User security authentication method and system based on encryption processing

Abstract

The application discloses a user security authentication method and system based on encryption processing, and the method comprises an initialization stage, user key processing, secondary encryption, user identity authentication, server identity authentication, secondary security authentication, a dynamic update expansion mechanism and key management. The application belongs to the field of data encryption, and specifically relates to a user security authentication method and system based on encryption processing. The scheme greatly improves the key generation anti-prediction capability by generating Q through high-entropy pseudo-random numbers. A double confusion mechanism is introduced for secondary encryption. Data errors are detected through base checking. The security of the encryption authentication is significantly improved. A multi-layer verification mechanism is constructed by combining user biological feature data for initial identity authentication, user direct authentication with a target server, and secondary security authentication, so that the confidentiality and integrity of the key are ensured. Based on dynamic expansion and layered key management, the risk of single-point key leakage is reduced, and the encryption authentication effect is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a user security authentication method and system based on encryption processing. Background Art

[0002] Encryption authentication methods primarily rely on various cryptographic algorithms to encrypt and verify identity information and communication data, ensuring that only legitimate users can access the system and preventing data theft or tampering during transmission and storage. However, common encryption authentication methods suffer from static key distribution management, which reduces security, low encryption system security performance, and a lack of effective error detection mechanisms, which can easily lead to transmission errors or undetected tampering, resulting in poor encryption authentication security. Common encryption authentication methods also suffer from single-factor reliance, static key management, and a lack of sufficient anti-replay and anti-man-in-the-middle attack measures, leading to poor encryption authentication effectiveness. Summary of the Invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a user security authentication method and system based on encryption processing. In view of the problem that the general encryption authentication method has static key distribution management, which leads to reduced security, low security performance of the encryption system, lacks an effective error detection mechanism, and is prone to transmission errors or tampering without being easily discovered, thereby leading to poor encryption authentication security, this scheme generates Q through high entropy pseudo-random numbers, which greatly improves the entropy value and anti-prediction ability of key generation; introduces a double obfuscation mechanism for secondary encryption, which greatly increases the difficulty for attackers to analyze and reverse the original key; detects data errors by verifying bases, and ensures that the data is not tampered with during transmission or storage. If there are errors or tampering in the storage process, it can be discovered in time; thereby significantly improving the security of encryption authentication; in view of the problem that general encryption authentication methods have single-factor reliance, static key management, and lack of sufficient anti-replay and anti-man-in-the-middle attack measures, which lead to poor encryption authentication effects, this solution combines user biometric data for initial identity authentication, users directly authenticate with the target server, and secondary security authentication to build a multi-layer verification mechanism. The final session key generation process ensures the confidentiality and integrity of the key during transmission and storage; based on dynamic expansion and hierarchical key management, it reduces the risk of single-point key leakage; thereby improving the encryption authentication effect.

[0004] The technical solution adopted by the present invention is as follows: The user security authentication method based on encryption processing provided by the present invention comprises the following steps:

[0005] Step S1: initialization phase;

[0006] Step S2: User key processing;

[0007] Step S3: secondary encryption;

[0008] Step S4: User identity verification;

[0009] Step S5: Server identity authentication;

[0010] Step S6: Secondary security authentication;

[0011] Step S7: Dynamically update the extension mechanism;

[0012] Step S8: Key management.

[0013] Furthermore, in step S1, the registration server RS ​​generates unique identity information for each user and server in the initialization phase and distributes keys; uses lattice encryption technology to generate key pairs for users and servers for key exchange and authentication processes; and the Merkle tree is used to store and manage user authority information.

[0014] Furthermore, in step S2, the user key is processed by the user's identity information , pseudo-random sequence Q and the user's Generate the user's key and encrypt the key; iteratively generate a pseudo-random sequence, expressed as: ; After N iterations, we get , and extract the pseudo-random number sequence Q, expressed as: ; Finally, the user identity information is generated, expressed as: ; Where a, b, c, d and e are parameters that control the generation of pseudo-random sequences; Is the user's original identity; 、 and is the state variable generated at the n+1th iteration; 、 and is the state variable generated at the nth iteration; N is the maximum number of iterations; k is the exponential parameter; CTB(·) is the function that converts the value into binary representation; is rounded down; h(·) is the hash function; user key generation is expressed as: ; Merkle tree root hash, represented as: ;in, is the exclusive OR operator; is the generated user key; It is the Merkle tree root hash encrypted by the key; is the user password; is the user random number; It is the user's permission data; is the lattice encryption function; Is the key used for encryption.

[0015] Furthermore, in step S3, the secondary encryption establishes a double obfuscation mechanism to Perform secondary encoding encryption, the initial encoding is expressed as: ;set up The binary representation of , group the binary bits into pairs; convert the binary pairs into bases, mapping function Expressed as: ; Map all groups in sequence and finally construct a sequence, which is expressed as: ;in, is the encoding function; is the encryption result; and Both A, T, C and G are bases; is the base sequence obtained after encoding; prepare two auxiliary keys, where the key sequence K=k1…k n Used for subtraction operation; binary key sequence R = r1…r n Used for XOR operation; convert the base into a numerical value through the mapping function, , denoted as N(d j ) and N(k j ), for each position j, perform modulo 4 subtraction, expressed as: ; Map the results back to bases , and converted to 2-bit binary representation to get ;right With the auxiliary binary key r j Perform bitwise XOR , convert the XORed binary value back to base, and get , and finally get the secondary encoding encryption sequence ;

[0016] Decoded representation for: ; Define the inverse mapping function , expressed as: ;Will Convert to 2-bit binary representation , using the same binary key r j Perform XOR recovery , and convert the result back to bases ; For each position j, first Mapped to corresponding values , and then use the auxiliary key k j Perform the reverse operation ; Set the value Mapping back to the original base; ; the recovered sequence is input into the decoding function to obtain the original user key ;

[0017] Adding check base; for All binary pairs are calculated to obtain a check value, denoted as: ; the check value is converted into a check base d using the mapping function n+1 ; the check base is appended to the end of the original sequence to obtain; during decoding, the is converted into binary pairs , the XOR value of these binary pairs is calculated, which is mapped into an inverse check base, and the calculated inverse check base is compared with the check base. If they are not consistent, it means that there is an error in the sequence, and the administrator is warned.

[0018] Further, in step S4, the user identity authentication combines the user's biometric data to generate encrypted biometric information; and the encryption and verification are performed through the password and random number;

[0019] Biometric generation and verification, denoted as: ; the biometric data is encrypted, denoted as: ; the password verification is denoted as: ; error counting and threshold control, denoted as: ; wherein, is a biometric generation function; is the user's biometric data; is the characteristic value of the user's biometric data; is the auxiliary parameter of the user's biometric data; E is the generated biometric encryption information; V is the password verification value; is an error counter for detecting the number of consecutive error authentications; n is a preset error number threshold; is a user determined as an illegal user; if the user completes the identity authentication, it goes to step S5 for server identity authentication.

[0020] Further, in step S5, the server identity authentication is directly performed between the user and the target server; the user sends a random number and an encrypted message, denoted as: ; ; the server calculates the session key SK, denoted as: ; wherein, is a temporary random number generated during the communication between the user and the server, used to construct an authentication message; and is the authentication message sent by the user to the server; Used to hide information; Used to verify user identity; It is the user identity used for authentication on the server side; Is the target server's identity; It is the level information of the user in the hierarchical system; It is the local link key; when the user completes the server identity verification, go to step S6 for secondary security authentication.

[0021] Furthermore, in step S6, the secondary security authentication is a secondary identity verification performed by the user to further confirm the user's identity and generate a final session key based on the secondary authentication result; the secondary authentication is expressed as: ; Generate the final key , expressed as: ;in, It is the new random number used in secondary authentication; is the secondary authentication verification value; is a function that encrypts data using the key Ki; It is another encrypted message passed during the authentication process and is used as a component of the final key; when the user completes the secondary security authentication, the authentication is complete.

[0022] Furthermore, in step S7, the dynamic update extension mechanism supports dynamic addition and deletion of server level information; the Merkle tree implements dynamic update; the newly added level Expressed as: ; Delete level Expressed as: ;in, It is a random factor in the dynamic update process; This is the key assigned when adding a new server tier; is the key used by the current level; P is the identifier used for the delete operation.

[0023] Furthermore, in step S8, the key management uses a hierarchical directed graph model to manage key information at different levels; the hierarchical key calculation is expressed as: ; Information update is represented by: ;in, is the hierarchical key; It is the information update parameter, used to encrypt and transmit the update information; It is the update information encryption function; It is the target level information to be updated.

[0024] The user security authentication system based on encryption processing provided by the present invention includes an initialization phase module, a user key processing module, a secondary encryption module, a user identity authentication module, a server identity authentication module, a secondary security authentication module, a dynamic update expansion module and a key management module;

[0025] The initialization phase module registration server generates unique identities and keys for all users and servers;

[0026] The user key processing module performs initial encryption on the key;

[0027] The secondary encryption module maps the user key to a biological sequence code, and then uses modulo 4 subtraction and bitwise XOR to achieve double encryption;

[0028] The user identity verification module performs user identity verification by combining user biometrics, password and random number;

[0029] The server identity authentication module enables the user to directly exchange random numbers and encrypted messages with the target server to achieve server identity authentication;

[0030] The secondary security authentication module is used by the user to perform a second identity confirmation, generate a verification value through a new random number and password, and then construct the final session key;

[0031] The dynamic update extension module supports dynamic addition and deletion of server levels;

[0032] The key management module uses a hierarchical directed graph model to manage and update keys of different levels.

[0033] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0034] (1) In view of the problem that general encryption authentication methods have static key distribution management, which leads to reduced security, low security performance of the encryption system, and lack of effective error detection mechanism, which easily leads to transmission errors or tampering without being easily discovered, thus resulting in poor encryption authentication security, this scheme generates Q through high entropy pseudo-random numbers, which greatly improves the entropy value and anti-prediction ability of key generation; introduces a double obfuscation mechanism for secondary encryption, which greatly increases the difficulty for attackers to analyze and reverse the original key; detects data errors by checking bases, ensuring that any errors or tampering during transmission or storage can be discovered in time; thereby significantly improving the security of encryption authentication.

[0035] (2) In view of the problem that general encryption authentication methods have single-factor dependence, static key management, and lack of sufficient anti-replay and anti-man-in-the-middle attack measures, which lead to poor encryption authentication effects, this solution combines user biometric data for initial identity authentication, users directly authenticate with the target server, and secondary security authentication to build a multi-layer verification mechanism. The final session key generation process ensures the confidentiality and integrity of the key during transmission and storage; based on dynamic expansion and hierarchical key management, it reduces the risk of single-point key leakage, thereby improving the encryption authentication effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of the process flow of the user security authentication method based on encryption processing provided by the present invention;

[0037] Figure 2 This is a schematic diagram of the user security authentication system based on encryption processing provided by the present invention.

[0038] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0040] In the description of the present invention, it should be understood that terms such as "up", "down", "front", "back", "left", "right", "top", "bottom", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0041] Example 1, see Figure 1 The present invention provides a user security authentication method based on encryption processing, which includes the following steps:

[0042] Step S1: Initialization phase; the registration server generates unique identities and keys for all users and servers;

[0043] Step S2: User key processing: the generated pseudo-random sequence is bound to the user identity data to generate and encrypt the user key;

[0044] Step S3: Secondary encryption: Map the user key to the biological sequence code, and then use modulo 4 subtraction and bitwise XOR to achieve double encryption;

[0045] Step S4: User identity verification: user identity verification is performed by combining user biometrics, password, and random number;

[0046] Step S5: Server identity verification: The user directly exchanges random numbers and encrypted messages with the target server to achieve server identity verification;

[0047] Step S6: Secondary security authentication: The user performs a second identity confirmation, generates a verification value using a new random number and password, and then constructs the final session key;

[0048] Step S7: Dynamically update the extension mechanism; support dynamic addition and deletion of server levels;

[0049] Step S8: Key management: Use a hierarchical directed graph model to manage and update keys at different levels.

[0050] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, during the initialization phase, the registration server RS ​​generates unique identity information for each user and server and allocates a key. Lattice encryption technology is used to generate a key pair for the user and server for key exchange and authentication processes. The Merkle tree is used to store and manage user permission information, reduce storage overhead, and ensure data security and consistency.

[0051] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, the user key is processed by the user's identity information. , pseudo-random sequence Q and the user's Generate the user's key and encrypt the key; iteratively generate a pseudo-random sequence, expressed as: ; After N iterations, we get , and extract the pseudo-random number sequence Q, expressed as: ; Finally, the user identity information is generated, expressed as: ; Where a, b, c, d and e are parameters that control the generation of pseudo-random sequences; Is the user's original identity; 、 and is the state variable generated at the n+1th iteration; 、 and is the state variable generated at the nth iteration; N is the maximum number of iterations; k is the exponential parameter; CTB(·) is the function that converts the value into binary representation; is rounded down; h(·) is the hash function; user key generation is expressed as: ; Merkle tree root hash, represented as: ;in, is the exclusive OR operator; is the generated user key; It is the Merkle tree root hash encrypted by the key; is the user password; is the user random number; It is the user's permission data; is the lattice encryption function; Is the key used for encryption.

[0052] Example 4, see Figure 1 This embodiment is based on the above embodiment. In step S3, the secondary encryption establishes a double obfuscation mechanism to Perform secondary encoding encryption, the initial encoding is expressed as: ;set up The binary representation of , group the binary bits into pairs; convert the binary pairs into bases, mapping function Expressed as: ; Map all groups in sequence and finally construct a sequence, which is expressed as: ;in, is the encoding function; is the encryption result; and Both A, T, C and G are bases; is the base sequence obtained after encoding; prepare two auxiliary keys, where the key sequence K=k1…k n Used for subtraction operation; binary key sequence R = r1…r n Used for XOR operation; convert the base into a numerical value through the mapping function, , denoted as N(d j ) and N(k j ), for each position j, perform modulo 4 subtraction, expressed as: ; Map the results back to bases , and converted to 2-bit binary representation to get ;right With the auxiliary binary key r j Perform bitwise XOR , convert the XORed binary value back to base, and get , and finally get the secondary encoding encryption sequence ;

[0053] Decoded representation for: ; Define the inverse mapping function , expressed as: ;Will Convert to 2-bit binary representation , using the same binary key r j Perform XOR recovery , and convert the result back to bases ; For each position j, first Mapped to corresponding values , and then use the auxiliary key k j Perform the reverse operation ; Set the value Map back to the original bases; ; Input the recovered sequence into the decoding function to obtain the original user key ;

[0054] Add check base; Calculate a checksum for all binary pairs, expressed as: ; Use the mapping function to check the value Convert to a check base d n+1 ; Append the check base to the end of the original sequence to get ; When decoding, first Convert to binary pair , calculate the XOR value of these binary pairs, map it to an inverse check base, and compare the calculated inverse check base with the check base. If they are inconsistent, it means that there is an error in the sequence and an early warning is issued to the management personnel.

[0055] By performing the above operations, the general encryption and authentication methods have static key distribution management, which leads to reduced security, low security performance of the encryption system, and lack of an effective error detection mechanism, which easily leads to transmission errors or tampering without being easily discovered, and thus leads to poor encryption and authentication security. This scheme generates Q through high-entropy pseudo-random numbers, greatly improving the entropy value and anti-prediction ability of key generation; introduces a double obfuscation mechanism for secondary encryption, which greatly increases the difficulty for attackers to analyze and reverse the original key; detects data errors by checking bases, ensuring that any errors or tampering during transmission or storage can be discovered in time, thereby significantly improving the security of encryption and authentication.

[0056] Example 5, see Figure 1The embodiment is based on the above embodiment, in step S4, the user identity authentication combines the user's biometric data to generate encrypted biometric information; and the encryption verification is performed through the password and the random number, to ensure the accuracy of the user identity;

[0057] Biometric generation and verification, denoted as: ; the biometric data is encrypted, denoted as: ; the password verification, denoted as: ; the error count and threshold control, denoted as: ; wherein, is a biometric generation function; is the user's biometric data; is the characteristic value of the user's biometric data; is the auxiliary parameter of the user's biometric data; E is the generated biometric encryption information; V is the password verification value; is an error counter for detecting the number of consecutive error authentications; n is a preset error number threshold; is a user determined as an illegal user; if the user completes the identity authentication, proceed to step S5 for server identity authentication.

[0058] Embodiment six, refer to Figure 1 The embodiment is based on the above embodiment, in step S5, the server identity authentication is directly performed by the user and the target server, to reduce the dependence on the registration center and improve the authentication efficiency; the user sends a random number and an encrypted message, denoted as: ; ; the server calculates the session key SK, denoted as: ; wherein, is a temporary random number generated in the user's communication process with the server, used to construct an authentication message; and is the authentication message sent by the user to the server; is used to hide information; is used to prove the user's identity; is the user's identity identification for verification on the server side; is the identity identification of the target server; is the hierarchical information of the user in the hierarchical system; is a local link key; when the user completes the server identity authentication, proceed to step S6 for secondary security authentication.

[0059] Embodiment seven, refer to Figure 1This embodiment is based on the above embodiment. In step S6, the secondary security authentication is a secondary authentication of the user to further confirm the user's identity. The final session key is generated based on the secondary authentication result to ensure the communication security after authentication. The secondary authentication is expressed as: ; Generate the final key , expressed as: ;in, It is the new random number used in secondary authentication; is the secondary authentication verification value; is a function that encrypts data using the key Ki; It is another encrypted message passed during the authentication process and is used as a component of the final key; when the user completes the secondary security authentication, the authentication is complete.

[0060] Example 8, see Figure 1 This embodiment is based on the above embodiment. In step S7, the dynamic update extension mechanism supports the dynamic addition and deletion of server level information to ensure the flexible expansion of the authentication system; the Merkle tree implements dynamic update to ensure the consistency and security of user and key information; the new level Expressed as: ; Delete level Expressed as: ;in, It is a random factor in the dynamic update process; This is the key assigned when adding a new server tier; is the key used by the current level; P is the identifier used for the delete operation.

[0061] Example 9, see Figure 1 This embodiment is based on the above embodiment. In step S8, key management uses a hierarchical directed graph model to manage key information at different levels, ensuring that the key update and deletion process does not affect data at other levels; the hierarchical key calculation is expressed as: ; Information update is represented by: ;in, is the hierarchical key; It is the information update parameter, used to encrypt and transmit the update information; It is the update information encryption function; It is the target level information to be updated.

[0062] Example 10, see Figure 2 This embodiment is based on the above embodiment. The user security authentication system based on encryption processing provided by the present invention includes an initialization phase module, a user key processing module, a secondary encryption module, a user identity authentication module, a server identity authentication module, a secondary security authentication module, a dynamic update extension module and a key management module.

[0063] The initialization phase module registration server generates unique identities and keys for all users and servers;

[0064] The user key processing module performs initial encryption on the key;

[0065] The secondary encryption module maps the user key to a biological sequence code, and then uses modulo 4 subtraction and bitwise XOR to achieve double encryption;

[0066] The user identity verification module performs user identity verification by combining user biometrics, password and random number;

[0067] The server identity authentication module enables the user to directly exchange random numbers and encrypted messages with the target server to achieve server identity authentication;

[0068] The secondary security authentication module is used by the user to perform a second identity confirmation, generate a verification value through a new random number and password, and then construct the final session key;

[0069] The dynamic update extension module supports dynamic addition and deletion of server levels;

[0070] The key management module uses a hierarchical directed graph model to manage and update keys of different levels.

[0071] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0072] While the embodiments of the present invention have been shown and described, it will be apparent to those skilled in the art that various changes, modifications, substitutions, and alterations can be made to the embodiments without departing from the principles and spirit of the invention.

[0073] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. A user security authentication method based on encryption processing, characterized by: The method comprises the following steps: Step S1: Initialization phase, generating unique identities and keys for all users and servers; Step S2: User key processing, initial encryption of the key; Step S3: Secondary encryption: mapping the user key to a biological sequence code, and then using modulo 4 subtraction and bitwise XOR to achieve double encryption; Step S4: User identity verification, which combines user biometrics, password, and random number to perform user identity verification; Step S5: Server identity verification: the user directly exchanges random numbers and encrypted messages with the target server to achieve server identity verification; Step S6: Secondary security authentication, the user performs a second identity confirmation, generates a verification value using a new random number and password, and then constructs the final session key; Step S7: Dynamically update the extension mechanism to support dynamic addition and deletion of server levels; Step S8: Key management, using a hierarchical directed graph model to manage and update keys at different levels; In step S2, the user key is processed by the user's identity information , pseudo-random sequence Q and the user's Generate the user's key and encrypt the key; iteratively generate a pseudo-random sequence, expressed as: ; After N iterations, we get , and extract the pseudo-random number sequence Q, expressed as: ; Finally, the user identity information is generated, expressed as: ; Where a, b, c, d and e are parameters that control the generation of pseudo-random sequences; Is the user's original identity; 、 and is the state variable generated at the n+1th iteration; 、 and is the state variable generated at the nth iteration; N is the maximum number of iterations; k is the exponential parameter; CTB(·) is the function that converts the value into binary representation; is rounded down; h(·) is the hash function; user key generation is expressed as: ; Merkle tree root hash, represented as: ;in, is the exclusive OR operator; is the generated user key; It is the Merkle tree root hash encrypted by the key; is the user password; is the user random number; It is the user's permission data; is a lattice encryption function; Is the key used for encryption.

2. The user security authentication method based on encryption processing according to claim 1, characterized in that: In step S3, the secondary encryption establishes a double obfuscation mechanism to Perform secondary encoding encryption, the initial encoding is expressed as: ;set up The binary representation of , group the binary bits into pairs; convert the binary pairs into bases, mapping function Expressed as: ; Map all groups in sequence and finally construct a sequence, which is expressed as: ;in, is the encoding function; is the encryption result; and Both A, T, C and G are bases; is the base sequence obtained after encoding; prepare two auxiliary keys, where the key sequence K=k1…k n Used for subtraction operation; binary key sequence R = r1…r n Used for XOR operation; convert the base into a numerical value through the mapping function, , denoted as N(d j ) and N(k j ), for each position j, perform modulo 4 subtraction, expressed as: ; Map the results back to bases , and convert it to 2-bit binary representation to get ;right With the auxiliary binary key r j Perform bitwise XOR , convert the XORed binary value back to base, and get , and finally get the secondary encoding encryption sequence ; Decoded representation for: ; Define the inverse mapping function , expressed as: ;Will Convert to 2-bit binary representation , using the same binary key r j Perform XOR recovery , and convert the result back to bases ; For each position j, first Mapped to corresponding values , and then use the auxiliary key k j Perform the reverse operation ; Set the value Map back to the original bases; ; Input the recovered sequence into the decoding function to obtain the original user key ; Add check base; Calculate a checksum for all binary pairs, expressed as: ; Use the mapping function to check the value Convert to a check base d n+1 ; Append the check base to the end of the original sequence to get ; When decoding, first Convert to binary pair , calculate the XOR value of these binary pairs, map it to an inverse check base, and compare the calculated inverse check base with the check base. If they are inconsistent, it means that there is an error in the sequence and an early warning is issued to the management personnel.

3. The user security authentication method based on encryption processing according to claim 2, characterized in that: In step S4, the user identity verification is combined with the user's biometric data to generate encrypted biometric information; and encrypted verification is performed using a password and a random number; Biometric generation and verification, expressed as: ; Encrypt the biometric data, expressed as: ; Password verification, expressed as: ; Error count and threshold control, expressed as: ;in, is the biometric generating function; is the user’s biometric data; is the characteristic value of the user's biometric data; is the auxiliary parameter of the user's biometric data; E is the generated biometric encryption information; V is the password verification value; is an error counter used to detect the number of consecutive authentication errors; n is the preset error threshold; The user is determined to be an illegal user; if the user completes identity verification, the process goes to step S5 for server identity verification.

4. The user security authentication method based on encryption processing according to claim 3, characterized in that: In step S5, the server identity authentication is performed directly between the user and the target server; the user sends a random number and an encrypted message; the server calculates the session key SK; when the user completes the server identity authentication, the process goes to step S6 for secondary security authentication.

5. The user security authentication method based on encryption processing according to claim 4 is characterized in that: In step S6, the secondary security authentication is a secondary identity verification performed by the user to further confirm the user's identity and generate a final session key based on the secondary authentication result; the secondary authentication is expressed as: ; Generate the final key , expressed as: ;in, It is the new random number used in secondary authentication; is the secondary authentication verification value; is a function that encrypts data using the key Ki; It is another encrypted message passed during the authentication process and is used as a component of the final key; when the user completes the secondary security authentication, the authentication is complete.

6. The user security authentication method based on encryption processing according to claim 5, characterized in that: In step S1, the registration server RS ​​generates unique identity information for each user and server in the initialization phase and distributes keys; uses lattice encryption technology to generate key pairs for users and servers for key exchange and authentication processes; and uses the Merkle tree to store and manage user authority information.

7. The user security authentication method based on encryption processing according to claim 6, characterized in that: In step S8, the key management uses a hierarchical directed graph model to manage key information at different levels; the hierarchical key calculation is expressed as: ; Information update is represented by: ;in, is the hierarchical key; It is the information update parameter, used to encrypt and transmit the update information; It is the random factor in the dynamic update extension mechanism; It is the update information encryption function; It is the target level information to be updated.

8. A user security authentication system based on encryption processing, for implementing the user security authentication method based on encryption processing according to any one of claims 1 to 7, characterized in that: It includes an initialization phase module, a user key processing module, a secondary encryption module, a user identity authentication module, a server identity authentication module, a secondary security authentication module, a dynamic update extension module and a key management module; The initialization phase module generates unique identities and keys for all users and servers; The user key processing module performs initial encryption on the key; The secondary encryption module maps the user key to a biological sequence code, and then uses modulo 4 subtraction and bitwise XOR to achieve double encryption; The user identity verification module performs user identity verification by combining user biometrics, password and random number; The server identity authentication module is used for the user to directly exchange random numbers and encrypted messages with the target server, thereby achieving server identity authentication; The secondary security authentication module is used to perform a second identity confirmation on the user, generate a verification value through a new random number and password, and then construct a final session key; The dynamic update extension module supports dynamic addition and deletion of server levels; The key management module uses a hierarchical directed graph model to manage and update keys of different levels.

Images