A user access security management method, a terminal device, and a storage medium

Abstract

This invention relates to a user access security management method, terminal device, and storage medium. The method includes: S1: After receiving a successful user login message, obtaining the user's username and creation time, and combining the username and creation time to generate a verification code corresponding to the user; S2: Encrypting the verification code to obtain a corresponding encrypted verification code; S3: Generating a corresponding password and key file based on the verification code and the encrypted verification code; S4: Decrypting the key file; if decryption is successful, proceed to S5; if decryption fails, the process ends; S5: Loading the user's file directory based on the password and key file; if loading is successful, proceed to S7; if loading fails, proceed to S6; S6: Initializing the user's file directory; S7: Loading the user's storage files and operation files generated after the user's login into the user's file directory. This invention can achieve physical isolation of one user, one data, and one storage.

Description

Technical Field

[0001] This invention relates to the field of user access management, and more particularly to a user access security management method, terminal device, and storage medium. Background Technology

[0002] With the rapid development of information technology, data security has become increasingly important. User authentication is the first line of defense for security and a prerequisite for various security measures to function effectively. As the internet continues to develop, online fraud incidents are rampant both domestically and internationally, posing a significant challenge to the security of organizations with high confidentiality levels. This has also led to a crisis of trust in online identities, making the prevention of identity theft a top concern for all organizations. Consequently, technologies such as identity verification, dynamic authorization, and data encryption have emerged, especially in situations where multiple users access their own storage and data, requiring secure and independent access systems.

[0003] Identity authentication refers to the process by which computer and network systems verify the identity of an operator. Computer systems and networks exist in a virtual digital world where all information, including user identity information, is represented by a specific set of data. Computers can only recognize a user's digital identity, and all authorizations granted to users are based on that digital identity. Therefore, ensuring that the operator using a digital identity is indeed the legitimate owner of that digital identity becomes a crucial issue. Identity authentication technology was developed to address this problem.

[0004] Currently, login in many systems is basically a single form, such as account and password login or SMS verification login. Security issues are easily overlooked. Moreover, multiple users accessing the same storage or the same data pose a risk of mutual leakage. Even if there is logical data isolation, it still brings security risks to organizations with high confidentiality levels. Summary of the Invention

[0005] To address the aforementioned problems, this invention proposes a user access security management method, a terminal device, and a storage medium.

[0006] The specific plan is as follows:

[0007] A user access security management method includes the following steps:

[0008] S1: After receiving the user login success information, obtain the login user's username and the user's creation time, and combine the username and creation time to generate the corresponding verification code for the user;

[0009] S2: Perform encryption operations on the check code to obtain the corresponding encrypted check code;

[0010] S3: Generate the corresponding password and key files based on the verification code and the encryption verification code;

[0011] S4: After decrypting the key file according to the password and verification code, if the decryption is successful, proceed to S5; if the decryption fails, the process ends.

[0012] S5: Load the user's file directory using the storage system encryption software based on the password and key file. If loading is successful, proceed to S7; if loading fails, proceed to S6.

[0013] S6: Initialize the user file directory based on the password and key files;

[0014] S7: The storage system encryption software loads the user's stored files and operation files generated after the user logs in to the user's file directory.

[0015] Furthermore, before receiving the user login success information in step S1, the process also includes dual verification using the user's basic information and the user's physical characteristics during the login process.

[0016] Furthermore, the user's physical physical characteristics information include their face or fingerprint.

[0017] Furthermore, the method for generating a verification code by combining the username and creation time is as follows: the verification code is set to be the concatenation of the username, creation time and the reverse order of the username, and the two consecutive ones are connected by a separator.

[0018] Furthermore, the separator is an array consisting of at least two characters.

[0019] Furthermore, the encryption operation in step S2 uses the MD5 algorithm.

[0020] Furthermore, the password is obtained by combining the first and last bits of the encrypted verification code.

[0021] Furthermore, the password is obtained by combining the first four and last four digits of the encryption checksum.

[0022] Furthermore, the key file consists of three parts: the key file name, the original key file content, and the ciphertext key file content.

[0023] Furthermore, the key file name is obtained by combining the first and last data bits of the encrypted verification code, excluding the password.

[0024] Furthermore, the key file name is obtained by combining the first 5-8 bits and the last 5-8 bits of the encryption checksum.

[0025] Furthermore, the original content of the key file uses the same value as the checksum.

[0026] Furthermore, the ciphertext of the key file content is obtained by performing a reversible encryption operation on the original key file content.

[0027] Furthermore, the specific process of obtaining the ciphertext content of the key file includes the following steps:

[0028] S301: Perform an XOR operation between the original content of the key file and the length of the checksum;

[0029] S302: The result of the XOR operation is encrypted using DES cryptography;

[0030] S303: Use the result of DES encryption as the ciphertext of the key file content.

[0031] A user access security management terminal device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the method described in the embodiments of the present invention.

[0032] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described above in the embodiments of the present invention.

[0033] The present invention adopts the above technical solution, loads the user file directory through two-factor authentication of password and key file, and dynamically loads the user directory and data file according to user information, truly achieving physical isolation of one user, one data, and one storage. Attached Figure Description

[0034] Figure 1 The diagram shown is a flowchart of Embodiment 1 of the present invention. Detailed Implementation

[0035] To further illustrate the various embodiments, the present invention provides accompanying drawings. These drawings are part of the disclosure of the present invention, primarily used to illustrate the embodiments, and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these drawings, those skilled in the art should be able to understand other possible implementations and the advantages of the present invention.

[0036] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0037] Example 1:

[0038] This invention provides a user access security management method, such as... Figure 1 As shown, the method includes the following steps:

[0039] S1: After receiving the user login success information, obtain the login user's username and the user's creation time, and combine the username and creation time to generate the corresponding verification code for the user.

[0040] In this embodiment, before receiving the user login success information in step S1, dual verification is performed during the user login process using the user's basic information (account, password, etc.) and the user's physical characteristics (face or fingerprint, preferably face). This login method, combining account password and physical characteristics, achieves a two-factor authentication effect; anyone who obtains another person's account password but does not possess the account holder's physical characteristics cannot log in.

[0041] In this embodiment, the user's username is USERNAME and the creation time is CREATETIME. Therefore, the generated checksum PASSWORD_SOURCE (length L bits) is:

[0042] PASSWORD_SOURCE=(USERNAME+DECOLLATOR+CREATETIME+DE COLLATOR+USERNAME_REVERSE)

[0043] The separator DECOLLATOR is in array form, specifically:

[0044] DECOLLATOR=new byte[]{0x01,0x02}

[0045] SERNAME_REVERSE is the username in reverse order.

[0046] The separator set in this embodiment is quite special and difficult to calculate. Furthermore, the combination of these three elements makes it virtually impossible for a third party to crack, greatly improving security. In other embodiments, the separator can also take other forms, which are not limited here.

[0047] S2: Perform encryption operations on the check code to obtain the corresponding encrypted check code.

[0048] In this embodiment, the encryption verification code is PASSWORD_SOURCE_MD5 (32 bits long) = GetMd5Hash(PASSWORD_SOURCE (L bits long)).

[0049] In this embodiment, the encryption operation is performed using the commonly used MD5 algorithm. In other embodiments, other encryption algorithms, such as the Chinese national standard 4, may also be used, and no limitation is made here.

[0050] S3: Generate the corresponding password and key files based on the checksum and the encryption checksum.

[0051] In this embodiment, the password is obtained through an encrypted verification code, specifically by combining the first four and last four digits of the PASSWORD_SOURCE_MD5 (32 bits long), as shown in Table 1. In other embodiments, other digit lengths can also be used for combination; this is not limited here.

[0052] Table 1

[0053] Location 0 1 2 3 …… 28 29 30 31 Assumed value X0 X1 X2 X3 …… Y0 Y1 Y2 Y3

[0054] From Table 1, the password can be obtained as: PASSWORD = X0X1X2X3Y0Y1Y2Y3. Here, X and Y are unknown values ​​represented by letters, but are not limited to X and Y.

[0055] The key file mainly consists of three parts: the key file name, the original key file content, and the ciphertext key file content.

[0056] (1) Key file name: Similar to the method of obtaining a password, it is obtained by combining the first 5-8 bits and the last 5-8 bits of the encryption verification code PASSWORD_SOURCE_MD5 (32 bits in length), as shown in Table 2. In other embodiments, other numbers of bits can also be combined, which is not limited here.

[0057] Table 2

[0058] Location … 4 5 6 7 …… 24 25 26 27 … Assumed value … A0 A1 A2 A3 …… B0 B1 B2 B3

[0059] Table 2 shows that the key file name is: PASSWORD_FILE_NAME = A0A1A2A3B0B1B2B3.my. The suffix "my" is custom-defined in this embodiment and has no special meaning. In other embodiments, those skilled in the art can customize other suffixes, which are not specified here.

[0060] (2) Original content of key file: In order to distinguish each user, the original content of key file adopts the same value as the check code PASSWORD_SOURCE, that is, the original content of key file is: username + separator + creation time + separator + username in reverse order.

[0061] (3) The ciphertext of the key file content is obtained by performing a reversible encryption operation on the original key file content. The specific acquisition process includes the following steps:

[0062] S301: Perform an XOR operation between the original content of the key file and the length L of the checksum;

[0063] S302: The result of the XOR operation is encrypted with DES using the password PASSWORD;

[0064] S303: Use the result of DES encryption as the ciphertext of the key file content.

[0065] The encryption process described above is reversible. The decryption algorithm can decrypt the encryption process in reverse order, and the specific steps will not be repeated here.

[0066] The encryption of the key file content is to prevent manual direct referencing of the key source file in the user's file directory. The key file is only decrypted to its original form at the moment of decryption; at all other times, the key file exists in encrypted form.

[0067] The key file is determined by the system after successful login. If the key file does not exist, it is created and archived. All key files for all users can be archived in the same directory.

[0068] S4: After decrypting the key file according to the password and verification code, if the decryption is successful, proceed to S5; if the decryption fails, end.

[0069] S5: Load the user's file directory using the storage system encryption software based on the password and key file. If loading is successful, proceed to S7; if loading fails, proceed to S6.

[0070] If loading fails, it means that the user file directory is not initialized or the corresponding storage file is corrupted. Therefore, it is necessary to perform the initialization step S6 first.

[0071] S6: Initialize the user file directory based on the password and key files.

[0072] The user file directory is primarily loaded via storage files. Each user's initial storage file is set to 50GB, and this loading process can be accomplished using storage system encryption software.

[0073] S7: The storage system encryption software loads the user's stored files and operation files generated after the user logs in to the user's file directory.

[0074] For terminal application systems, only one user is allowed to log in at a time, so different user file directories can be loaded as the same directory (each user sees the same directory after logging in, but the data inside is different).

[0075] Writing user operation files to the user's file directory can achieve the goal of one user, one data, one storage, thus providing physical isolation for security.

[0076] The embodiments of the present invention enable multiple users to use the device without interfering with each other, with data isolated from each other and information transparent to each other, satisfying security, convenience and automation. Moreover, the entire solution has independent invention technology to prevent risks such as data leakage or access to different users' data due to device loss.

[0077] The embodiments of this invention have been implemented and are widely used in standalone mobile computer devices, particularly for internal government applications, where they better meet the requirements of security and controllability. Furthermore, this product is highly versatile and can be deployed in other networks where mobility and security requirements are high.

[0078] Example 2:

[0079] The present invention also provides a user access security management terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps in the method embodiment described above in Embodiment 1 of the present invention.

[0080] Furthermore, as an executable solution, the user access security management terminal device can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The user access security management terminal device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the above-described composition of the user access security management terminal device is merely an example and does not constitute a limitation on the user access security management terminal device. It may include more or fewer components than described above, or combine certain components, or different components. For example, the user access security management terminal device may also include input / output devices, network access devices, buses, etc., and this embodiment of the invention does not limit this.

[0081] Furthermore, as an executable solution, the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. This processor is the control center of the user access security management terminal device, connecting all parts of the user access security management terminal device via various interfaces and lines.

[0082] The memory can be used to store the computer programs and / or modules. The processor, by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory, realizes various functions of the user access security management terminal device. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0083] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described in the embodiments of the present invention.

[0084] If the modules / units integrated into the user access security management terminal device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0085] Although the invention has been specifically shown and described in conjunction with preferred embodiments, those skilled in the art should understand that various changes in form and detail may be made to the invention without departing from the spirit and scope of the invention as defined in the appended claims, all of which shall be within the scope of protection of the invention.

Claims

1. A user access security management method, characterized in that, Includes the following steps: S1: After receiving the user login success information, obtain the login user's username and the user's creation time, and combine the username and creation time to generate the corresponding verification code for the user; S2: Perform encryption operations on the check code to obtain the corresponding encrypted check code; S3: Generate corresponding password and key files based on the checksum and the encryption checksum; the password is obtained by combining the first and last bits of the encryption checksum; the key file consists of three parts: key file name, key file plaintext, and key file ciphertext; the key file name is obtained by combining the first and last bits of the encryption checksum excluding the password; the key file plaintext uses the same value as the checksum; the key file ciphertext is obtained by performing a reversible encryption operation on the key file plaintext. S4: After decrypting the key file based on the password and verification code, if the decryption is successful, proceed to S5; if the decryption fails, end. S5: Load the user's file directory using the storage system encryption software based on the password and key file. If loading is successful, proceed to S7; if loading fails, proceed to S6. S6: Initialize the user file directory based on the password and key files; S7: The storage system encryption software loads the user's stored files and operation files generated after the user logs in to the user's file directory.

2. The user access security management method according to claim 1, characterized in that: Before receiving the user login success information in step S1, the process also includes dual verification using the user's basic information and the user's physical characteristics during the login process.

3. The user access security management method according to claim 2, characterized in that: The user's physical physical characteristics information is their face or fingerprints.

4. The user access security management method according to claim 1, characterized in that: The method for generating a verification code by combining the username and creation time is as follows: the verification code is set to be the concatenation of the username, creation time and username in reverse order, and the two consecutive parts are connected by a separator.

5. The user access security management method according to claim 1, characterized in that: The separator is an array consisting of at least two characters.

6. The user access security management method according to claim 1, characterized in that: The encryption operation in step S2 uses the MD5 algorithm.

7. The user access security management method according to claim 1, characterized in that: The password is obtained by combining the first four and last four digits of the encryption checksum.

8. The user access security management method according to claim 1, characterized in that: The key file name is obtained by combining the first 5-8 bits and the last 5-8 bits of the encryption checksum.

9. The user access security management method according to claim 1, characterized in that: The specific process of obtaining the ciphertext of the key file includes the following steps: S301: Perform an XOR operation between the original content of the key file and the length of the checksum; S302: The result of the XOR operation is encrypted using DES cryptography; S303: Use the result of DES encryption as the ciphertext of the key file content.

10. A user access security management terminal device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any one of claims 1 to 9.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 9.

Images