Multi-factor login authentication method and system based on dynamic authentication chain

Abstract

The invention discloses a multi-factor login authentication method and system based on a dynamic authentication chain, and belongs to the technical field of information security, and the method comprises the steps: defining a plurality of authentication factors and an associated authentication chain sequence through extensible configuration data; recording the current authentication step and the completion state of each step through a state machine object; realizing cross-request state synchronization based on a distributed cache storage session state; and intercepting a login request through a section controller, and dynamically driving a multi-factor authentication process according to an authentication chain sequence. According to the invention, flexible and safe identity verification is realized through configurable authentication process and state machine management, the code coupling degree can be reduced, the user experience can be improved, and the brute force cracking risk can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, in particular to a multi-factor login authentication method and system based on a dynamic authentication chain. Background Art

[0002] In existing technologies, multi-factor authentication (MFA) typically uses a fixed sequence of authentication steps (e.g., password → SMS verification code → facial recognition). For example, patent CN113032721A discloses a multi-factor authentication method based on time synchronization. However, its authentication process is rigid and cannot dynamically adjust the authentication chain sequence based on business needs. Furthermore, traditional solutions often implement authentication logic through hard-coding, leading to the following problems: 1. Poor scalability: Adding or adjusting authentication steps requires code modification, increasing development and maintenance costs; 2. Insufficient state management: The authentication process state relies on HTTP Session, which makes it difficult to support distributed scenarios; 3. High interactive coupling: The authentication method is strongly bound to the front-end display, and the login method cannot be dynamically hidden or switched. Summary of the Invention

[0003] The technical task of the present invention is to address the above shortcomings and provide a multi-factor login authentication method and system based on a dynamic authentication chain, which can reduce code coupling, improve user experience, and reduce the risk of brute force cracking.

[0004] The technical solution adopted by the present invention to solve its technical problem is: A multi-factor login authentication method based on a dynamic authentication chain, comprising: Define multiple authentication factors and their associated authentication chain order through extensible configuration data; Record the current authentication step and the completion status of each step through the state machine object; Store session state based on distributed cache to achieve state synchronization across requests; The login request is intercepted by the aspect controller, and the multi-factor authentication process is dynamically driven according to the authentication chain sequence.

[0005] This method achieves flexible and secure identity authentication through configurable authentication process and state machine management.

[0006] Furthermore, the authentication chain configuration includes conditional judgment logic to dynamically adjust the authentication steps based on the user's risk level.

[0007] Furthermore, the state machine object manages the authentication chain state through LinkedHashMap and defines state transition rules.

[0008] Furthermore, after the last step of authentication is successful, the aspect controller is integrated with the Shiro framework to generate a user session.

[0009] Furthermore, the specific implementation of this method includes: (1) Authentication rule configuration: define authentication rules through JSONArray, including authentication factor type, control whether the front end displays the authentication method, and define the authentication chain order; (2) Front-end dynamic rendering: The front-end parses the JSON configuration and only displays the authentication methods defined for display; after the user selects the login method, the authentication process is initialized according to the defined authentication chain sequence; (3) LoginSession object design: record the status of each step through the loginStatusChain command; point to the current authentication step to be executed through the currentStep command; (4) Distributed session storage: The LoginSession object is serialized and stored in Redis, with the key being the user session ID; each login request reads the status from Redis to ensure state consistency in a distributed environment.

[0010] Furthermore, the status of each step recorded in the loginStatusChain includes inactive, active, success, and failed.

[0011] Furthermore, the specific implementation process of this method is as follows: S1. After the user initiates login, the aspect intercepts the request and checks the LoginSession in Redis. S2. If LoginSession does not exist, initialize LoginSession and store it in Redis; If S3 and LoginSession exist, verify the current step status; S4. If the verification is successful, activate the current step and execute the authentication logic; S5. If the current step is the last step, call Shiro to complete the login and generate a Session.

[0012] The present invention also claims protection for a multi-factor login authentication system based on a dynamic authentication chain, comprising: Authentication rule configuration module: defines authentication factor type, activation status and authentication chain order through JSON; Login status management module: records the current step and the status of each step through the LoginSession object; Distributed session storage module: stores session status based on Redis and supports state synchronization in a distributed environment; Authentication process aspect controller: intercepts login requests and drives the multi-factor authentication process according to the authentication chain sequence; The system specifically implements multi-factor login authentication through the above method.

[0013] The present invention also claims protection for a multi-factor login authentication device based on a dynamic authentication chain, comprising: at least one memory and at least one processor; The at least one memory is configured to store a machine-readable program; The at least one processor is configured to call the machine-readable program to implement the above method.

[0014] The present invention also claims protection for a computer-readable medium having computer instructions stored thereon, which are capable of implementing the above method when executed by a processor.

[0015] Compared with the prior art, the multi-factor login authentication method and system based on dynamic authentication chain of the present invention has the following advantages: 1. Dynamic authentication chain configuration: Flexibly arrange the authentication process through JSON configuration to reduce code coupling; 2. State-driven process control: supports complex scenarios such as breakpoint resumption and asynchronous authentication, improving user experience; 3. Distributed session management: Redis-based session storage ensures high availability and consistency; 4. Security enhancement: The state machine mechanism is used to prevent authentication process bypass, and the risk of brute force cracking is reduced by limiting the number of attempts. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flowchart of a multi-factor login authentication method based on a dynamic authentication chain provided by an embodiment of the present invention; Figure 2 This is a diagram illustrating the implementation process of a multi-factor login authentication method based on a dynamic authentication chain provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The embodiment of the present invention provides a multi-factor login authentication method based on dynamic authentication chain, such as Figure 1 Shown, including: Define multiple authentication factors and their associated authentication chain order through extensible configuration data; Record the current authentication step and the completion status of each step through the state machine object; Store session state based on distributed cache to achieve state synchronization across requests; The login request is intercepted by the aspect controller, and the multi-factor authentication process is dynamically driven according to the authentication chain sequence.

[0018] This method achieves flexible and secure identity authentication through configurable authentication process and state machine management.

[0019] Among them, the authentication chain configuration includes conditional judgment logic, which dynamically adjusts the authentication steps according to the user's risk level.

[0020] The state machine object manages the authentication chain state through LinkedHashMap and defines state transition rules.

[0021] After the last step of authentication is successful, the aspect controller integrates with the Shiro framework to generate a user session.

[0022] The specific implementation of this method includes: (1) Authentication rule configuration.

[0023] The data structure defines the authentication rules through JSONArray, including the authentication factor type, whether the front-end displays the authentication method, and the order of the authentication chain. The example is as follows: json [ { "type": "ACCOUNT", "active": "true", "loginChain": ["ACCOUNT", "SMS_CODE"] }, { "type": "SMS_CODE", "active": "true", "loginChain": ["SMS_CODE", "QR_CODE"] } ] type: authentication factor type (such as account password, SMS verification code); active: controls whether the front-end displays the authentication method; loginChain: defines the authentication chain order.

[0024] (2) Front-end dynamic rendering.

[0025] The front-end parses the JSON configuration and only displays the authentication methods where active is true; After the user selects the login method, the authentication process is initialized according to the loginChain sequence.

[0026] (3) LoginSession object design.

[0027] The data structure is as follows: java public class LoginSession { private String loginMethod; / / Current authentication rule type (such as SMS_CODE) private LinkedHashMap<String, String> loginStatusChain; / / Authentication chain status (e.g. {SMS_CODE=inactive, QR_CODE=inactive}) private String currentStep; / / Current execution step (such as SMS_CODE) } State Management: loginStatusChain records the status of each step (inactive / active / success / failed); currentStep points to the authentication step currently to be executed.

[0028] (4) Distributed session storage: Serialize the LoginSession object and store it in Redis, with the key being the user session ID. Each login request reads the status from Redis to ensure state consistency in a distributed environment.

[0029] like Figure 2 As shown, the specific implementation process of this method is as follows: S1. After the user initiates login, the aspect intercepts the request and checks the LoginSession in Redis. S2. If LoginSession does not exist, initialize LoginSession and store it in Redis; If S3 and LoginSession exist, verify the current step status; S4. If the verification is successful, activate the current step and execute the authentication logic; S5. If the current step is the last step, call Shiro to complete the login and generate a Session.

[0030] The following are two specific application cases of this method, which can better illustrate the specific implementation of this method.

[0031] Application Case 1: Dynamic authentication chain in high-risk scenarios.

[0032] 1. Configure a high-risk authentication chain: ["ACCOUNT", "SMS_CODE", "FACE_RECOGNITION"]; 2. When a user logs in, only ACCOUNT and SMS_CODE are displayed on the front end (if the IP risk is low, FACE_RECOGNITION is hidden); 3. If an abnormal login is detected, the FACE_RECOGNITION step is automatically activated.

[0033] Application Case 2: Distributed Session Synchronization

[0034] 1. The user initiates login through device A. After completing the ACCOUNT step, the session state is stored in Redis. 2. The user switches to device B to continue logging in, reads the session status from Redis, and performs SMS_CODE verification.

[0035] Through the specific application of this method, the following problems in the prior art can be solved: The multi-factor authentication process is fixed and the authentication chain order cannot be dynamically configured; Authentication status management is not flexible and cannot support scenarios such as breakpoint resumption and asynchronous authentication. The authentication method is interactively coupled with the front-end, and specific login rules cannot be hidden or displayed on demand.

[0036] An embodiment of the present invention further provides a multi-factor login authentication system based on a dynamic authentication chain, comprising: Authentication rule configuration module: defines authentication factor type, activation status and authentication chain order through JSON; Login status management module: records the current step and the status of each step through the LoginSession object; Distributed session storage module: stores session status based on Redis and supports state synchronization in a distributed environment; Authentication process aspect controller: intercepts login requests and drives the multi-factor verification process according to the authentication chain sequence.

[0037] The system implements multi-factor login authentication through the multi-factor login authentication method based on dynamic authentication chain described in the above embodiment. The specific implementation is as follows: (1) Authentication rule configuration.

[0038] The data structure defines the authentication rules through JSONArray, including the authentication factor type, whether the front-end displays the authentication method, and the order of the authentication chain. The example is as follows: json [ { "type": "ACCOUNT", "active": "true", "loginChain": ["ACCOUNT", "SMS_CODE"] }, { "type": "SMS_CODE", "active": "true", "loginChain": ["SMS_CODE", "QR_CODE"] } ] type: authentication factor type (such as account password, SMS verification code); active: controls whether the front-end displays the authentication method; loginChain: defines the authentication chain order.

[0039] (2) Front-end dynamic rendering.

[0040] The front-end parses the JSON configuration and only displays the authentication methods where active is true; After the user selects the login method, the authentication process is initialized according to the loginChain sequence.

[0041] (3) LoginSession object design.

[0042] The data structure is as follows: java public class LoginSession { private String loginMethod; / / Current authentication rule type (such as SMS_CODE) private LinkedHashMap<String, String> loginStatusChain; / / Authentication chain status (e.g. {SMS_CODE=inactive, QR_CODE=inactive}) private String currentStep; / / Current execution step (such as SMS_CODE) } State Management: loginStatusChain records the status of each step (inactive / active / success / failed); currentStep points to the authentication step currently to be executed.

[0043] (4) Distributed session storage: Serialize the LoginSession object and store it in Redis, with the key being the user session ID. Each login request reads the status from Redis to ensure state consistency in a distributed environment.

[0044] An embodiment of the present invention further provides a multi-factor login authentication device based on a dynamic authentication chain, comprising: at least one memory and at least one processor; The at least one memory is configured to store a machine-readable program; The at least one processor is configured to call the machine-readable program to implement the multi-factor login authentication method based on the dynamic authentication chain described in the above embodiment.

[0045] Embodiments of the present invention further provide a computer-readable medium storing computer instructions that, when executed by a processor, cause the processor to perform the multi-factor login authentication method based on a dynamic authentication chain as described in the aforementioned embodiments. Specifically, a system or device may be provided that includes a storage medium storing software program code that implements the functions of any of the aforementioned embodiments, and that causes a computer (or CPU or MPU) in the system or device to read and execute the program code stored in the storage medium.

[0046] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0047] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (e.g., CD-ROMs, CD-Rs, CD-RWs, DVD-ROMs, DVD-RAMs, DVD-RWs, and DVD+RWs), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer via a communications network.

[0048] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0049] In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or into the memory provided in the expansion unit connected to the computer, and then based on the instructions of the program code, the CPU installed on the expansion board or expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0050] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the code review methods in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the scope of protection of the present invention.

Claims

1. A multi-factor login authentication method based on dynamic authentication chain, characterized in that: include: Define multiple authentication factors and their associated authentication chain order through extensible configuration data; Record the current authentication step and the completion status of each step through the state machine object; Store session state based on distributed cache to achieve state synchronization across requests; The login request is intercepted by the aspect controller, and the multi-factor authentication process is dynamically driven according to the authentication chain sequence.

2. A multi-factor login authentication method based on dynamic authentication chain according to claim 1, characterized in that: The authentication chain configuration includes conditional judgment logic to dynamically adjust the authentication steps based on the user's risk level.

3. A multi-factor login authentication method based on dynamic authentication chain according to claim 1, characterized in that: The state machine object manages the authentication chain state through LinkedHashMap and defines state transition rules.

4. A multi-factor login authentication method based on dynamic authentication chain according to claim 1, characterized in that: After the last step of authentication is successful, the aspect controller integrates with the Shiro framework to generate a user session.

5. A multi-factor login authentication method based on dynamic authentication chain according to claim 1, characterized in that: The specific implementation of this method includes: (1) Authentication rule configuration: define authentication rules through JSONArray, including authentication factor type, control whether the front end displays the authentication method, and define the authentication chain order; (2) Front-end dynamic rendering: The front-end parses the JSON configuration and only displays the authentication methods defined for display; after the user selects the login method, the authentication process is initialized according to the defined authentication chain sequence; (3) LoginSession object design: Use the loginStatusChain command to record the status of each step; use the currentStep command to point to the current authentication step to be executed; (4) Distributed session storage: The LoginSession object is serialized and stored in Redis, with the key being the user session ID; each login request reads the status from Redis to ensure state consistency in a distributed environment.

6. A multi-factor login authentication method based on dynamic authentication chain according to claim 5, characterized in that: The status of each step recorded in the loginStatusChain includes inactive, active, success, and failed.

7. A multi-factor login authentication method based on dynamic authentication chain according to claim 5, characterized in that: The specific implementation process of this method is as follows: S1. After the user initiates login, the aspect intercepts the request and checks the LoginSession in Redis. S2. If LoginSession does not exist, initialize LoginSession and store it in Redis; If S3 and LoginSession exist, verify the current step status; S4. If the verification is successful, activate the current step and execute the authentication logic; S5. If the current step is the last step, call Shiro to complete the login and generate a Session.

8. A multi-factor login authentication system based on a dynamic authentication chain, characterized in that: include: Authentication rule configuration module: defines authentication factor type, activation status and authentication chain order through JSON; Login status management module: records the current step and the status of each step through the LoginSession object; Distributed session storage module: stores session status based on Redis and supports state synchronization in a distributed environment; Authentication process aspect controller: intercepts login requests and drives the multi-factor authentication process according to the authentication chain sequence; The system specifically implements multi-factor login authentication through the method described in any one of claims 1 to 7.

9. A multi-factor login authentication device based on a dynamic authentication chain, characterized in that: include: at least one memory and at least one processor; The at least one memory is configured to store a machine-readable program; The at least one processor is configured to call the machine-readable program to implement the method according to any one of claims 1 to 7.

10. A computer-readable medium, characterized in that The computer readable medium stores computer instructions, which, when executed by a processor, can implement the method according to any one of claims 1 to 7.

Images