Identity verification method and system

Abstract

The invention discloses an identity verification method and system, and the method comprises the steps: generating a verification result through a verification algorithm after an identity verification server receives an identity verification request; when the verification result is successful, generating a legal identity certificate; and when the verification result is failure, generating a counterfeit identity certificate, and generating at least one of counterfeit reasonable data, counterfeit reasonable authority and counterfeit reasonable abnormity. The method has the core advantages that fake reasonable information is returned when verification fails, so that illegal visitors cannot deduce correct identity information by using failure feedback and cannot distinguish the authenticity of acquired data, authority or abnormal prompts, illegal behaviors such as library collision attacks and brute force cracking are effectively avoided, and the safety of the visitors is improved. The defect that key information is leaked due to failure feedback in the traditional identity verification technology is overcome, and the security of system data and functions is remarkably improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method and system for authentication. Background Technology

[0002] With the development of information technology, authentication technologies are typically used to ensure system and data security during human-computer interaction, inter-system interaction, and intra-system interaction (see the instruction manual appendix). Figure 1 The authentication server receives an authentication request from the client. When the authentication result is successful (verification passed), the authentication server generates a valid identity credential. The visitor can then use the correct system data or access system functions with the correct permissions using this valid identity credential. For example, when a user checks the amount of funds in their bank account through the online banking system, they must first pass authentication to log in and view the account's financial data. If the user needs to transfer funds, they must pass authentication again to confirm whether they have the permission to transfer funds; only after successful authentication can the fund transfer operation be executed.

[0003] When authentication fails, existing authentication technologies typically return a failure message (such as incorrect password or username). If the visitor is legitimate, this message alerts them to whether they have provided incorrect authentication information due to oversight, allowing them to complete authentication by resubmitting the correct information. However, if the visitor is unauthorized, the message essentially guides them to attempt to obtain the correct authentication information. In real-world scenarios, unauthorized users may eventually steal the correct authentication information through continuous trial and error (such as credential stuffing attacks) or other illegal means, objectively resulting in the loss of protection for system data or system functionality. Summary of the Invention

[0004] To overcome the shortcomings of existing technologies where feedback information upon authentication failure can be exploited by unauthorized users, leading to a loss of protection for system data and functions, this application provides an authentication method and system that hides the true authentication result by forging reasonable feedback information, thereby enhancing information security protection capabilities.

[0005] Specifically, this application is achieved through the following technical solution:

[0006] In a first aspect, the present invention provides an authentication method applied to an authentication server, comprising: receiving an authentication request; generating an authentication result through an authentication algorithm (such as password hash matching, biometric comparison algorithm, etc.); generating a legitimate identity credential when the authentication result is successful; generating a forged identity credential when the authentication result is unsuccessful; and generating at least one of forged reasonable data, forged reasonable permissions, and forged reasonable exceptions.

[0007] Among them, the forged reasonable data, forged reasonable permissions, and forged reasonable anomalies are all virtual information that conforms to the normal behavior of the system, exists reasonably in the system, and has the least potential loss. Their generation rules are pre-set on the identity verification server.

[0008] Optionally, when the verification result fails, pre-defined information (such as preset security reminders, abnormal access notifications, etc.) will also be sent.

[0009] Secondly, the present invention provides an identity verification system, comprising: an identity verification module and a forgery result module; the identity verification module is configured to receive an identity verification request, generate a verification result through a verification algorithm, generate a legitimate identity credential when the verification result is successful, and generate a forged identity credential when the verification result is unsuccessful; the forgery result module is configured to generate at least one of forged reasonable data, forged reasonable permissions, and forged reasonable exceptions when the verification result is unsuccessful.

[0010] Among them, the forged reasonable data, forged reasonable permissions, and forged reasonable anomalies are all virtual information that conforms to the normal behavior of the system, exists reasonably in the system, and has the least potential loss. Their generation rules are pre-set on the identity verification server.

[0011] Optionally, the system further includes: a reservation information module; the reservation information module is used to send reservation information when the verification result is a failure.

[0012] The forged reasonable data refers to data that reasonably exists within the system, such as the system's initial value, default value, or random value within a reasonable range, or a preset specific value. For example, the common initial value for numeric data is 0; the common default value for character data is an empty string; the reasonable range for human body temperature data is 36-38℃, and so on. To reduce security risks, the forged reasonable data must be virtual data that reasonably exists within the system and has the least potential loss. For example, when an unauthorized user attempts to check a bank account balance, after authentication failure, the system returns an initial value of 0 or a preset specific value of 1.2 yuan, making it impossible for the unauthorized user to distinguish between incorrect identity information and the real account balance.

[0013] The forged legitimate permissions refer to permissions that legally exist in the system, such as the access permissions initially configured in the system, the minimum operating permissions that only allow data viewing, or preset specific permissions. To reduce security risks, the forged legitimate permissions must be permissions that reasonably exist in the system and have the least potential loss. For example, when an unauthorized user attempts to transfer funds from a bank account, if identity verification fails, read-only permissions are returned, making it impossible for the unauthorized user to distinguish whether the identity information is incorrect or online transfer permissions are not activated.

[0014] The forged reasonable anomaly refers to a common anomaly that may occur in the system, such as a network failure in a network system, insufficient power supply in a battery-powered system, or a memory error in a Windows operating system. It can also be a pre-set anomaly. To reduce security risks, the forged reasonable anomaly must be a reasonably existing anomaly in the system with the least potential loss. For example, when an unauthorized user attempts to transfer funds from a bank account, an HTTP 500 error (Internal Server Error) is returned after authentication failure, making it impossible for the unauthorized user to distinguish between an incorrect identity information or a genuine malfunction of the online banking system.

[0015] This invention discloses a method and system for identity verification. In the method, after receiving an identity verification request, the identity verification server generates a verification result through a verification algorithm. When the verification result is successful, a legitimate identity credential is generated; when the verification result fails, a forged identity credential is generated; and at least one of forged reasonable data, forged reasonable permissions, or forged reasonable exceptions is generated. The core advantage of this invention is that by returning forged reasonable information when verification fails, unauthorized users cannot use the failure feedback to infer correct identity information, nor can they distinguish the authenticity of the obtained data, permissions, or exception prompts. This effectively avoids illegal acts such as credential stuffing attacks and brute-force attacks, compensates for the deficiency of traditional identity verification technologies in leaking critical information through failure feedback, and significantly improves the security of system data and functions. Attached Figure Description

[0016] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments are briefly described below. Obviously, the drawings described below are merely simplified schematic diagrams of the present invention, and do not show the connection relationships between modules or all implementation details, and do not constitute a limitation on the technical solutions of the present invention. Those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0017] Figure 1 This is a flowchart illustrating the existing authentication technologies in the background.

[0018] Figure 2 This is a schematic flowchart of an embodiment of an authentication method disclosed in this invention.

[0019] Figure 3 This is a schematic flowchart of another embodiment of an authentication method disclosed in this invention.

[0020] Figure 4 This is a schematic diagram of a module of an embodiment of an authentication system disclosed in this invention.

[0021] Figure 5 This is a schematic diagram of another embodiment of an authentication system disclosed in this invention.

[0022] Figure 6 This is a flowchart illustrating an automated teller machine (ATM) using an authentication method disclosed in this invention.

[0023] Figure 7 This is a flowchart illustrating a mobile phone photo album system that uses an authentication method disclosed in this invention.

[0024] Figure 8 This is a flowchart illustrating a smart door lock that uses an authentication method disclosed in this invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, and to make the above-mentioned objectives, features, and advantages of the present invention more apparent and understandable, the technical solutions of the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the embodiments discussed herein are only for the purpose of enabling those skilled in the art to understand and implement the contents of this disclosure, and do not imply any limitation on the scope of protection of this disclosure.

[0026] As used herein, the term "comprising" and its variations should be interpreted as an open-ended term meaning "including but not limited to"; the term "based on" should be interpreted as "at least partially based on"; the terms "one embodiment" and "an embodiment" should be interpreted as "at least one embodiment"; the term "another embodiment" should be interpreted as "at least one other embodiment"; the terms "upper," "lower," "left," "right," "front," "rear," "top," "bottom," "inner," "outer," "vertical," "horizontal," "lateral," and "longitudinal," etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing this application and its embodiments, and do not limit the indicated devices, modules, elements, or components to having a specific orientation or being constructed and operated in a specific orientation. Some of the above terms may also have other meanings, for example, "upper" may in some cases indicate a dependency or connection relationship, and those skilled in the art can understand their specific meaning in this application according to the specific circumstances. Furthermore, the terms "installation," "setup," "equipped with," "connection," and "linked" should be interpreted broadly. For example, they may refer to fixed connections, detachable connections, or integral structures; mechanical or electrical connections; direct connections or indirect connections via an intermediate medium; or internal communication between two devices, modules, elements, or components. Those skilled in the art can understand their specific meaning in this application based on the specific circumstances. Additionally, the terms "first," "second," etc., are primarily used to distinguish different devices, modules, elements, or components (the specific types and structures may be the same or different) and are not intended to indicate or imply the relative importance or quantity of the indicated objects; unless otherwise stated, "multiple" refers to two or more.

[0027] Figure 1 in the specification is a common flowchart of existing authentication technologies in the background art: The authentication server receives the authentication request from the authentication requester and generates a verification result through the verification algorithm; when the verification result is successful (verification passed), the authentication server generates a valid identity credential, which allows the visitor to access the system's real data or use system functions with corresponding valid permissions; when the verification result is unsuccessful (verification failed), existing authentication technologies usually return verification failure information (such as incorrect password, incorrect username, etc.) to the authentication requester.

[0028] According to a first aspect of the present invention, this embodiment discloses an authentication method, in a first possible implementation as described in the appendix to the specification. Figure 2 The flowchart shown is a schematic diagram of one embodiment, and is attached to the specification. Figure 1 Compared to the common flowchart of existing identity verification technologies, the core features are: when the verification result fails, it does not return a verification failure message, but generates a forged identity credential, and generates at least one of the following: forged reasonable data, forged reasonable permissions, and forged reasonable exceptions.

[0029] According to the first aspect of the invention, in a second possible implementation, as described in the appendix... Figure 3 The flowchart of another embodiment shown is attached to the specification. Figure 1 Compared to the common flowchart of existing identity verification technologies, the core features are: when the verification result fails, instead of returning a verification failure message, a forged identity credential is generated, and at least one of the following is generated: forged reasonable data, forged reasonable permissions, forged reasonable exceptions, and a pre-defined message is sent.

[0030] According to a second aspect of the present invention, this embodiment discloses an authentication system, in a first possible implementation as described in the appendix to the specification. Figure 4 The diagram illustrates an embodiment of an authentication system, comprising an authentication module and a forgery result module. The authentication module receives authentication requests, generates authentication results using an authentication algorithm, and generates a legitimate identity credential when the authentication result is successful and a forged identity credential when the authentication result fails. The forgery result module generates at least one of the following when the authentication result fails: forged reasonable data, forged reasonable permissions, or forged reasonable exceptions.

[0031] According to a second aspect of the invention, in a second possible implementation, as described in the appendix... Figure 5The schematic diagram of another embodiment of an identity verification system shown includes: an identity verification module, a forgery result module, and a pre-defined information module. The identity verification module receives identity verification requests, generates verification results through a verification algorithm, and generates a legitimate identity credential when the verification result is successful and a forged identity credential when the verification result fails. The forgery result module generates at least one of forged reasonable data, forged reasonable permissions, or forged reasonable exceptions when the verification result fails. The pre-defined information module sends pre-defined information when the verification result fails.

[0032] The following describes the implementation methods for forging reasonable data, forging reasonable permissions, and forging reasonable anomalies using three specific examples.

[0033] Example 1: An automated teller machine (ATM) using an authentication method disclosed in this invention.

[0034] When an unauthorized accessor obtains a bank card and coerces the legitimate holder into providing the PIN, if the card is inserted into a standard ATM using existing authentication technology and the PIN is entered: if the correct PIN is entered, authentication is successful (verification passed), and the ATM displays the correct account balance, allowing the unauthorized accessor to steal the funds, resulting in financial loss for the legitimate holder; if an incorrect PIN is entered, authentication fails (verification unsuccessful), and the ATM displays "Incorrect PIN," the unauthorized accessor may resort to more aggressive coercion until the legitimate holder is forced to provide the correct PIN, ultimately leading to both financial loss and physical harm for the legitimate holder. Therefore, standard ATM systems using existing authentication technology cannot effectively protect the assets of legitimate bank card holders.

[0035] If a bank card is inserted into an ATM that uses an authentication method disclosed in this invention (as per the attached specification), Figure 6 As shown in the process, when the legitimate cardholder provides an incorrect PIN, the identity verification fails (verification not passed). However, the ATM will not display "Incorrect PIN," but instead show a random value between 0.1 and 0.99 yuan (this forged reasonable value represents the legitimate cardholder's pre-set acceptable loss range). At this point, the unauthorized access user will mistakenly believe that the bank card's actual balance is extremely low, thus abandoning further coercion and preventing the legitimate cardholder from suffering greater losses.

[0036] Example 2: A mobile phone photo album system using an authentication method disclosed in this invention.

[0037] Most smartphone operating systems nowadays have a "hidden album" function, allowing the rightful owner of the phone to move photos to a hidden album to prevent others from viewing them. When someone else activates the hidden album and enters a password: if the password is correct, the authentication result is successful (verification passed), and the complete contents of the hidden album will be displayed and all operations will be supported; if the password is incorrect, the authentication result is unsuccessful (verification failed), and an "incorrect password" message will be displayed. Although others cannot view the hidden content, they can infer from this message that the rightful owner has indeed hidden the relevant content.

[0038] If the mobile phone's photo album system uses the authentication method disclosed in this invention (as shown in Figure 7 of the specification), when someone else enters an incorrect password, the authentication result will be a failure (verification not passed). Instead of displaying "Incorrect password," an empty photo album will be shown, and only the "Import Photos" operation will be available. At this point, others will mistakenly believe that the legitimate owner of the phone has enabled the hidden album function but has not stored any content in it, thus abandoning further attempts.

[0039] Example 3: A smart door lock using an authentication method disclosed in this invention.

[0040] Common smart locks support password input via the control panel: if the correct password is entered, authentication is successful (verification passed), and the lock opens; if the incorrect password is entered, authentication fails (verification unsuccessful), and an "Incorrect password" message will be displayed, preventing the lock from opening. An unauthorized intruder, upon seeing this message, may continue to try different passwords and potentially obtain the correct one to open the lock.

[0041] If the smart door lock uses the authentication method disclosed in this invention (as shown in Figure 8 of the specification), when an unauthorized intruder enters an incorrect password, the authentication result will be a failure (verification not passed). Instead of displaying "Incorrect password," the lock will display "Motor malfunction, unable to open the door." At this time, the unauthorized intruder will mistakenly believe that they have entered the correct password and that the door cannot be opened due to a device malfunction, thus giving up further attempts and ensuring indoor security.

[0042] Those skilled in the art will recognize that the modules described in the embodiments disclosed herein can be implemented through electronic hardware, computer software, or a combination of electronic hardware and computer software. Those skilled in the art can employ different methods to implement the function of each specific module, and such implementation should not be considered beyond the scope of protection of this invention.

[0043] In the embodiments provided in this application, it should be understood that the disclosed modules can be implemented in other ways. For example, the above embodiments are merely illustrative, and the division of modules is only a logical functional division. In actual implementation, other division methods may be adopted, such as multiple modules or components being combined or integrated into another system, or some features being ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed can be implemented through interfaces, and the indirect coupling or communication connection of devices or modules can take electrical, mechanical, or other forms.

[0044] The modules described as separate components may or may not be physically separate; the components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to implement the technical solutions of the embodiments of the present invention according to actual needs.

[0045] In addition, the functional modules in the embodiments of the present invention can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into a module.

[0046] The above description is merely a preferred embodiment of this application and an explanation of the applied technical principles. Those skilled in the art should understand that the scope of protection of this application is not limited to the specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the inventive concept, such as technical solutions formed by replacing the above-mentioned features with technical features with similar functions disclosed in this application (but not limited to).

[0047] It should be understood that the description and embodiments of this invention do not constitute any limitation on the implementation process. For illustrative and descriptive purposes, the above description of embodiments of this disclosure is not exhaustive and does not limit this disclosure to the precise form disclosed. Various variations and modifications may be possible based on the above teachings, or various variations and modifications may be obtained from the practice of this disclosure. These embodiments were chosen and described to illustrate the principles and practical applications of this disclosure, enabling those skilled in the art to utilize this disclosure in various implementations and modifications according to specific uses.

Claims

1. A method for identity verification, characterized in that, The method is applied to an authentication server, and the method includes: Receive authentication requests and generate authentication results using an authentication algorithm; A valid identity credential is generated when the verification result is successful. When the verification result fails, a forged identity credential is generated, and at least one of the following is generated: forged reasonable data, forged reasonable permissions, and forged reasonable exceptions.

2. The method according to claim 1, characterized in that, The method further includes sending predetermined information when the verification result is a failure.

3. An authentication system, characterized in that, The system includes: an identity verification module and a forged result module; The identity verification module is used to receive identity verification requests, generate verification results through verification algorithms, generate legitimate identity credentials when the verification result is successful, and generate forged identity credentials when the verification result is unsuccessful. The forgery result module is used to generate at least one of forged reasonable data, forged reasonable permissions, and forged reasonable exceptions when the verification result is a failure.

4. The system according to claim 3, characterized in that, The system also includes: a reservation information module; The pre-defined information module is used to send pre-defined information when the verification result is a failure.

Images