login page to the client browser in response to the authentication of the login request being passed.

Preferably, the login request verification performed by the login verification unit 320 on the client login request authentication information may specifically include: decrypting the interface packet information in the client login request authentication information according to the agreed symmetric key SM4, and using the service system reserved SM2 public key verification.

The second receiving unit 330 is configured to receive the account password information submitted by the customer based on the login page.

The account verification unit 340 is configured to perform legality verification on the client according to the account password information received by the second receiving unit 330 .

Preferably, the account verification unit 340 performing legality verification on the customer according to the account password information may specifically include: comparing the account password information with inventory information for consistency to perform legality verification on the customer.

The login feedback unit 350 is configured to extract the account association information of the multi-service system of the customer in response to the passing of the legality verification, and encrypt the account association information and send it to the service system server, where the service system After passing the decryption and verification, the server opens the business system transaction page for the client.

Preferably, the account association information includes information about the corresponding business system opened by the account and information about the authority of the account in the corresponding business system.

Preferably, the login feedback unit 350 encrypts the account association information and sends it to the business system server, which may specifically include: generating a unified token by using SM4 symmetric encryption for the account association information, and attaching a valid valid timestamp and SM2 The private key signature is sent to the business system server together.

Correspondingly, the business system server decryption and verification includes: after the business system server decrypts with the symmetric key SM4 agreed upon by both parties, and then uses the SM2 public key to verify the signature.

After receiving the unified token, the preferred business system server may also perform an integrity check on the unified token, and if the integrity check fails, notifies the authentication server to resend the unified token.

For detailed descriptions of the above units, reference may be made to the corresponding descriptions in the foregoing method embodiments, which will not be repeated here.

The enterprise-level business system authentication device provided by the embodiment of the present invention decouples the transaction function and the authentication function from multiple business systems, and integrates the authentication function into the authentication server, thereby enhancing the independence of the authentication system, and the division of modules and responsibilities. Relatively clear, the change of the module itself minimizes the impact on the system transactions of other partners, ensuring the flexibility of the business. In addition, due to the use of the two-way authentication based on the national secret unified token, the integrity and consistency of the storage, transmission and verification of user information can be guaranteed, and the risk of unauthorized tampering of information can be avoided.

FIG. 4 is a schematic diagram of the composition of an enterprise-level business system authentication system provided by an embodiment of the present application. The system includes: a client 401, a business system server 402, and an authentication server 403. The client 401 and the business system server 402 are respectively The authentication server 403 is connected in communication with the authentication server 403, and the service system server 402 and the authentication server 403 are communicatively connected, and the authentication server 403 includes the enterprise-level service system authentication device as described above.

In the enterprise-level business system authentication system provided by the embodiment of the invention, by decoupling the transaction function and the authentication function from multiple business systems, the authentication function is integrated into the authentication server, so that the independence of the authentication system is enhanced, and the module division and responsibilities are relatively relative. Clearly, the change of the module itself minimizes the impact on the system transactions of other partners, which ensures the flexibility of the business. In addition, due to the use of the two-way authentication based on the national secret unified token, the integrity and consistency of the storage, transmission and verification of user information can be guaranteed, and the risk of unauthorized tampering of information can be avoided.

FIG. 5 is a schematic diagram of an electronic device provided by an embodiment of the present invention. The electronic device shown in FIG. 5 is a general-purpose data processing apparatus, which includes a general-purpose computer hardware structure, which at least includes a processor 501 and a memory 502 . The processor 501 and the memory 502 are connected by a bus 503 . Memory 502 is adapted to store one or more instructions or programs executable by processor 501 . The one or more instructions or programs are executed by the processor 501 to implement the steps in the enterprise-level business system authentication method.

The above-mentioned processor 501 may be an independent microprocessor, or may be a set of one or more microprocessors. Thus, the processor 501 executes the commands stored in the memory 502 to execute the above-described method flow of the embodiments of the present invention to process data and control other devices. The bus 503 connects the above-mentioned various components together, while connecting the above-mentioned components to the display controller 504 and the display device and the input/output (I/O) device 505 . The input/output (I/O) device 505 may be a mouse, a keyboard, a modem, a network interface, a touch input device, a somatosensory input device, a printer, and other devices known in the art. Typically, input/output (I/O) devices 505 are connected to the system through input/output (I/O) controllers 506 .

Among them, the memory 502 may store software components, such as an operating system, a communication module, an interaction module, and an application program. Each of the modules and applications described above corresponds to a set of executable program instructions that perform one or more functions and methods described in embodiments of the invention.

Embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the above enterprise-level business system authentication method.

Embodiments of the present invention further provide a computer program product, including computer programs/instructions, when the computer program/instructions are executed by a processor, the steps of the above-mentioned enterprise-level business system authentication method are implemented.

To sum up, the enterprise-level business system authentication method, device, and system provided by the embodiments of the present invention can decouple the transaction function and the authentication function from multiple business systems, and integrate the authentication function into the authentication server, so that the The independence of the authentication system is enhanced, the division of modules and responsibilities are relatively clear, and changes in the modules themselves have minimal impact on other partners' system transactions, ensuring business flexibility. In addition, due to the use of the two-way authentication based on the national secret unified token, the integrity and consistency of the storage, transmission and verification of user information can be guaranteed, and the risk of unauthorized tampering of information can be avoided.

The preferred embodiments of the present invention have been described above with reference to the accompanying drawings. The many features and advantages of these embodiments are apparent from this detailed description, and the appended claims are therefore intended to cover all such features and advantages of these embodiments as fall within their true spirit and scope. Furthermore, since many modifications and changes will readily occur to those skilled in the art, the embodiments of the present invention are not intended to be limited to the precise construction and operation illustrated and described, but are intended to cover all suitable modifications and equivalents falling within the scope thereof thing.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above-mentioned specific embodiments are only specific embodiments of the present invention, and are not intended to limit the scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (12)

1. an enterprise-level business system authentication method, is characterized in that, comprises: Receive the authentication information of the client login request sent by the business system server; Perform login request verification according to the client login request authentication information, and return a login page to the client browser in response to passing the login request verification; Receive the account password information submitted by the customer based on the login page; Verify the legitimacy of the customer according to the account and password information; In response to passing the legality verification, extract the account associated information of the client's multi-service system, and encrypt the account associated information and send it to the business system server, which is decrypted and verified by the business system server. The customer opens the business system transaction page. 2 . The enterprise-level business system authentication method according to claim 1 , wherein the authentication information of the client login request comprises: interface request message information after symmetric encryption by SM4, valid time stamp and SM2 private key signature. 3 . 3. The enterprise-level business system authentication method according to claim 2, wherein the performing login request verification according to the client login request authentication information comprises: Decrypt the interface packet information in the authentication information of the client login request according to the agreed symmetric key SM4, and use the SM2 public key reserved by the service system to verify the signature. 4. The enterprise-level business system authentication method according to claim 1, characterized in that, performing legality verification on the customer according to the account password information comprises: performing consistency between the account password information and inventory information The comparison is used to verify the legitimacy of the client. 5. The enterprise-level business system authentication method according to claim 1, wherein, Encrypting the account association information and sending it to the business system server includes: generating a unified token using SM4 symmetric encryption for the account association information, and attaching a valid timestamp and an SM2 private key signature to send to the business system server; The business system server decryption and verification includes: after the business system server decrypts with the symmetric key SM4 agreed upon by both parties, and then uses the SM2 public key to verify the signature. 6. The enterprise-level business system authentication method according to claim 5, wherein after receiving the unified token, the business system server performs an integrity check on the unified token. If the verification fails, notify the authentication server to resend the unified token. 7 . The enterprise-level business system authentication method according to claim 5 , wherein the account association information includes the corresponding business system information opened by the account and the authority information of the account in the corresponding business system. 8 . 8. An enterprise-level business system authentication device, comprising: a first receiving unit, configured to receive the authentication information of the client login request sent by the business system server; a login verification unit, configured to verify the login request according to the authentication information of the client login request, and return a login page to the client browser in response to the verification of the login request being passed; a second receiving unit, configured to receive the account password information submitted by the customer based on the login page; an account verification unit, configured to perform legality verification on the customer according to the account password information; The login feedback unit is used to extract the account associated information of the multi-service system of the customer in response to the passing of the legality verification, and encrypt the account associated information and send it to the business system server, and the business system After passing the decryption and verification, the server opens the business system transaction page for the client. 9. An enterprise-level business system authentication system, characterized in that the system comprises: a client, a business system server and an authentication server, wherein the client is respectively connected to the business system server and the authentication server in communication, and the The business system server and the authentication server are communicatively connected, and the authentication server includes the enterprise-level business system authentication device according to claim 8 . 10. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the processor implements claim 1 when the processor executes the computer program Steps of any one of to 7 of the enterprise-level business system authentication method. 11 . A computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the enterprise-level business system authentication method according to any one of claims 1 to 7 are implemented. 12 . 12. A computer program product, comprising computer programs/instructions, wherein when the computer program/instructions are executed by a processor, the steps of the enterprise-level business system authentication method according to any one of claims 1 to 7 are implemented.

Images