Granted Patent B2

US 12,592,829 · App. 18/123,690 · Granted Mar 31, 2026

Inventors: Lianying Wang (Beijing, CN); Chuanda Ding (Beijing, CN); Yang Yu (Beijing, CN)

Assignee: TENCENT CLOUD COMPUTING (BEIJING) CO., LTD

H04L9/3247H04L9/0825H04L9/0897H04L9/3271H04L63/0823

Abstract

Claims (64)

1 . An access control method of a user device, comprising:

receiving a service access request of a service application, the service access request including identity information of a user;

sending an identity validation request to a user management server based on the service access request, the identity validation request including the identity information of the user;

receiving challenge information from a certificate authority server based on the identity information of the user in the identity validation request being determined to be valid by the user management server, wherein the challenge information is based on a random value and associated with the identity information of the user;

forwarding, by processing circuitry, the challenge information to a key storage component of the user device, the key storage component being configured to generate a public key and a private key;

receiving, by the processing circuitry, signature information of the challenge information from the key storage component, the signature information of the challenge information being generated with the private key;

sending the signature information to the certificate authority server;

receiving a signature valid message from the certificate authority server when the challenge information is verified by the certificate authority server based on the public key that is indicated by a public key certificate from the user management server and associated with the identity information of the user; and

sending, based on the signature valid message, the service access request to the user management server.

2 . The access control method according to claim 1 , wherein

the signature information is generated by the key storage component, and

the private key is inaccessible outside the key storage component.

3 . The access control method according to claim 1 , wherein the key storage component is configured to perform a hash operation on the challenge information to obtain a digital digest of the challenge information, and perform asymmetric encryption processing on the digital digest based on the private key to generate the signature information of the challenge information.

4 . The access control method according to claim 1 , wherein the key storage component is a hardware device.

5 . The access control method according to claim 1 , wherein the identity information of the user in the identity validation request is determined to be valid based on the identity information being included in valid user information.

6 . The access control method according to claim 1 , further comprising:

receiving, by the processing circuitry, the public key from the key storage component; and

sending, by the processing circuitry, a user registration request for the user to the user management server, the user registration request including the public key and user information of the user.

7 . The access control method according to claim 1 , further comprising:

determining an access state of the user; and

sending the service access request to the user management server based on the access state being an allowed access state,

wherein the identity validation request is sent to the user management server based on the access state being an unknown access state.

8 . A non-transitory computer-readable storage medium, storing instructions which when executed by a processor cause the processor to perform the access control method according to claim 1 .

9 . An access control method of a certificate authority server, comprising:

receiving, from a user management server, a challenge request corresponding to validated identity information of a user, the identity information being provided to the user management server in a service access request from a user device;

sending challenge information to a key storage component of the user device, the key storage component being configured to generate a public key and a private key, wherein the challenge information is based on a random value and associated with the identity information of the user;

receiving, from the key storage component of the user device, signature information of the challenge information, the signature information of the challenge information being generated with the private key;

sending a user information query request to the user management server;

receiving a public key certificate associated with the identity information of the user from the user management server based on the user information query request;

determining, by processing circuitry, whether the signature information is verified based on the public key that is indicated by the public key certificate; and

sending a signature valid message to the user device based on the signature information being verified, the signature valid message indicating that the service access request is to be transmitted to the user management server.

10 . The access control method according to claim 9 , wherein the determining whether the signature information is verified comprises:

decrypting, based on the public key of the user, the signature information to obtain a digital digest;

performing a hash operation on the challenge information to obtain a real digital digest of the challenge information; and

determining the signature information is verified based on the digital digest being same as the real digital digest.

11 . The access control method according to claim 9 , wherein the private key is inaccessible outside the key storage component.

12 . The access control method according to claim 9 , wherein the key storage component is a hardware device.

13 . The access control method according to claim 9 , further comprising:

receiving a certificate signing request from the user management server, the certificate signing request including the public key;

generating the public key certificate based on the certificate signing request; and

sending the public key certificate to the user management server.

14 . A non-transitory computer-readable storage medium, storing instructions which when executed by a processor cause the processor to perform the access control method according to claim 9 .

15 . An access control apparatus, comprising:

processing circuitry configured to:

receive a service access request of a service application, the service access request including identity information of a user;

send an identity validation request to a user management server based on the service access request, the identity validation request including the identity information of the user;

receive challenge information from a certificate authority server based on the identity information of the user in the identity validation request being determined to be valid by the user management server, wherein the challenge information is based on a random value and associated with the identity information of the user;

forward the challenge information to a key storage component of the access control apparatus, the key storage component being configured to generate a public key and a private key;

receive signature information of the challenge information from the key storage component, the signature information of the challenge information being generated with the private key;

send the signature information to the certificate authority server;

receive a signature valid message from the certificate authority server when the challenge information is verified by the certificate authority server based on the public key that is indicated by a public key certificate from the user management server and associated with the identity information of the user; and

send, based on the signature valid message, the service access request to the user management server.

16 . The access control apparatus according to claim 15 , wherein

the signature information is generated by the key storage component, and

the private key is inaccessible outside the key storage component.

17 . The access control apparatus according to claim 15 , wherein the key storage component is configured to perform a hash operation on the challenge information to obtain a digital digest of the challenge information, and perform asymmetric encryption processing on the digital digest based on the private key to generate the signature information of the challenge information.

18 . The access control apparatus according to claim 15 , wherein the identity information of the user in the identity validation request is determined to be valid based on the identity information being included in valid user information.

19 . The access control apparatus according to claim 15 , wherein the processing circuitry is configured to:

receive the public key from the key storage component; and

send a user registration request for the user to the user management server, the user registration request including the public key and user information of the user.

20 . The access control apparatus according to claim 15 , wherein the processing circuitry is configured to:

determine an access state of the user, and

send the service access request to the user management server based on the access state being an allowed access state,

wherein the identity validation request is sent to the user management server based on the access state being an unknown access state.

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (28)