CN104320389A - Fusion identify protection system and fusion identify protection method based on cloud computing - Google Patents

Abstract

The invention discloses a fusion identity protection system and method based on cloud computing, so as to realize the effective protection of network identity security through public cloud and private cloud architecture under the cloud computing environment. The present invention adopts the unique distributed cluster management of cloud computing, integrates an infinite number of existing and unknown strong identity authentication means through a unified standard interface, and provides users with a single-entry authentication interface, and allows users to Independently choose authentication means of different security levels. In addition, the present invention also builds biometric identification technology and digital authentication technology into the security cloud terminal to protect the cloud computing platform and user client desktop from illegal control machine intrusion.

Description

A cloud computing-based integrated identity protection system and method

technical field

The invention relates to a cloud technology-based identity authentication system and method, belonging to the field of cloud security operating systems.

Background technique

With the gradual improvement of cloud computing technology and the gradual formation of the industrial chain, the demand for cloud security operating systems in various industries in the national economy and society will grow rapidly. The cloud security operating system itself is a virtualized cloud platform. All data and applications are stored in the cloud. Communication connections between the cloud and users are established through encrypted channels to achieve data access and control. Through this isolation system, ensure The security of data storage is ensured, and data loss will not be caused by the failure of the user terminal. However, at the same time, due to the discrete and disordered nature of the cloud, there are extremely high security risks, and user identity information is easily leaked. The basic way to solve this problem is to protect user identity information through identity authentication technology. .

Identity authentication is divided into two basic categories: authentication between users and hosts and authentication between hosts. In the existing identity authentication system, when performing user identity authentication, the identity is determined mainly through three basic methods based on physiological or behavioral characteristics, knowledge-based, and token-based; among them, the method based on physiological or behavioral characteristics is mainly through life. The biometric or behavioral characteristics that come with the identity authentication, that is, biometric authentication; the knowledge-based method mainly uses passwords or PIN codes for identity authentication, including static and dynamic methods; the token-based method mainly uses the user's Possessed identity document for identity verification. At present, the commonly used identity authentication mechanism is mainly based on the static password method. The identity authentication system maintains a two-tuple information for each user. When the user logs in to the system, he enters his ID and password, and the system combines the entered information and the information maintained by himself. Matching is performed to determine the legitimacy of the user.

The existing identity authentication system is convenient and simple to operate, but the existing identity authentication system is mainly a single-factor authentication method. Restricted by unfavorable factors such as , there is a very high risk of potential safety hazards.

Contents of the invention

In order to solve the above problems, the present invention provides a cloud computing-based integrated identity protection system and method, and the specific technical solutions are as follows:

A converged identity protection system based on cloud computing, including a secure cloud terminal, an identity authentication server, and a cloud virtual machine server cluster, wherein,

Security cloud terminal interface The motherboard integrates biometric authentication equipment including UPEK fingerprint identification system, and also integrates a digital certificate IC module, which supports PKI authentication, digital signature, data encryption and other security applications; the motherboard hardware level has controllable WiFi and USB interfaces , The controllable signal input and output interface of the "activation/deactivation" state of the optical fiber photoelectric converter supports the direct access of optical fiber to the security cloud terminal, and eliminates the threat of data information leakage hidden in ordinary Ethernet and wireless networks.

The identity authentication server is responsible for realizing the authentication of the user's identity;

The cloud virtual machine server cluster is responsible for the authentication of identity authentication operations, the verification of identity authentication results, and the monitoring and management of identity authentication mode updates.

Further, the security cloud terminal of the present invention deploys interface software for docking with the identity authentication server and the cloud virtual machine management server; the security cloud terminal automatically supports different network architectures of public cloud and private cloud; the cloud terminal has a built-in hardware true random number generator;

Furthermore, the security cloud terminal is deployed between the identity authentication server and the cloud virtual machine server to support RSA, ECC public key algorithm engines, support standard commercial secrets such as RSA, ECC and other algorithms, and support DES, 3DES, AES algorithm data encryption and decryption, etc. The encrypted encryption algorithm module isolates and protects the transmitted data, effectively prevents malicious attacks, and prevents the leakage of sensitive user information.

Furthermore, the transmission of information adopts HTTPS/SSL secure transmission channel to ensure the security of information during transmission, and at the same time, encrypt and hash the communication content to ensure the security of information content.

Further, the identity authentication mark is stored in the secure cloud terminal, the identity authentication server and the cloud virtual machine server cluster in the form of a list.

In the present invention, the cluster end of the cloud virtual machine server can automatically return the execution result to the identity authentication server, thereby enhancing the post-event audit capability. The cloud virtual machine server cluster can provide a complete log recording function, and the recorded content includes the login time, login user identity, login virtual machine system, and terminal IP address used for login.

A fusion identity protection method based on cloud computing, comprising the following steps:

User requests identity authentication: The user enters user identity information through the security cloud terminal, selects a specific identity authentication method, and the security cloud terminal automatically encrypts the user's instant identity authentication request information, and passes the identity authentication method identification and user identity information through a secure transmission channel The data is transmitted to the cloud virtual machine server cluster.

Authentication of identity authentication by the cloud virtual machine server cluster: After receiving the user identity authentication request, the cloud virtual machine server cluster authenticates the security cloud terminal and the identity authentication server involved in the user identity authentication operation through the authentication server, specifically including: Obtain the security cloud terminal and identity authentication server information involved in user identity authentication operations, check whether the security cloud terminal has the right to initiate identity authentication operations, and check the legitimacy and adaptability of the requested authentication server; after the authentication is passed, the cloud virtual machine The server cluster writes the user identity authentication request message into the message management server in the server cluster, and sends the identity authentication confirmation message to the corresponding security cloud terminal and the identity authentication server, and sends the authentication result to the security cloud terminal and the identity authentication server. If a secure cloud terminal fails the legality verification, the data storage server in the cloud virtual machine server cluster records the number of the secure cloud terminal that failed the authentication and the cause of the error, and directly sends an authentication failure message to the secure cloud terminal.

User identity authentication on the authentication server side: the identity authentication server adapts the corresponding authentication mechanism according to the received user identity authentication request message and the authentication mode identifier selected by the user on the security cloud terminal side, and transmits the identity authentication result to the Cloud virtual machine.

Verification of user identity authentication on the server cluster side of the cloud virtual machine: After receiving the authentication result of the user identity from the identity authentication server, the cloud virtual machine matches it with the user identity information backed up in the data storage server in the server cluster, Perform secondary verification on authenticated user identities. If the identity verification is successful, the identity verification result is sent to the security cloud terminal, and if the verification is unsuccessful, the reason for the verification error is returned to the identity verification server, and the user identity is re-authenticated until the user's identity information is determined.

The user identity information backed up in the data storage server in the cloud virtual machine server cluster is composed of the ID of the identity authentication server and the mirror image of the user identity information, that is, the cloud virtual machine server cluster database backs up the user's multi-dimensional identity data information and The ID number of the identity authentication server matching different authentication request methods.

Further, the legality authentication includes: checking whether the security cloud terminal involved in the user identity authentication operation has the right to initiate the identity authentication operation; checking whether the identity authentication server involved in the user identity authentication operation can perform the identity authentication operation. Adaptive authentication includes: checking whether the user identity to be authenticated belongs to the authentication service category of the authentication server; checking whether the user identity authentication method initiated by the security cloud terminal belongs to the authentication service category of the server. If an identity authentication server fails the legality verification, the cloud virtual machine server sends an alarm to inform that the identity server may be a malicious server.

Further, the present invention also includes the step of updating and upgrading the user identity authentication method, specifically including:

Update of identity authentication methods on the security cloud terminal side: including the upgrade of existing user authentication methods and the addition of new user authentication methods. The upgrade of existing authentication methods can be upgraded locally through USB and the cloud platform sends upgrade instructions and upgrade data packets to the security cloud terminal for remote upgrade; adding new user authentication methods includes adding new biometric authentication sensor devices and adding new digital certificates IC modules. After the update of the identity authentication method on the terminal side of the security cloud is completed, the new user authentication method information is sent to the cloud virtual machine.

Update and upgrade on the server cluster side of the cloud virtual machine: After the cloud virtual machine receives the operation of updating the identity authentication method sent by the security cloud terminal, it matches it with the authentication method of the data storage server in the server cluster. If there is no form of authentication, the identity authentication logo will not be updated; if there is no such form of authentication, a new identity authentication logo will be given, and the new identity authentication logo will be sent to the security cloud terminal to update the security cloud terminal. Authentication ID. At the same time, the message management server in the cloud virtual machine server cluster sends the update request of this identity authentication method to the cloud platform, and the update operation is performed after the cloud platform administrator returns a confirmation message.

After the cloud virtual machine server cluster completes the update and upgrade operation, it will compare the newly updated user identity authentication method with the ID of the identity authentication server stored in the data storage server. If there is such an identity authentication server, it will update The upgrade request and the new identity authentication identifier are sent to the identity authentication server of the corresponding ID. If there is no such identity authentication server, the update and upgrade request is sent to the cloud platform administrator, and a request for deploying a new identity authentication server is sent.

Identity authentication server update and upgrade: According to the comparison results in the cloud virtual machine server cluster in the update and upgrade steps of the cloud virtual machine server cluster side, if there is no identity authentication server that matches the newly updated and upgraded identity authentication method, deploy a new one Identity authentication server, and send the ID number of the new identity authentication server to the cloud virtual machine; when there is an identity authentication server that matches the newly updated and upgraded identity authentication method, the cloud virtual machine will send an update request to the corresponding ID After receiving the update and upgrade request information, the identity authentication server sends a confirmation message to the cloud virtual machine server cluster, and the cloud virtual machine server cluster then sends a new identity authentication identifier and update data packet to the identity authentication server, and the identity authentication server Perform update and upgrade operations.

Test of the newly upgraded identity authentication method: After the identity authentication server completes the update and upgrade operation, it sends an update confirmation message to the cloud virtual machine server cluster, and the cloud virtual machine server cluster sends a test request to the cloud platform administrator. The administrator of the cloud platform updates and upgrades based on the aforementioned user request identity authentication, cloud virtual machine server cluster authentication for identity authentication, user identity authentication on the authentication server side, and cloud virtual machine server cluster side user identity authentication verification steps. The identity authentication method is used for test operation. If the test fails, repeat the above steps of updating and upgrading the user identity authentication mode until the test passes, and if the test passes, the update and upgrade operation is completed.

Furthermore, before the cloud virtual machine server cluster updates its own authentication method, it will conduct a security assessment of the identity authentication method to be updated, determine the security level of the new identity authentication method, and then perform corresponding upgrade operations according to its security level .

The present invention adopts the unique distributed cluster management of cloud computing, integrates an infinite number of existing and unknown strong identity authentication methods through a unified standard interface, and provides users with a single-entry authentication interface, and users can use it according to their immediate needs. Independently select authentication methods of different security levels to realize effective protection of network identity security through public cloud and private cloud architecture in cloud computing environment. In addition, the present invention also builds biometric identification technology and digital authentication technology into the secure cloud terminal, providing multi-factor high-strength identity virtualization authentication including user login name, login ID number, biometric information, and digital key, combining role Multiple security functions such as type-based access control and fine-grained security audit protect the cloud computing platform and user client desktops from illegal control machine intrusion. In the present invention, the user identity authentication system adopts a variety of security authentication and protection facilities and integrates them on the low-power, micro-volume security cloud terminal through a unified strategy, so that the data and user information of the security cloud terminal are effectively protected.

Description of drawings

Figure 1 is an architecture diagram of a converged identity protection system based on cloud computing.

Fig. 2 is a basic flowchart of user identity authentication operation.

Fig. 3 is a basic flow chart of updating and upgrading the user identity authentication mode.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

The architecture of the integrated identity protection system based on cloud computing is shown in Figure 1. The system includes secure cloud terminals, identity authentication servers, and cloud virtual machine server clusters. The built-in fingerprint sensor and built-in digital certificate can realize the input request of user identity authentication; the controllable WiFi and controllable optical fiber module can realize the encrypted transmission of user identity authentication request information and identity authentication mode update information; the controllable USB interface can realize secure cloud terminal The download of stored data and the local upgrade service of identity authentication methods; the identity authentication server can realize the authentication of user identities; the cloud virtual machine server cluster can realize the authentication of identity authentication operations, the verification of identity authentication results, and the monitoring of identity authentication method updates and management.

In the present invention, the identity authentication supports the integration of various existing and unknown strong identity authentication methods, and the identity authentication methods can be selected and updated according to actual conditions. Each identity authentication method is distinguished by a unique user identity authentication method identifier. The identity authentication method is identified by 8 bits in the message, and the identity authentication identifier is stored in the secure cloud terminal, the identity authentication server and the cloud virtual server in the form of a list. Machine server clusters to ensure the operability and scalability of user identity authentication. Specific identification examples are shown in the table below.

Table 1. Examples of ID authentication methods

In Table 1, reserved bits are used for unknown purposes; the first 4 bits identify the same type of identity authentication method, and the last 4 bits identify the specific identity authentication method, for example, 00010001 identifies fingerprint authentication, and 00010010 identifies iris authentication.

The basic process of user identity authentication operation is shown in Figure 2:

Step 101: User requests identity authentication

Users can independently choose authentication methods through the unified man-machine interface and software interface on the security cloud terminal, including biometric fingerprint authentication, digital certificate authentication, etc. The secure cloud terminal automatically encrypts the user's timely authentication request information, and transmits the identity authentication method identification and user identity information data to the cloud virtual machine through a secure transmission channel.

Step 102: The cloud virtual machine server cluster authenticates the identity

After the cloud virtual machine receives the user identity authentication request, it first authenticates the security cloud terminal and authentication server involved in the user identity authentication operation through the authentication server in its server cluster, specifically including: obtaining the security cloud terminal and authentication server involved in the user identity authentication operation. Terminal and authentication server information, check whether the security cloud terminal has the right to initiate identity authentication operations, and check the legitimacy and adaptability of the requested authentication server. After the authentication is passed, the cloud virtual machine writes the user identity authentication request message to the message management server in the server cluster, and sends an identity authentication confirmation message to the corresponding security cloud terminal and identity authentication server, and sends the authentication result to the security cloud terminal and authentication server.

Wherein, the legality authentication includes: checking whether the security cloud terminal involved in the user identity authentication operation has the right to initiate the identity authentication operation; checking whether the identity authentication server involved in the user identity authentication operation can perform the identity authentication operation. Adaptive authentication includes: checking whether the user identity to be authenticated belongs to the authentication service category of the authentication server; checking whether the user identity authentication method initiated by the security cloud terminal belongs to the authentication service category of the server.

If a secure cloud terminal fails the legality verification, the data storage server in the cloud virtual machine server cluster records the number of the secure cloud terminal that failed the authentication and the cause of the error, and directly sends an authentication failure message to the secure cloud terminal.

If an identity authentication server fails the legality verification, the cloud virtual machine server sends an alarm to inform that the identity server may be a malicious server.

Step 103: User identity authentication on the authentication server side

According to the received user identity authentication request message, the authentication server adapts the corresponding authentication mechanism according to the authentication mode identifier selected by the user on the security cloud terminal side to perform identity authentication operations, and transmits the identity authentication result to the cloud virtual machine.

Step 104: Verifying user identity authentication on the cloud virtual machine server cluster side

After the cloud virtual machine receives the authentication result of the user identity from the identity authentication server, it matches it with the user identity information ID backed up in the data storage server in the server cluster, and performs a second check on the authenticated user identity. If the identity verification is successful, the identity verification result is sent to the security cloud terminal, and if the verification is unsuccessful, the reason for the verification error is returned to the identity verification server, and the user identity is re-authenticated until the user's identity information is determined.

The user identity information backed up in the data storage server in the cloud virtual machine server cluster is composed of the ID of the identity authentication server and the mirror image of the user identity information, that is, the cloud virtual machine server cluster database backs up the user's multi-dimensional identity data information and The ID number of the identity authentication server matching different authentication request methods.

The basic process of updating and upgrading the user identity authentication method is shown in Figure 3:

Step 201: Update the identity authentication method on the security cloud terminal side

The update of the identity authentication method on the security cloud terminal side includes the upgrade of the existing user authentication method and the addition of a new user authentication method. The upgrade of existing authentication methods can be upgraded locally through USB and the cloud platform sends upgrade instructions and upgrade data packets to the security cloud terminal for remote upgrade; adding new user authentication methods includes adding new biometric authentication sensor devices and adding new digital certificates IC module.

After the update of the identity authentication method on the terminal side of the security cloud is completed, the new user authentication method information is sent to the cloud virtual machine.

Step 202: Update and upgrade the cloud virtual machine server cluster side

After the cloud virtual machine receives the operation of updating the identity authentication method sent by the security cloud terminal, it matches it with the authentication method of the data storage server in the server cluster. If there is such an authentication method in the data storage server, the identity will not be updated. Authentication mark, if there is no such form of authentication, a new identity verification mark is given, and the new identity verification mark is sent to the security cloud terminal to update the identity verification mark in the security cloud terminal. At the same time, the message management server in the cloud virtual machine server cluster sends the update request of this identity authentication method to the cloud platform, and the update operation is performed after the cloud platform administrator returns a confirmation message.

It should be noted that before the cloud virtual machine server cluster updates its own authentication method, it will conduct a security assessment on the identity authentication method to be updated, judge the security level of the new identity authentication method, and then perform corresponding authentication according to its security level. upgrade operation.

After the cloud virtual machine server cluster completes the update and upgrade operation, it will compare the newly updated user identity authentication method with the ID of the identity authentication server stored in the data storage server. If there is such an identity authentication server, it will update The upgrade request and the new identity authentication identifier are sent to the identity authentication server of the corresponding ID. If there is no such identity authentication server, the update and upgrade request is sent to the cloud platform administrator, and a request for deploying a new identity authentication server is sent.

Step 203: Updating the identity authentication server

According to the comparison result in the virtual machine server cluster in step 202, when there is no identity authentication server that matches the newly updated identity authentication mode, a new identity authentication server is deployed, and the ID of the new identity authentication server is ID is sent to the cloud virtual machine; when there is an identity authentication server that matches the newly updated and upgraded identity authentication method, the cloud virtual machine will send an update request to the identity authentication server with the corresponding ID number, and the identity authentication server receives the update and upgrade After requesting information, send a confirmation message to the cloud virtual machine server cluster, and then the cloud virtual machine server cluster sends a new identity authentication logo and update data package to the identity authentication server, and the identity authentication server performs an update and upgrade operation.

Step 204: Test the newly upgraded identity authentication method

After the identity authentication server completes the update and upgrade operation, it sends an update confirmation message to the cloud virtual machine server cluster, and the cloud virtual machine server cluster sends a test request to the cloud platform administrator. The cloud platform administrator performs a test operation on the newly updated identity authentication method according to steps 101-104. If the test fails, repeat steps 201-204 until the test passes, and if the test passes, the updating and upgrading operation is completed.

The technical features involved in the above embodiments may be combined with each other as long as they do not conflict with each other. The present invention is not limited to the above-mentioned embodiments, and all equivalent replacements or technical solutions formed by equivalent replacements fall within the protection scope of the present invention.

Claims (10)

1. A fusion identity protection system based on cloud computing, characterized in that it includes a secure cloud terminal, an identity authentication server, and a cloud virtual machine server cluster, wherein: Biometric authentication equipment and digital certificate IC modules are integrated on the main board of the secure cloud terminal interface, and the hardware level of the main board is provided with controllable WiFi, USB interface, and controllable signal input and output interfaces, and supports direct access of optical fiber to the safe cloud terminal; The identity authentication server is responsible for realizing the authentication of the user's identity; The cloud virtual machine server cluster is responsible for the authentication of identity authentication operations, the verification of identity authentication results, and the monitoring and management of identity authentication mode updates. 2. The system according to claim 1, characterized in that the secure cloud terminal deploys interface software for docking with the identity authentication server and the cloud virtual machine server; the cloud terminal has a built-in hardware true random number generator. 3. The system according to claim 1 or 2, wherein an engine supporting RSA and ECC public key algorithms is deployed between the secure cloud terminal, the identity authentication server and the cloud virtual machine server. 4. The system according to claim 1, wherein the transmission of information adopts HTTPS/SSL secure transmission channel, and the communication content is encrypted and hashed. 5. The system according to claim 1, 2 or 4, wherein the identity authentication mark is stored in the secure cloud terminal, the identity authentication server and the cloud virtual machine server cluster in the form of a list. 6. A fusion identity protection method based on cloud computing, characterized in that it comprises the following steps: User requests identity authentication: the user enters user identity information through the secure cloud terminal and selects an identity authentication method; Authentication of identity authentication by the cloud virtual machine server cluster: the cloud virtual machine server cluster authenticates the secure cloud terminal and the identity authentication server involved in the user identity authentication operation through the authentication server; the cloud virtual machine server cluster selects according to the identity authentication mode identification The corresponding identity authentication server, and initiates an identity authentication request message to it; User identity authentication on the authentication server side: the identity authentication server authenticates the user's identity information according to the user identity information packet sent by the cloud virtual machine server cluster, and returns the identity authentication result to the cloud virtual machine server cluster for identity verification operation; Verification of user identity authentication on the cloud virtual machine server cluster side: call the identity verification server to perform a second verification of the authenticated user identity, and send the verification result to the security cloud terminal. 7. The method according to claim 6, wherein the authentication specifically comprises: acquiring information about the security cloud terminal and the identity authentication server involved in the user identity authentication operation, checking whether the security cloud terminal has the right to initiate the identity authentication operation, Check the legitimacy and suitability of the requested authentication server; If a secure cloud terminal fails the legality verification, the data storage server in the cloud virtual machine server cluster records the number of the secure cloud terminal that failed the authentication and the cause of the error, and directly sends an authentication failure message to the secure cloud terminal. 8. The method according to claim 7, wherein the legality authentication includes: checking whether the security cloud terminal involved in the user identity authentication operation has the right to initiate the identity authentication operation, and checking the identity authentication information involved in the user identity authentication operation. Whether the server can carry out the identity authentication operation; the adaptive authentication includes: checking whether the user identity to be authenticated belongs to the authentication service category of the authentication server, and checking whether the user identity authentication method initiated by the security cloud terminal belongs to the authentication of the authentication server service category. 9. The method according to any one of claims 6 to 8, further comprising the step of updating and upgrading the user identity authentication method, specifically comprising: Update the identity authentication method on the security cloud terminal side: including upgrading the existing user authentication method and adding a new user authentication method. After the update of the identity authentication method on the security cloud terminal side is completed, the new user authentication method information will be sent to the cloud virtual machine; Cloud virtual machine server cluster side update: the cloud virtual machine matches the operation of updating the identity authentication method with the existing authentication method, assigns the new form of authentication method to a new identity authentication mark, and updates the identity in the secure cloud terminal at the same time certification mark; Identity authentication server update and upgrade: According to the update and upgrade steps of the cloud virtual machine server cluster side, decide whether to deploy a new identity authentication server, and send the ID number of the new identity authentication server to the cloud virtual machine; Test of the newly upgraded identity authentication method: After the identity authentication server completes the update and upgrade operation, the administrator of the cloud platform bases on the aforementioned user request identity authentication, authentication of identity authentication by the cloud virtual machine server cluster, user identity authentication on the authentication server side, The verification steps of user identity authentication on the cloud virtual machine server cluster side test the newly updated and upgraded identity authentication methods. 10. The method according to claim 9, wherein, before the cloud virtual machine server cluster updates its own authentication method, it performs a security assessment on the identity authentication method to be updated, and determines the new identity authentication method security level, and then perform corresponding upgrade operations according to its security level.