Background
The identity authentication technology is a technology for determining the true identity of a user, is an important component of an information security system, and plays a very important role in the fields of computer networks, electronic commerce, financial transactions and the like. In conventional businesses, the identity of a user is typically confirmed by an identity document (e.g., an identity card, a household account book, a passport, etc.), and a paper or electronic image of the identity document is saved as a business authorization credential.
After the digital age, account number plus password and digital certificate plus private key become two mainstream digital identity security authentication technologies. However, although the conventional identity authentication technology is convenient to use, the security and management aspects are still to be further improved, enriched and perfected, and the conventional identity authentication technology is mainly characterized in the following two aspects:
(1) The single-factor authentication mode is single, and once the password is lost, the user account is leaked;
(2) The identity authentication of the PKI system involves cumbersome certificate management, increasing the operation cost.
Disclosure of Invention
Aiming at the technical problems existing in the prior art, the invention aims to provide a unified identity authentication method based on double factors, and provides a double-factor unified authentication system with trusted registration, autonomous authorization and reliable audit by utilizing the characteristics of the blockchain technology, such as disclosure verification, non-falsification, reliable audit and the like, so as to facilitate access, use and management of various application systems. The system and the method perform identity authentication based on two factors, namely the password, the secret key or the biotechnology, and ensure account security even if the password of the user is lost or revealed, thereby meeting the unified identity authentication requirements of system security and reliability.
Aiming at the purpose of the invention, the invention provides a double-factor based unified authentication method, which specifically comprises the following 3 steps:
step 1. Registration phase (Register): the registration server acquires the user biological characteristic information P according to the password pwd set by the useri Calculating to obtain the private key of the userPublic key pk=gsk The method comprises the steps of carrying out a first treatment on the surface of the And acquires the registration timestamp ts of the current timer Calculating registration signature sigmar ＝signsk (Mr ,tsr ) The above processing is done on the registration server. After the processing is completed, the registration server applies for registration information Mr Registration timestamp tsr Public key pk, registration signature sigmar And sending the data to the verification server. The authentication server automatically authenticates the registration timestamp tsr If so, running a verification algorithm verfpk (Mr ,tsr ,σr ) Whether the calculation result is 1. If the user id is 1, uploading the pk to the blockchain by using the sub function of the intelligent contract, generating the corresponding user id, and returning the user id to the user to indicate that the registration is completed.
Step 2, authorization phase (Authorization): when a user requests the right to be authorized for a target application in the system server, the password pwd and the biometric information P need to be enteredi Simultaneously generating request authority information Ma ，Ma Application and rights information that is authorized for the user request. Subsequently, the authorized timestamp ts of the current time is obtaineda Calculating a private keyThen calculating the signature sigma of the request authority according to the private key ska ＝signsk (Ma ,tsa Id). The above processes are all completed on the user side. After the processing is completed, the user requests the authority information Ma Authorized timestamp tsa Request rights signature sigmaa And sending the data to a system server. Subsequent processing in the systemAnd (3) finishing on the server. System server automatically verifies the authorization timestamp tsa If so, running Check (id) algorithm in the smart contract to verify whether the user id exists, and if so, verifying sigma by using public key pk of the usera If so, adding corresponding pk information in a system authorization List of the blockchain to indicate the authority of the target application in the system server requested by the user authorized.
Step 3, login phase (Login): when a user logs into a target application in the system, the password pwd and biometric information P need to be inputi Simultaneously generating request login information Ml ，Ml Application information logged in for the user request. Subsequently, the login timestamp ts of the current time is obtainedl Calculating a private keyThen according to the private key sk, calculating the request login signature sigmal ＝signsk (Ml ,tsl Id). The above processes are all completed on the user side. After the processing is completed, the user will request the login information Ml Logging in timestamp tsl Request login signature sigmal And sending the data to a system server. The System server calls Check (id, system) algorithm in the intelligent contract to verify, wherein the System is the identification of the target application in the System server, if the result is 1, the user is authorized by the System, and the System further calls verfpk (Ml ,tsl ,σl ) And (3) the algorithm, if the result is 1, allowing the user to log in the target application in the system, otherwise, refusing to log in.
The invention has the following advantages:
the existing identity authentication systems in the market at present mostly adopt a single password authentication mode of MD5 international hash algorithm with poor security intensity, and the authentication mode has poor security. Although some two-factor authentication systems exist in the market, the systems require a server to store user passwords, keys and biological information, and once the server is invaded, the private information of a user is revealed, so that the requirements of safety, reliability, high efficiency and the like are difficult to meet.
The invention designs a unified identity authentication protocol based on double factors, and designs a unified authentication method by using two factors of password, secret key or biotechnology, so that the account security can be ensured even if the password of a user is lost or revealed. In addition, the method does not need to store the user password, the secret key and the biological information at the server, only stores the public information in the blockchain, and effectively reduces the risk of leakage of the user information due to invasion of the server. In addition, the invention can be combined with the existing ECDSA, schnorr, SM and other digital signature algorithms in the current market, and has stronger system compatibility.
Detailed Description
The invention will now be described in further detail with reference to the accompanying drawings, which are given by way of illustration only and are not intended to limit the scope of the invention.
An implementation flow of the present invention is shown in fig. 1, and includes a client, a verification end, a registration server, a system server, and a blockchain. The specific user registration, authority authorization and user login processes are as follows:
1) User registration: the user to be registered sets a password and provides biological characteristic information, a hash value of the password and the biological characteristic is calculated, and a corresponding public and private key pair is generated by using the hash value. The user calculates a registration signature containing a time stamp and registration information by using a private key, and sends the registration information, the registration time stamp, the public key and the registration signature to a verification server together for verification by the verification server, after verification by the verification server is effective, an identity information registration function in the intelligent contract is called, the public key of the user is uploaded to a blockchain, and an id corresponding to the public key of the user is generated to represent successful registration of the user.
2) Rights authorization: if the registered user requests the right of a target application in the authorized system server, the password and the biological characteristic information need to be input, the hash value of the password and the biological characteristic is calculated, and the corresponding public and private key pair is generated by utilizing the hash value. The user calculates a request authorization signature comprising a time stamp, a user id and request authorization information by using a private key, and sends the request authorization information, the authorization time stamp, the public key, the user id and the request authorization signature to a system server together for verification by the system server, and after the system server invokes a verification algorithm in an intelligent contract to verify that the user id is registered and the signature is valid, corresponding public key information is added in a system authorization list of a blockchain to represent the authority of a target application in the system server requested by the user to be authorized.
3) User login: when a user logs in a target application in a certain system server, the user needs to input a password and biological characteristic information, calculates hash values of the password and the biological characteristic, and generates a corresponding public and private key pair by using the hash values. The user calculates a login signature containing login time stamp, user id and login information by using a private key, and sends the login information, the time stamp, the public key, the user id and the login signature to a system server together for verification by the system server, and the system server invokes a verification algorithm in the intelligent contract for verification; after verifying that the user id is authorized and the signature is valid, the user is allowed to log in to the target application in the system, otherwise the user is refused to log in.
Example 1
1. Symbol and definition
g: and generating elements of the multiplication group.
A hash function.
ts: a time stamp.
pk: the public key of the user.
sk: the private key of the user.
pwd: a password set by the user.
Pi : biometric information of the user.
M: a request message of the user.
Sigma: signer signature of message.
signsk (. Cndot.): signing algorithm, the signer calls the algorithm to complete the signature of the message.
verfpk (. Cndot.): and the signature verification algorithm is called by a verifier to finish verification of the signature.
Sub: and the submitting algorithm of the intelligent contract is used for uploading pk to the blockchain.
Check (.): and the verification algorithm of the intelligent contract is used for verifying the validity of the user authority.
2. The two-factor unified identity authentication scheme mainly comprises a registration stage (Register), an Authorization stage (Authorization), a Login stage (Login) and three parts. The method comprises the following steps:
step 1. Registration phase (Register): the registration server acquires the user biological characteristic information P according to the password pwd set by the useri Calculating to obtain the private key of the userPublic key pk=gsk The method comprises the steps of carrying out a first treatment on the surface of the And acquires the registration timestamp ts of the current timer Calculating registration signature sigmar ＝signsk (Mr ,tsr ) The above processing is done on the registration server. After the processing is completed, the registration server applies for registration information Mr Registration timestamp tsr Public key pk, registration signature sigmar And sending the data to the verification server. The authentication server automatically authenticates the registration timestamp tsr If so, running a verification algorithm verfpk (Mr ,tsr ,σr ) Whether the calculation result is 1. If the user id is 1, uploading the pk to the blockchain by using the sub function of the intelligent contract, generating the corresponding user id, and returning the user id to the user to indicate that the registration is completed.
Step 2, authorization phase (Authorization): when a user requests the right to be authorized for a target application in the system server, the password pwd and the biometric information P need to be enteredi Simultaneously generating request authority information Ma ，Ma Application and rights information that is authorized for the user request. Subsequently, the authorized timestamp ts of the current time is obtaineda Calculating a private keyThen calculating the signature sigma of the request authority according to the private key ska ＝signsk (Ma ,tsa Id). The above processes are all completed on the user side. After the processing is completed, the user requests the authority information Ma Authorized timestamp tsa Request rights signature sigmaa And sending the data to a system server. The process is then completed on the system server. System server automatically verifies the authorization timestamp tsa If so, running Check (id) algorithm in the smart contract to verify whether the user id exists, and if so, verifying sigma by using public key pk of the usera If so, adding corresponding pk information in a system authorization List of the blockchain to indicate the authority of the target application in the system server requested by the user authorized.
Step 3, login phase (Login): when a user logs into a target application in the system, the password pwd and biometric information P need to be inputi Simultaneously generating request login information Ml ，Ml Application information logged in for the user request. Subsequently, the login timestamp ts of the current time is obtainedl Calculating a private keyThen according to the private key sk, calculating the request login signature sigmal ＝signsk (Ml ,tsl Id). The above processes are all completed on the user side. After the processing is completed, the user will request the login information Ml Logging in timestamp tsl Request login signature sigmal And sending the data to a system server. The System server calls Check (id, system) algorithm in the intelligent contract to verify, wherein the System is the identification of the target application in the System server, if the result is 1, the user is authorized by the System, and the System further calls verfpk (Ml ,tsl ,σl ) And (3) the algorithm, if the result is 1, allowing the user to log in the target application in the system, otherwise, refusing to log in.
Although specific embodiments of the invention have been disclosed for illustrative purposes, it will be appreciated by those skilled in the art that the invention may be implemented with the help of a variety of examples: various alternatives, variations and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, it is intended that the invention not be limited to the particular embodiment disclosed as the best mode contemplated for carrying out this invention, but that the invention will have the scope indicated by the scope of the appended claims.