Authentication data encryption method, system, device and storage medium based on network security

Abstract

The present application discloses a method, system, device and storage medium for encrypting authentication data based on network security, and relates to the field of data encryption technology. The method includes: in response to an authentication request initiated by a user, initializing several optional data transmission links according to the server to be accessed corresponding to the authentication request; determining the link security score corresponding to each optional data transmission link according to the credibility of the transmission node in each optional data transmission link; determining the target data transmission link based on each link security score, and determining the current key distribution node in the preset key distribution center network according to the target data transmission link; obtaining the encryption algorithm corresponding to the current key distribution node, and encrypting the authentication data corresponding to the authentication request according to the encryption algorithm. The present application realizes the encryption of authentication data through the dynamic change of the data transmission link and the encryption algorithm. Compared with the existing method, it avoids the security loopholes caused by the fixed encryption algorithm, thereby reducing the risk of authentication data leakage.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a method, system, device and storage medium for encrypting authentication data based on network security. Background Art

[0002] When a user needs to log in to an enterprise system, that is, when the user has a need to access a certain server, it is usually necessary to verify the legitimacy of the user's identity based on the authentication system. The user initiates an authentication request on the user side and generates authentication data, which is then sent to the authentication server associated with the server to be accessed through a data transmission link for authentication. During this data transmission process, in order to improve transmission security, the authentication data can be encrypted for transmission.

[0003] However, in the existing method, when users make authentication requests to the same server, a fixed encryption algorithm is usually used to encrypt the authentication data. As a result, after the user makes multiple authentication requests, the data transmission pattern becomes predictable, and the data transmission link is vulnerable to intrusion (for example, the possibility of side channel attacks is increased), thereby increasing the risk of authentication data leakage. Summary of the invention

[0004] The main purpose of this application is to provide an authentication data encryption method, system, device and storage medium based on network security, aiming to solve the technical problem that the encryption algorithm in the existing data encryption transmission method is fixed, and the data transmission mode is predictable after multiple transmissions, which easily causes the risk of authentication data leakage.

[0005] To achieve the above purpose, the present application proposes an authentication data encryption method based on network security, the authentication data encryption method based on network security comprising:

[0006] In response to an authentication request initiated by a user, initializing a plurality of optional data transmission links according to the to-be-accessed server corresponding to the authentication request;

[0007] Determine a link security score corresponding to each of the optional data transmission links according to the credibility of the transmission node in each of the optional data transmission links;

[0008] Determine a target data transmission link based on the security score of each link, and determine a current key distribution node in a preset key distribution center network according to the target data transmission link;

[0009] Obtain an encryption algorithm corresponding to the current key distribution node, and encrypt the authentication data corresponding to the authentication request according to the encryption algorithm.

[0010] In one embodiment, the step of determining the link security score corresponding to each of the optional data transmission links according to the credibility of the transmission node in each of the optional data transmission links includes:

[0011] Acquire a number of transmission nodes in each of the optional data transmission links;

[0012] Determining the credibility of each transmission node based on a preset credibility scoring method;

[0013] A link security score corresponding to each of the optional data transmission links is determined according to the credibility of each of the transmission nodes and the weight of each of the transmission nodes.

[0014] In one embodiment, the step of determining the credibility of each transmission node based on a preset credibility scoring method includes:

[0015] Acquire relevant data of each of the transmission nodes, the relevant data including node configuration information, node historical events, and node maintenance logs;

[0016] The node configuration information, the node historical events and the node maintenance log are input into a preset credibility evaluation model to obtain the credibility of each transmission node.

[0017] In one embodiment, the preset key distribution center includes a plurality of optional key distribution nodes, and the step of determining a target data transmission link based on the security score of each link, and determining a current key distribution node in the preset key distribution center network according to the target data transmission link includes:

[0018] Among the optional data transmission links, determining the optional data transmission link with the highest link security score as the target data transmission link;

[0019] Respectively obtaining distance information between each of the optional key distribution nodes and the target data transmission link;

[0020] According to the distance information, a current key distribution node is determined among the optional key distribution nodes based on a distance optimality principle.

[0021] In one embodiment, the step of determining the current key distribution node among the optional key distribution nodes based on the distance optimality principle according to the distance information includes:

[0022] According to the distance information, priority sorting is performed on each of the optional key distribution nodes based on a distance optimal principle;

[0023] According to the sorting result, a preset number of optional key distribution nodes are selected to construct a set of candidate key distribution nodes;

[0024] In the candidate key distribution node set, the current key distribution node is determined according to the real-time load capacity of each candidate key distribution node.

[0025] In one embodiment, the step of responding to the authentication request initiated by the user and initializing a plurality of optional data transmission links according to the to-be-accessed server corresponding to the authentication request includes:

[0026] Upon receiving an authentication request triggered by a user, obtaining a server to be accessed corresponding to the authentication request, and determining a corresponding cloud access management server based on the server to be accessed;

[0027] A number of optional data transmission links are generated according to the network location of the user and the cloud access management server.

[0028] In one embodiment, the step of obtaining an encryption algorithm corresponding to the current key distribution node and encrypting the authentication data corresponding to the authentication request according to the encryption algorithm includes:

[0029] Obtaining key pair information generated by the current key distribution node based on the corresponding encryption algorithm,

[0030] Encrypting the authentication data corresponding to the authentication request according to the key pair information to obtain encrypted authentication data;

[0031] The encrypted authentication data is transmitted to the cloud access management server through the target data transmission link to complete the authentication process of the server to be accessed.

[0032] In addition, to achieve the above purpose, the present application also proposes an authentication data encryption system based on network security, the system comprising: an authentication request end and an authentication receiving end, the authentication request end comprising: a request response module, a transmission link scoring module, a key node determination module and a data encryption module;

[0033] The request response module is used to respond to the authentication request initiated by the user and initialize several optional data transmission links according to the server to be accessed corresponding to the authentication request;

[0034] The transmission link scoring module is used to determine the link security score corresponding to each of the optional data transmission links according to the credibility of the transmission node in each of the optional data transmission links;

[0035] The key node determination module is used to determine a target data transmission link based on the security score of each link, and determine a current key distribution node in a preset key distribution center network according to the target data transmission link;

[0036] The data encryption module is used to obtain the encryption algorithm corresponding to the current key distribution node, and encrypt the authentication data corresponding to the authentication request according to the encryption algorithm, and send the encrypted authentication data to the authentication receiving end;

[0037] The authentication receiving end is used to decrypt the received encrypted authentication data.

[0038] In addition, to achieve the above-mentioned purpose, the present invention also proposes a network security-based authentication data encryption device, the device comprising: a memory, a processor, and a network security-based authentication data encryption program stored on the memory and executable on the processor, the network security-based authentication data encryption program being configured to implement the steps of the network security-based authentication data encryption method as described above.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a network security-based authentication data encryption program is stored, and when the network security-based authentication data encryption program is executed by a processor, the steps of the network security-based authentication data encryption method as described above are implemented.

[0040] The present application proposes a method for encrypting authentication data based on network security. In response to an authentication request initiated by a user, a plurality of optional data transmission links are initialized according to the server to be accessed corresponding to the authentication request; the link security score corresponding to each optional data transmission link is determined according to the credibility of the transmission node in each optional data transmission link; the target data transmission link is determined based on the link security score, and the current key distribution node is determined in the preset key distribution center network according to the target data transmission link; the encryption algorithm corresponding to the current key distribution node is obtained, and the authentication data corresponding to the authentication request is encrypted according to the encryption algorithm. Since the present application can determine the target data transmission link based on the link security score, the security of the target data transmission link can be improved; and then the authentication data is encrypted according to the encryption algorithm corresponding to the current key distribution node determined by the target data transmission link, thereby avoiding the security vulnerabilities that may be caused by the fixed encryption algorithm. The present application realizes the encryption of authentication data through the dynamic change of the data transmission link and the encryption algorithm, so that even if the attacker obtains the encrypted authentication data at a certain time point, it is difficult to successfully decrypt it at other time points or links, thereby reducing the risk of authentication data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] Figure 1 This is a flow chart of the first embodiment of the authentication data encryption method based on network security of this application;

[0044] Figure 2 This is a flow chart of a second embodiment of the authentication data encryption method based on network security of the present application;

[0045] Figure 3 This is a flowchart of the third embodiment of the authentication data encryption method based on network security of the present application;

[0046] Figure 4 This is a schematic diagram of the module structure of the first embodiment of the authentication data encryption system based on network security of this application;

[0047] Figure 5 This is a schematic diagram of the structure of the authentication data encryption device based on network security in this application.

[0048] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0049] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0050] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0051] The present application embodiment provides an authentication data encryption method based on network security, referring to Figure 1 , Figure 1 This is a flow chart of a first embodiment of the authentication data encryption method based on network security of the present application. In this embodiment, the method includes: Steps S10 to S40:

[0052] Step S10: In response to the authentication request initiated by the user, a plurality of optional data transmission links are initialized according to the to-be-accessed server corresponding to the authentication request.

[0053] It should be noted that the execution subject of this embodiment can be a computer service device with data processing, program running and network communication, such as a mobile phone, a tablet computer, an access registration server, etc., and can also be other electronic devices that can implement the authentication data encryption method based on network security of this embodiment, which is the same as or similar to this embodiment. This embodiment is not limited to this. Here, the authentication request device is taken as an example to illustrate this embodiment and the following embodiments.

[0054] It should be understood that when receiving an authentication request triggered by a user, the authentication request device can obtain the server to be accessed corresponding to the authentication request, and determine the corresponding cloud access management server based on the server to be accessed; and generate several optional data transmission links according to the user's network location and the cloud access management server.

[0055] It is understandable that when a user has a need to access a server to be accessed, an authentication request instruction can be triggered on the authentication request device. When the authentication request receives the authentication request instruction triggered by the user, the server to be accessed can be obtained by analyzing the authentication request instruction.

[0056] It should be noted that in order to centralize the authentication logic and ensure the data security of the server to be accessed, the server to be accessed does not directly perform the authentication data verification, but can be verified through the cloud access management server. Therefore, when the server to be accessed is determined, the cloud access management server corresponding to the server to be accessed can be determined.

[0057] It should be understood that the network location of the user can be determined based on network positioning technology (such as IP address, GPS, etc.) in combination with the authentication request device. When the cloud access manager identifies the network location of the user, it generates several optional data transmission links based on the network location, and each data transmission link has several transmission nodes.

[0058] Step S20: determining a link security score corresponding to each of the optional data transmission links according to the credibility of the transmission nodes in each of the optional data transmission links.

[0059] It should be understood that first, the evaluation criteria for the credibility of the transmission node, i.e., credibility evaluation parameters, can be defined, such as the physical security of the node, the software update status of the node, the network monitoring and anomaly detection capabilities of the node, etc. Then, relevant information of the above credibility evaluation parameters can be obtained, which can be obtained from the operator of the transmission node or obtained through evaluation by a third-party security evaluation service. Finally, the credibility of each transmission node is quantitatively scored based on the collected relevant information.

[0060] It should be noted that for each optional data transmission link, the link security score of the optional data transmission link can be calculated based on the credibility of each transmission node. The credibility comprehensive calculation process can be calculated by arithmetic average or more complex weighted average, which is not limited in this embodiment.

[0061] Step S30: determining a target data transmission link based on the security scores of each link, and determining a current key distribution node in a preset key distribution center network according to the target data transmission link.

[0062] It should be understood that when obtaining the link security scores of each optional data transmission link, the optional data transmission link with the highest link security score can be directly selected as the target data transmission link, or the target data transmission link can be finally determined by further combining the link redundancy.

[0063] It should be noted that the preset key distribution center network is composed of a number of preset key distribution centers (KDCs), each KDC is used to generate, manage and distribute encryption keys. Different encryption algorithms can be preset in each KDC.

[0064] It should be understood that the closest KDC can be determined as the current key distribution node (current KDC) among the KDCs according to the starting position of the target data transmission link (the user's network location and the cloud access manager).

[0065] Step S40: Obtain the encryption algorithm corresponding to the current key distribution node, and encrypt the authentication data corresponding to the authentication request according to the encryption algorithm.

[0066] It should be understood that the current KDC corresponds to a certain encryption algorithm. The current KDC can generate an encryption key based on the encryption algorithm or select an encryption key from a key pool and send the encryption key to the authentication requesting device.

[0067] In a specific implementation, the authentication request device can obtain the key pair information generated by the current key distribution node based on the corresponding encryption algorithm, encrypt the authentication data corresponding to the authentication request according to the key pair information, and obtain the encrypted authentication data; transmit the encrypted authentication data to the cloud access management server through the target data transmission link to complete the request authentication process for the server to be accessed. This avoids the security vulnerabilities that may be caused by fixed encryption algorithms and increases the difficulty for attackers to crack.

[0068] In this embodiment, the authentication request device responds to the authentication request initiated by the user, initializes several optional data transmission links according to the server to be accessed corresponding to the authentication request; determines the link security score corresponding to each optional data transmission link according to the credibility of the transmission node in each optional data transmission link; determines the target data transmission link based on each link security score, and determines the current key distribution node in the preset key distribution center network according to the target data transmission link; obtains the encryption algorithm corresponding to the current key distribution node, and encrypts the authentication data corresponding to the authentication request according to the encryption algorithm. Since this embodiment can realize the encryption of authentication data through the dynamic change of data transmission link and encryption algorithm, even if the attacker obtains the encrypted authentication data at a certain time point, it is difficult to successfully decrypt it at other time points or links, thereby reducing the risk of authentication data leakage.

[0069] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 , Figure 2 This is a flow chart of the second embodiment of the authentication data encryption method based on network security of the present application.

[0070] In this embodiment, in order to specifically illustrate the calculation process of the link security score, step S20 specifically includes steps S201 to S203:

[0071] Step S201: Acquire a number of transmission nodes in each of the optional data transmission links.

[0072] Step S202: Determine the credibility of each transmission node based on a preset credibility scoring method.

[0073] It should be understood that for any optional data transmission link, the number of transmission nodes included in the optional data transmission link may be determined first, and then the credibility of each transmission node may be calculated based on a preset credibility scoring method.

[0074] It should be noted that, in order to illustrate the preset credibility scoring method, step S202 specifically includes steps S2021 to S2022:

[0075] Step S2021: Acquire relevant data of each of the transmission nodes, wherein the relevant data includes node configuration information, node historical events, and node maintenance logs.

[0076] It is understandable that the node configuration information may include: the node's identity authentication mechanism (whether the node uses a strong authentication method, such as multi-factor authentication), the node's encryption standard (whether the node uses modern encryption technology, such as TLS1.3 or higher), the node's physical security (the physical security of the node's location, such as whether it is in a secure data center). The node's network monitoring and anomaly detection capabilities (whether the node has the ability to monitor and respond to network attacks in real time); the node's historical events may include the node's historical security records, such as whether the node has ever suffered a security intrusion, or whether it frequently experiences data leaks; the node maintenance log may be the node's software update status, such as whether the node regularly updates its software and operating system to fix known security vulnerabilities.

[0077] Step S2022: input the node configuration information, the node historical events and the node maintenance log into a preset credibility evaluation model to obtain the credibility of each transmission node.

[0078] It should be understood that the above node configuration information, the node historical events and the relevant parameters in the node maintenance log are obtained, and the relevant parameters are input into the preset credibility evaluation model, and the credibility evaluation model can calculate the credibility score of each transmission node according to the input parameters. The credibility score is a quantitative expression of the node security, which is helpful for the subsequent data transmission link selection and key distribution node determination.

[0079] It should be noted that the preset credibility assessment model can be a mathematical model set up based on the weighted average method. Specifically, it can be pre-set to allocate weights to each relevant parameter based on the degree of security contribution. When each relevant parameter is obtained, the credibility score can be directly calculated according to its corresponding weight and numerical size.

[0080] It should also be noted that the preset credibility assessment model can also be a network model constructed based on machine learning ideas, such as support vector machines, random forests, or neural networks. Specifically, the constructed network model can be trained and parameterized using a node history data set in advance to obtain a trained model, and the model can be deployed in an actual environment containing transmission nodes to continuously collect and analyze data. Then, when the relevant parameters are obtained, they can be input into the above-mentioned trained model, and the model outputs the credibility score of the transmission node.

[0081] Step S203: Determine a link security score corresponding to each of the optional data transmission links according to the credibility of each of the transmission nodes and the weight of each of the transmission nodes.

[0082] It should be understood that the weight of each transmission node may be preset according to the importance or risk level of each transmission node on the optional data transmission link where the transmission node is located.

[0083] Among them, the link security score formula corresponding to the optional data transmission link is:

[0084] Link security score = ∑ (trustworthiness of transmission node × weight of transmission node)

[0085] It can be understood that, for each optional data transmission link, the link security score of the entire link can be obtained by adding up the weight-adjusted credibility scores of all transmission nodes constituting the link.

[0086] This embodiment obtains several transmission nodes in each of the optional data transmission links; determines the credibility of each of the transmission nodes based on a preset credibility scoring method; and determines the link security score corresponding to each of the optional data transmission links according to the credibility of each of the transmission nodes and the weight of each of the transmission nodes. In this embodiment, the credibility score of each transmission node can be calculated to quantify the network security of each optional data transmission link, so as to facilitate the subsequent selection of the most secure link as the target data transmission link for data transmission, and can flexibly adapt to real-time changes in the network environment, effectively avoiding the risk of data being intercepted and tampered with during transmission.

[0087] Based on the first and second embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those of the first and second embodiments can be referred to the above description, and will not be described in detail later. Figure 3 , Figure 3 This is a flowchart of the third embodiment of the authentication data encryption method based on network security of the present application.

[0088] In this embodiment, the preset key distribution center includes several optional key distribution nodes. In order to illustrate how to determine the current key distribution node among the optional key distribution nodes, the step S30 specifically includes: steps S301 to S303:

[0089] Step S301: among the optional data transmission links, determine the optional data transmission link with the highest link security score as the target data transmission link.

[0090] It should be understood that the optional data transmission links can be prioritized according to the calculated link security scores, and the links with higher link security scores can be preferentially selected for data transmission. Based on the principle of security priority, the link with the highest link security score can be directly selected as the target data transmission link.

[0091] Step S302: respectively obtaining distance information between each of the optional key distribution nodes and the target data transmission link.

[0092] It is understandable that the distance information may be the logical / physical distance between each optional key distribution node (optional KDC) and the target data transmission link. The distance information may specifically include: physical distance, network hop count or delay time.

[0093] Step S303: determining a current key distribution node among the optional key distribution nodes according to the distance information and based on a distance optimality principle.

[0094] It should be understood that among all optional KDCs, the node closest to the target data transmission link can be directly selected as the current KDC. Since the closer the distance means less transmission delay and potential security risks, selecting the current KDC based on the distance optimal principle can ensure the efficiency and security of subsequent key distribution.

[0095] Furthermore, in order to improve the performance of subsequent key distribution, when selecting the current KDC, the reliability and performance of the selected KDC can be considered while considering efficiency. Step S301 specifically includes: Steps S3011 to S3012:

[0096] Step S3011: Prioritize each of the optional key distribution nodes based on the distance optimization principle according to the distance information.

[0097] It should be understood that the optional KDCs may be prioritized according to the distance information of the optional KDCs, and the optional KDC with a shorter distance may be preferentially selected as the current KDC.

[0098] Step S3012: According to the sorting result, a preset number of optional key distribution nodes are selected to construct a candidate key distribution node set.

[0099] It should be understood that when obtaining the sorting results, a preset number of relatively close optional KDCs can be selected to construct a candidate key distribution node set, and each candidate KDC in the set can be used as a candidate set of the current KDC for further screening and load balancing.

[0100] Step S3013: Determine the current key distribution node in the candidate key distribution node set according to the real-time load capacity of each candidate key distribution node.

[0101] It should be understood that in the candidate KDC set, the current load capacity information of each candidate KDC is further obtained: such as the processing capacity of the KDC, bandwidth usage, and the number of currently active sessions. Then, an evaluation is performed based on the real-time load capacity, and the candidate KDC with the lightest load is selected as the current KDC. This ensures that the KDC responds quickly to key distribution and avoids overload.

[0102] It should also be noted that by maintaining a set of alternative KDCs, you can quickly switch to other KDCs when the current KDC is unavailable to achieve redundancy and failover.

[0103] In this embodiment, among the optional data transmission links, the optional data transmission link with the highest link security score is determined as the target data transmission link; the distance information between each optional key distribution node and the target data transmission link is obtained respectively; and the current key distribution node is determined among the optional key distribution nodes based on the distance optimal principle according to the distance information. Since the present embodiment can determine the current key distribution node through the preset key distribution center network, the secure distribution of encryption keys is ensured, and the complexity and risk of key management are reduced. Furthermore, according to the distance information, each optional key distribution node is prioritized based on the distance optimal principle; according to the sorting result, a preset number of optional key distribution nodes are selected to construct a set of candidate key distribution nodes; in the set of candidate key distribution nodes, the current key distribution node is determined according to the real-time load capacity of each candidate key distribution node. It can ensure that the selection of the current key distribution node takes into account both efficiency (through the distance optimal principle) and reliability and performance (through load capacity evaluation), thereby providing a robust key management foundation for the end-to-end encryption algorithm.

[0104] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the authentication data encryption method based on network security of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0105] The present application also provides a network security-based authentication data encryption system, referring to Figure 4 , Figure 4 This is a schematic diagram of the module structure of the first embodiment of the authentication data encryption system based on network security in the present application. The system includes: an authentication request end 10 and an authentication receiving end 20. The authentication request end 10 includes: a request response module 101, a transmission link scoring module 102, a key node determination module 103 and a data encryption module 104.

[0106] The request response module 101 is used to respond to an authentication request initiated by a user and initialize several optional data transmission links according to the server to be accessed corresponding to the authentication request;

[0107] The transmission link scoring module 102 is used to determine the link security score corresponding to each of the optional data transmission links according to the credibility of the transmission nodes in each of the optional data transmission links;

[0108] The key node determination module 103 is used to determine a target data transmission link based on the security score of each link, and determine a current key distribution node in a preset key distribution center network according to the target data transmission link;

[0109] The data encryption module 104 is used to obtain the encryption algorithm corresponding to the current key distribution node, encrypt the authentication data corresponding to the authentication request according to the encryption algorithm, and send the encrypted authentication data to the authentication receiving end;

[0110] The authentication receiving end 20 is used to decrypt the received encrypted authentication data.

[0111] Furthermore, the transmission link scoring module 102 is also used to obtain several transmission nodes in each of the optional data transmission links; determine the credibility of each of the transmission nodes based on a preset credibility scoring method; and determine the link security score corresponding to each of the optional data transmission links according to the credibility of each of the transmission nodes and the weight of each of the transmission nodes.

[0112] Furthermore, the transmission link scoring module 102 is also used to obtain relevant data of each of the transmission nodes, and the relevant data includes node configuration information, node historical events and node maintenance logs; the node configuration information, the node historical events and the node maintenance logs are input into a preset credibility assessment model to obtain the credibility of each of the transmission nodes.

[0113] Furthermore, the preset key distribution center includes several optional key distribution nodes, and the key node determination module 103 is also used to determine the optional data transmission link with the highest link security score as the target data transmission link among each of the optional data transmission links; obtain the distance information between each of the optional key distribution nodes and the target data transmission link respectively; and determine the current key distribution node among each of the optional key distribution nodes based on the distance optimal principle according to the distance information.

[0114] Furthermore, the key node determination module 103 is also used to prioritize each of the optional key distribution nodes based on the distance optimal principle according to the distance information; based on the sorting result, select a preset number of optional key distribution nodes to construct an alternative key distribution node set; in the alternative key distribution node set, determine the current key distribution node according to the real-time load capacity of each alternative key distribution node.

[0115] Furthermore, the request response module 101 is also used to obtain the server to be accessed corresponding to the authentication request triggered by the user when receiving the authentication request, and determine the corresponding cloud access management server based on the server to be accessed; and generate several optional data transmission links according to the network location of the user and the cloud access management server.

[0116] Furthermore, the data encryption module 104 is also used to obtain the key pair information generated by the current key distribution node based on the corresponding encryption algorithm, encrypt the authentication data corresponding to the authentication request according to the key pair information, and obtain the encrypted authentication data; transmit the encrypted authentication data to the cloud access management server through the target data transmission link to complete the request authentication process for the server to be accessed.

[0117] This embodiment can encrypt authentication data through dynamic changes in data transmission links and encryption algorithms, so that even if an attacker obtains the encrypted authentication data at a certain point in time, it is difficult to successfully decrypt it at other time points or links, which is beneficial to reducing and improving the security of authentication data and preventing the risk of authentication data leakage.

[0118] The present application also provides an authentication data encryption device based on network security, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the authentication data encryption method based on network security in the above-mentioned embodiment one.

[0119] Reference below Figure 5 , Figure 5 The schematic diagram of the structure of the authentication data encryption device based on network security of the present application. The authentication data encryption device based on network security in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The network security-based authentication data encryption device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0120] like Figure 5As shown, the network security-based authentication data encryption device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the network security-based authentication data encryption device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the network security-based authentication data encryption device to communicate wirelessly or wired with other devices to exchange data. Although the network security-based authentication data encryption device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0121] The present application also provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the authentication data encryption method based on network security in the above-mentioned embodiment.

[0122] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0123] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0124] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0125] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0126] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for encrypting authentication data based on network security, characterized in that: The method comprises: In response to an authentication request initiated by a user, initializing a plurality of optional data transmission links according to the to-be-accessed server corresponding to the authentication request; Determine a link security score corresponding to each of the optional data transmission links according to the credibility of the transmission node in each of the optional data transmission links; Determine a target data transmission link based on the security score of each link, and determine a current key distribution node in a preset key distribution center network according to the target data transmission link; Obtaining an encryption algorithm corresponding to the current key distribution node, and encrypting authentication data corresponding to the authentication request according to the encryption algorithm; The step of determining the link security score corresponding to each of the optional data transmission links according to the credibility of the transmission node in each of the optional data transmission links includes: Acquire a number of transmission nodes in each of the optional data transmission links; Determining the credibility of each transmission node based on a preset credibility scoring method; Determining a link security score corresponding to each of the optional data transmission links according to the credibility of each of the transmission nodes and the weight of each of the transmission nodes; The step of determining the credibility of each transmission node based on a preset credibility scoring method includes: Acquire relevant data of each of the transmission nodes, the relevant data including node configuration information, node historical events, and node maintenance logs; Inputting the node configuration information, the node historical events and the node maintenance log into a preset credibility evaluation model to obtain the credibility of each transmission node; The preset key distribution center includes a plurality of optional key distribution nodes, and the step of determining a target data transmission link based on the security score of each link, and determining a current key distribution node in the preset key distribution center network according to the target data transmission link includes: Among the optional data transmission links, determining the optional data transmission link with the highest link security score as the target data transmission link; Respectively obtaining distance information between each of the optional key distribution nodes and the target data transmission link; According to the distance information, a current key distribution node is determined among the optional key distribution nodes based on a distance optimality principle.

2. The method according to claim 1, characterized in that The step of determining the current key distribution node among the optional key distribution nodes based on the distance optimal principle according to the distance information comprises: According to the distance information, priority sorting is performed on each of the optional key distribution nodes based on a distance optimal principle; According to the sorting result, a preset number of optional key distribution nodes are selected to construct a set of candidate key distribution nodes; In the candidate key distribution node set, the current key distribution node is determined according to the real-time load capacity of each candidate key distribution node.

3. The method according to claim 1, characterized in that The step of responding to the authentication request initiated by the user and initializing a plurality of optional data transmission links according to the to-be-accessed server corresponding to the authentication request includes: Upon receiving an authentication request triggered by a user, obtaining a server to be accessed corresponding to the authentication request, and determining a corresponding cloud access management server based on the server to be accessed; A number of optional data transmission links are generated according to the network location of the user and the cloud access management server.

4. The method according to claim 3, characterized in that The step of obtaining the encryption algorithm corresponding to the current key distribution node and encrypting the authentication data corresponding to the authentication request according to the encryption algorithm includes: Obtaining key pair information generated by the current key distribution node based on the corresponding encryption algorithm, Encrypting the authentication data corresponding to the authentication request according to the key pair information to obtain encrypted authentication data; The encrypted authentication data is transmitted to the cloud access management server through the target data transmission link to complete the authentication process of the server to be accessed.

5. An authentication data encryption system based on network security, characterized in that: The system comprises: an authentication request end and an authentication receiving end, wherein the authentication request end comprises: a request response module, a transmission link scoring module, a key node determination module and a data encryption module; The request response module is used to respond to the authentication request initiated by the user and initialize several optional data transmission links according to the server to be accessed corresponding to the authentication request; The transmission link scoring module is used to determine the link security score corresponding to each of the optional data transmission links according to the credibility of the transmission node in each of the optional data transmission links; The key node determination module is used to determine a target data transmission link based on the security score of each link, and determine a current key distribution node in a preset key distribution center network according to the target data transmission link; The data encryption module is used to obtain the encryption algorithm corresponding to the current key distribution node, and encrypt the authentication data corresponding to the authentication request according to the encryption algorithm, and send the encrypted authentication data to the authentication receiving end; The authentication receiving end is used to decrypt the received encrypted authentication data; The transmission link scoring module is further used to obtain a number of transmission nodes in each of the optional data transmission links; determine the credibility of each of the transmission nodes based on a preset credibility scoring method; and determine the link security score corresponding to each of the optional data transmission links according to the credibility of each of the transmission nodes and the weight of each of the transmission nodes; The transmission link scoring module is further used to obtain relevant data of each transmission node, wherein the relevant data includes node configuration information, node historical events, and node maintenance logs; input the node configuration information, the node historical events, and the node maintenance logs into a preset credibility evaluation model to obtain the credibility of each transmission node; Wherein, the preset key distribution center includes several optional key distribution nodes; The key node determination module is also used to determine the optional data transmission link with the highest link security score as the target data transmission link among the optional data transmission links; respectively obtain the distance information between each of the optional key distribution nodes and the target data transmission link; and determine the current key distribution node among the optional key distribution nodes based on the distance optimality principle according to the distance information.

6. An authentication data encryption device based on network security, characterized in that: The network security-based authentication data encryption device comprises: a memory, a processor, and a network security-based authentication data encryption program stored in the memory and executable on the processor. When the network security-based authentication data encryption program is executed by the processor, the steps of the network security-based authentication data encryption method as described in any one of claims 1 to 4 are implemented.

7. A storage medium, characterized in that: The storage medium stores an authentication data encryption program based on network security, and when the authentication data encryption program based on network security is executed by the processor, the steps of the authentication data encryption method based on network security as described in any one of claims 1 to 4 are implemented.

Images