System, method, and apparatus for secure identity authentication

Patent metadata

Field	Value
Publication number	US-11146554-B2
Application number	US-201615141042-A
Country	US
Kind code	B2
Filing date	Apr 28, 2016
Priority date	Apr 30, 2015
Publication date	Oct 12, 2021
Grant date	Oct 12, 2021

Abstract

A method for authentication is disclosed. The method may be implemented by a terminal device. The method may comprise generating, by a starting unit of the terminal device, process information of a process of the terminal device before starting the process, transmitting, by the starting unit, the process information to an authentication proxy of the terminal device, requesting, by the process, the authentication proxy to authenticate the process after the process is started, obtaining, by the authentication proxy and from system resources of the terminal device, process information corresponding to the process, and determining, by the authentication proxy, that the process is legal if the obtained process information is the same as the process information transmitted to the authentication proxy.

First claim

What is claimed is:

1. A method for authentication, implemented by a terminal device, comprising:
generating, by a parent process of the terminal device, process information of a process of the terminal device before starting the process;
transmitting, by the parent process, the process information to an authentication proxy of the terminal device;
after the process is started, requesting, by the process, the authentication proxy to authenticate the process;
determining, by the authentication proxy, a path tracing the process to the authentication proxy, wherein the path comprises the parent process and the process;
obtaining, by the authentication proxy and from the terminal device, process information corresponding to the process, wherein the process information corresponding to the process comprises the path tracing the process to the authentication proxy; and
determining, by the authentication proxy, that the process is authenticated, if the obtained process information corresponding to the process that has been started matches the process information transmitted to the authentication proxy before the process having been started.

2. The method for authentication of claim 1 , wherein the process information includes at least one of a process ID of the process, an access path of the process's execution file, or a signature value of the process's execution file.

3. The method for authentication of claim 1 , further comprising:
generating, by the parent process, an original secret key of the process;
transmitting, by the parent process, the original secret key to the authentication proxy;
starting, by the parent process, the process;
transmitting, by the parent process, the original secret key to the process;
authenticating, by the authentication proxy, a secret key transmitted by the process against the original secret key transmitted by the parent process; and
determining that the process is legal, if the authentication is passed.

4. The method for authentication of claim 1 , further comprising:
using, by the authentication proxy, the path as the only identification of the process.

5. The method for authentication of claim 1 , further comprising negotiating, by the authentication proxy, a first secret key for secure communication between the authentication proxy and the process, if the process is determined legal.

6. The method for authentication of claim 5 , further comprising:
requesting, by the process, communication with a target process on a second terminal device;
negotiating, by the authentication proxy, a communication secret key with a target authentication proxy of the second terminal device, in response to the request;
encrypting, by the authentication proxy, the communication secret key with the first secret key to obtain a first ticket;
transmitting, by the authentication proxy, the first ticket to the process; and
decrypting, by the process, the first ticket with the first secret key to obtain the communication secret key for secure communication between the process and the target process.

7. The method for authentication of claim 6 , further comprising:
after negotiating the communication secret key with the target authentication proxy of the second terminal device, receiving, by the authentication proxy, a second ticket transmitted by the target authentication proxy; and
transmitting, by the authentication proxy, the second ticket to the process, the second ticket being obtained by encrypting the communication secret key with the second secret key, and the second secret key being used for communication between the target process and the target authentication proxy.

8. The method for authentication of claim 6 , further comprising obtaining, by the authentication proxy, an identification of the target process from the target authentication proxy, and wherein:
encrypting, by the authentication proxy, the communication secret key with the first secret key to obtain the first ticket comprises encrypting, by the authentication proxy, the communication secret key and the identification of the target process with the first secret key to obtain a first ticket and transmitting the first ticket to the process, and
decrypting, by the process, the first ticket with the first secret key to obtain the communication secret key comprises decrypting, by the process, the first ticket with the first secret key to obtain the communication secret key and the identification.

9. The method for authentication of claim 8 , further comprising:
before communicating with the target process with the communication secret key, determining, by the process, if the target process is an expected communication target based on the identification of the target process; and
communicating, by the process, with the target process with the communication secret key, if the target process is the expected communication target.

10. A non-transitory computer-readable medium storing one or more programs, the one or more programs comprising instructions which, when executed by a processor of a first terminal device, cause the first terminal device to perform a method comprising:
generating, by a parent process of the first terminal device, process information of a process of the first computer system before starting the process;
transmitting, by the parent process, the process information to an authentication proxy of the first terminal device;
after the process is started, requesting, by the process, the authentication proxy to authenticate the process;
determining, by the authentication proxy, a path tracing the process to the authentication proxy, wherein the path comprises the parent process and the process;
obtaining, by the authentication proxy and from the first terminal device, process information corresponding to the process; and
determining, by the authentication proxy, that the process is authenticated, if the obtained process information corresponding to the process that has been started matches the process information transmitted to the authentication proxy before the process having been started.

11. The non-transitory computer-readable medium of claim 10 , wherein the process information includes at least one of a process ID of the process, an access path of the process's execution file, or a signature value of the process's execution file.

12. The non-transitory computer-readable medium of claim 10 , wherein the method further comprises:
generating, by the parent process, an original secret key of the process;
transmitting, by the parent process, the original secret key to the authentication proxy;
starting, by the parent process, the process;
transmitting, by the original secret key to the process;
authenticating, by the authentication proxy, a secret key transmitted by the process against the original secret key transmitted by the parent process; and
determining that the process is legal, if the authentication is passed.

13. The non-transitory computer-readable medium of claim 10 , further comprising:
using, by the authentication proxy, the path as the only identification of the process.

14. The non-transitory computer-readable medium of claim 10 , further comprising:
negotiating, by the authentication proxy, a first secret key for secure communication between the authentication proxy and the process, if the process is determined legal;
requesting, by the process, communication with a target process on a second terminal device;
negotiating, by the authentication proxy, a communication secret key with a target authentication proxy of the second terminal device;
encrypting, by the authentication

Assignees

• Alibaba Group Holding Ltd

Inventors

• YANG Mengzhe
• Zhou Can
• Cheng Lin

Classifications

• G06F2221/2145

  Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy · CPC title

• G06F2221/2129

  Authenticate client device independently of the user · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title