CN105827624B - an authentication system - Google Patents

Abstract

The invention discloses an identity verification system, which is applied to a video surveillance network, and includes a management server and a client, the client includes a first client and a second client, the first client accesses the management server, and the management The server generates a corresponding access ID, and queries the management server whether the access ID has been authorized, and directly logs in to the management server after being authorized; the second client carries the access ID to connect to the management server, and establishes the access ID, the second access ID in the management server. The binding relationship between the second client and the monitoring user name is used to authorize the first client. In the identity verification system of the present invention, the mobile terminal of the second client authorizes the first client through fingerprint confirmation, and does not need to input complicated user names and passwords every time they log in, which facilitates users to log in on different clients.

Description

an authentication system

technical field

The invention belongs to the technical field of safety verification, in particular to an identity verification system in a video surveillance network.

Background technique

Video surveillance is an important part of the security system. Video surveillance is widely used in many occasions because of its intuition, accuracy, timeliness and rich information content. In recent years, with the rapid development of computer, network, image processing and transmission technology, the popularization trend of video surveillance has become more and more obvious.

With the development of mobile communication technology, especially the popularization of 3G/4G technology, high-bandwidth mobile services provide conditions for the realization of video surveillance on mobile terminals, and more and more users begin to use mobile terminals as customers of video surveillance end. When the user needs to view the video or live video of the video surveillance system, he only needs to log in to the management server of the video surveillance system through a mobile terminal to realize video viewing and live monitoring.

In the prior art, the identity verification of the video surveillance system is mainly through login and verification through user names and passwords. In some video surveillance systems, the management server cannot be accessed directly, and the network needs to be dialed up through the VPN. At this time, the user name and password of the VPN dial-up also need to be entered. However, for a video surveillance system that needs to input user names and passwords multiple times, the user's operations are more cumbersome. If the password is set too simple, it is easy to be guessed and illegally invaded, and if the password is set too complicated, it is not easy to remember and input.

Contents of the invention

The purpose of the present invention is to provide an identity verification system, which avoids the technical problems of cumbersome password input and inconvenient login in the prior art, and can quickly and safely access the video monitoring system.

In order to achieve the above object, the technical scheme of the present invention is as follows:

An identity verification system, applied to a video surveillance network, includes a management server and a client, and the client includes a first client and a second client, wherein:

The first client is used to carry its own feature code to access the management server, and display the corresponding graphic code according to the feedback information of the management server, the graphic code includes the access ID generated by the management server according to the feature code, and sends the The server queries whether the access ID has been authorized, and directly logs in to the management server after obtaining the authorization;

The second client is used to scan the graphic code displayed by the first client, and carry the feature code of the second client and the access ID in the graphic code to connect to the management server. In the management server, there is no such access ID, the second When there is a binding relationship between the client feature code and the monitoring user name, prompt the user to enter the monitoring user name and password, initiate a login to the management server, and record the access ID, the second client feature code and the monitoring user name in the management server name, and establish a binding relationship between user identity information and the access ID on the second client; when there is a binding relationship between the access ID, the second client feature code, and the monitoring user name in the management server , receiving the response information from the management server, inputting user identity information according to the prompt, and sending authorization information carrying the access ID and the second client feature code to the management server;

The management server is configured to, when receiving the connection that the second client carries the feature code and the access ID, inquire whether itself has the binding relationship of the access ID, the feature code and the monitoring user name, and when there is the binding relationship, send The second client sends a response message. After receiving the authorization information of the second client, it judges whether the authorization information is consistent with the recorded access ID, the second client characteristic code and the binding relationship of the monitoring user name. A client logs in; if the binding relationship does not exist, the second client is notified to enter the monitoring user name and password to log in, and after the verification is passed, the binding relationship between the access ID, the second client feature code and the monitoring user name is recorded .

Further, the first client is also used to record the access ID returned by the management server, and when accessing the management server for the second time, carry the access ID to access the management server, and display the graphic code with the access ID for the second client side scan.

Described management server is also used for receiving the visit that the first client carries access ID, after receiving the authorization information of the second client, judges whether authorization information and the access ID of record, the second client characteristic code and monitoring username The binding relationship is consistent, and if they are consistent, the first client is authorized to log in.

Further, the first client is also used to input the VPN user name and password to perform VPN connection when the management server is not authorized by the second client; when the management server is authorized by the second client, directly according to the VPN username and password for VPN connection.

The graphic code also includes management server address, VPN user name and password, and management server address after VPN dial-up.

The second client is also used for performing VPN dial-up according to the VPN user name and password contained in the graphic code, and establishing a VPN connection with the management server.

Further, the management server is also used to record the access ID and login status of the first client as usage traces, and send the management server IP address and port number of the first client access ID and management usage traces to the second client, The second client retains the access ID of the first client and the IP address and port number of the management server for managing usage traces.

The second client is also used to send a disconnection request to the management server, and send the access ID to the IP address and port number of the management server that manages the usage traces, and the management server receives the disconnection request carrying the access ID. After the request, terminate all services with the corresponding first client.

In the identity verification system proposed by the present invention, the access ID is generated by the management server according to the feature code of the PC client, and the mobile terminal of the second client logs into the management server, and the access ID, mobile terminal and monitoring user name are generated in the management server. In the binding relationship, the mobile terminal authorizes the first client through fingerprint confirmation, so as to realize password-free login on the PC client. The identity verification system of the present invention does not need to input complicated user names and passwords every time when logging in, which facilitates users to log in on different clients.

Description of drawings

Fig. 1 is a schematic diagram of the structure of a video surveillance network according to an embodiment of the present invention;

Fig. 2 is a schematic structural diagram of the identity verification system of the present invention.

Detailed ways

The technical solution of the present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments, and the following embodiments do not constitute a limitation of the present invention.

As shown in Figure 1, a video surveillance network includes a management server, a client, and a front-end device. The client can be a PC client or a mobile terminal client. The client logs in to the management server through client software or a browser, and accesses the entire video surveillance system after verification and authorization. The client will also directly access the subordinates managed by the management server. Devices (IPC, storage).

For a large-scale video surveillance system, its video management server VM can be used as the management server in this embodiment. As for the small-scale networking system of NVR+IPC, it can be considered that the NVR is the role of the management server in this embodiment. In particular, a video surveillance system composed of a single IPC can also be considered, and the IPC itself plays the role of a management server. The front-end device in this embodiment generally refers to the network camera IPC. In this embodiment, the management server is described only by taking the video management server as an example, and other devices under the management of the management server are described only by taking the IPC as an example.

As shown in FIG. 2 , an identity verification system in this embodiment is applied to a video surveillance network, and includes a management server and a client, and the client includes a first client and a second client.

In this embodiment, the first client is a PC client, or other fixedly installed clients, large-screen display clients, etc., and the second client is a mobile terminal, or a smart tablet computer, or the like. The general idea of the present invention is that, according to the feature code of the first client, the management server generates the corresponding access ID of the first client and returns it to the first client, and the second client realizes the connection between the access ID and the second client by logging into the management server. Binding, so that the first client can be authorized to log in to the management server without a password through the second client.

The first client, the second client and the management server are described in detail below:

The first client is used to carry its own feature code to access the management server, and display the corresponding graphic code according to the feedback information from the management server. The graphic code includes the access ID generated by the management server according to the feature code, and queries the management server Whether the access ID has been authorized, and directly log in to the management server after being authorized.

Taking the client software installed on the PC as the first client as an example, when the PC client accesses the management server, the PC client can generate a unique feature code based on the characteristics of the PC, such as the MAC address, random number, and login user name. Generate a unique signature. If the PC client directly uses a web browser, a unique feature code can be generated based on the browser version, operating system, and computer name.

After the unique feature code of the PC client is submitted to the management server, the management server generates a random number again, and returns the hash algorithm calculation result of the random number and the submitted unique feature code to the PC client as the access ID of the first client. . The PC client retains this access ID, and the subsequent access uses this access ID and the unique feature code as the distinguishing identifier of the first client.

It is easy to understand that, for different management servers, according to the hash algorithm of the management server, the access IDs generated for the same PC client may be the same or different. But for the same management server, for a PC client, the generated access ID is unique. However, when the feature code on the PC changes, a different access ID will be generated, and details will not be described here.

For example, the feature code corresponding to the PC client is a random number 12938. When accessing the management server for the first time, the random number 12938 is carried, and the management server obtains the access ID 32309 after calculation. The management server generates a QR code or directly returns the access ID to the PC client, and the PC client saves the access ID in a local cookie as a subsequent access ID.

The graphic code in this embodiment is a two-dimensional code, and may also be other identifiable graphic codes such as a barcode. The graphic code displayed on the first client may be directly generated by the management server and then sent to the first client, or generated by the first client on the first client according to the information sent by the management server.

The two-dimensional code includes the following information: the access ID corresponding to the first client (for example, 32309), and the address of the management server. Carrying the address of the management server in the QR code is for multiple management servers. In order to distinguish the logged-in management server, for a video surveillance network with only one management server, this information may not be carried.

After the first client displays the QR code, it starts to continuously inquire the management server whether the access ID has been authorized by the second client, and at the same time, the page displays the input interface for monitoring the user name and password, which is convenient for the user to log in manually on the second client . Once the user confirms the authorization on the second client, the first client can complete the login process, and the login is successful without manually inputting the user name and password.

It is easy to understand that after the first client accesses the management server and the management server generates an access ID according to the feature code of the first client, the first client saves the access ID, and only needs to carry the access ID when it needs to access the management server later. The ID only needs to initiate access to the management server, and display the graphic code with the access ID for the second client to scan.

At present, many video surveillance systems are in the user's private network, and users in the public network need to access the management server through VPN. Therefore, when the first client accesses the management server, it also needs to establish a VPN connection with the management server through VPN dial-up. . In such a system, when you directly access the management server, you will be prompted to download the VPN dial-up client, and then you can connect to the management server only after entering the VPN user name and password through the VPN dial-up client. access.

Specifically, the first client is also used to input the VPN user name and password for VPN connection when the management server is not authorized by the second client; username and password for a VPN connection.

Similarly, the second client also needs to establish a VPN connection with the management server, so the QR code in this embodiment also carries the VPN user name, password, and management server address after VPN dialing.

That is, after the management server establishes a VPN connection with the first client, the above information is generated in a two-dimensional code and returned to the first client, or directly returned to the first client, and the first client generates a two-dimensional code. When the second client accesses the management server, it also needs to perform VPN dial-up according to the VPN user name and password contained in the graphic code, and establish a VPN connection with the management server.

The second client is used to scan the graphic code displayed by the first client, and carries the feature code of the second client and the access ID in the graphic code to connect to the management server. There is no such access ID and second client in the management server. When the feature code is bound to the monitoring user name, the user is prompted to enter the monitoring user name and password, and initiates a login to the management server. binding relationship, and set up the binding relationship between user identity information and the access ID on the second client; when there is a binding relationship between the access ID, the second client feature code and the monitoring user name in the management server, receive For the response information of the management server, input the user identity information according to the prompt, and send the authorization information carrying the access ID and the characteristic code of the second client to the management server.

This embodiment takes the mobile terminal installed with client software as the second client as an example. The mobile terminal can obtain the access ID and management server address corresponding to the first client by scanning the QR code displayed by the first client. Further, the VPN user name and password can also be obtained. Thereby, the management server can be accessed. If the management server is in the private network and needs to be accessed through a VPN connection, then a VPN connection is established first according to the obtained VPN user name and password. The two-dimensional code may also not contain the VPN user name and password, which are manually input by the user himself.

When the second client scans the QR code for the first time, the binding relationship between the access ID, the mobile terminal feature code and the monitoring user name has not been generated in the second client, and there is no corresponding binding relationship in the management server. Therefore, a binding is required, that is, when the second client connects to the management server, the second client carries the access ID and its own feature code, such as the IMEI serial number of the mobile terminal, and the management server will find that it does not have the access ID, the first If there is a binding relationship between the client feature code and the monitoring user name, the connection failure will be returned. The second client prompts to input the monitoring user name and password, initiates login to the management server, and records the binding relationship between the access ID, the second client characteristic code and the monitoring user name in the management server after the authentication is passed.

Simultaneously in the second client, save the access ID of the first client, and prompt the user to input user identity information (such as fingerprint, or face, or retina, the present embodiment takes fingerprint as an example) to bind the saved access ID, At the same time, the second client saves the address connected to the monitoring server and the VPN user name and password. Therefore, when the access ID needs to be carried to access the management server, the user identity information needs to be input for confirmation, which ensures that the operation is performed by the user himself and improves security.

After the second client successfully logs in to the management server, the management server records the binding relationship between the access ID, the feature code of the second client and the monitoring user name. At this time, there is a binding between the access ID and the monitoring user name in the management server Therefore, the management server sends a response message to the second client, that is, the second client displays "the user will log in on the PC client", and prompts to input user identity information (such as fingerprint) for authorization. Once the user inputs the fingerprint, the authorization information carrying the access ID and the second client feature code is sent to the management server.

It is easy to understand that when the second client interacts with the management server for the first time, after the binding has been completed, when scanning the QR code of the first client for the second time, you only need to enter the user identity information to call the binding The access ID of the second client and the characteristic code of the second client initiate access to the management server, and the management server checks whether there is a binding relationship with itself after receiving the access. At this time, there is a binding relationship and sends a response to the second client. Just notify the second client to authorize.

When authorizing, the second client also needs the user to input user identity information, and sends authorization information carrying the access ID and the second client feature code to the management server.

The management server is used to, when receiving the connection of the second client carrying the feature code and the access ID, inquire whether itself has the binding relationship between the access ID, the feature code and the monitoring user name, and when there is the binding relationship, notify The second client authorizes. After receiving the authorization information of the second client, it judges whether the authorization information is consistent with the recorded access ID, the second client characteristic code and the binding relationship of the monitoring user name. If it is consistent, the first client is authorized. Client login; if the binding relationship does not exist, the second client is notified to log in, and after the verification is passed, the binding relationship of the access ID, the second client characteristic code and the monitoring user name is recorded.

After receiving the access from the first client, the management server generates an access ID corresponding to the first client, and starts to inquire whether the access ID is authorized by the second client. After being authorized by the second client, the first client is directly authorized to log in successfully. Therefore, there is no need to input a user name and password on the first client to perform a login operation.

It is easy to understand that after the first binding, the second client only needs to scan the QR code of the first client and carry the access ID and its own ID when it encounters the first client again and needs to log in. The feature code connects to the management server, and the management server inquires that there is a binding relationship, and sends a response message to the second client, that is, the second client displays "The user will log in on the PC client" and prompts to enter user identity information (such as fingerprint ) to authorize. Once the user inputs the fingerprint, the authorization information carrying the access ID and the second client feature code is sent to the management server. After receiving the authorization information of the second client, the management server judges whether the authorization information is consistent with the recorded access ID, the second client characteristic code and the binding relationship of the monitoring user name, and if consistent, authorizes the first client to log in.

It should be noted that when the access ID changes, it needs to be bound again, and the binding process is the same, which will not be repeated here.

The implementation process is described below through specific embodiments, where user identity information takes fingerprints as an example.

The PC accesses the management server for the first time through a browser, carrying feature code 12938;

The management server returns access ID 32309 after calculation;

The PC browser saves this access ID to a local cookie as a subsequent access ID;

The PC browser accesses the management server, and the management server finds that the PC is directly accessing the public network address of the management server, prompting the user to download and install the VPN dial-up software;

After the user installs the VPN dial-up software, enter the VPN dial-up user name and password, and access the management server again after VPN login;

The management server finds that the client has dialed up, jumps to the dialed management server address, and completes the VPN login;

At this time, the PC browser displays the generated QR code, which contains the following information: access ID32309, management server address, VPN user name, password, management server address after VPN dial-up;

The PC browser queries the management server whether it has been authorized;

The mobile terminal as the second client scans the QR code to obtain access ID32309, management server address, VPN user name, password, and management server address after VPN dial-up;

The mobile terminal tries to connect to the management server with the address of the management server, but the connection fails because the VPN dial-up is not performed;

Try to use the VPN user name and password carried in the QR code to dial the address of the management server. After the dial is successful, connect to the management server again, carrying the access ID32309 and the unique identifier of the mobile phone, such as IMEI;

The management server address queries the management server whether ID32309+IMEI is bound to the monitoring user, and returns failure;

The management server address prompts to enter the monitoring user name and password. After entering the monitoring user name and password, the management server verifies the correctness of the user name and password;

After the management server is verified, it binds the access ID32309 with the monitoring user name, and the management server records the binding relationship between the monitoring user name-access ID-IMEI;

After the mobile terminal logs into the management server, it saves the access ID, and prompts the user to input the fingerprint to bind the saved access ID, and the mobile terminal saves the address and VPN user/password (if any) connected to the management server;

The management server finds that there is already a mobile terminal logged in with the access ID 32309 at this time, and sends a response message "The user will log in on the PC client" to the mobile terminal;

The mobile terminal displays "User will log in on the PC client" and prompts to enter fingerprint authorization;

After the user enters the fingerprint, the mobile terminal sends the authorization information carrying access ID32309 and IMEI to the management server. After the management server receives it, if the query is consistent with the saved record, the authorization is considered to be passed;

The PC browser inquires from the management server whether the authorization has been obtained, and upon learning that the authorization is passed, jumps to the login success interface.

It should be noted that the subsequent user logs in on the same PC again and directly uses the saved access ID 32309 to access the management server, while the second client scans the QR code and confirms it with a fingerprint, and sends a password carrying the access ID 32309 to the management server. Access, the management server queries and finds that there is a corresponding binding relationship, and responds to the second client. The second client confirms through fingerprints, sends an authorization message for authorization, and the management server completes the authorization after receiving the authorization message. Therefore, in the subsequent login, the mobile terminal can complete the login of the first client through fingerprint confirmation.

And in the subsequent login process, the mobile terminal does not need to complete the monitoring service connection with the monitoring server, only needs to send the access and receive the response, and does not need to enter the monitoring user name and password. A client's login confirmation, the implementation process is fast.

Subsequent users log in on another PC, and the PC client access ID will change at this time. At this time, the mobile terminal needs to scan the QR code, and then complete the same process after rebinding again to realize the login, which will not be repeated here.

In the identity verification system of this embodiment, after the user leaves the PC and remembers that he forgot to close the important video, the mobile terminal can initiate a request to log out of the PC terminal.

For this reason, the management server of this embodiment is also used to record the access ID and login status of the first client as usage traces, and send the management server IP address and port number of the first client's access ID and management usage traces to the second client , the second client retains the access ID of the first client and the IP address and port number of the management server used to manage traces.

When it is necessary to close the connection of the first client by the second client, a disconnection request is sent to the management server, and the access ID is sent to the management server IP address and port number for managing usage traces, and the management server receives the port access After the disconnection request of the ID, all services with the corresponding first client end are terminated.

Usually, the overhead of the VPN on the management server is relatively large, so the second client in this embodiment actively disconnects the VPN connection after successfully logging in. Or the management server actively disconnects the VPN connection with the second client, so as to reduce the overhead of the VPN on the server.

The above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and changes according to the present invention. deformation, but these corresponding changes and deformations should belong to the scope of protection of the appended claims of the present invention.

Claims (7)

1. a kind of authentication system is applied to video surveillance network, including management server and client, which is characterized in that The client includes the first client and the second client, in which:

First client, the condition code for carrying itself accesses management server, according to the feedback letter of management server Breath, shows corresponding graphic code, which includes the access ID that is generated according to described document information of management server, and to management Server inquires whether access ID has been authorized, and management server is directly logged in after being authorized；

Second client, the graphic code shown for scanning the first client, carry the second client condition code and Access ID connection management server in the graphic code, in the management server without access ID, the second client features When code and the binding relationship of monitoring user name, user's input monitoring username and password is prompted, initiates to log in management server, The binding for recording access ID, the second client features code and monitoring user name in the management server after being verified is closed System, and the binding relationship of subscriber identity information Yu access ID is established on a second client；Existing in the management server should When accessing ID, the second client features code and monitoring the binding relationship of user name, the response message of management server is received, according to Prompt input subscriber identity information sends the authorization letter for carrying access ID and the second client features code to management server Breath；

Management server, for inquiring whether itself has when receiving the second client carrying condition code and accessing the connection of ID There are access ID, condition code and the binding relationship for monitoring user name, when there are the binding relationship, send and ring to the second client Answer message, after the authorization message for receiving the second client, judge authorization message whether access ID with record, the second client Condition code is consistent with the monitoring binding relationship of user name, and the first client is authorized to log in if consistent；It is tied up if there is no this Determine relationship, then notifies that the second client input monitoring username and password is logged in, after being verified, record access ID, The binding relationship of second client features code and monitoring user name；

The access ID that first client is also used to record management server return takes in secondary access management server Management server is accessed with access ID, and shows that the graphic code with access ID supplies the second client scan.

2. authentication system according to claim 1, which is characterized in that the management server is also used to receive first Client carry access ID access, after the authorization message for receiving the second client, judge authorization message whether with record It is consistent with the monitoring binding relationship of user name to access ID, the second client features code, authorizes the first client to step on if consistent Record.

3. authentication system according to claim 1, which is characterized in that first client is also used to take in management When business device does not obtain the authorization of the second client, input VPN username and password carries out VPN connection；It is obtained in management server To the second client authorization when, directly according to management server return VPN username and password carry out VPN connection.

4. authentication system according to claim 3, which is characterized in that the graphic code also includes management server Management server address after location, VPN user name and password, VPN dialing.

5. authentication system according to claim 4, which is characterized in that second client is also used to according to figure The VPN user name and password for including in code carry out VPN dialing, establish VPN with management server and connect.

6. authentication system according to claim 1, which is characterized in that the management server is also used to record first The access ID and logging state of client, which are used as, uses trace, and the access ID of the first client and management are used to the management of trace Server ip address and port numbers issue the second client, and the second client retains the access ID of the first client and management uses The management server IP address and port numbers of trace.

7. authentication system according to claim 6, which is characterized in that second client is also used to management service Device transmission disconnects request, and the access ID is sent to the management server IP address and port numbers that management uses trace, The management server receive carry access ID disconnect request after, terminate and all business of corresponding first client.