TW201533605A - Integrated smart card UNIX authentication management system and method - Google Patents

Abstract

This invention relates to an integrated smart card UNIX authentication management system and method, which mainly comprises a main control operation module that interacts with users, a kernel management module for processing account management and password management, and a client end agency module responsible for interpreting instructions and communicating with management server. Furthermore, for the open secure shell (Open SSH) commonly used by UNIX systems, an authentication management system based on smart cards is designed, wherein the coding and decoding verification of the smart card is used to perform identity authentication, in conjunction with the open secure shell (Open SSH) public key authentication method to perform identity authentication for login the UNIX system, thereby using the physical smart cards for authentication in an indirect way.

Description

Integrated smart card UNIX authentication management system and method

The present invention relates to a UNIX authentication management system and method; in particular, a system and method for logging in to a UNIX system with an integrated smart card and performing authentication and management, dynamically generating an authentication code for the user The encrypted certificate of the smart card is encrypted and transmitted to the user end, and then decrypted by the smart card and transmitted back to the system to verify the identity of the user. Then upload and dynamically deploy the public key generated by the user's asymmetric key algorithm (Rivest Shamir Adleman, RSA) to the UNIX side, and then use the public key authentication method of Open Secure Shell (OPENSSH). (Public key Authentication) authenticates to log in to the UNIX system. Indirect ways to achieve authentication using physical smart cards.

In the pre-patent case, there is a one-time password authentication method for the user to confirm the transaction data (application date: 2011/10/14, application number: 100137295), which is for the client to transmit the transaction data to the bank, so that the bank will Part of the transaction data is transmitted to the authentication server to generate a user review code, a bank authentication code and a transaction authentication code according to the part of the transaction data, wherein the user terminal receives the user review. The code, the bank authentication code and part of the transaction data, after the client confirms part of the transaction data, send the relevant data back to the certification server for authentication through the transaction provider, and notify the bank to conduct the transaction after the authentication is correct, and finally, the bank The terminal transmits the transaction result to the client for re-confirmation by the client to ensure the security of the user transaction through multiple checks on the transaction data. In addition, a one-time password generated through transaction data provides a basis for non-repudiation after the transaction.

Multi-factor authentication system and access to the pre-patent window operating system Entry method (application date: 2006/10/27, application number: 095139806), used for customized system login and authentication methods in Windows VistaTM operating system, without affecting user usage habits, in Windows Vista TM A multi-factor authentication window is generated on the operating system login screen, which results in a safer and more convenient login method. The system functions include using the Windows login program (Winlogon.exe) to create a Windows login program window login method, and the Windows login program calls. Log in to the user interface (LogonUI.exe) login user interface, use the credential provider to manage the user's authentication means, generate a login screen display means including a multi-factor authentication window, and generate more The multi-factor authentication method of the factor authentication program, the user identity comparison method for comparing the user identification data generated by the multi-factor authentication program with the user data in the database, and the user identification of the backfill user identifier/password Code/password backfilling means, as well as a means of message delivery. This patent proposal proposes a new authentication model for Microsoft Windows operating system, which enables the login screen (LogonUI) to communicate directly with the Winlogon program of the management window login program. The Windows VistaTM operating system provides a credential provider that contacts the window login screen. (credential provider) module, by taking the user credentials (credential), and passed to the Winlogon login program for system login.

Traditional UNIX authentication is performed by means of account password verification. As information security is increasingly valued, organizations are beginning to demand increased password length and complexity. However, the traditional passwords are managed by the user. The longer the password is, the more complicated it is, and the harder it is for the user to remember. Therefore, some users will use the trick to set the complexity rule but the real password strength is low. Password, such as the common "1qaz2wsx", or record the password with a pen and paper. These behaviors make the principle of high-intensity passwords useless. Therefore, in the conflict between information security and user resistance, it is more feasible to construct an authentication system with sufficient security and user-friendly operation.

G10 code launched the smart card authentication system in 2004. The Secure Shell (SSH) client communicates directly with the RSA (Rivest Shamir Adleman) key in the smart card, and the SSH public key authentication is performed directly through the smart card, but it must be used in accordance with ISO 7816. -4,-8 special OpenPGP cards can apply this authentication mode.

It can be seen that the above-mentioned conventional methods are still insufficient, and it needs to be improved.

In view of the various elements that are lacking in the above-mentioned conventional methods, the inventors of the present invention have improved and innovated, and after years of painstaking research, they finally succeeded in researching and developing this invention.

The invention designs an authentication management system based on smart card for the open source security suite (OPENSSH) commonly used in UNIX systems, and dynamically generates an authentication code to encrypt the credentials of the user's smart card. After being encrypted, it is transmitted to the user end, and then decrypted by the smart card and transmitted back to the system to verify the identity of the user. Upload and dynamically deploy the client to be asymmetric The public key generated by the Rivest Shamir Adleman (RSA) is sent to the UNIX side, and then authenticated by the OPENSSH public key authentication method to log in to the UNIX system. Indirect ways to achieve authentication using physical smart cards. This method is compatible with smart cards commonly used in Taiwan, including natural person certificates, and does not require the use of smart cards of special specifications.

The system divides the user source address into high risk area and low risk Zone, for example, whether the source address is the trust zone to discriminate the risk level, and the differentiated authentication level is given according to the risk. In the high-risk area, the patent's certification model will aim to improve system security. Therefore, in addition to the traditional authentication mode, it is necessary to match the smart card authentication mode. In the low-risk area, the system will aim at improving the convenience of operation, and it is mainly based on smart card authentication.

Smart card authentication is the use of physical smart card objects for authentication, but the use of physical objects for verification may be lost or forgotten to carry. The invention has several supporting measures when it is unable to obtain a smart card under special circumstances. Authentication mode:

1. Smart card authentication, with the physical card of the smart card for the authentication process, can strengthen the information security level.

2. Co-certification certification, when not carrying a smart card, it can be authenticated through two smart cards of the same department.

3. When the competent authority is certified, if the smart card is not carried, and the working environment cannot be accompanied by the same, the certification can be carried out through the competent authority.

Temporary passcode authentication. If you do not carry a smart card, you can customize a set of temporary passcodes after you have passed the certification of the peer or the authorization of the supervisor. This is a simplified authentication procedure that needs to be repeated for a short period of time.

The invention is an integrated smart card UNIX authentication management system, which mainly comprises an operation main control module, a core management module and a client agent module. Please refer to FIG. 1. FIG. 1 is a structural diagram of an integrated smart card UNIX authentication management system according to the present invention. As shown in FIG. 1 , the operation main control module 103 is an intermediary for providing communication between the user 105 and the back end, and provides an operation platform for actually communicating and authenticating with the management server. The core management module 102 is a console that is responsible for processing the needs of the user and managing the information of the UNIX host group. The client agent module 101 is responsible for actually operating the agent platform of the management server, receiving commands related to the translation system management, executing and reporting the results, and achieving cross-platform requirements.

The operation main control module 103 further includes a smart card, a human interface component 1031, a smart card (IC) mediation component 1032, and an SSH client component 1033. The human interface component 1031 provides an application for the user 105 to communicate with the core management module 102, and provides a list of UNIX host groups 104 for the user 105 to select an interface for connecting to the UNIX host. Next, the smart card (IC) mediation component 1032 is responsible for communicating with the smart card. Then, the SSH client component 1033 is responsible for implementing the Secure Shell (SSH) and communicating with the UNIX host group, and connecting the UNIX host selected by the human interface component to the user for login authentication and remote operation. Terminal application.

The core management module 102 further includes a management database 1021, an account management component 1022, a passcode management component 1023, and a schedule management component 1024. The management database 1021 stores a database of user information and UNIX host group data, and the personal data file is a personal basic data of the user. User information can be divided into personal data files and account permission files. The account permission file is used to set the user's available permissions, as the basis for determining the risk level of the user's source address and the appropriateness of logging in to the system account and time. Next, the account management component 1022 provides new/transfer/delete of the account authority for the UNIX host group, and Communicate with the client agent module to deploy the account rights, read the personal data file and the account permission file from the management database, and call the command translation component of the client agent module, and the information of the personal data file and the account permission file. Translated into the legal instructions of the UNIX host operating system for account rights deployment. Then, the passcode management component 1023 generates the components of the random number password and the key according to the cryptographic principle, and communicates with the client proxy module to perform the pass code deployment. Finally, the schedule management component 1024 periodically drives the passcode management component to perform the cryptographic and key update components, as well as the scheduling requirements for temporary passcode authentication and dynamic password authentication.

The personal data file is a personal basic data of the user, and may be an application account code, an email address, a mobile phone number, a competent email address, a competent mobile phone address, or a department code. Then, the account permission file is a setting for the user to use the permission, as the basis for determining the risk level of the user source address and the appropriateness of the login system account and the time point, which can be:

(1) A trusted work area, which can be represented by IP, subnet or other identifiable network address depending on the needs of the system environment.

(2) The system and account code that can be logged in.

(3) The time limit for logging into the system.

The client agent module 101 operates and manages the proxy platform of the server, and is responsible for receiving and translating the commands related to the translation system management, and executing and reporting the results to meet the requirements of cross-platform. The public key management component 1011, the command translation component 1012, and the link communication component 1013 are further included. The public key management component 1011 manages the trusted public key of the UNIX host, and adds or deletes the trusted public key according to requirements. Then, the link communication component 1013 and the core management module 102 link the components to handle the data transmission and command reception requirements. Then, command the translation component 1012 According to the UNIX host, the requirements of the core management module are converted into appropriate instructions, and the different data formats are converted into components of standardized files.

The integrated smart card UNIX authentication management method of the present invention is mainly To log in to the user control module, the system will check the risk level of the user's login area. If it is a trusted work area, it is low risk, otherwise it is high risk; after the login area risk judgment, it will be checked again. Smart card status and verification card user identification number (Personal Identification Number code, pin code). After starting the operation main control module, first check the risk level of the user login area and check whether the smart card exists, and perform the authentication mode selection process.

(1) If it is a high risk:

A. If the smart card exists, and the user adopts the "smart card authentication" for the card owner, and then performs dynamic password authentication, the authentication is completed.

B. If the smart card exists, but the user is not the card owner to adopt the "same certification certification", and then the dynamic password authentication, the party certification is completed.

C. If the smart card does not exist, but there is a valid temporary RSA key, the "temporary pass code authentication" is adopted, and then the dynamic password authentication is performed, and the authentication is completed.

D. If the smart card does not exist, and there is no valid temporary RSA key to adopt the “supervisor certification”, then the dynamic password authentication is performed, and the authentication is completed.

(2) If it is a low risk person:

A. If the smart card exists and the user adopts the "smart card authentication" for the card owner, the authentication can be completed.

B. If the smart card exists, but the user non-card owner adopts the “same certification certification”, the authentication can be completed.

C. If the smart card does not exist, but there is a valid temporary RSA key to adopt "temporary pass code authentication", the certification can be completed.

D. If the smart card does not exist and there is no valid temporary RSA key to adopt the “supervisor certification”, the certification can be completed.

Please refer to FIG. 2, which is a flow chart of the integrated authentication method for the smart card UNIX authentication according to the present invention. As shown in Figure 2, the method steps can include:

S210 classifies the risk of the user's login IP and determines whether to strengthen the authentication control. The authentication mode selection procedure, the system needs to determine the authentication mode according to the smart card status.

In the S220 smart card authentication mode, the user should use the smart card to log in to the system under the preset conditions, and the protection of the physical smart card can be used to enhance the security.

The S230 is accompanied by the certification mode. When the user cannot obtain the smart card under special circumstances, the user can authenticate with the same smart card of the same department to obtain the temporary access code.

S240 temporary passcode authentication mode, when the user passes the peer authentication or the supervisor authorization authentication, the user can customize a set of temporary passwords and use the temporary passcode authentication method to simplify the authentication process during the valid period of the passcode.

The S250 is in charge of the authorization authentication mode. When the authentication is performed by the supervisor authorization method, the system will send an authorization code to the supervisor, and the user must obtain the authorization code and obtain the authorization code.

S260 determines whether to strengthen the authentication control.

S270 dynamic password authentication program, because the password is managed by the system, Users must apply for a password online when they need a password.

The S280 passcode update program is a situation in which the password is inevitably outflowed in an environment that is not secure enough. If there is enough time, any algorithm may be cracked. In order to reduce the threat of password outflow or key cracking, it is a common propaganda strategy that the passcode must be updated regularly. Since the invention administers the rights and responsibilities of the pass code management to the system management and excludes the influence of human factors, the information security strength requirement of the on-site environment can be visually shortened, and the transit code update time is shortened.

Please refer to FIG. 3, which is a flow chart of the authentication mode selection procedure of the integrated smart card UNIX authentication management method of the present invention. As shown in Figure 3, the authentication mode selection program can further include the following steps:

Based on the login IP risk classification, S21001 determines whether authentication control needs to be strengthened. The permissions are set according to the IP risk based on the location of the IP.

S21002 determines whether the card still exists. If yes, perform S21006 smart card user identification number (Personal Identification Number code, pin code) verification; if not, perform S21003 whether it is a valid temporary RSA key.

S21003 determines whether it is a valid temporary RSA key, and if so, performs S21004 authentication mode setting; if not, performs other authentication mode setting.

S21004 determines the authentication mode setting according to S21003, and can be temporary passcode authentication in actual operation.

S21005 is judged to be set to other authentication modes according to S21003, and may be authorized for authentication in actual use.

S21006 smart card verification user personal identification number (Personal Identification Number code, pin code); If yes, check if the S21007 query card has a login record; if not, return to step S21002.

S21007 queries whether the smart card has a recorded data record. If yes, S21008 determines whether the smart card owner matches the user; if not, performs S21009 to upload the smart card encryption credential.

S21008 determines whether the smart card owner matches the user, and if so, performs S21010 to set the smart card authentication mode; if not, performs S21011 to set the smart card other authentication mode.

S21009 uploads the smart card encryption credential, and then executes S21008 to determine whether the smart card owner matches the user.

S21010 sets the smart card authentication mode, which can be used for smart card authentication in actual use.

S21011 sets the other authentication mode of the smart card, and in the actual application, it can be the same as the certification.

Please refer to FIG. 4, which is a flow chart of the smart card authentication of the integrated smart card UNIX authentication management method of the present invention. As shown in Figure 4, smart card authentication can include the following steps:

S22001 generates an authentication code, which is encrypted by the user encrypted credential and transmitted to the user end.

S22002 receives the user identification number (Personal Identification Number code, pin code) input by the user, decrypts the smart card and returns the authentication code.

S22003 returns the authentication code to confirm whether it matches. If yes, S2204 displays the list of UNIX hosts; if not, it ends.

S22004 receives the data of the management database and displays a list of UNIX hosts.

S22005 determines the connection of the UNIX host to connect.

S22006 determines whether the client has a certificate key file, and if so, performs a smart card decryption authentication private key and a public key in S22009; if not, performs a public-private key for pair authentication in S22007.

S22007 generates the public and private keys for pairing authentication. At the same time, S22008 uses the smart card encryption authentication private key and stores it on the user side, and S22011 uploads the authentication public key.

S22008 uses a smart card to encrypt the private key and store it on the client.

S22009 uses the smart card to decrypt the authentication private key and the public key, and performs S22010 to determine whether the authentication private key matches the public key.

S22010 determines whether the authentication private key matches the public key. If yes, the S22013 starts the SSH client connection to the server; if not, the S22007 generates the public and private key for pairing authentication.

S22011 uploads the authentication public key, and then performs S22012 to deploy the authentication public key to the connected UNIX server.

S22012 deploys the certified public key to the connected UNIX server. The choice of the UNIX server can be applied for the user. Next, start S22013 to start the SSH Client connection to the server.

S22013 starts the SSH client connection to the server.

S22014 uses the RSA private key for SSH public key authentication.

Please refer to FIG. 5, which is a flow chart of the same as the certification certification of the integrated smart card UNIX authentication management method of the present invention. As shown in Figure 5, Peer certification can include the following steps:

S23001 peer certification program.

S23002 receives the smart card authentication of the peer and receives the personal identification number code (pin code).

S23003 Whether to replace the smart card, if yes, perform S23004 Personal Identification Number code (pin code) verification; if not, return to S23002.

S23004: If the user identification number (Personal Identification Number code, pin code) is verified, if yes, S23005 determines whether the smart card owner and the user are in the same department; if not, return to S23003.

S23005 determines whether the smart card owner and the user are in the same department. If yes, the 23006 generates a temporary pass code; if not, returns to S23002.

S23006 generates a temporary pass code, which can receive the data input of the user during actual use to generate a temporary pass code.

S23007 uses the temporary pass code as the passphrase to generate the paired authentication key and store it on the local end.

S23008 uploads the authentication public key.

S23009 downloads and displays the server list.

S23010 receives the data and selects the connected server according to the data. The data input by the user can be received in actual use.

S23011 deploys the authentication public key to the connected server and performs the following steps at the same time.

S23012 uses the temporary pass code as the passphrase and uses the RSA private key for SSH public key authentication.

S23013 sets the scheduling component and removes the authentication public key.

Please refer to FIG. 6. FIG. 6 is a flow chart of the temporary passcode authentication of the integrated smart card UNIX authentication management method of the present invention. As shown in Figure 6, the temporary passcode authentication procedure can include the following steps:

S24001 temporary passcode authentication procedure.

S24002 determines whether there is a temporary pass code, and if so, performs a temporary pass code on S24004; if not, enters another authentication mode process.

S24003 enters other authentication mode processes, and can be used to authorize the authentication process in actual use.

S24004 receives the temporary pass code, and the user can receive the data and input the temporary pass code.

The S24005 uses the temporary pass code as the passphrase and uses the temporary authentication key to verify and determine whether the pass code matches.

If the S24006 passcode is correct, if yes, download S24007 and display the connection server; if not, end.

S24007 downloads and displays the connection server.

S24008 receives the data of the user terminal and selects the connected server.

S24009 deploys the authentication public key to the connected server and performs the following steps.

The S24010 uses the temporary pass code as the passphrase and uses the RSA private key for SSH public key authentication.

S24011 sets the scheduling component and removes the authentication public key.

Please refer to FIG. 7. FIG. 7 is a flow chart of the main authority authorization authentication of the integrated smart card UNIX authentication management method of the present invention. As shown in Figure 7, the supervisory certification can include the following steps:

S25001 is responsible for the authorization certification process.

S25002 generates the supervisor authorization code.

S25003 transmits the supervisor authorization code and user information to the competent mobile device.

The user of S25004 receives the authorization code through the supervisor and transmits the authorization code to the system for authentication.

S25005 determines whether the authorization code is valid and correct. If yes, perform S25006 to change the temporary password; if not, return to S25002.

S25006 receives the user's new temporary passcode.

S25007 uses this new temporary pass code as a passphrase to generate a paired authentication key, which is stored on the local end.

S25008 uploads the authentication public key.

S25009 downloads and displays the server list.

The S25010 connects to the server based on the user's data.

The S25011 deploys the authentication public key to the connection server and performs the following steps.

The S25012 uses the temporary pass code as the passphrase and uses the RSA private key for SSH public key authentication.

S25013 sets the scheduling component and removes the authentication public key.

Please refer to FIG. 8. FIG. 8 is an integrated smart card of the present invention. Flowchart of the application dynamic password for the UNIX certification management method. As shown in Figure 8, since the password is managed by the system, the user must apply for a password online when the password is required. Among them, the following steps can be included:

S27101 applies for a dynamic password.

S27102 Whether the dynamic password application procedure has not expired, if yes, S27104 sends a dynamic password application notification to the user supervisor; if not, S27103 prompts the dynamic password to be accepted.

S27103 indicates that the dynamic password is being accepted in the application.

S27104 sends a dynamic password application notification to the user supervisor.

The S27105 sends a dynamic password to the user's mobile device while performing the following steps.

The S27106 regenerates the password and enters the password deployment process.

S27107 receives the user password

S27108 determines whether the password is correct. If yes, perform S27109 to log in to the UNIX system; if not, return to S27107 to re-enter the password or end.

S27109 If the password is correct, log in to the UNIX system.

Please refer to FIG. 9. FIG. 9 is a flow chart of the update of the pass code of the integrated smart card UNIX authentication management method of the present invention. As shown in Figure 9, in an external environment that is not secure enough, passwords will inevitably have an outflow. If there is enough time, any algorithm may be cracked. In order to reduce the threat of password outflow or key cracking, it is a common propaganda strategy that the passcode must be updated regularly. Since the present invention transfers the rights and responsibilities of the pass code management to the system management and excludes the influence of human factors, the information security strength requirement of the on-site environment can be shortened. Passcode update time. Among them, the following steps can be included:

The S27201 pass code is updated regularly.

S27202 reads the account list of all the tube server and the corresponding user encryption certificate.

The S27203 batch processes the passcode update job.

S27204 removes the overdue trust public key.

Whether the S27205 successfully removes the overdue trust public key. If yes, the S27206 marks the trusted public key removal time; if not, the S27207 notifies the administrator of the timeout public key removal exception.

The S27206 flag trusts the public key removal time and stores it in the database.

S27207 notifies the administrator of the timeout public key removal exception.

S27208 generates a random number password.

S27209 sets the password of the random number to the corresponding host.

S27210 determines whether the password setting is successful, and if so, returns to the S27203 batch processing pass code update operation; if not, performs S27211 to notify the administrator that the password update fails.

S27211 notifies the administrator that the password update has failed, and returns to the S27203 batch processing passcode update operation.

The technical features provided by the present invention have the following advantages when compared with other conventional technologies:

1. Propose a smart card authentication UNIX system mode. The traditional authentication method relies on the user to keep the account password. If the user forgets the password or enters the wrong password too many times, the account will be locked and cannot be used. Special feature of the invention The point is to use smart cards to enhance or replace the method of password authentication. Smart card authentication methods can be used to simplify the login process or to enhance authentication security. If it is used to simplify the login process, the user can insert the smart card and input the user identification number (Personal Identification Number code, pin code) to log in to the system, so as to avoid the problem that the account lock cannot be logged in due to the password input error. If the authentication security is used, the user still needs to perform account password authentication after inputting the smart card and inputting the personal identification number code (pin code), which can improve the level of information security.

2. No need to use smart cards with special specifications. The invention designs an authentication management system based on the popular card of the OPENSSH suite commonly used in UNIX systems, dynamically generates an authentication code, encrypts the encrypted certificate of the user's smart card, and transmits it to the user end, and then transmits The smart card is decrypted and passed back to the system to verify the identity of the user. And the random number generates the RSA public key, dynamically deployed to the UNIX end, and the user authenticates by SSH public key authentication method to log in to the UNIX system. Indirect way to achieve the use of physical smart card for authentication, this method can be compatible with Taiwan's common smart cards including natural person credentials, without the need for special specifications of smart cards.

3. Replace the manual management password with the system management password. The existing password management method relies on the user's own management. For the convenience of the user, the password that meets the password rule but has a low physical strength is often used. The system design password is managed by the system, and the system will change periodically and generate random passwords. Users must apply online when they need a password. The system will inform users of the latest password through SMS and email. A longer password length can be used since no user memory is required.

4. Hardware protection plus password protection, triple authentication protection mode. Traditional password recognition As long as the account number and password are correct, you can log in to the system. If you are subject to side recording or password outflow, you will be suspected of illegal login. In addition to the traditional password authentication method, the system adds a smart card and a personal identification number code (pin code) authentication process. Even if it is monitored, the account password and even the Personal Identification Number code (pin code) are outflowed. As long as the physical smart card itself is not stolen, people who are interested can not log in to the system.

100‧‧‧Integrated Smart Card UNIX Authentication Management System

101‧‧‧Client Agent Module

1011‧‧‧ Public Key Management Components

1012‧‧‧Command translation component

1013‧‧‧ Link communication components

102‧‧‧Core Management Module

1021‧‧‧Management database

1022‧‧‧ Account Management Components

1023‧‧‧pass code management component

1024‧‧‧ Schedule Management Components

103‧‧‧Operation master module

1031‧‧‧Human Machine Interface Components

1032‧‧‧Smart IC card intermediary components

1033‧‧‧SSH client component

104‧‧‧UNIX host group

105‧‧‧Users

S210~S280‧‧‧Integrated smart card UNIX authentication management method

S21001~S21011‧‧‧Procedure mode selection procedure

S22001~S22014‧‧‧Smart Card Certification Process Steps

S23001~S23013‧‧‧Committed certification process steps

S24001~24011‧‧‧Procedures for the process of temporary passcode authentication

S25001~S25013‧‧‧ Process steps for authorization certification

S27101~S27109‧‧‧ Process steps for applying for a dynamic password

S27201~S27211‧‧‧Procedures for updating the passcode

Please refer to the detailed description of the present invention and the accompanying drawings for further understanding of the technical contents of the present invention and the functions thereof. The related drawings are: FIG. 1 is a structural diagram of the integrated smart card UNIX authentication management system of the present invention. .

2 is a flow chart of a method for managing an integrated smart card UNIX authentication according to the present invention.

FIG. 3 is a flow chart of the authentication mode selection procedure of the integrated smart card UNIX authentication management method of the present invention.

FIG. 4 is a flow chart of the smart card authentication of the integrated smart card UNIX authentication management method of the present invention.

FIG. 5 is a flow chart of the same as the certification certification of the integrated smart card UNIX authentication management method of the present invention.

Figure 6 is a flow chart of the temporary pass code authentication of the integrated smart card UNIX authentication management method of the present invention.

Figure 7 is a flow chart of the authority authorization authentication of the integrated smart card UNIX authentication management method of the present invention.

FIG. 8 is a flow chart of the application dynamic password of the integrated smart card UNIX authentication management method of the present invention.

FIG. 9 is a flow chart of the update of the pass code of the integrated smart card UNIX authentication management method of the present invention.

In order to make the objects, technical solutions and advantages of the present invention more comprehensible, the present invention will be further described in detail below with reference to the embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

Scenario 1, the zone of confidence smart card authentication, users first use of the system, want to apply for an account of Host _A Account _A, and in the zone of confidence to Host _A smart card login authentication of Account _A.

1. The system administrator completes the personal data file and the account permission file through the account management component of the core management module, and starts the account deployment process.

2. The system links the client communication module's link communication system, generates an account creation command conforming to the Host _A environment through the command translation component, and actually establishes Account _A. At the same time, the account attributes and environment are constructed according to the user settings.

3. The user activates the human interface component and verifies the validity of the smart card and the correctness of the personal identification number code (pin code) through the smart card intermediary component.

4. Confirm that there is no such card information in the management database, and the first smart card login procedure is required.

5. The system of smart card read by smart card information with the intermediary element encrypted credential encrypt, and uploaded to the management information kept in the library.

6. The console lists the list of accounts owned by the user based on the information in the management database.

7. The user chooses to connect to Host _A , and the system generates the paired RSA keys publicKey _A and privateKey _A.

8. Upload publicKey _A and deploy publicKey _A to the trust key list of Account _A of Host _A through the public key management component of the client proxy module.

9. Encrypt privateKey _{A with} encrypt and store it on the local machine for later use.

10. Start the SSH client device to connect to a Account _A Host _A and to privateKey _A public key for authentication.

11. The authentication is successful, and the area to which the user belongs belongs to the trusted area. Therefore, the password authentication is omitted and the login authentication procedure is completed.

Situation Second, the zone of confidence colleagues evidence certification, users User _B forgot to carry smart cards, is required to pass through the zone of confidence colleagues corroborated authentication login Account _B Host _B's.

1. User User _B logs in to the human interface component through the human interface component and the authentication management component of the system. The smart card intermediary component is used to verify the validity of the smart card and the correctness of the personal identification number code (pin code).

2. Confirm that the smart card owner User _C does not match User _B , but belongs to the same unit and enters step 5 of the same authentication mode.

3. The man-machine interface component prompts the second peer to perform collaborative authentication.

4. Confirm that the smart card has been exchanged and verified by the Personal Identification Number code (pin code) through the smart card mediation component, and the owner User _D is different from User _C.

5. Confirm that User _D and User _B belong to the same unit and pass the peer authentication procedure.

6. The user enters a temporary pass code passphrase _B that conforms to the password principle according to the prompt of the human interface component.

7. Using passphrase _B , generate the paired temporary RSA keys publicKey _B and privateKey _B.

8. Go to step eight.

9. The human interface component lists a list of accounts owned by the user.

10. The user chooses to connect to Host _B.

11. Deploy the publicKey _B to the Trust Key list of Account _B of Host _B through the public key management component of the client proxy module.

12. Remove the publicKey _{B in the} Account _B trust key after three minutes via the passcode management component.

13. Start the SSH client device to connect to a Account _B Host _B passphrase _B and to match privateKey _B for public key authentication.

14. The authentication is successful, and the area to which the user belongs is confirmed as the trust zone. Therefore, the password authentication is omitted and the login authentication procedure is completed.

Scenario 3: The untrusted zone supervisor authorizes the authentication. User User _C forgets to carry the smart card and must log in to Account _{C of} Host _C through the authorization authorization in the untrusted zone.

1. User User _C logs in to the human interface component through the human interface component and the authentication management component of the system. The smart card mediation component detects that the smart card does not exist.

2. There is no temporary RSA key belonging to User _{C in the} management database, go to step 7.

3. The passcode management component generates a random number authorization code Code _C that conforms to the password principle, and sends User _C and Code _C to the mobile device of the supervisor. User _C must obtain Code _C through the supervisor and enter the system within the time limit.

4. The human interface component confirms that the Code _C entered by the user is correct and valid, and passes the authorization authorization procedure.

5. The user enters a temporary pass code passphrase _{C that} complies with the password principle.

6. Using passphrase _C , generate paired temporary RSA keys publicKey _C and privateKey _C.

7. Go to step eight.

8. The Human Interface component lists a list of accounts owned by the user.

9. The user chooses to connect to Host _C.

10. Deploy publicKey _C to the list of trust keys in Account _C of Host _C through the public key management component of the client agent module.

11. Remove the publicKey _C from the Account _C trust key after three minutes through the scheduling management component and the passcode management component.

12. Start the SSH client component, connect to Account _{C of} Host _C , and use passphrase _C with privareKey _C for public key authentication.

13. If the authentication is successful, confirm that the user belongs to the non-trust zone, and you need to use password authentication. Go to Step 9.

14. The system sends a password request notification to the user's supervisor by email.

15. Through the passcode management component, regenerate the random password password _C and set it to Account _C of Host _C.

16. Send password _C to the user's mobile device, the user must enter the system within the time limit to pass the verification.

17. The system will start the passcode deployment procedure after three minutes, regenerate the random password password _{C 2} and set it to the Account _C of Host _C , ensuring that the password applied by the user will expire after three minutes.

Temporary password authentication in the untrusted zone. User User _C must log in to Account _{C of} Host _C in the untrusted zone. User _C forgot to carry the smart card, but has completed the authorization of the supervisor before, and needs to log in again within the validity period of the temporary password. system.

1. User User _C logs in to the human interface component through the human interface component and the authentication management component of the system. The smart card mediation component detects that the smart card does not exist.

2. Confirm that the temporary RSA keys publicKey _C and privateKey _C that are valid for User _C already exist in the management database.

3. The user enters the temporary pass code passphrase _{C 2} and uses privateKey _{C to} verify that the passphrase _{C 2} is correct.

4. Confirm that the passphrase _{C 2 is} correct and the Human Interface component lists the list of accounts owned by the user.

5. The user chooses to connect to Host _C.

6. Deploy publicKey _C to Host _C 's Account _C trust key list through the public key management component of the client agent module.

7. Remove the publicKey _C from the Account _C trust key after three minutes through the scheduling management component and the passcode management component.

8. Start SSH client device, to connect to Host _C and the Account _C passphrase _C with privateKey _C to perform public key authentication.

9. The authentication is successful. Confirm that the user belongs to the non-trust zone. You need to use the password. Certification, go to step 9.

10. The system sends a password request notification to the user's supervisor by email.

11. Through the passcode management component, regenerate the random password password _C and set it to Account _C of Host _C.

12. Send password _C to the user's mobile device, the user must enter the system within the time limit to pass the verification.

13. The system will start the passcode deployment procedure after three minutes, regenerate the random password password _{C 2} and set it to the Account _C of Host _C to ensure that the password applied by the user will expire after three minutes.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

S210~S280‧‧‧Integrated smart card UNIX authentication management method

Claims (14)

An integrated smart card UNIX authentication management system, which at least comprises: a client agent module, an agent platform for operating and managing a server, receiving and managing commands related to the translation system, executing and reporting the results, including the connected public Key management component, command translation component and link communication component; a core management module, receiving and processing user data, and managing the main control console of the server, including the connected management database, account management component, Passcode management component and scheduling management component; an operation main control module, the operation main control component is an intermediary for providing communication between the user and the back end, and provides an operation platform for actually communicating with the management server, including connection The human interface component, the smart IC card intermediary component and the SSH client component; and a UNIX host group. The integrated smart card UNIX authentication management system according to claim 1, wherein the public key management component manages a trusted public key of the UNIX host, and adds or deletes a trusted public key according to the instruction; the command translates the component according to the UNIX The host, the need to translate the core management module is an appropriate instruction, and converts different data formats into standardized files; and the link communication component is connected to the core management module to process data transmission and reception instructions. For example, the integrated smart card UNIX authentication management system described in claim 1, wherein the management database stores user information and UNIX host group data; the account management component provides new account authority for the UNIX host group. Increase/transfer/delete, and perform account authority deployment with the client proxy module; the passcode management component generates random password according to the password principle And the key and the client agent module for password code deployment; and the scheduling management component, periodically driving the passcode management component and updating the password and key, and providing temporary passcode authentication and dynamic password authentication. schedule. For example, the integrated smart card UNIX authentication management system described in claim 1, wherein the account management component reads the personal data file and the account permission file from the management database, and calls the command translation of the client agent module. The component translates the personal data file and the information of the account permission file into legal instructions of the UNIX host operating system for account authority deployment. For example, the integrated smart card UNIX authentication management system described in claim 1, wherein the human interface component is an application for the user to communicate with the core management module, and displays a list of the UNIX host group to receive the user. Select the connected UNIX host; the smart IC card mediation component reads the smart card; and the SSH client component implements a Secure Shell (SSH) and communicates with the UNIX host group, according to the human interface component The selected UNIX host is a terminal application that connects to the user and performs login authentication and remote operation. For example, the integrated smart card UNIX authentication management system described in claim 1 is wherein the smart card is a smart card conforming to ISO 7810 and 7816. An integrated smart card UNIX authentication management method, the steps including at least: A. authentication mode selection procedure, determining an authentication mode according to a smart card state; B. determining a smart card authentication mode and performing authentication; C. determining whether to strengthen authentication control, If yes, go to step D; if no, go to step E; D. Perform dynamic password authentication; and E. Log in to the UNIX system. For example, the integrated smart card UNIX authentication management method described in claim 7 of the patent scope, wherein the smart card authentication mode of the step B further includes B1 smart card authentication, B2 peer certification, B3 temporary password authentication, and B4 supervisor authentication. . For example, the integrated smart card UNIX authentication management method described in the seventh aspect of the patent application, wherein the step B1 smart card authentication further comprises: the B11 system generates a random number authentication code, which is encrypted by the user encrypted credential and transmitted to the user end; B12, the human interface component receives the user identification number (Personal Identification Number code, pin code) input by the user, and is verified by the smart card, and then the authentication code is returned by the smart card; B13 confirms that the authentication code is correct, and the identity verification is performed. The operation master module lists the account list that the user has applied for; the B14 system generates a random RSA key, uploads the public key, and encrypts the private key with the smart card encryption certificate; the B15 system deploys the RSA public key. To a specific server account; B16 starts the SSH client component to connect to the UNIX host, and performs SSH public key authentication through the RSA private key; B17 determines whether to strengthen the authentication control according to the user work area, and if necessary, strengthens the dynamic The password authentication procedure; and B18, if it is not necessary to strengthen the authentication control, complete the login procedure. For example, the integrated smart card UNIX authentication management method described in claim 7 of the patent scope, wherein the step B2 and the certification support further include: B201 checking whether the smart card owner and the user belong to the same department, and if so, performing peer certification; B202 tests whether the smart card is replaced, and the second card user identification number code (Personal Identification Number code, pin code) verifies whether the card is correct; B203 confirms that the card exists and is verified by the personal identification number code (pin code), and The owner is different from the owner of the first card; B204 confirms that the owner and the user belong to the same unit, and completes the peer authentication procedure; B205 receives the temporary password that the user inputs the password-compliant principle, and is used for subsequent re-authentication in a short period of time. B206 completes the temporary passcode setting, uses the temporary passcode as the passphrase, generates the paired temporary RSA key, and stores the RSA private key on the local end for subsequent temporary passcode authentication; B207 operation master The module lists the account list that the user has applied for, and makes a selection judgment; B208 Passing the public key management component, temporarily placing the temporary RSA public key into the trusted public key of the corresponding account of the UNIX host selected by the user; B209 starts the scheduling management component to update the passcode program, and sets the time limit to remove the new one. Increase the temporary trust public key; The B210 initiates the connection of the SSH client component to the server, and uses a temporary pass code as a passphrase with the RSA private key for SSH public key authentication; B211 determines whether to strengthen the authentication control according to the user work area, and if necessary, strengthens The dynamic password authentication procedure is performed; and if the B212 does not need to strengthen the authentication control, the login procedure is completed. For example, the integrated smart card UNIX authentication management method described in claim 7, wherein the step B3 temporary passcode authentication further comprises: B31 confirming that there is a valid temporary RSA private key, prompting the user to input a temporary passcode; B32 to use The pass code entered as a passphrase, and the temporary RSA private key is used to verify whether the temporary pass code is correct; B33 confirms that the temporary pass code is correct, and the operation main control module lists the account list applied by the user; The public key management component temporarily puts the temporary RSA public key into the trusted public key of the specific server corresponding account; B35 starts the scheduling management component to update the password code program, and sets the time limit to remove the added temporary trust. Public key; B36 starts the SSH client component to connect to the server, and uses the temporary pass code as the passphrase with the RSA private key for SSH public key authentication; B37 determines whether to strengthen the authentication control according to the user work area, if Dynamic password authentication procedures are required to be enhanced; B38 If you do not need to strengthen the certification control, complete the login process. For example, the integrated smart card UNIX authentication management method described in claim 7 of the patent scope, wherein the step B4 for authorizing the authentication further includes: B401 generating an authorization code conforming to the password principle, and transmitting the applicant information and the authorization code to the supervisor B402 obtains the authorization code of the supervisor, and enters the system to obtain authorization within the time limit; B403 confirms that the authorization code is correct and valid, and passes the authorization authorization of the supervisor; B404 user inputs the temporary password that conforms to the password principle; B405 completes the temporary password setting, The temporary pass code is used as a passphrase to generate a paired temporary RSA key, and the RSA private key is stored in the local end for subsequent temporary passcode authentication; B406 the operation main control module lists the user application After the public key management component, B407 temporarily puts the temporary RSA public key into the trusted public key of the corresponding UNIX host corresponding account; B408 starts the scheduling management component to update the passcode program, and sets the time limit to expire. Remove the newly added temporary trust public key; B409 initiates the SSH client component to connect to the server, and uses the temporary pass code as the pass code (pass Phrase) SSH public key authentication with the RSA private key; B410 determines whether to strengthen the authentication control according to the user's work area, and if necessary, strengthens the dynamic password authentication procedure; and B411 completes the login procedure if it does not need to strengthen the authentication control. For example, the integrated smart card UNIX authentication management method described in claim 7 wherein the step D1 dynamic password authentication process step further comprises: D11 transmitting the password application notification to the user's supervisor by email; D12 according to The password principle generates a random number password, and the translation component transmits the password to the corresponding account of the server through the command; D13 starts the scheduling management component to change the password program, and sets the password to change the password again when the time limit expires. The password application procedure cannot be repeated within the time limit to prevent the password from being invalidated in advance; and D14 transmits the password to the user by email or SMS, and the user must manually enter the password within the time limit to complete the login procedure. For example, the method for managing the integrated smart card UNIX authentication according to the seventh aspect of the patent application, wherein the step D2 process of updating the pass code further comprises: D21 reading the account list of all the pipe server and the corresponding user encrypted certificate. D22 performs the following key and password update procedures in batch mode; D23 uses the RSA key algorithm to generate the paired public and private keys; D24 updates the corresponding account of the column server through the public key management component of the client agent module. Trust the public key; D25 confirms that the key is successfully updated, encrypts the RSA private key with the user's smart card encryption key, and updates the encrypted RSA private key of the user in the management database; D26 generates a random password according to the password principle. , password through the client proxy module Deploy to the corresponding account; and D27 repeat D22~D26 until all account server passwords are updated.