TWI894679B - System and method for cross enterprise identity verification - Google Patents

Abstract

A system and a method for cross enterprise identity verification are provided. The method includes following steps: after an inviting-enterprise-server generates an invitation-letter corresponding to an inviter-device, transmitting, by the inviter-device, the invitation-letter to an invitee-device; generating, by an invitee-enterprise-server, an invitee-identity-endorsement, wherein the invitee-identity-endorsement corresponds to the invitee-device and the invitation-letter; and after the invitee-device generates an invitee-identity-proof corresponding to the invitation-letter, verifying, by the inviting-enterprise-server, the invitee-identity-endorsement and the invitee-identity-proof.

Description

Cross-enterprise identity authentication system and method

The present invention relates to a cross-enterprise identity authentication system and method.

To ensure security, identity verification is required before cross-enterprise instant messaging. However, current practices may create security risks by centralizing authentication information with a third party. Alternatively, the server-to-server approach may increase the coupling between enterprises. For technical professionals in this field, there is still a lack of optimal cross-enterprise identity authentication solutions.

The cross-enterprise identity authentication system of the present invention includes an inviting enterprise server, an inviter device, an invited enterprise server, and an invitee device. The inviter device is communicatively connected to the inviting enterprise server. The invitee device is communicatively connected to both the invited enterprise server and the inviting enterprise server. After the inviting enterprise server generates an invitation letter corresponding to the inviter device, the inviter device transmits the invitation letter to the invitee device. The invited enterprise server generates an invitee identity endorsement corresponding to the invitee device and the invitation letter. After the invitee device generates an invitee identity certificate corresponding to the invitation letter, the inviting enterprise server verifies the invitee identity endorsement and the invitee identity certificate.

The cross-enterprise identity verification method of the present invention includes the following steps: after the inviting enterprise server generates an invitation letter corresponding to the inviter's device, the inviter device transmits the invitation letter to the invitee device; the invited enterprise server generates an invitee identity endorsement, wherein the invitee identity endorsement corresponds to the invitee device and the invitation letter; and after the invitee device generates an invitee identity certificate corresponding to the invitation letter, the inviting enterprise server verifies the invitee identity endorsement and the invitee identity certificate.

1: Cross-enterprise identity authentication system

10: Invite Enterprise Server

20: Inviter device

30: Invited to the enterprise server

40: Invitee device

S100, S101, S102, S103, S104, S200, S201, S202, S203, S204, S300, S301, S302, S303, S304, S400, S401, S402, S403, S404, S31, S33, S35: Steps

Figure 1 is a schematic diagram of a cross-enterprise identity verification system according to an embodiment of the present invention.

Figure 2 is a schematic diagram of the operation of the cross-enterprise identity authentication system shown in Figure 1.

Figure 3 is a flow chart illustrating a cross-enterprise identity verification method according to an embodiment of the present invention.

Figure 1 is a schematic diagram of a cross-enterprise identity authentication system 1 according to one embodiment of the present invention. Referring to Figure 1 , the cross-enterprise identity authentication system 1 may include an inviting enterprise server 10, an inviter device 20, an invited enterprise server 30, and an invitee device 40. In this embodiment, the inviter device 20 is communicatively connected to the inviting enterprise server 10, and the invitee device 40 is communicatively connected to both the invited enterprise server 30 and the inviting enterprise server 10. In this embodiment, the inviting enterprise server 10, the inviter device 20, the invited enterprise server 30, and the invitee device 40 may all include essential components such as a communication chip (not shown), a storage device (not shown), and a processing module (not shown).

Figure 2 is a schematic diagram of the operation of the cross-enterprise identity authentication system 1 shown in Figure 1. Please refer to Figures 1 and 2 simultaneously. It should be noted that step S100 shown in Figure 2 may include step S101, step S102, step S103, and step S104. Step S200 shown in Figure 2 may include step S201, step S202, step S203, and step S204. Step S300 shown in Figure 2 may include step S301, step S302, step S303, and step S304. Step S400 shown in Figure 2 may include step S401, step S402, step S403, and step S404.

In step S100, the inviting enterprise server 10, the inviter device 20, the invited enterprise server 30, and the invitee device 40 may perform preliminary operations.

Specifically, in step S101, the inviting enterprise server 10 may use asymmetric cryptography to generate the inviting enterprise server public key ( ) and invite enterprise server private key ( For example, the inviting enterprise server 10 can use RSA (Rivest-Shamir-Adleman) to generate the inviting enterprise server public key ( ) and invite enterprise server private key ( On the other hand, the invited enterprise server 30 can use asymmetric cryptography to generate the invited enterprise server public key ( ) and the invited enterprise server private key ( For example, the invited enterprise server 30 can use Elliptic Curve Cryptography to generate the invited enterprise server public key ( ) and the invited enterprise server private key ( Then, the inviting enterprise server 10 can send the inviting enterprise server public key ( ) to the invited enterprise server 30, and the invited enterprise server 30 can send the invited enterprise server public key ( ) to the inviting enterprise server 10. For example, the inviting enterprise server 10 and the invited enterprise server 30 may pre-agreed on the S/MIME (Secure Multipurpose Internet Mail Extensions) method. Then, the inviting enterprise server 10 may use the S/MIME method to send the inviting enterprise server public key ( ) to the invited enterprise server 30, and the invited enterprise server 30 can use S/MIME to send the invited enterprise server public key ( ) to invite the enterprise server 10.

In step S102, the inviting enterprise server 10 may send the inviting enterprise server public key ( ) to the inviter device 20. For example, the inviting enterprise server 10 can send the inviting enterprise server public key ( ) to the inviter device 20.

In step S103, the invited enterprise server 30 may send the invited enterprise server public key ( ) to the invitee device 40. For example, the invited enterprise server 30 can transmit the invited enterprise server public key ( ) to the invitee device 40.

In step S104, the inviter device 20 may transmit the inviter's email address ( Address ₂₀ ) corresponding to the inviter device 20 to the invitee device 40. Conversely, the invitee device 40 may transmit the invitee's email address ( Address ₄₀ ) corresponding to the invitee device 40 to the inviter device 20. For example, the inviter (using the inviter device 20) and the invitee (using the invitee device 40) may have previously known each other's email addresses through business card exchange. More specifically, the inviter's email address ( Address ₂₀ ) may include the inviter's user ID and the inviter's company ID (using the inviter's device 20). These user IDs and company IDs can be used to identify the inviter and the inviter's company. Meanwhile, the invitee's email address ( Address ₄₀ ) may include the invitee's user ID and company ID (using the invitee's device 40). These user IDs and company IDs can be used to identify the invitee and the invitee's company. More specifically, the inviter's company and the invitee's company are different companies. It should be noted that although this embodiment uses the inviter's email address ( Address ₂₀ ) and the invitee's email address ( Address ₄₀ ) for illustration, the present invention is not limited to this. In other embodiments, the present invention may also not use email addresses, but instead use text or a format that can distinguish between the user ID and the company ID based on actual needs.

Please continue to refer to FIG. 2. In step S200, the inviting enterprise server 10 generates an invitation letter ( INV ₁₀ ( ))After that, the inviter device 20 can send the invitation letter ( INV ₁₀ ( )) to the invitee device 40.

Specifically, in step S201, the inviter device 20 may send an invitation letter generation request corresponding to the invitation letter to the inviting enterprise server 10, wherein the invitation letter generation request may include the invitee's email address ( Address ₄₀ ).

In step S202, the inviting enterprise server 10 may generate an invitation letter ( INV ₁₀ ( )), including invitation letter ( INV ₁₀ ( )) may include the inviter's email address ( Address ₂₀ ) and the invitee's email address ( Address ₄₀ ). Specifically, after the inviting enterprise server 10 receives the invitation letter generation request from the inviter device 20, the inviting enterprise server 10 may first confirm whether the requester is the inviter device 20. For example, the inviting enterprise server 10 may use the token generated in the invitation letter generation request to confirm the requester's identity. Then, after the inviting enterprise server 10 confirms that the requester is the inviter device 20, the inviting enterprise server 10 may enter the inviter's email address ( Address ₂₀ ) of the inviter (using the inviter device 20) in the "Inviter User ID and Inviter Enterprise ID" of the invitation letter, and the inviting enterprise server 10 may enter the invitee's email address ( Address _{40 )} in the invitation letter generation request in the "Invitee User ID and Invitee Enterprise ID" of the invitation letter. )) can also include invitation ID, invitation connection information, validity timestamp and signature of the inviting enterprise server 10. In detail, the inviting enterprise server 10 can use the inviting enterprise server private key ( ) to sign the invitation ID, invitation connection information, inviter email address ( Address ₂₀ ), invitee email address ( Address ₄₀ ), and validity timestamp.

In step S203, the inviting enterprise server 10 may send an invitation letter ( INV ₁₀ ( )) to the inviter device 20.

In step S204, when the inviter device 20 uses the invitation enterprise server public key ( ) to successfully verify the invitation letter ( INV ₁₀ ( )), the inviter device 20 may send an invitation letter ( INV ₁₀ ( )) to the invitee device 40. Specifically, when the inviter device 20 uses the invitation enterprise server public key ( ) to verify the invitation letter ( INV ₁₀ ( )) and the invitation letter generation request are matched, the inviter device 20 can send the invitation letter ( INV ₁₀ ( )) is encoded into a two-dimensional barcode, and the inviter device 20 can send the two-dimensional barcode to the invitee device 40. In other embodiments, the inviter device 20 can use the invitee's email address ( Address ₄₀ ) to send the invitation letter ( INV ₁₀ ( )) to the invitee device 40. The present invention does not limit the inviter device 20 to send the invitation letter ( INV ₁₀ ( )) way.

Please continue to refer to FIG. 2. In step S300, the invited enterprise server 30 may generate an invitee identity endorsement ( ENDT ₃₀ ( )), where the invitee's identity endorsement ( ENDT ₃₀ ( )) may correspond to the invitee device 40 and the invitation letter ( INV ₁₀ ( )).

Specifically, in step S301, the invitee device 40 may use asymmetric cryptography to generate the invitee temporary public key ( ) and the invitee's temporary private key ( ). According to the above embodiment, the invitee device 40 can decode the two-dimensional barcode to obtain the invitation letter ( INV ₁₀ ( )). The asymmetric cryptography is, for example, elliptical cryptography.

In step S302, the invitee device 40 may send an invitee identity endorsement generation request corresponding to the invitation letter to the invited enterprise server 30, wherein the invitee identity endorsement generation request may include the invitation letter ( INV ₁₀ ( )) and the invitee's temporary public key ( ).

In step S303, when the invited enterprise server 30 uses the inviting enterprise server public key ( ) to successfully verify the invitee identity endorsement generation request, the invited enterprise server 30 may generate the invitee identity endorsement ( ENDT ₃₀ ( )), wherein the invitee identity endorsement may include the invitee email address ( Address ₄₀ ). In detail, after the invited enterprise server 30 receives the invitee identity endorsement request from the invitee device 40, the invited enterprise server 30 may first perform data confirmation, wherein the data confirmation includes but is not limited to: (1) confirming that the requester is the invitee using the invitee device 40 (2) using the inviting enterprise server public key ( )Verification Invitation Letter ( INV ₁₀ ( ))'s signature validity (3) Confirm invitation letter ( INV ₁₀ ( ))The valid timestamp has not expired (4)Confirm invitation letter ( INV ₁₀ ( )) matches the invitee in the requester that sent the invitee identity endorsement request. If (1) to (4) above are all confirmed to be correct and the invitation ID has not appeared before, the invited enterprise server 30 can generate the invitee identity endorsement ( ENDT ₃₀ ( )). Furthermore, the invitee's identity endorsement ( ENDT ₃₀ ( )) can also include invitation ID, invitation letter ( INV ₁₀ ( )) hash value, invitee's temporary public key ( ), valid timestamp and signature of the invited enterprise server 30. In detail, the invited enterprise server 30 can use the invited enterprise server private key ( ) to the invitation ID, invitee email address ( Address ₄₀ ), invitation letter ( INV ₁₀ ( )) hash value, invitee's temporary public key ( ) and a valid timestamp execution signature. It should be noted that the same invitation ID can only generate one invitee identity endorsement ( ENDT ₃₀ ( )). If the invited enterprise server 30 has generated an invitee identity endorsement for a specific invitation ID ( ENDT ₃₀ ( )), and if the invited enterprise server 30 receives the invitee identity endorsement generation request for this specific invitation ID again, the invited enterprise server 30 may reply an error message to the invitee device 40.

In step S304, the invitee device 40 may receive the invitee identity endorsement ( ENDT ₃₀ ( )), and the invitee device 40 can use the invited enterprise server public key ( ) to verify the identity endorsement of the invitee ( ENDT ₃₀ ( )). In detail, the invitee device 40 can use the invited enterprise server public key ( ) to verify whether the content of the invitee's identity endorsement matches the invitee's identity endorsement generation request.

Please continue to refer to FIG. 2. In step S400, the invitee device 40 generates a corresponding invitation letter ( INV ₁₀ ( ))'s Proof of Identity ( Proof ₄₀ ( ) after which the inviting enterprise server 10 can verify the invitee's identity endorsement ( ENDT ₃₀ ( )) and the invitee's identity certificate ( Proof ₄₀ ( ).

Specifically, in step S401, the invitee device 40 may use the invitee temporary private key ( ) to generate the corresponding invitation letter ( INV ₁₀ ( ))'s Proof of Identity ( Proof ₄₀ ( Furthermore, the invitee's identity proof ( Proof ₄₀ ( ) may include invitation ID, invitation letter ( INV ₁₀ ( )) hash value, validity timestamp and signature of the invitee device 40. In detail, the invitee device 40 can use the invitee temporary private key ( ) to the invitation ID, invitation letter ( INV ₁₀ ( )) and a valid timestamp to execute the signature.

In step S402, the invitee device 40 may send the corresponding invitation letter ( INV ₁₀ ( )) of the invitee identity verification request to the inviting enterprise server 10, wherein the invitee identity verification request may include the invitee identity endorsement ( ENDT ₃₀ ( )) and the invitee's identity certificate ( Proof ₄₀ ( In detail, the invitee device 40 can use the invitation letter ( INV ₁₀ ( )) to obtain the method/address for connecting to the invited enterprise server 10.

In step S403, the inviting enterprise server 10 can use the invited enterprise server public key ( ) to verify the identity endorsement of the invitee ( ENDT ₃₀ ( )), you can use the invitee's temporary public key ( ) to verify the invitee's identity ( Proof ₄₀ ( ) and can obtain the identity verification result. In detail, after the inviting enterprise server 10 receives the invitee identity verification request from the invitee device 40, the inviting enterprise server 10 can perform identity verification, wherein the identity verification includes but is not limited to: (1) using the invited enterprise server public key ( ) to check the identity endorsement of the invitee ( ENDT ₃₀ ( ))'s signature (2) endorsed by the invitee ( ENDT ₃₀ ( )) to obtain the invitee's temporary public key ( ) and use the invitee's temporary public key ( ) to verify the invitee's identity ( Proof ₄₀ ( )'s signature (3) confirms the identity endorsement of the invitee ( ENDT ₃₀ ( )) has not expired, and the invitee's identity is confirmed ( Proof ₄₀ ( )'s valid timestamp has not expired (4) Confirm the identity endorsement of the invitee ( ENDT ₃₀ ( ))'s invitation ID matches the invitee's ID ( Proof ₄₀ ( ) invitation ID (5) to confirm whether there is an invitation letter with a valid time stamp corresponding to the invitation ID and not expired in the inviting enterprise server 10 ( INV ₁₀ ( ))(6) Check the invitation letter generated by the invitation enterprise server 10 ( INV ₁₀ ( )) in the invitee's email address ( Address ₄₀ ) matches the invitee's identity endorsement ( ENDT ₃₀ ( )) in the invitee's email address ( Address ₄₀ ). If all of the above (1) to (6) are confirmed to be correct, the inviting enterprise server 10 can determine that the identity of the requester of the invitee identity verification request is the invitee device 40.

In step S404, the inviting enterprise server 10 may transmit the identity verification result to the invitee device 40.

Figure 3 is a flow chart illustrating a cross-enterprise identity verification method according to an embodiment of the present invention. The method can be implemented by the cross-enterprise identity verification system 1 shown in Figure 1 . In step S31, after the inviting enterprise server generates an invitation letter corresponding to the inviter's device, the inviter device transmits the invitation letter to the invitee device. In step S33, the invited enterprise server generates an invitee identity endorsement, where the invitee identity endorsement corresponds to the invitee device and the invitation letter. In step S35, after the invitee device generates an invitee identity certificate corresponding to the invitation letter, the inviting enterprise server verifies the invitee identity endorsement and the invitee identity certificate. The method has been described in the aforementioned embodiment and will not be repeated here.

In summary, the cross-enterprise identity authentication system and method of the present invention enables the inviting enterprise's server to generate an invitation letter for the inviter's device. Subsequently, after the invited enterprise's server generates the invitee's identity endorsement and the invitee's device generates the invitee's identity certificate, the inviting enterprise's server verifies the invitee's identity endorsement and the invitee's identity certificate. Consequently, enterprises do not need to establish additional server connections. Instead, cross-enterprise identity authentication can be performed by pre-exchanging public keys over a secure channel, thereby reducing implementation costs and barriers to entry. Furthermore, user authentication information can be stored within the enterprise rather than being disclosed to third parties, thus reducing the risk of enterprise information leakage.

S31, S33, S35: Steps

Claims (6)

A cross-enterprise identity verification system comprises: an inviting enterprise server; an inviter device; an invited enterprise server; and an invitee device, wherein the inviter device is communicatively connected to the inviting enterprise server, wherein the invitee device is communicatively connected to both the invited enterprise server and the inviting enterprise server, wherein after the inviting enterprise server generates an invitation letter corresponding to the inviter device, the inviter device transmits the invitation letter to the invitee device; the invited enterprise server generates an invitee identity endorsement, wherein the invitee identity endorsement corresponds to the invitee device and the invitation letter; After the invitee device generates an invitee identity certificate corresponding to the invitation letter, the inviting enterprise server verifies the invitee identity endorsement and the invitee identity certificate. A cross-enterprise identity authentication system as described in claim 1, wherein: the inviting enterprise server uses asymmetric cryptography to generate an inviting enterprise server public key and an inviting enterprise server private key; the invited enterprise server uses the asymmetric cryptography to generate an invited enterprise server public key and an invited enterprise server private key; the inviting enterprise server transmits the inviting enterprise server public key to the invited enterprise server; the invited enterprise server transmits the invited enterprise server public key to the inviting enterprise server; the inviting enterprise server transmits the inviting enterprise server public key to the inviter device; the invited enterprise server transmits the invited enterprise server public key to the invitee device; The inviter device transmits the inviter email address corresponding to the inviter device to the invitee device; The invitee device transmits the invitee email address corresponding to the invitee device to the inviter device. The cross-enterprise identity authentication system of claim 1, wherein: the inviter device transmits an invitation letter generation request corresponding to the invitation letter to the inviting enterprise server, wherein the invitation letter generation request includes the invitee's email address; the inviting enterprise server generates the invitation letter, wherein the invitation letter includes the inviter's email address and the invitee's email address; the inviting enterprise server transmits the invitation letter to the inviter device; when the inviter device successfully verifies the invitation letter using the inviting enterprise server's public key, the inviter device transmits the invitation letter to the invitee device. The cross-enterprise identity authentication system of claim 1, wherein: the invitee device utilizes asymmetric cryptography to generate an invitee temporary public key and an invitee temporary private key; the invitee device transmits an invitee identity endorsement generation request corresponding to the invitation letter to the invited enterprise server, wherein the invitee identity endorsement generation request includes the invitation letter and the invitee temporary public key; when the invited enterprise server successfully verifies the invitee identity endorsement generation request using the inviting enterprise server public key, the invited enterprise server generates the invitee identity endorsement, wherein the invitee identity endorsement includes the invitee email address; The invitee device receives the invitee identity endorsement from the invited enterprise server, and the invitee device verifies the invitee identity endorsement using the invited enterprise server public key. The cross-enterprise identity authentication system of claim 1, wherein: the invitee device generates the invitee identity certificate corresponding to the invitation letter using the invitee temporary private key; the invitee device transmits an invitee identity authentication request corresponding to the invitation letter to the inviting enterprise server, wherein the invitee identity authentication request includes the invitee identity endorsement and the invitee identity certificate; the inviting enterprise server verifies the invitee identity endorsement using the invited enterprise server public key and verifies the invitee identity certificate using the invitee temporary public key, and obtains an identity authentication result; the inviting enterprise server transmits the identity authentication result to the invitee device. A cross-enterprise identity verification method, suitable for a system comprising an inviting enterprise server, an inviter device, an invited enterprise server, and an invitee device, wherein the method comprises the following steps: After the inviting enterprise server generates an invitation letter corresponding to the inviter device, the inviter device transmits the invitation letter to the invitee device; The invited enterprise server generates an invitee identity endorsement, wherein the invitee identity endorsement corresponds to the invitee device and the invitation letter; and After the invitee device generates an invitee identity certificate corresponding to the invitation letter, the inviting enterprise server verifies the invitee identity endorsement and the invitee identity certificate.