WO2020001455A1 - 基于CPK的Linux操作***登录认证方法、设备、终端及服务器 - Google Patents

基于CPK的Linux操作***登录认证方法、设备、终端及服务器 Download PDF

Info

Publication number
WO2020001455A1
WO2020001455A1 PCT/CN2019/092925 CN2019092925W WO2020001455A1 WO 2020001455 A1 WO2020001455 A1 WO 2020001455A1 CN 2019092925 W CN2019092925 W CN 2019092925W WO 2020001455 A1 WO2020001455 A1 WO 2020001455A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
cpk
key device
time
password
Prior art date
Application number
PCT/CN2019/092925
Other languages
English (en)
French (fr)
Inventor
李维刚
Original Assignee
晋商博创（北京）科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 晋商博创（北京）科技有限公司 filed Critical 晋商博创（北京）科技有限公司
Publication of WO2020001455A1 publication Critical patent/WO2020001455A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present invention relates to the technical field of computers and information security, and in particular to a CPK-based Linux operating system login authentication method, device, terminal, and server.
  • the purpose of the embodiments of the present invention is to provide a CPK-based Linux operating system login authentication method, device, terminal, and server, which solves the problem of obtaining operating system passwords through network attacks in the prior art to obtain access control rights.
  • the technology realizes the login security authentication of the Linux operating system.
  • an embodiment of the present invention provides a CPK-based Linux operating system login authentication method, which is applied to a terminal.
  • the method includes obtaining a CPK key device's user identifier to be authenticated, and Send the user ID to the Linux server; obtain the password of the CPK key device, and send the password and the time to be signed by the terminal to the CPK key device; receive the signature information sent by the CPK key device, and send The signature information is sent to the Linux server, so that the Linux server performs login authentication through the signature information, and the signature information includes a digital signature of the time to be signed by the terminal and a user corresponding to the CPK key device.
  • obtaining the password of the CPK key device, and sending the password and the time to be signed by the terminal to the CPK key device includes: when receiving the prompt sent by the Linux server, entering the password of the CPK key device At this time, a password entry interface is displayed; the password of the CPK key device is obtained, and the password and the time to be signed by the terminal are sent to the CPK key device.
  • the method further includes: when receiving a notification of a password verification error sent by the CPK key device, continuing The password entry interface is displayed.
  • an embodiment of the present invention also provides a CPK-based Linux operating system login authentication method.
  • the method is applied to a CPK key device.
  • the method includes: receiving a password of the CPK key device sent by the terminal and the terminal to be signed. Time; verify whether the password is correct; when verifying that the password is correct, digitally sign the terminal to be signed with a preset private key to obtain signature information and send the signature information to the terminal so that The terminal sends the signature information to a Linux server for login authentication.
  • the terminal to be signed time sent by the receiving terminal includes: receiving the password of the CPK key device and the terminal to be signed time sent by the terminal; verifying the password, and verifying the password to the The terminal sends a notification that the password verification is correct; when the password verification is incorrect, sends a notification of the password verification error to the terminal.
  • an embodiment of the present invention also provides a CPK-based Linux operating system login authentication method.
  • the method is applied to a Linux server.
  • the method includes: receiving a user identifier to be authenticated sent by the terminal, and determining the standby Verifying whether the user ID exists in the legal user information of the Linux operating system; after determining that the user ID to be authenticated exists in the legal user information of the Linux operating system, receiving the signature information sent by the terminal, and
  • the signature information performs login authentication, and the signature information includes a digital signature of a terminal to be signed and a user identifier corresponding to the CPK key device.
  • the method further includes: sending a password prompting the CPK key device to the terminal.
  • the time to be signed and the user ID corresponding to the CPK key device perform login authentication; when c and c ′ are different, it is determined that the login of the user ID to be authenticated fails.
  • the performing login authentication according to the time to be signed by the terminal and the user identifier corresponding to the CPK key device includes: determining a time difference between the local time of the Linux operating system and the time to be signed by the terminal; and judging Whether the time difference is less than or equal to a preset time; and when the time difference is less than or equal to the preset time, determining whether a user identifier corresponding to the CPK key device is consistent with the user identifier to be authenticated; When the user identifier corresponding to the CPK key device is consistent with the user identifier to be authenticated, it is determined that the login of the user identifier to be authenticated is successful.
  • the method further includes determining that the login of the user ID to be authenticated fails when the time difference is greater than the preset time.
  • the method further comprises: when the user identifier corresponding to the CPK key device is inconsistent with the user identifier to be authenticated, determining that the user identifier to be authenticated fails to log in.
  • an embodiment of the present invention further provides a terminal, which is configured to execute the CPK-based Linux operating system login authentication method described above.
  • an embodiment of the present invention further provides a CPK key device, where the CPK key device is configured to execute the CPK-based Linux operating system login authentication method described above.
  • an embodiment of the present invention further provides a Linux server, which is configured to execute the CPK-based Linux operating system login authentication method described above.
  • the CPK key device and the software and hardware of the terminal to be signed are combined with the authentication system, and the digital signature technology of the public key system is integrated into the authentication process, which realizes CPK-based security authentication and improves the login of the Linux operating system.
  • Security solves the problem of obtaining the operating system password through network attacks in the prior art to obtain access control rights.
  • FIG. 1 is a schematic block diagram of a CPK-based Linux operating system login authentication method according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a CPK-based Linux operating system login authentication method according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of another CPK-based Linux operating system login authentication method according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of another CPK-based Linux operating system login authentication method according to an embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a CPK-based Linux operating system login authentication method according to an embodiment of the present invention.
  • the security authentication of the Linux operating system is implemented by digital signature technology.
  • the digital signature is provided by the CPK combined public key system.
  • CPK is an identity-based public key system.
  • the identity is Alice
  • Alice's public and private keys are: the identity is transformed into a series of random number sequences by Hash transformation, the random number sequence is used as the coordinates of the matrix, and the variables on the 32 coordinates are accumulated respectively for the public and private key.
  • the public key matrix (R i, j ) is set in the Linux server in advance, as long as the ID is known, the public key can be calculated, while the private key matrix (r i, j ) only exists in the key center, and the private key is in the CPK Key device storage.
  • the user uses a CPK key device for authentication, the user uses the user ID corresponding to the CPK key device to apply for a private key from a key center, so that the key center writes the private key into the CPK secret through a security protocol. Key device.
  • PAM Pluggable Authentication Modules, Pluggable Authentication Modules
  • the CPK security authentication module is set in the pluggable authentication module of the Linux operating system.
  • the public key matrix and other configuration files that the CPK security authentication module relies on are deployed in the specified path, the PAM configuration file of the Linux operating system is modified, and the original default authentication module is cancelled, so that the operating system can be used directly when performing operating system login authentication.
  • the CPK security authentication module is used for authentication, and the Selinux module of the Linux operating system needs to be set to the ON state to ensure that only the CPK key device can be used to log in to the Linux operating system.
  • the system authentication application program interface is a communication interface between an application program that requires an authentication service and an authentication mechanism that provides an authentication service, and is the entrance to a secure channel for an application program in the Linux operating system.
  • the CPK security authentication module is included in the Linux operating system, the security authentication of multiple applications at the upper application layer can be implemented. Only the configuration of the interface layer can be used to flexibly add the CPK security authentication mechanism for an application. Therefore, in the embodiment of the present invention, not only the secure login authentication of the Linux operating system, but also the secure authentication of multiple applications, it is only necessary to configure the applications that need to implement secure authentication in the configuration file.
  • the Linux server mentioned in the embodiment of the present invention may be a remote server or a local server.
  • FIG. 2 is a schematic flowchart of a CPK-based Linux operating system login authentication method according to an embodiment of the present invention. As shown in FIG. 2, the method is applied to a terminal, and the method includes the following steps:
  • Step 201 Obtain a user identifier to be authenticated of a CPK key device, and send the user identifier to be authenticated to the Linux server;
  • Step 202 Obtain a password of the CPK key device, and send the password and the time to be signed by the terminal to the CPK key device;
  • Step 203 Receive signature information sent by the CPK key device, and send the signature information to the Linux server, so that the Linux server performs login authentication through the signature information, and the signature information includes the signature information.
  • the terminal can obtain the user identifier to be authenticated of the CPK key device, and then sends the user identifier to be authenticated to the terminal.
  • the Linux server After a user inserts a CPK key device into the terminal, the terminal can obtain the user identifier to be authenticated of the CPK key device, and then sends the user identifier to be authenticated to the terminal.
  • the Linux server After a user inserts a CPK key device into the terminal, the terminal can obtain the user identifier to be authenticated of the CPK key device, and then sends the user identifier to be authenticated to the terminal.
  • step 202 when receiving the prompt for the password of the CPK key device sent by the Linux server, a password entry interface is displayed; the password of the CPK key device is obtained, and the password and the time to be signed by the terminal are sent to The CPK key device.
  • the password entry interface continues to be displayed.
  • the CPK key device and password are used for two-factor authentication, even if the password is leaked, it does not matter, because the device cannot log in to the Linux operating system without the CPK key device, which effectively prevents network attacks and makes the most commonly used network attack means.
  • Complete failure which solves the problem of obtaining operating system passwords through network attacks in the prior art to obtain access control rights, implements CPK-based security authentication, and improves login security of the Linux operating system.
  • FIG. 3 is a schematic flowchart of a CPK-based Linux operating system login authentication method according to an embodiment of the present invention. As shown in FIG. 3, the method is applied to a CPK key device, and the method includes the following steps:
  • Step 301 Receive the password of the CPK key device and the time to be signed by the terminal from the terminal.
  • Step 302 verify whether the password is correct
  • Step 303 When verifying that the password is correct, digitally sign the terminal to be signed with a preset private key, obtain signature information, and send the signature information to the terminal, so that the terminal can The signature information is sent to the Linux server for login authentication.
  • the preset private key of the user ID corresponding to the CPK key device is stored in the CPK key device, so that the preset private key can be used to digitally sign the time to be signed by the terminal in step 302.
  • the signature information specifically:
  • SIG is a signature function
  • alice is a preset private key of the CPK key device
  • time is the time to be signed by the terminal
  • s is the signature code
  • c is the verification code
  • sign is used to mark (s, c).
  • the signature information is obtained, so that the Linux server verifies the terminal to be signed in the signature information, that is, a terminal is registered for each login.
  • Digitally signing at the time of signing solves the problem of obtaining operating system passwords through network attacks in the prior art to obtain access control rights, implements CPK-based security authentication, and improves login security of the Linux operating system.
  • FIG. 4 is a schematic flowchart of a CPK-based Linux operating system login authentication method according to an embodiment of the present invention. As shown in FIG. 4, the method is applied to a Linux server, and the method includes the following steps:
  • Step 401 Receive a user identifier to be authenticated sent by the terminal, and determine whether the user identifier to be authenticated exists in legal user information of the Linux operating system;
  • Step 402 After determining that the user identifier to be authenticated exists in the legal user information of the Linux operating system, receive signature information sent by the terminal, and perform login authentication according to the signature information.
  • the signature information includes The digital signature of the time to be signed by the terminal and the user ID corresponding to the CPK key device.
  • the Linux server After determining that the user ID to be authenticated exists in the legal user information of the Linux operating system, the Linux server sends a password prompting the CPK key device to the terminal.
  • the signature information data ⁇ alice, time, sign ⁇ is received, where alice is the user ID corresponding to the CPK key device, time is the time to be signed by the terminal, and sign is used to mark (s, c), s is the signature code, and c is the verification code.
  • login authentication is performed according to the time to be signed by the terminal and the user ID corresponding to the CPK key device, and when c and c 'are not the same, it is determined The login of the user to be authenticated fails.
  • performing login authentication according to the time to be signed by the terminal and the user ID corresponding to the CPK key device includes: determining the local time of the Linux operating system and the time to be signed by the terminal. Time difference, and determine whether the time difference is less than or equal to a preset time, and when the time difference is less than or equal to the preset time, determine whether a user identifier corresponding to the CPK key device is the same as the The user identifiers to be authenticated are consistent, and when the user identifier corresponding to the CPK key device is consistent with the user identifiers to be authenticated, it is determined that the login of the user identifiers to be authenticated is successful. That is, it is determined whether the received user identifier to be authenticated is consistent with the user identifier corresponding to the CPK key device when the login authentication is started, thereby ensuring that the two are the same user.
  • the time difference is greater than the preset time, it is determined that the login of the user ID to be authenticated fails.
  • the user identifier corresponding to the CPK key device is inconsistent with the user identifier to be authenticated, it is also determined that the login of the user identifier to be authenticated fails.
  • the public key matrix is stored in the Linux server. After obtaining the user ID corresponding to the CPK key device, the public key matrix can be used to obtain the preset public key corresponding to the user ID.
  • signature information is obtained, and the Linux server verifies the terminal to be signed in the signature information, that is, a terminal standby is generated for each login.
  • the signature time realizes the dynamic change of login credentials.
  • the comparison of the terminal's time to be signed with the system time can solve the problem of replay attacks.
  • Digital signature technology is used to realize the security authentication of the Linux operating system, which solves the problems of easy guessing and interception of static passwords.
  • FIG. 5 is a schematic flowchart of a CPK-based Linux operating system login authentication method according to an embodiment of the present invention. As shown in FIG. 5, the method includes the following steps:
  • Step 501 The terminal obtains a user identifier to be authenticated of the CPK key device, and sends the user identifier to be authenticated to the Linux server.
  • Step 502 The Linux server receives the user identifier to be authenticated, and determines whether the user identifier to be authenticated exists in the legal user information of the Linux operating system, and if so, executes step 503, and otherwise returns to step 501;
  • Step 503 Send a password prompting to the CPK key device to the terminal;
  • Step 504 The terminal receives the password prompting for the CPK key device, and displays a password entry interface.
  • Step 505 The terminal obtains the password of the CPK key device, and sends the password and the time to be signed by the terminal to the CPK key device.
  • Step 506 The CPK key device receives the password of the CPK key device and the time to be signed by the terminal from the terminal;
  • Step 507 Verify that the password is correct.
  • the password is verified to be correct, execute step 508.
  • the password is verified to be incorrect, send a notification of the password verification error to the terminal and return to step 504.
  • Step 508 The CPK key device digitally signs the terminal to be signed using a preset private key, obtains signature information, and sends the signature information to the terminal.
  • Step 509 The terminal receives the signature information sent by the CPK key device, and sends the signature information to the Linux server.
  • Step 510 The Linux server receives the signature information sent by the terminal, and verifies the signature information. When the verification is passed, step 511 is performed, and if the verification fails, it is determined that the login of the user ID to be authenticated fails.
  • Step 511 Determine the time difference between the local time of the Linux operating system and the time to be signed by the terminal;
  • Step 512 determine whether the time difference is less than or equal to a preset time, and if step 513 is performed, if it is determined that the login of the user ID to be authenticated fails;
  • Step 513 Determine whether the user ID corresponding to the CPK key device is consistent with the user ID to be authenticated. If it is determined that the user ID to be authenticated is successfully logged in, and if it is determined that the user ID to be authenticated is failed to log in.
  • the digital signature technology is used to implement the security authentication of the operating system, and the problems of easy guessing and interception of static passwords are solved.
  • the CPK key device and password must be provided when logging in, and strong two-factor authentication is used, even if the password is leaked, you are not concerned. Effectively prevent network attacks. Devices without CPK keys cannot log in, making the commonly used network attack methods completely invalid.
  • the embodiment of the present invention also has a high degree of loose coupling and scalability, which not only supports the login of the Linux operating system, but also supports the login authentication of multiple applications, and only needs to modify the configuration file in the Linux operating system to achieve the CPK security of the application. Certified, no code modification required for applications.
  • an embodiment of the present invention further provides a terminal, which is configured to execute the CPK-based Linux operating system login authentication method applied to the terminal in the foregoing embodiment.
  • an embodiment of the present invention further provides a CPK key device, which is used to execute the CPK-based Linux operating system login authentication method applied to the CPK key device in the foregoing embodiment.
  • an embodiment of the present invention further provides a Linux server, which is configured to execute the CPK-based Linux operating system login authentication method applied to the Linux server in the foregoing embodiment.
  • the program is stored in a storage medium and includes a number of instructions to enable a microcontroller, a chip, or a processor. (processor) executes all or part of the steps of the method described in each embodiment of the present application.
  • the foregoing storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供一种基于CPK的Linux操作***登录认证方法、设备、终端及服务器，属于计算机和信息安全技术领域，解决了现有技术中网络攻击Linux操作***获得访问控制权的问题。所述方法包括获取CPK密钥设备的待认证用户标识，并将所述待认证用户标识发送给所述Linux服务器；获取CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备；接收所述CPK密钥设备发送的签名信息，并将所述签名信息发送给所述Linux服务器，以便所述Linux服务器通过所述签名信息进行登录认证，所述签名信息中包括所述终端待签名时间的数字签名以及所述CPK密钥设备对应的用户标识。本发明实施例适用于登录Linux操作***的认证过程。

Description

基于CPK的Linux操作***登录认证方法、设备、终端及服务器 技术领域
本发明涉及计算机和信息安全技术领域，具体地涉及一种基于CPK的Linux操作***登录认证方法、设备、终端及服务器。
背景技术
随着计算机和网络应用的发展，大量的Linux服务器被部署。而Linux服务器的日常维护和管理都需要管理员登录Linux操作***。传统的方式中管理员采用用户名和口令作为登录的用户凭证，这种方法存在很多安全风险，如简单口令易被攻击，口令易泄漏，口令不能真正确认用户的身份，口令过于复杂又不容易记忆。
而且现代的网络攻击多以猜测口令、暴力破解口令或网络劫持口令等手段非法获得操作***的访问控制权，一旦非法获得管理员控制权，则对***安全是毁灭性的。所以采用静态口令的认证方式，其安全强度是非常有限的，对于承载了企业重要数据的服务器操作***，增加操作***的安全性至关重要。
发明内容
本发明实施例的目的是提供一种基于CPK的Linux操作***登录认证方法、设备、终端及服务器，解决了现有技术中通过网络攻击获得操作***口令从而得到访问控制权的问题，通过数字签名技术实现了Linux操作***的登录安全认证。
为了实现上述目的，本发明实施例提供一种基于CPK的Linux操作***登录认证方法，所述方法应用于终端，所述方法包括获取CPK密钥设备的待认证用户标识，并将所述待认证用户标识发送给所述Linux服务器；获取CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备；接收所述CPK密钥设备发送的签名信息，并将所述签名信息发送给所述Linux服务器，以便所述Linux服务器通过所述签名信息进行登录认证，所述签名信息中包括所述终端待签名时间的数字签名以及所述CPK密钥设备对应的用户标识。
进一步地，所述获取CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备包括：当接收到所述Linux服务器发送的提示输入CPK密钥设备的口令时，显示口令录入界面；获取所述CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备。
进一步地，在所述将所述口令和终端待签名时间发送给所述CPK密钥设备之后，所述方法还包括：当接收到所述CPK密钥设备发送的口令验证错误的通知时，继续显示所述口令录入界面。
相应的，本发明实施例还提供一种基于CPK的Linux操作***登录认证方法，所述方法应用于CPK密钥设备，所述方法包括：接收终端发送的CPK密钥设备的口令和终端待签名时间；验证所述口令是否正确；当验证所述口令正确时，利用预设私钥对所述终端待签名时间进行数字签名，得到签名信息并将所述签名信息发送给所述终端，以便由所述终端将所述签名信息发送给Linux服务器进行登录认证。
进一步地，所述接收终端发送的终端待签名时间包括：接收所述终端发送的CPK密钥设备的口令和终端待签名时间；验证所述口令，并当验证所述口令正确时，向所述终端发送口令验证正确的通知；当验证所述口令错误时，向所述终端发送口令验证错误的通知。
进一步地，所述利用预设私钥对所述终端待签名时间进行数字签名，得到签名信息包括：根据SIG alice(time)＝(s,c)＝sign，得到签名数据data＝{alice,time,sign}，其中，SIG为签名函数，alice为所述CPK密钥设备的预设私钥，alice为所述CPK密钥设备对应的用户标识，time为所述终端待签名时间，s为签名码，c为验证码，sign用于标记(s,c)。
相应的，本发明实施例还提供一种基于CPK的Linux操作***登录认证方法，所述方法应用于Linux服务器，所述方法包括：接收所述终端发送的待认证用户标识，并确定所述待认证用户标识是否存在于所述Linux操作***的合法用户信息中；当确定所述待认证用户标识存在于所述Linux操作***的合法用户信息中之后，接收所述终端发送的签名信息，并根据所述签名信息进行登录认证，所述签名信息中包括终端待签名时间的数字签名以及CPK密钥设备对应的用户标识。
进一步地，当确定所述待认证用户标识存在于所述Linux操作***的合法用户信息中之后，所述方法还包括：向所述终端发送提示输入CPK密钥设备的口令。
进一步地，所述接收所述终端发送的签名信息，并根据所述签名信息进行登录认证包括：接收所述签名信息data＝{alice,time,sign}，其中，alice为所述CPK密钥设备对应的用户标识，time为所述终端待签名时间，sign用于标记(s,c)，s为签名码，c为验证码；根据VER ALICE(time,s)＝c’，得到所述终端待签名时间的验证码c’，其中，VER为验证函数，ALICE为所述CPK密钥设备的预设公钥；验证c与c’是否相同；当c与c’相同时，根据所述终端待签名时间和所述CPK密钥设备对应的用户标识进行登录认证；当c与c’不相同时，确定所述待认证用户标识登录失败。
进一步地，所述根据所述终端待签名时间和所述CPK密钥设备对应的用户标识进行登录认证包括：确定所述Linux操作***的本地时间与所述终端待签名时间的时间差值；判断所述时间差值是否小于或等于预设时间；当所述时间差值小于或等于所述预设时间时，判断所述CPK密钥设备对应的用户标识是否与所述待认证用户标识一致；当所述CPK密钥设备对应的用户标识与所述待认证用户标识一致时，确定所述待认证用户标识登录成功。
进一步地，所述方法还包括：当所述时间差值大于所述预设时间时，确定所述待认证用户标识登录失败。
进一步地，所述方法还包括：当所述CPK密钥设备对应的用户标识与所述待认证用户标识不一致时，确定所述待认证用户标识登录失败。
相应的，本发明实施例还提供一种终端，所述终端用于执行上述所述的基于CPK的Linux操作***登录认证方法。
相应的，本发明实施例还提供一种CPK密钥设备，所述CPK密钥设备用于执行上述所述的基于CPK的Linux操作***登录认证方法。
相应的，本发明实施例还提供一种Linux服务器，所述Linux服务器用于执行上述所述的基于CPK的Linux操作***登录认证方法。
通过上述技术方案，采用CPK密钥设备和终端待签名时间的软硬件结合认证体系，而且将公钥体制的数字签名技术融入认证过程，实现了基于CPK的安全认证，提升了Linux操作***的登录安全性，解决了现有技术中通过网络攻击获得操作***口令从而得到访问控制权的问题。
本发明实施例的其它特征和优点将在随后的具体实施方式部分予以详细说明。
附图说明
附图是用来提供对本发明实施例的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本发明实施例，但并不构成对本发明实施例的限制。在附图中：
图1是本发明实施例提供的基于CPK的Linux操作***登录认证方法的模块示意图；
图2是本发明实施例提供的一种基于CPK的Linux操作***登录认证方法的流程示意图；
图3是本发明实施例提供的另一种基于CPK的Linux操作***登录认证方法的流 程示意图；
图4是本发明实施例提供的又一种基于CPK的Linux操作***登录认证方法的流程示意图；
图5是本发明实施例提供的一种基于CPK的Linux操作***登录认证方法的流程示意图。
具体实施方式
以下结合附图对本发明实施例的具体实施方式进行详细说明。应当理解的是，此处所描述的具体实施方式仅用于说明和解释本发明实施例，并不用于限制本发明实施例。
本发明实施例是通过数字签名技术实现Linux操作***的安全认证。其中的数字签名是由CPK组合公钥体制提供的。CPK是基于标识的公钥体制，公钥由标识通过Hash变换和矩阵的组合运算而得到。其中，在椭圆曲线上，G是基点，如果任意整数a是私钥，那么aG＝A，A是对应于a的公钥。设：标识是Alice，那么Alice的公私钥分别是：标识通过Hash变换，变为一串随机数序列，将随机数序列当作矩阵的坐标，将32个坐标上的变量分别累加得公、私钥。如：
Figure PCTCN2019092925-appb-000001
(大写，斜体，表示公钥)
Figure PCTCN2019092925-appb-000002
(小写，斜体，表示私钥)
由于公钥矩阵(R i,j)预先设置在Linux服务器中，所以只要知道标识，就可以计算出公钥，而私钥矩阵(r i,j)只存在于密钥中心，私钥在CPK密钥设备中保管。其中，当用户予使用CPK密钥设备进行认证时，用户使用所述CPK密钥设备对应的用户标识向密钥中心申请私钥，从而密钥中心通过安全协议将私钥写入所述CPK密钥设备中。
为了实现本发明实施例，扩展了Linux操作***的PAM(Pluggable Authentication Modules，可***认证模块)，如图1所示，将CPK安全鉴别模块设置在Linux操作***的可***认证模块中。另外，所述CPK安全鉴别模块所依赖的公钥矩阵以及其它配置文件部署在指定的路径，修改Linux操作***的PAM配置文件，注销原默认认证模块，使得在进行操作***登录认证时直接使用所述CPK安全鉴别模块进行认证，而且需要将Linux操作***的Selinux模块设置为开启状态，才能保证只能使用CPK密钥设备方可登录Linux操作***。
如图1所示，***认证应用程序接口是要求验证服务的应用程序与提供验证服务的验证机制之间的通信接口，是Linux操作***中应用程序安全通道的入口。由于Linux操作***中包括CPK安全鉴别模块，即可实现上层应用层的多个应用程序的安全认证 问题，只需要通过接口层的配置就能灵活为某一应用程序增加CPK的安全认证机制。从而在本发明实施例中，不仅支持Linux操作***的安全登录认证，还可支持多应用程序的安全认证，只需要在配置文件中配置需要实现安全认证的应用程序即可。
另外，本发明实施例中提到的Linux服务器可以是远程服务器，也可以是本地服务器。
实施例一
图2是本发明实施例提供的一种基于CPK的Linux操作***登录认证方法的流程示意图。如图2所示，所述方法应用于终端，所述方法包括如下步骤：
步骤201，获取CPK密钥设备的待认证用户标识，并将所述待认证用户标识发送给所述Linux服务器；
步骤202，获取CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备；
步骤203，接收所述CPK密钥设备发送的签名信息，并将所述签名信息发送给所述Linux服务器，以便所述Linux服务器通过所述签名信息进行登录认证，所述签名信息中包括所述终端待签名时间的数字签名以及所述CPK密钥设备对应的用户标识。
在本发明实施例中，当用户将CPK密钥设备***所述终端之后，所述终端即可获取到所述CPK密钥设备的待认证用户标识，从而将所述待认证用户标识发送给所述Linux服务器。
对于步骤202，当接收到所述Linux服务器发送的提示输入CPK密钥设备的口令时，显示口令录入界面；获取所述CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备。
另外，当接收到所述CPK密钥设备发送的口令验证错误的通知时，继续显示所述口令录入界面。
通过本发明实施例，采用CPK密钥设备和口令的双因子认证，即使口令被泄密也没关系，因为没有CPK密钥设备是无法登录Linux操作***，有效防止网络攻击，使得最常用的网络攻击手段完全失效，解决了现有技术中通过网络攻击获得操作***口令从而得到访问控制权的问题，实现了基于CPK的安全认证，提升了Linux操作***的登录安全性。
实施例二
图3是本发明实施例提供的一种基于CPK的Linux操作***登录认证方法的流程示意图。如图3所示，所述方法应用于CPK密钥设备，所述方法包括如下步骤：
步骤301，接收终端发送的CPK密钥设备的口令和终端待签名时间；
步骤302，验证所述口令是否正确；
步骤303，当验证所述口令正确时，利用预设私钥对所述终端待签名时间进行数字签名，得到签名信息并将所述签名信息发送给所述终端，以便由所述终端将所述签名信息发送给Linux服务器进行登录认证。
其中，当验证所述口令错误时，向所述终端发送口令验证错误的通知。
另外，所述CPK密钥设备内保存有所述CPK密钥设备对应的用户标识的预设私钥，从而在步骤302中可利用所述预设私钥对所述终端待签名时间进行数字签名，得到签名信息，具体为：
根据SIG alice(time)＝(s,c)＝sign，得到签名数据data＝{alice,time,sign}，其中，SIG为签名函数，alice为所述CPK密钥设备的预设私钥，alice为所述CPK密钥设备对应的用户标识，time为所述终端待签名时间，s为签名码，c为验证码，sign用于标记(s,c)。
通过本发明实施例，利用CPK密钥设备对终端待签名时间进行数字签名之后，得到签名信息，以便Linux服务器对所述签名信息中的终端待签名时间进行验证，即每次登录都会对一个终端待签名时间进行数字签名，解决了现有技术中通过网络攻击获得操作***口令从而得到访问控制权的问题，实现了基于CPK的安全认证，提升了Linux操作***的登录安全性。
实施例三
图4是本发明实施例提供的一种基于CPK的Linux操作***登录认证方法的流程示意图。如图4所示，所述方法应用于Linux服务器，所述方法包括如下步骤：
步骤401，接收所述终端发送的待认证用户标识，并确定所述待认证用户标识是否存在于所述Linux操作***的合法用户信息中；
步骤402，当确定所述待认证用户标识存在于所述Linux操作***的合法用户信息中之后，接收所述终端发送的签名信息，并根据所述签名信息进行登录认证，所述签名信息中包括终端待签名时间的数字签名以及CPK密钥设备对应的用户标识。
其中，当确定所述待认证用户标识存在于所述Linux操作***的合法用户信息中之后，所述Linux服务器向所述终端发送提示输入CPK密钥设备的口令。
对于步骤402，接收所述签名信息data＝{alice,time,sign}，其中，alice为所述CPK密钥设备对应的用户标识，time为所述终端待签名时间，sign用于标记(s,c)，s为签名码，c为验证码。然后根据VER ALICE(time,s)＝c’，得到所述终端待签名时间的验证码c’，其中，VER为验证函数，ALICE为所述CPK密钥设备的预设公钥。之后验证c与c’是 否相同，当c与c’相同时，根据所述终端待签名时间和所述CPK密钥设备对应的用户标识进行登录认证，而当c与c’不相同时，确定所述待认证用户标识登录失败。
另外，当c与c’相同时，根据所述终端待签名时间和所述CPK密钥设备对应的用户标识进行登录认证包括：确定所述Linux操作***的本地时间与所述终端待签名时间的时间差值，并判断所述时间差值是否小于或等于预设时间，当所述时间差值小于或等于所述预设时间时，判断所述CPK密钥设备对应的用户标识是否与所述待认证用户标识一致，当所述CPK密钥设备对应的用户标识与所述待认证用户标识一致时，确定所述待认证用户标识登录成功。即判断本次登录认证开始时，接收到的待认证用户标识是否与所述CPK密钥设备对应的用户标识一致，保证了上述二者为同一用户。
而当所述时间差值大于所述预设时间时，确定所述待认证用户标识登录失败。另外，当所述CPK密钥设备对应的用户标识与所述待认证用户标识不一致时，也确定所述待认证用户标识登录失败。
其中，由于在所述Linux服务器中存储有公钥矩阵，在获得CPK密钥设备对应的用户标识之后，利用公钥矩阵就可以得到所述用户标识对应的预设公钥。
通过本发明实施例，利用CPK密钥设备对终端待签名时间进行数字签名之后，得到签名信息，Linux服务器对所述签名信息中的终端待签名时间进行验证，即每次登录都生成一个终端待签名时间，实现了登录凭证的动态变化，另外，对于终端待签名时间与***时间的比较，可解决重放攻击的问题。通过数字签名技术实现Linux操作***的安全认证，解决了静态口令易猜测、可拦截的问题。
实施例四
为了便于理解本发明实施例，下面以终端、CPK密钥设备和Linux服务器之间的信息交互进行说明本发明实施例。图5是本发明实施例提供的一种基于CPK的Linux操作***登录认证方法的流程示意图。如图5所示，所述方法包括如下步骤：
步骤501，终端获取CPK密钥设备的待认证用户标识，并将所述待认证用户标识发送给所述Linux服务器；
步骤502，所述Linux服务器接收待认证用户标识，并确定所述待认证用户标识是否存在于所述Linux操作***的合法用户信息中，若是则执行步骤503，若否则返回步骤501；
步骤503，向所述终端发送提示输入CPK密钥设备的口令；
步骤504，所述终端接收所述提示输入CPK密钥设备的口令，显示口令录入界面；
步骤505，所述终端获取所述CPK密钥设备的口令，并将所述口令和终端待签名 时间发送给所述CPK密钥设备；
步骤506，所述CPK密钥设备接收所述终端发送的CPK密钥设备的口令和终端待签名时间；
步骤507，验证所述口令是否正确，当验证所述口令正确时执行步骤508，当验证所述口令错误时，向所述终端发送口令验证错误的通知并返回步骤504；
步骤508，所述CPK密钥设备利用预设私钥对所述终端待签名时间进行数字签名，得到签名信息并将所述签名信息发送给所述终端；
步骤509，所述终端接收所述CPK密钥设备发送的签名信息，并将所述签名信息发送给所述Linux服务器；
步骤510，所述Linux服务器接收所述终端发送的签名信息，并对所述签名信息进行验证，当验证通过后执行步骤511，验证未通过则确定所述待认证用户标识登录失败；
步骤511，确定所述Linux操作***的本地时间与所述终端待签名时间的时间差值；
步骤512，判断所述时间差值是否小于或等于预设时间，若是执行步骤513，若否确定所述待认证用户标识登录失败；
步骤513，判断所述CPK密钥设备对应的用户标识是否与所述待认证用户标识一致，若是确定所述待认证用户标识登录成功，若否确定所述待认证用户标识登录失败。
通过上述实施例，利用数字签名技术实现操作***的安全认证，解决静态口令易猜测、可拦截的问题。另外，登录时必须提供CPK密钥设备和口令，采用强双因子认证，即使口令泄密也不担心。有效地防止网络攻击，没有CPK密钥设备无法登录，使得常用的网络攻击手段完全失效。本发明实施例还具有高度松耦合性和可扩展性，不仅支持Linux操作***的登录，还支持多应用程序的登录认证，只需要修改Linux操作***中的配置文件即可实现应用程序的CPK安全认证，应用程序无需进行代码修改。
相应的，本发明实施例还提供了一种终端，所述终端用于执行上述实施例中应用于终端的所述的基于CPK的Linux操作***登录认证方法。
相应的，本发明实施例还提供了一种CPK密钥设备，所述CPK密钥设备用于执行上述实施例中应用于CPK密钥设备的所述的基于CPK的Linux操作***登录认证方法。
相应的，本发明实施例还提供了一种Linux服务器，所述Linux服务器用于执行上述实施例中应用于Linux服务器的所述的基于CPK的Linux操作***登录认证方法。
以上结合附图详细描述了本发明实施例的可选实施方式，但是，本发明实施例并不限于上述实施方式中的具体细节，在本发明实施例的技术构思范围内，可以对本发明实施例的技术方案进行多种简单变型，这些简单变型均属于本发明实施例的保护范围。
另外需要说明的是，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合。为了避免不必要的重复，本发明实施例对各种可能的组合方式不再另行说明。
本领域技术人员可以理解实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得单片机、芯片或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
此外，本发明实施例的各种不同的实施方式之间也可以进行任意组合，只要其不违背本发明实施例的思想，其同样应当视为本发明实施例所公开的内容。

Claims (15)

  1. 一种基于CPK的Linux操作***登录认证方法，其特征在于，所述方法应用于终端，所述方法包括：
    获取CPK密钥设备的待认证用户标识，并将所述待认证用户标识发送给所述Linux服务器；
    获取CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备；
    接收所述CPK密钥设备发送的签名信息，并将所述签名信息发送给所述Linux服务器，以便所述Linux服务器通过所述签名信息进行登录认证，所述签名信息中包括所述终端待签名时间的数字签名以及所述CPK密钥设备对应的用户标识。
  2. 根据权利要求1所述的方法，其特征在于，所述获取CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备包括：
    当接收到所述Linux服务器发送的提示输入CPK密钥设备的口令时，显示口令录入界面；
    获取所述CPK密钥设备的口令，并将所述口令和终端待签名时间发送给所述CPK密钥设备。
  3. 根据权利要求2所述的方法，其特征在于，在所述将所述口令和终端待签名时间发送给所述CPK密钥设备之后，所述方法还包括：
    当接收到所述CPK密钥设备发送的口令验证错误的通知时，继续显示所述口令录入界面。
  4. 一种基于CPK的Linux操作***登录认证方法，其特征在于，所述方法应用于CPK密钥设备，所述方法包括：
    接收终端发送的CPK密钥设备的口令和终端待签名时间；
    验证所述口令是否正确；
    当验证所述口令正确时，利用预设私钥对所述终端待签名时间进行数字签名，得到签名信息并将所述签名信息发送给所述终端，以便由所述终端将所述签名信息发送给Linux服务器进行登录认证。
  5. 根据权利要求4所述的方法，其特征在于，在所述验证所述口令之后，所述方法包括：
    当验证所述口令错误时，向所述终端发送口令验证错误的通知。
  6. 根据权利要求4所述的方法，其特征在于，所述利用预设私钥对所述终端待签名时间进行数字签名，得到签名信息包括：
    根据SIG alice(time)＝(s,c)＝sign，得到签名数据data＝{alice,time,sign}，
    其中，SIG为签名函数，alice为所述CPK密钥设备的预设私钥，alice为所述CPK密钥设备对应的用户标识，time为所述终端待签名时间，s为签名码，c为验证码，sign用于标记(s,c)。
  7. 一种基于CPK的Linux操作***登录认证方法，其特征在于，所述方法应用于Linux服务器，所述方法包括：
    接收所述终端发送的待认证用户标识，并确定所述待认证用户标识是否存在于所述Linux操作***的合法用户信息中；
    当确定所述待认证用户标识存在于所述Linux操作***的合法用户信息中之后，接收所述终端发送的签名信息，并根据所述签名信息进行登录认证，所述签名信息中包括终端待签名时间的数字签名以及CPK密钥设备对应的用户标识。
  8. 根据权利要求7所述的方法，其特征在于，当确定所述待认证用户标识存在于所述Linux操作***的合法用户信息中之后，所述方法还包括：
    向所述终端发送提示输入CPK密钥设备的口令。
  9. 根据权利要求7所述的方法，其特征在于，所述接收所述终端发送的签名信息，并根据所述签名信息进行登录认证包括：
    接收所述签名信息data＝{alice,time,sign}，其中，alice为所述CPK密钥设备对应的用户标识，time为所述终端待签名时间，sign用于标记(s,c)，s为签名码，c为验证码；
    根据VER ALICE(time,s)＝c’，得到所述终端待签名时间的验证码c’，其中，VER为验证函数，ALICE为所述CPK密钥设备的预设公钥；
    验证c与c’是否相同；
    当c与c’相同时，根据所述终端待签名时间和所述CPK密钥设备对应的用户标识 进行登录认证；
    当c与c’不相同时，确定所述待认证用户标识登录失败。
  10. 根据权利要求9所述的方法，其特征在于，所述根据所述终端待签名时间和所述CPK密钥设备对应的用户标识进行登录认证包括：
    确定所述Linux操作***的本地时间与所述终端待签名时间的时间差值；
    判断所述时间差值是否小于或等于预设时间；
    当所述时间差值小于或等于所述预设时间时，判断所述CPK密钥设备对应的用户标识是否与所述待认证用户标识一致；
    当所述CPK密钥设备对应的用户标识与所述待认证用户标识一致时，确定所述待认证用户标识登录成功。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    当所述时间差值大于所述预设时间时，确定所述待认证用户标识登录失败。
  12. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    当所述CPK密钥设备对应的用户标识与所述待认证用户标识不一致时，确定所述待认证用户标识登录失败。
  13. 一种终端，其特征在于，所述终端用于执行权利要求1-3任一项所述的基于CPK的Linux操作***登录认证方法。
  14. 一种CPK密钥设备，其特征在于，所述CPK密钥设备用于执行权利要求4-6任一项所述的基于CPK的Linux操作***登录认证方法。
  15. 一种Linux服务器，其特征在于，所述Linux服务器用于执行权利要求7-12任一项所述的基于CPK的Linux操作***登录认证方法。
PCT/CN2019/092925 2018-06-26 2019-06-26 基于CPK的Linux操作***登录认证方法、设备、终端及服务器 WO2020001455A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810673064.6 2018-06-26
CN201810673064.6A CN108881243B (zh) 2018-06-26 2018-06-26 基于CPK的Linux操作***登录认证方法、设备、终端及服务器

Publications (1)

Publication Number Publication Date
WO2020001455A1 true WO2020001455A1 (zh) 2020-01-02

Family

ID=64295043

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/092925 WO2020001455A1 (zh) 2018-06-26 2019-06-26 基于CPK的Linux操作***登录认证方法、设备、终端及服务器

Country Status (2)

Country Link
CN (1) CN108881243B (zh)
WO (1) WO2020001455A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108881243B (zh) * 2018-06-26 2021-02-23 晋商博创（北京）科技有限公司 基于CPK的Linux操作***登录认证方法、设备、终端及服务器
CN109815745B (zh) * 2019-01-11 2023-02-17 珠海金山数字网络科技有限公司 一种基于图像签名的应用程序授权方法
CN109977662B (zh) * 2019-03-01 2021-04-02 晋商博创（北京）科技有限公司 基于组合公钥的应用程序处理方法、装置、终端及存储介质
CN111400733A (zh) * 2020-03-13 2020-07-10 中国电力科学研究院有限公司 一种用于嵌入式Linux***的信息安全防护***及方法
CN115085968B (zh) * 2022-04-29 2023-08-04 麒麟软件有限公司 一种Linux下基于自定义标签的登录认证方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050044379A1 (en) * 2003-08-20 2005-02-24 International Business Machines Corporation Blind exchange of keys using an open protocol
CN1889426A (zh) * 2005-06-30 2007-01-03 联想(北京)有限公司 一种实现网络安全存储与访问的方法及***
CN101938473A (zh) * 2010-08-24 2011-01-05 北京易恒信认证科技有限公司 单点登录***及单点登录方法
CN104243493A (zh) * 2014-10-11 2014-12-24 上海众人科技有限公司 一种网络身份认证方法及***
CN108881243A (zh) * 2018-06-26 2018-11-23 晋商博创（北京）科技有限公司 基于CPK的Linux操作***登录认证方法、设备、终端及服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050044379A1 (en) * 2003-08-20 2005-02-24 International Business Machines Corporation Blind exchange of keys using an open protocol
CN1889426A (zh) * 2005-06-30 2007-01-03 联想(北京)有限公司 一种实现网络安全存储与访问的方法及***
CN101938473A (zh) * 2010-08-24 2011-01-05 北京易恒信认证科技有限公司 单点登录***及单点登录方法
CN104243493A (zh) * 2014-10-11 2014-12-24 上海众人科技有限公司 一种网络身份认证方法及***
CN108881243A (zh) * 2018-06-26 2018-11-23 晋商博创（北京）科技有限公司 基于CPK的Linux操作***登录认证方法、设备、终端及服务器

Also Published As

Publication number Publication date
CN108881243A (zh) 2018-11-23
CN108881243B (zh) 2021-02-23

Similar Documents

Publication Publication Date Title
CN110915183B (zh) 经由硬/软令牌验证的区块链认证
WO2020001455A1 (zh) 基于CPK的Linux操作***登录认证方法、设备、终端及服务器
US10432619B2 (en) Remote keychain for mobile devices
US20170244676A1 (en) Method and system for authentication
US8739260B1 (en) Systems and methods for authentication via mobile communication device
US8971539B2 (en) Management of SSL certificate escrow
US20170250974A1 (en) System and method for service assisted mobile pairing of password-less computer login
EP3423977A1 (en) Secure mobile device two-factor authentication
CN110990827A (zh) 一种身份信息验证方法、服务器及存储介质
CN106452764B (zh) 一种标识私钥自动更新的方法及密码***
US11184336B2 (en) Public key pinning for private networks
WO2009137371A2 (en) Enterprise device recovery
CN107798258B (zh) 用于认证针对固态驱动器的关键操作的***和方法
CN109388937B (zh) 一种多因子身份认证的单点登录方法及登录***
US11363009B2 (en) System and method for providing secure cloud-based single sign-on connections using a security service provider having zero-knowledge architecture
EP3674938B1 (en) Identifying computing processes on automation servers
CN108886530B (zh) 企业移动管理中移动设备的激活方法和移动设备
JP2017152880A (ja) 認証システム、鍵処理連携方法、および、鍵処理連携プログラム
US8321671B2 (en) Method and apparatus for client-driven profile update in an enterprise wireless network
US8051470B2 (en) Consolidation of user directories
CN114301617A (zh) 多云应用网关的身份认证方法、装置、计算机设备及介质
US20140250499A1 (en) Password based security method, systems and devices
KR101996317B1 (ko) 인증변수를 이용한 블록체인 기반의 사용자 인증 시스템 및 그 방법
KR102062851B1 (ko) 토큰 관리 데몬을 이용한 싱글 사인 온 서비스 인증 방법 및 시스템
KR102288445B1 (ko) 단체용 인증모듈의 온보딩 방법, 장치 및 프로그램

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19826957

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19826957

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 19826957

Country of ref document: EP

Kind code of ref document: A1