A security authentication method, system, device and storage medium for WEB applications

Abstract

The present invention discloses a security authentication method, system, device and storage medium for WEB applications. The method comprises: when a user registers, obtaining a registration password provided by the user, encrypting the registration password to generate a registration password ciphertext and uploading it to a database; when performing front-end security authentication, obtaining a user name and a password provided by the user, encrypting the password to generate a password ciphertext, and encrypting the user name and password ciphertext to generate an authentication ciphertext; when performing back-end security authentication, obtaining an authentication ciphertext, decrypting the authentication ciphertext to obtain a user name and a password ciphertext; verifying the decrypted password ciphertext, and if the verification is successful, querying the corresponding registration password ciphertext from the database according to the user name; matching the registration password ciphertext with the password ciphertext, and if the match is successful, completing the authentication; the present invention can achieve the transmission confidentiality and integrity of identity authentication information and the confidentiality and integrity of data storage.

Description

Technical Field

[0001] The present invention relates to a security authentication method, system, device and storage medium for a WEB application, and belongs to the technical field of identity authentication. Background Art

[0002] With the development of network technology and the widespread adoption of network communications, network security issues are becoming increasingly serious and have become a global concern. Current network security threats primarily stem from hacker attacks, network vulnerabilities, malicious programs, software vulnerabilities, and inadequate management. Network security incidents are becoming increasingly serious, and web applications are subject to security risks such as forgery and man-in-the-middle hijacking, where hackers can forge identities and launch attacks. To prevent the leakage of user personal information and strengthen the security of web applications, various security authentication methods are often performed on web applications to reduce information leakage through illegal means and further enhance data security. Therefore, identity authentication security for web applications is becoming increasingly important. Summary of the Invention

[0003] The purpose of the present invention is to overcome the deficiencies in the prior art and to provide a secure authentication method, system, device and storage medium for WEB applications, which can achieve the confidentiality and integrity of the transmission of identity authentication information and the confidentiality and integrity of data storage.

[0004] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0005] In a first aspect, the present invention provides a security authentication method for a WEB application, comprising:

[0006] When a user registers, the user's registration password is obtained, the registration password is encrypted to generate a ciphertext of the registration password and uploaded to the database;

[0007] During front-end security authentication, obtain the user name and password provided by the user, encrypt the password to generate password ciphertext, and encrypt the user name and password ciphertext to generate authentication ciphertext;

[0008] During background security authentication, obtain the authentication ciphertext, decrypt the authentication ciphertext to obtain the user name and password ciphertext;

[0009] Verify the password ciphertext obtained by decryption. If the verification is successful, query the corresponding registration password ciphertext from the database according to the user name;

[0010] The registration password ciphertext is matched with the password ciphertext. If the match is successful, the authentication is completed.

[0011] Optionally, encrypting the registration password to generate a ciphertext of the registration password includes:

[0012] The registration password is encrypted using the SM3 algorithm to generate a preliminary registration password ciphertext, recorded as SM3[registration password];

[0013] The preliminary registration password ciphertext is encrypted using the SM4 algorithm to generate the final registration password ciphertext, which is recorded as SM4[SM3[registration password]].

[0014] Optionally, encrypting the password to generate password ciphertext includes:

[0015] Encrypt the password using the SM3 algorithm to generate a preliminary password ciphertext, recorded as SM3[password];

[0016] The password ciphertext, 8-bit random code, and password are encrypted using the SM2 algorithm to generate the final password ciphertext, which is recorded as SM2[SM3[password ciphertext], 8-bit random code, password ciphertext].

[0017] Optionally, encrypting the user name and password ciphertext to generate the authentication ciphertext includes:

[0018] The username and password ciphertext are encrypted using the SM2 algorithm to generate the authentication ciphertext, recorded as SM2[username, SM2[SM3[password], 8-bit random code, password]];

[0019] Decrypting the authentication ciphertext to obtain the username and password ciphertext includes:

[0020] Decrypt the authentication ciphertext using the SM2 algorithm to obtain the username and password ciphertext, which are recorded as [username] and SM2[SM3[password], 8-bit random code, password].

[0021] Optionally, the public key encrypted by the SM2 algorithm and the private key decrypted by the SM2 algorithm are both stored in a key library; the key library provides a service for obtaining the public key through the REST protocol and provides a service for obtaining the private key through the JDBC protocol.

[0022] Optionally, the verification of the password ciphertext obtained by decryption includes:

[0023] Encrypt the password in the password ciphertext obtained by decryption using the SM3 algorithm to generate the verification password ciphertext;

[0024] The password ciphertext in the decrypted password ciphertext and the verification password ciphertext are matched and verified.

[0025] Optionally, matching the registration password ciphertext with the password ciphertext includes:

[0026] Perform SM4 decryption on the registration password ciphertext SM4[SM3[registration password]] to obtain the preliminary registration password ciphertext SM3[registration password];

[0027] Match the preliminary registration password ciphertext SM3[registration password] with the password ciphertext SM3[registration password].

[0028] In a second aspect, the present invention provides a security authentication system for a WEB application, comprising:

[0029] The registration module is used to obtain the registration password provided by the user when the user registers, encrypt the registration password to generate the registration password ciphertext and upload it to the database;

[0030] The front-end authentication module is used to obtain the user name and password provided by the user during the front-end security authentication, encrypt the password to generate password ciphertext, and encrypt the user name and password ciphertext to generate authentication ciphertext;

[0031] The background authentication module is used to obtain the authentication ciphertext during background security authentication, decrypt the authentication ciphertext to obtain the user name and password ciphertext; verify the decrypted password ciphertext, if the verification is successful, query the corresponding registration password ciphertext from the database according to the user name; match the registration password ciphertext with the password ciphertext, if the match is successful, the authentication is completed.

[0032] In a third aspect, the present invention provides a security authentication device for a WEB application, comprising a processor and a storage medium;

[0033] The storage medium is used to store instructions;

[0034] The processor is configured to operate according to the instructions to execute the steps of the above method.

[0035] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the above method when executed by a processor.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] The present invention provides a security authentication method, system, device and storage medium for WEB applications, which encrypt and store user registration passwords through a national secret algorithm to ensure the confidentiality and integrity of data storage; encrypt user passwords through a national secret algorithm to ensure the confidentiality and integrity of data storage; perform integrity verification on user passwords through a national secret algorithm and compare them with the user registration passwords stored in a database; when the verification is consistent, the verification result and access token are fed back to the front end; when the verification is inconsistent, the error information is fed back to the front end; in summary, the present invention can achieve the confidentiality and integrity of identity authentication information transmission and the confidentiality and integrity of data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a flowchart of a security authentication method for a WEB application provided in Example 1 of the present invention;

[0039] Figure 2 This is a flowchart of front-end authentication and back-end authentication provided by Example 1 of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0041] Example 1:

[0042] like Figure 1 As shown, the present invention provides a security authentication method for a WEB application, comprising the following steps:

[0043] 1. When a user registers, obtain the registration password provided by the user, encrypt the registration password to generate the registration password ciphertext and upload it to the database;

[0044] The steps of encrypting the registration password to generate the ciphertext of the registration password include:

[0045] 1.1. Encrypt the registration password using the SM3 algorithm to generate a preliminary registration password ciphertext, recorded as SM3[registration password];

[0046] 1.2. The preliminary registration password ciphertext is encrypted using the SM4 algorithm to generate the final registration password ciphertext, which is recorded as SM4[SM3[registration password]].

[0047] 2. During the front-end security authentication, obtain the user name and password provided by the user, encrypt the password to generate password ciphertext, and encrypt the user name and password ciphertext to generate authentication ciphertext;

[0048] like Figure 2 As shown, the authentication information is the user name and password;

[0049] The process of encrypting the password to generate ciphertext includes:

[0050] 2.1. Encrypt the password using the SM3 algorithm to generate a preliminary password ciphertext, recorded as SM3[password];

[0051] 2.2. Encrypt the password ciphertext, 8-bit random code, and password using the SM2 algorithm to generate the final password ciphertext, recorded as SM2[SM3[password], 8-bit random code, password].

[0052] The steps of encrypting the username and password to generate authentication ciphertext include:

[0053] 2.3. Encrypt the username and password using the SM2 algorithm to generate the authentication ciphertext, recorded as SM2[username, SM2[SM3[password], 8-bit random code, password]];

[0054] 3. During background security authentication, obtain the authentication ciphertext, decrypt the authentication ciphertext to obtain the username and password ciphertext;

[0055] Decrypting the authentication ciphertext to obtain the username and password ciphertext includes:

[0056] 3.1. Decrypt the authentication ciphertext using the SM2 algorithm to obtain the username and password ciphertext, which are recorded as [username] and SM2[SM3[password], 8-bit random code, password].

[0057] During decryption, the SM2 algorithm integrity check is required. The result of each encryption with the SM2 algorithm is different. The verification length is consistent and whether it can be decrypted. If the length is insufficient, decryption cannot be performed. If the length is too long, it will be automatically truncated to a decryptable length. If decryption is still not possible at this time, the verification fails and the code is directly returned to the front end.

[0058] The public key encrypted by the SM2 algorithm and the private key decrypted by the SM2 algorithm are both stored in the keystore. The keystore provides services for obtaining public keys through the REST protocol and for obtaining private keys through the JDBC protocol.

[0059] 4. Verify the password ciphertext obtained by decryption. If the verification is successful, query the corresponding registration password ciphertext from the database based on the user name;

[0060] The verification of the password ciphertext obtained by decryption includes:

[0061] Encrypt the password in the password ciphertext obtained by decryption using the SM3 algorithm to generate the verification password ciphertext;

[0062] The password ciphertext in the decrypted password ciphertext and the verification password ciphertext are matched and verified.

[0063] 5. Match the ciphertext of the registration password with the ciphertext of the password. If the match is successful, the authentication is completed.

[0064] Matching the registration password ciphertext with the password ciphertext includes:

[0065] 5.1. Perform SM4 decryption on the registration password ciphertext SM4[SM3[registration password]] to obtain the preliminary registration password ciphertext SM3[registration password];

[0066] 5.2. Match the preliminary registration password ciphertext SM3[registration password] with the password ciphertext SM3[registration password].

[0067] The private key decrypted by the SM4 algorithm is stored in the keystore, and the service for obtaining the private key is provided through the JDBC protocol.

[0068] Example 2:

[0069] like Figure 2 As shown, the present invention provides a security authentication system for WEB applications, comprising:

[0070] The registration module is used to obtain the registration password provided by the user when the user registers, encrypt the registration password to generate the registration password ciphertext and upload it to the database;

[0071] The front-end authentication module is used to obtain the user name and password provided by the user during the front-end security authentication, encrypt the password to generate password ciphertext, and encrypt the user name and password ciphertext to generate authentication ciphertext;

[0072] The background authentication module is used to obtain the authentication ciphertext during background security authentication, decrypt the authentication ciphertext to obtain the user name and password ciphertext; verify the decrypted password ciphertext, if the verification is successful, query the corresponding registration password ciphertext from the database according to the user name; match the registration password ciphertext with the password ciphertext, if the match is successful, the authentication is completed.

[0073] Example 3:

[0074] The present invention provides a security authentication device for a WEB application, including a processor and a storage medium;

[0075] The storage medium is used to store instructions;

[0076] The processor is configured to operate according to the instructions to execute the steps of the above method.

[0077] Example 4:

[0078] The present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the above method are implemented.

[0079] In summary, the present invention encrypts and stores the user registration password through the national secret algorithms SM4 and SM3 to ensure the confidentiality and integrity of data storage; encrypts the user's password through the national secret algorithms SM2 and SM3 to ensure the confidentiality and integrity of data transmission; performs integrity verification on the user's password through the national secret algorithm, and compares it with the user registration password stored in the database. When the verification is consistent, the verification result and access token are fed back to the front end, and when the verification is inconsistent, the error information is fed back to the front end.

[0080] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0081] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0082] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0083] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0084] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A security authentication method for a WEB application, characterized in that: include: When a user registers, the user's registration password is obtained, the registration password is encrypted to generate a ciphertext of the registration password and uploaded to the database; During front-end security authentication, obtain the user name and password provided by the user, encrypt the password to generate password ciphertext, and encrypt the user name and password ciphertext to generate authentication ciphertext; During background security authentication, obtain the authentication ciphertext, decrypt the authentication ciphertext to obtain the user name and password ciphertext; Verify the password ciphertext obtained by decryption. If the verification is successful, query the corresponding registration password ciphertext from the database according to the user name; Match the registration password ciphertext with the password ciphertext. If the match is successful, the authentication is completed. The step of encrypting the password to generate a ciphertext of the password includes: Encrypt the password using the SM3 algorithm to generate a preliminary password ciphertext, recorded as SM3[password]; The password ciphertext, 8-bit random code, and password are encrypted using the SM2 algorithm to generate the final password ciphertext, which is recorded as SM2[SM3[password ciphertext], 8-bit random code, password ciphertext].

2. A security authentication method for a WEB application according to claim 1, characterized in that: The step of encrypting the registration password to generate the registration password ciphertext includes: The registration password is encrypted using the SM3 algorithm to generate a preliminary registration password ciphertext, recorded as SM3[registration password]; The preliminary registration password ciphertext is encrypted using the SM4 algorithm to generate the final registration password ciphertext, which is recorded as SM4[SM3[registration password]].

3. A security authentication method for WEB applications according to claim 2, characterized in that: The encrypting of the user name and password ciphertext to generate the authentication ciphertext includes: The username and password ciphertext are encrypted using the SM2 algorithm to generate the authentication ciphertext, recorded as SM2[username, SM2[SM3[password], 8-bit random code, password]]; Decrypting the authentication ciphertext to obtain the username and password ciphertext includes: Decrypt the authentication ciphertext using the SM2 algorithm to obtain the username and password ciphertext, which are recorded as [username] and SM2[SM3[password], 8-bit random code, password].

4. A security authentication method for WEB applications according to claim 3, characterized in that: The public key encrypted by the SM2 algorithm and the private key decrypted by it are both stored in the key library; the key library provides a service for obtaining the public key through the REST protocol and a service for obtaining the private key through the JDBC protocol.

5. A security authentication method for WEB applications according to claim 3, characterized in that: The verification of the password ciphertext obtained by decryption includes: Encrypt the password in the password ciphertext obtained by decryption using the SM3 algorithm to generate the verification password ciphertext; The password ciphertext in the decrypted password ciphertext and the verification password ciphertext are matched and verified.

6. A security authentication method for WEB applications according to claim 3, characterized in that: The matching of the registration password ciphertext with the password ciphertext includes: Perform SM4 decryption on the registration password ciphertext SM4[SM3[registration password]] to obtain the preliminary registration password ciphertext SM3[registration password]; Match the preliminary registration password ciphertext SM3[registration password] with the password ciphertext SM3[registration password].

7. A security authentication system for a WEB application, characterized in that: include: The registration module is used to obtain the registration password provided by the user when the user registers, encrypt the registration password to generate the registration password ciphertext and upload it to the database; The front-end authentication module is used to obtain the user name and password provided by the user during the front-end security authentication, encrypt the password to generate password ciphertext, and encrypt the user name and password ciphertext to generate authentication ciphertext; wherein, the encrypting of the password to generate password ciphertext includes: encrypting the password with the SM3 algorithm to generate preliminary password ciphertext, recorded as SM3[password]; encrypting the password ciphertext, the 8-bit random code, and the password with the SM2 algorithm to generate a final password ciphertext, recorded as SM2[SM3[password], 8-bit random code, password]; The background authentication module is used to obtain the authentication ciphertext during background security authentication, decrypt the authentication ciphertext to obtain the user name and password ciphertext; verify the decrypted password ciphertext, if the verification is successful, query the corresponding registration password ciphertext from the database according to the user name; match the registration password ciphertext with the password ciphertext, if the match is successful, the authentication is completed.

8. A security authentication device for a WEB application, characterized in that: including processor and storage medium; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images