CN116318909A - A multi-identity authentication method, device and storage medium - Google Patents

Abstract

The invention provides a method, device and storage medium for multiple identity authentication, which uses hardware equipment to encrypt user's biometric information and apply it to identity authentication. Combined with biometric information, hardware equipment and network environment, the IP, MAC address of the server where the software service is located and the biometrics entered by the user are used as identity authentication factors for identity authentication, achieving a higher security level of identity authentication and simplifying the authentication process.

Description

A multi-identity authentication method, device and storage medium

technical field

The invention relates to the field of encryption technology, in particular to a multiple identity authentication method, device and storage medium, which can be used in the identity authentication process of different data nodes in a network environment.

Background technique

Authentication is the process of determining whether someone or something is actually who or what it says it is. Authentication technologies provide access control to systems by checking that a user's credentials match those in an authorized user database or data authentication server. In the process, authentication ensures secure systems, secure processes, and corporate information security.

There are several authentication types. For user identity purposes, a user is typically identified using a user ID, and authentication occurs when a user provides credentials such as a password that match their user ID. The practice of requiring a user ID and password is called single-factor authentication (SFA). In recent years, companies have strengthened authentication by requiring other authentication factors, such as a unique code or biometric signature provided to users via mobile devices when they attempt to log in. This is known as two-factor authentication (2FA).

Authentication factors can go even further than SFA, which requires a user ID and password, or 2FA, which requires a user ID, password, and biometric signature. When authentication is done using three or more authentication factors—for example, a user ID and password, a biometric signature, and a personal question that the user must answer—it’s called multi-factor authentication (MFA).

Authentication enables organizations to keep their networks secure by allowing only authenticated users or processes to access their protected resources. This may include computer systems, networks, databases, websites and other web-based applications or services. To make 2FA as secure as possible, additional steps can be added to the process. For example, customers may be asked to enter a personal identification number (PIN) and a piece of biometric information. In these cases, the process is known as two-factor authentication (mFA). The more steps the customer is required to complete, the more secure the process. However, adding steps also makes the process more cumbersome for customers.

Contents of the invention

The purpose of the present invention is to solve the problem of low security or cumbersome steps of identity authentication in the prior art, and proposes a new multiple identity authentication method, device and storage medium. The identity authentication method includes a user registration stage and a user login stage, wherein the user registration stage includes:

Step 1: The local server receives the user's registration information, starts the information collector to obtain and store the user's characteristic information, and returns the characteristic information to the local server;

Step 2: The local server obtains the IP address and MAC address of the network card of the local device, generates a random salt s, and uses the hash function to generate the IP parameter P of the IP address, the MAC parameter I of the MAC address, and the parameters X and v to generate the formula As follows, where g is a fixed parameter within the range of a fixed large prime number N:

P=Hash(IP address+feature information+random number)

I=Hash(MAC address+characteristic information)

X = Hash(random salt s, P)

V=g^X

Step 3: Start the key management device to encrypt the characteristic information and parameter P, and return the encrypted characteristic information and parameter P to the local server; the local server will register information, parameter I, encrypted parameter P, encrypted The final feature information is stored in the first database, and the registration information, parameter I, parameter v and random salt s are sent to the identity authentication server;

Step 4: The identity authentication server stores the received parameter I, parameter v and random salt s in the second database, and sends the user registration completion information to the local server.

Specifically, the information collector includes a fingerprint collector, a face collector, and an iris collector; the feature information is the fingerprint feature, face feature, and iris feature corresponding to the information collector.

Further, the user login phase includes:

Step 1: The user sends a login request to the local server, and the local server starts the information collector to collect characteristic information;

Step 2: The key management device encrypts the feature information and returns it to the local server; the local server searches the first database according to the encrypted feature information to obtain the corresponding parameter I and the encrypted parameter P; the key The management device decrypts the encrypted parameter P, obtains the parameter P and returns it to the local server;

Step 3: The local server calculates parameter A=g^a, wherein a is a random number, g is a fixed parameter in the system, and sends parameter I and parameter A to the identity authentication server;

Step 4: The identity authentication server finds parameter v and parameter s in the second database according to parameter I, and calculates parameter B=kv+g^b wherein parameter k=Hash(N, g), and N is a fixed large prime number g is fixed as a number within N;

Step 5: The identity authentication server sends the parameter s and parameter B to the local server;

Step 6: The local server and the authentication server simultaneously calculate the parameter u=Hash(A, B), the local server calculates the parameter x=Hash(s,p), and the parameter S1=(B-kg^x)^(a +ux), parameter K1=Hash (S), identity authentication server calculation parameter S2=(Av^u)^b, K2=Hash(S);

Step 7: The local server calculates the parameter M1=Hash(Hash(N)xor Hash(g),Hash(I),s,A,B,K1) and sends it to the identity authentication server;

Step 8: The identity authentication server also calculates the parameter M2 and verifies it with the received parameter M1, and stores the parameter K1 as a session key in the memory after the verification is passed;

Step 9: The identity authentication server calculates Hash (A, M, K2), and returns the hash value to the local server;

Step 10: The local server receives the Hash (A, M, K2), and also calculates the Hash (A, M, K1) for verification. After the verification is passed, the parameter K2 is stored in the memory as the session key.

Specifically, after the verification in step ten is passed, the parameters K1 and K2 are used as the user's trusted token.

Further, the first database is the local storage system of the local server, and the second database is the local storage system of the identity authentication server; the local server and the identity authentication server can be data circuit termination devices such as hubs and switches and/or hosts, Data terminal equipment such as servers.

Further, the key management device is a mobile device capable of encrypting and decrypting information.

The present invention also proposes a multi-identity authentication system, including a user terminal and a server, wherein the user terminal includes an information collector and a key management device.

The present invention also proposes a computer device, which includes a memory and a processor. Executable codes are stored in the memory. When the processor executes the executable codes, any one of the above methods is implemented.

The present invention also proposes a computer-readable storage medium, which is characterized in that the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are called and executed by the processor, the computer-executable instructions prompt the processor to realize the above-mentioned Either method.

Compared with the prior art, the present invention solves the problems of cumbersome multiple identity authentication steps and low security in the prior art: firstly, by adding an information collection step, it is ensured that the user can perform identification according to a personal identification code or a piece of biometric information. Identity authentication, and at the same time encrypt the biological information in the mobile encryption and decryption device to ensure that the data is not exposed.

Description of drawings

FIG. 1 is a schematic diagram of a user registration process in an embodiment of the present invention;

FIG. 2 is a schematic diagram of a user login process in an embodiment of the present invention;

FIG. 3 is an architecture diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

The present invention will be described in detail below by taking text recognition as an example in conjunction with the accompanying drawings.

This embodiment is carried out on the premise of the technical solution of the present invention, and detailed implementation and specific operation process are given, but the protection scope of the present invention is not limited to the following embodiments.

An embodiment of the present invention provides a multiple identity authentication method. In this embodiment, taking fingerprint information collected by an information collector as an example, the specific steps of the identity authentication method provided by the embodiment of the present invention are described in detail. Identity authentication includes two phases, which are user registration phase and user login phase. Referring to Figure 1, the steps in the user registration phase are as follows:

Step 1: The local server receives the registration information of the user, starts the information collector to obtain and store the characteristic information of the user, and returns the characteristic information to the local server;

In the embodiment of the present invention, the local server is deployed on the user's terminal (desktop, laptop), and its main function is to interact with fingerprint collection equipment and hardware encryption equipment such as Ukey to complete fingerprint collection and identification and encrypt key parameters. The local server opens a registration interface to the user to receive the user's registration information, mainly name, gender, etc. When the user enters the registration information, the local server starts the driver of the fingerprint collector and waits for the user to press the identification area. When the fingerprint collector collects the user's fingerprint, the fingerprint features will be stored in the fingerprint collector and returned to the local server. server.

Step 2: The local server obtains the IP address and the MAC address of the network card of the local device, generates a random salt s, and uses a hash function to generate the IP parameter P of the IP address, the MAC parameter I and the parameter X of the MAC address and parameter v, the generation formula is as follows, where g is a fixed parameter within the range of a fixed large prime number N:

P=Hash(IP address+feature information+random number)

I=Hash(MAC address+characteristic information)

X = Hash(random salt s, P)

V=g^X

The random number in the parameter P in the embodiment of the present invention is not limited, and may be any natural number. After generating the above parameters, start the key management device. The key management device is a mobile device capable of encrypting and decrypting information, and is preferably Ukey in the embodiment of the present invention.

Step 3: Start the key management device to encrypt the feature information and the parameter P, and return the encrypted feature information and the parameter P to the local server; the local server sends the The registration information, the parameter I, the encrypted parameter P, and the encrypted feature information are stored in a first database, and the registration information, the parameter I, the parameter v and the The random salt s is sent to the authentication server;

Step 4: The identity authentication server stores the received parameter I, the parameter v and the random salt s in the second database, and sends user registration completion information to the local server.

In the identity authentication method provided by the embodiment of the present invention, in the user registration stage, the offline identity information registration method avoids the risk of information leakage, tampering or counterfeiting when the identity information is registered in the network, and at the same time adds the user's biological characteristics , so that the security is enhanced without increasing the operation steps. In the subsequent process of user login and encrypted transmission, the IP and MAC address of the server where the software service is located can also be used as identity authentication factors for identity authentication. Once the network environment changes, identity authentication will fail and subsequent operations will be terminated.

Further, referring to Figure 2, the steps in the user login phase are as follows:

Step 1: The user sends a login request to the local server, and the local server starts the information collector to collect characteristic information;

In the embodiment of the present invention, after the user requests the login interface from the local server, the local server starts the driver of the fingerprint collector to collect fingerprints, and sends the collected fingerprint features to the key management device Ukey.

Step 2: The key management device encrypts the feature information and returns it to the local server; the local server searches the first database according to the encrypted feature information to obtain the corresponding parameter I and the encrypted parameter P; the key The management device decrypts the encrypted parameter P, obtains the parameter P and returns it to the local server;

Step 3: The local server calculates parameter A=g^a, wherein a is a random number, g is a fixed parameter in the system, and sends parameter I and parameter A to the identity authentication server;

Step 4: The identity authentication server finds parameter v and parameter s in the second database according to parameter I, and calculates parameter B=kv+g^b wherein parameter k=Hash(N, g), and N is a fixed large prime number g is fixed as a number within N;

Step 5: The identity authentication server sends the parameter s and parameter B to the local server;

Step 6: The local server and the authentication server simultaneously calculate the parameter u=Hash(A, B), the local server calculates the parameter x=Hash(s,p), and the parameter S1=(B-kg^x)^(a +ux), parameter K1=Hash (S), identity authentication server calculation parameter S2=(Av^u)^b, K2=Hash(S);

Step 7: The local server calculates the parameter M1=Hash(Hash(N)xor Hash(g),Hash(I),s,A,B,K1) and sends it to the identity authentication server;

Step 8: The identity authentication server also calculates the parameter M2 and verifies it with the received parameter M1, and stores the parameter K1 as a session key in the memory after the verification is passed;

Step 9: The identity authentication server calculates Hash (A, M, K2), and returns the hash value to the local server;

Step 10: The local server receives the Hash (A, M, K2), and also calculates the Hash (A, M, K1) for verification. After the verification is passed, the parameter K2 is stored in the memory as the session key.

In the embodiment of the present invention, the fingerprint information is combined with the traditional identity authentication method, and the fingerprint feature is added into the parameter calculation, which improves the security of the identity authentication without adding operation steps. In the embodiment of the present invention, the information collector can also collect other biological characteristics such as iris information, face information, and voiceprint information. The embodiment of the present invention takes fingerprint information as an example.

The embodiment of the present invention also provides a multi-identity authentication system, including a user terminal and a server. Wherein, the user terminal includes an information collector and a key management device. The operation method of the system is the same as that of the above-mentioned embodiment, and no more description is given here.

An embodiment of the present invention also provides a computer device. Referring to FIG. 3 , the computer device includes a processor and a memory. Wherein, the processor is used to execute executable modules stored in the memory, such as computer programs.

Wherein, the memory may include a high-speed random access memory (RAM, Random Access Memory), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory is used to store a program, and the processor executes the program after receiving an execution instruction. The method disclosed in any of the foregoing embodiments of the present invention may be applied to the processor or implemented by the processor.

A processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. Above-mentioned processor can be general-purpose processor, comprises central processing unit (Central Processing Unit, be called for short CPU), network processor (Network Processor, be called for short NP) etc.; Can also be Digital Signal Processor (Digital Signal Processing, be called for short DSP), Application Specific Integrated Circuit (ASIC for short), off-the-shelf programmable gate array (Field-Programmable Gate Array, FPGA for short) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. Various methods, steps and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the methods disclosed in the embodiments of the present invention may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.

The computer program product of the identity authentication method, device, and computer-readable storage medium provided by the embodiments of the present invention includes a computer-readable storage medium storing program codes, and the instructions included in the program codes can be used to execute the above method embodiments. For the specific implementation of the method, refer to the method embodiments, and details are not repeated here.

On the basis of the traditional identity authentication method, the embodiment of the present invention adds two pieces of hardware, an information collector and a key management device, and encrypts the biometric information for identity authentication, which not only simplifies the identity authentication process, but also strengthens the identity authentication process. The security of authentication ensures that the user's personal information is not leaked.

The protection scope of the present invention is defined by the appended claims. The technology, method, and use of the technology and method can be used for text recognition, speech recognition, or image recognition and video signal processing. As a component of the neural network, the activation function is used for text recognition, speech recognition, image recognition and video signal processing, and should be regarded as a part of the protection claimed in the claim specification and should be protected by relevant laws.

Claims (9)

1. A multi-identity authentication method, characterized in that, comprises a user registration stage and a user login stage; the user registration stage includes: Step 1: The local server receives the registration information of the user, starts the information collector to obtain and store the characteristic information of the user, and returns the characteristic information to the local server; Step 2: The local server obtains the IP address and the MAC address of the network card of the local device, generates a random salt s, and uses a hash function to generate the IP parameter P of the IP address, the MAC parameter I and the parameter X of the MAC address and parameter v, the generation formula is as follows, where g is a fixed parameter within the range of a fixed large prime number N: P=Hash(IP address+feature information+random number) I=Hash(MAC address+characteristic information) X = Hash(random salt s, P) V=g^X Step 3: Start the key management device to encrypt the feature information and the parameter P, and return the encrypted feature information and the parameter P to the local server; the local server sends the The registration information, the parameter I, the encrypted parameter P, and the encrypted feature information are stored in a first database, and the registration information, the parameter I, the parameter v and the The random salt s is sent to the authentication server; Step 4: The identity authentication server stores the received parameter I, the parameter v and the random salt s in the second database, and sends user registration completion information to the local server. 2. A kind of multiple identity authentication method according to claim 1, it is characterized in that, described information collector comprises fingerprint collector, face collector, iris collector; Described feature information is that described information collector corresponds Fingerprint features, facial features, iris features. 3. The multi-identity authentication method according to claim 1, wherein the user login stage includes: Step 1: the user sends a login request to the local server, and the local server starts the information collector to collect the characteristic information; Step 2: The key management device encrypts the feature information and returns it to the local server; the local server searches the first database according to the encrypted feature information to obtain the corresponding The parameter I and the encrypted parameter P; the key management device decrypts the encrypted parameter P, obtains the parameter P and returns it to the local server; Step 3: The local server calculates parameter A=g^a, wherein a is a random number, g is a fixed parameter in the system, and sends the parameter I and the parameter A to the identity authentication server; Step 4: The identity authentication server finds the parameter v and the parameter s in the second database according to the parameter I, and calculates the parameter B=kv+g^b where the parameter k=Hash(N, g), N is a fixed large prime number g is fixed as the number in N; Step 5: The identity authentication server sends the parameter s and the parameter B to the local server; Step 6: The local server and the identity authentication server simultaneously calculate the parameter u=Hash(A, B), the local server calculates the parameter x=Hash(s,p), and the parameter S1=(B -kg^x)^(a+ux), parameter K1=Hash(S), said identity authentication server calculation parameter S2=(Av^u)^b, K2=Hash(S); Step 7: The local server calculates the parameter M1=Hash(Hash(N)xor Hash(g), Hash(I), s, A, B, K1) and sends it to the identity authentication server; Step 8: The identity authentication server also calculates the parameter M2 and checks it with the received parameter M1, and stores the parameter K1 as a session key in the memory after the verification is passed; Step 9: The identity authentication server calculates Hash (A, M, K2), and returns the hash value to the local server; Step 10: The local server receives Hash (A, M, K2), calculates Hash (A, M, K1) for verification, and stores the parameter K2 in the memory as a session key after the verification is passed . 4. The multi-identity authentication method according to claim 2, further comprising: after the verification in step ten is passed, the parameter K1 and the parameter K2 are used as the user's trusted token. 5. A multi-identity authentication method according to claim 1, wherein the first database is the local storage system of the local server, and the second database is the local storage system of the identity authentication server ; The local server and the identity authentication server may be data circuit termination devices such as hubs and switches and/or data terminal devices such as hosts and servers. 6. A multi-identity authentication method according to claim 1, wherein the key management device is a mobile device capable of encrypting and decrypting information. 7. A multi-identity authentication system, characterized in that it includes a user terminal and a server; the user terminal includes an information collector and a key management device. 8. A computer device, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method according to any one of claims 1-6 is realized. 9. A computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are invoked and executed by a processor, the computer-executable instructions prompt the processor Realize an identity authentication method as described in any one of claims 1-5.

Images