Dynamic password authentication system based on quantum key

Abstract

The present invention provides a dynamic password authentication system based on quantum key. The dynamic password authentication system includes three layers: an external service layer, an internal logic layer, and a basic function layer. The external service layer provides service interfaces for quantum key distribution (QKD), application systems, and management. The internal logic layer processes business or management logic specific to the dynamic password authentication system. The basic function layer provides the necessary underlying support for the dynamic password authentication system. The dynamic password authentication system of the present invention effectively enhances the security of dynamic password applications and facilitates the promotion and testing of quantum key applications.

Description

Technical Field

[0001] The present invention relates to the field of quantum communication, and in particular to a dynamic password authentication system based on quantum keys. Background Art

[0002] There are three common dynamic password authentication technologies: message-based, hardware token-based, and software token-based. Hardware and software token authentication work in similar ways, differing in that hardware tokens utilize hardware security chips to securely store key authentication information. Software token technology is not discussed here.

[0003] For a message-based dynamic password, the user first registers in the server system and fills in information to provide a third-party communication tool number or account (such as a mobile phone, email, etc.); when the user logs in to the system, he clicks the "Get Verification Code" button. The background generates a random password in the system cache through pre-set settings, and then calls the third-party communication interface to send the password to the user; the user receives the password from the third-party communication tool and submits it to the server as a login authentication credential; the server side uses comparison or algorithm support (such as digest comparison) to confirm the consistency of the user's password with the cached password, and finally confirms the legitimacy of the user.

[0004] Token-based dynamic passwords first use a security solution to generate a seed key between the dynamic token and the dynamic password authentication server, enabling both parties to achieve shared secrets. During authentication, the client uses the dynamic token's seed key, time value, event count, and challenge information to calculate the dynamic password. The server uses the same algorithm to calculate the password using the corresponding seed, similar time value, identical event count, and identical challenge information. Finally, a character-by-character comparison of the password verifies the identity.

[0005] In dynamic message password technology, the random number is the user password, and its generation method is security-critical. Existing solutions primarily use true random number generators to generate random numbers. True random number hardware physical random sequences are generated using objective methods such as thermal noise. Actual physical noise is often limited by factors such as temperature, power supply, and circuit characteristics. The objective environment is real and external, and attackers can simulate or interfere with environmental information to reproduce and control random number generation, thus posing certain security risks.

[0006] Another key security factor is how to securely deliver the generated password to the user. The current authentication scheme involves the server distributing the password to a third-party communication application service, which then forwards it to the user. The end user then sends the password back to the server for authentication, creating a loop. In reality, servers often run in highly secure production environments, while third-party communication applications are public network applications like telecommunications or the internet. Therefore, access to these applications requires multiple layers of tunneling within the production environment. This deployment approach increases complexity and poses security risks.

[0007] Dynamic token production typically involves application issuers generating seed files in batches and then packaging them for dynamic token vendors to produce. This process uses the vendor's key to protect the seed file key during transmission, which offers some security benefits. However, the transmission process is complex and poses a risk of data theft. Furthermore, because seed files are large and bulky, using a fixed key to protect large amounts of data poses a statistical vulnerability. Summary of the Invention

[0008] In order to solve the above problems, the present invention provides a dynamic password authentication system based on quantum key. In one embodiment, a dynamic password authentication system based on quantum key is provided, and the dynamic password authentication system includes three layers: an external service layer, an internal logic layer, and a basic function layer; wherein the external service layer provides a service interface for quantum key distribution (QKD), application system, and management, and serves as a window for the dynamic password authentication system to communicate and process with the outside world; the internal logic layer processes business or management logic specific to the dynamic password authentication system, and its operating environment cannot be directly accessed by the external interface, and the basic function layer provides data access and security processing basic function support for it; and the basic function layer provides the necessary underlying support for the dynamic password authentication system, including providing basic components for data storage and secure computing.

[0009] In one embodiment, the external service layer includes a quantum key interface module, a dynamic password authentication interface module and a management service interface module; the internal logic layer includes a temporary password management module, a seed key management module, an encryption and authentication module and a system configuration module; and the basic function layer includes a dynamic password cache pool, a token seed key library, a secure computing component and a system configuration library.

[0010] In one embodiment, the quantum key interface module is responsible for communicating with the quantum key distribution device of the quantum network, adapting to different quantum key distribution devices and protocols, and obtaining the quantum key from the quantum key system according to the quantum key configuration. The obtained key is stored by the internal logic layer as a message password in the dynamic password cache pool or as a seed key in the token key library.

[0011] In one embodiment, the dynamic password authentication interface module is responsible for receiving and parsing the dynamic password authentication request of the application system.

[0012] In one embodiment, the management service interface module provides a management portal through which an administrator performs dynamic password service configuration and system management configuration.

[0013] In one embodiment, the temporary password management module processes message-type dynamic passwords, receives the key obtained from the quantum key interface module as a dynamic password and stores it in the dynamic password buffer pool according to the specific business configuration, and receives the authentication message from the dynamic password authentication module, and completes the dynamic password authentication processing with the assistance of the authentication module.

[0014] In one embodiment, the seed key management module processes token-type dynamic passwords, receives the key obtained from the quantum key interface module as a seed key and securely stores it in the token seed key library with the assistance of the encryption and authentication modules, and receives the authentication message from the dynamic password authentication module, and completes the dynamic password authentication processing with the assistance of the encryption and authentication modules.

[0015] In one embodiment, the encryption and authentication module processes encryption and dynamic password authentication functions, and its security is guaranteed by the secure computing component.

[0016] In one embodiment, the system configuration module processes the configuration requirements of the management interface module, provides dynamic token service configuration management and system configuration management functions, and provides configuration information access and reading services for modules at the same layer.

[0017] In one embodiment, the dynamic password cache pool is used to temporarily store message-type dynamic passwords. When the dynamic password is verified or expires, it is automatically cleared from the pool, depending on the storage time and storage method configured by the business.

[0018] In one embodiment, the token seed key library is used to store dynamic token seed keys, and the seed key becomes invalid when the token expires, is reported lost, or is disabled.

[0019] In one embodiment, the security calculation component provides encryption and authentication algorithms for the dynamic password authentication system and ensures the security of the system encryption scheme.

[0020] In one embodiment, the system configuration library is a static library for storing dynamic password service configuration information and system configuration information.

[0021] Quantum random numbers are generated based on the principles of quantum physics, using a quantum entropy source called phase noise from spontaneous light emission. This randomness is unaffected by environmental interference, which is superior to conventional randomness sources. Quantum keys are keys generated from quantum random numbers. The quantum key distribution process is unconditionally secure, guaranteed by the quantum non-cloning principle and the Heisenberg uncertainty principle.

[0022] Dynamic password security refers to the security of random passwords during their generation, distribution, and use. Solving the problem of distributing sensitive information is a crucial factor in achieving unconditional password security. Existing dynamic password technology uses conventional key technology, which relies on physical noise sources and computational complexity for security and is theoretically not unconditionally secure. Due to the continuous improvement of computer computing power and the emergence of quantum computers, the probability of being cracked is high, posing a significant security risk. The current development of quantum random number and key distribution technology, using quantum key distribution technology to replace conventional password or seed distribution channels with quantum distribution, theoretically provides an effective and more secure solution.

[0023] This invention provides a quantum-key-based dynamic password authentication system, effectively enhancing the security of dynamic password applications. Based on quantum key distribution technology, this solution uses keys distributed over a quantum network as the key information for dynamic password authentication (dynamic password and seed key). The unconditional security of quantum key distribution ensures and strengthens the security of key dynamic password information.

[0024] The message-type dynamic password in the present invention uses the quantum key directly as the dynamic password. The dynamic password is distributed and transmitted between two locations in the transmission network, which is more secure than the traditional solution in which the random number is generated by the center, transmitted uniformly by the center, and finally returned to the center for verification.

[0025] The token-type dynamic password in the present invention uses a quantum key as a seed key during production and is directly distributed to the dynamic password authentication system and token manufacturer through a quantum network, thus avoiding the security risk of batch quantum keys being leaked during production and transmission.

[0026] The system of the present invention is divided into three layers. The external service layer provides input and output interfaces with external systems or management platforms, adapts to the data streams of various systems associated with it, and checks and parses the data; the middle internal logic layer processes the main business logic, which only accepts data parsed by the external service layer and is completely isolated from external systems and networks to ensure the security of internal data processing; the bottom basic function layer provides functional support for data storage and secure computing capabilities for the upper layer. The three-layer structure and the low coupling design between layers allow targeted processing of certain functions during system function expansion or upgrade maintenance, while other functions remain unaffected; the external service layer encapsulates and implements quantum network and quantum key details, making the quantum concept completely transparent in the internal logic layer and reducing the complexity of system implementation; the basic function layer uses independent secure computing components to provide security algorithm support to the upper layer, which allows for security module upgrades and updates and increases flexibility of use.

[0027] This invention provides a quantum-key-based dynamic password authentication system, which facilitates the application, promotion, and testing of quantum keys. Dynamic password technology is widely used, and the promotion of this invention will provide systems requiring dynamic passwords with a ready-made quantum-key-based dynamic password solution, thereby promoting the application of quantum keys in traditional key applications.

[0028] The following is a list of abbreviations, English and key term definitions used in this invention:

[0029] QKD: Quantum Key Distribution, a device that uses the basic principles of quantum mechanics to ensure that both communicating parties can generate a string of identical random numbers that attackers cannot obtain as a shared key.

[0030] Quantum communication technology: Quantum communication, a key branch of quantum information science, is a communication technology that uses quantum states as information carriers to exchange information. Quantum key distribution is the first practical quantum information technology and a key area of ​​quantum communication. Quantum key distribution enables the sharing of keys between spatially separated users in an information-theoretically secure manner.

[0031] Classical network: the mainstream IP network relative to the quantum network.

[0032] Dynamic Password: Dynamic Password, also known as One-Time Password (OTP), is a security method that generates an unpredictable random number combination based on a special algorithm. Each password can only be used once and is widely used in online banking, online games, telecom operators, e-commerce, enterprises and other application fields.

[0033] Dynamic password authentication technology: Dynamic password authentication technology is a method of using dynamic passwords to authenticate user identities. It is a very convenient technical means to enhance the current static password authentication and is an important two-factor authentication technology.

[0034] Challenge code: A parameter generated by a dynamic password, generally provided to the authenticator based on business-critical information or random, unpredictable information.

[0035] Challenge information: Parameters for generating dynamic passwords, including current events information and random challenge codes.

[0036] Dynamic token seed: It is a key element used to generate dynamic passwords and stored in the dynamic token.

[0037] Dynamic token: It is a terminal used to generate dynamic passwords. Dynamic token is a hardware product that can securely store seed keys and use seed keys to perform specific algorithm calculations and output dynamic passwords. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 Schematic diagram of the structure of the dynamic password authentication system based on quantum key of the present invention;

[0040] Figure 2 It is a configuration flow chart of the administrator of the dynamic password authentication system of the present invention;

[0041] Figure 3 This is a message-based dynamic password business flow chart of the dynamic password authentication system of the present invention;

[0042] Figure 4 It is a dynamic token port business flow chart of the dynamic password authentication system of the present invention;

[0043] Figure 5 This is a specific authentication flow chart of a message-based dynamic password in the dynamic password authentication system of the present invention;

[0044] Figure 6 This is a production flow chart of a dynamic token and dynamic password of a dynamic password authentication system of the present invention;

[0045] Figure 7 This is a flow chart of the authentication of a dynamic token and dynamic password in the dynamic password authentication system of the present invention;

[0046] Figure 8It is a schematic diagram of the application architecture of the dynamic password authentication system of the present invention. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the technical solutions in this application, the present invention will be further described below in conjunction with embodiments. Obviously, the embodiments described are only part of the embodiments of this application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without making creative efforts should fall within the scope of protection of this application. The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0048] like Figure 1 As shown in the figure, the quantum key-based dynamic password authentication system of the present invention consists of three layers: an external service layer, an internal logic layer, and a basic function layer. The external service layer provides a service interface for quantum key distribution (QKD), application systems, and management, serving as a window for the system to communicate and process with the outside world. The internal logic layer processes system-specific business or management logic. Its operating environment is not directly accessible to external interfaces, and is supported by underlying layers for basic functions such as data access and security processing. The basic function layer provides the necessary underlying support for the system, including basic components such as data storage and secure computing components.

[0049] In one embodiment, the external service layer includes a quantum key interface module, a dynamic password authentication interface module, and a management service interface module. The quantum key interface module is responsible for communicating with the quantum key distribution device of the quantum network, adapting to different quantum key distribution devices and protocols, and obtaining quantum keys from the quantum key system based on the quantum key configuration. The obtained keys are stored by the internal logic layer as message passwords in the dynamic password cache pool or as seed keys in the token key library. The dynamic password authentication interface module is responsible for receiving and parsing dynamic password authentication requests from application systems. The management service interface module provides a management portal through which administrators can perform operations such as dynamic password service configuration and system management configuration.

[0050] In one embodiment, the internal logic layer includes a temporary password management module, a seed key management module, an encryption and authentication module, and a system configuration module. The temporary password management module processes message-based dynamic passwords and primarily includes two key logic components: first, it receives the key obtained from the quantum key interface module as a dynamic password and stores it in a dynamic password buffer pool according to specific service configurations; second, it receives authentication messages from the dynamic password authentication module and, with the assistance of the authentication module, completes dynamic password authentication. The seed key management module processes token-based dynamic passwords and primarily includes two key logic components: first, it receives the key obtained from the quantum key interface module as a seed key and securely stores it in a token seed key library with the assistance of the encryption and authentication modules; second, it receives authentication messages from the dynamic password authentication module and, with the assistance of the encryption and authentication modules, completes dynamic password authentication. The encryption and authentication module handles encryption and dynamic password authentication functions, with security ensured by the secure computing component. The system configuration module processes configuration requirements from the management interface module, provides dynamic token service configuration management and system configuration management functions, and also provides configuration information access and read services for modules on the same layer.

[0051] In one embodiment, the basic function layer includes a dynamic password cache pool, a token seed key library, a security calculation component, and a system configuration library. The dynamic password cache pool is used to temporarily store message-type dynamic passwords. When the dynamic password is verified or expires, it will be automatically cleared from the pool, depending on the storage time and storage method configured by the business. The token seed key library is used to store dynamic token seed keys. When the token expires, is reported lost, or the work is abolished, the seed key becomes invalid. The security calculation component is a security component that provides encryption and authentication algorithms for the system and ensures the security of the system encryption scheme. The system configuration library is a static library for storing dynamic password business configuration information and system configuration information.

[0052] In one embodiment, the dynamic password authentication system process based on quantum key of the present invention includes the administrator's configuration process, the message-based dynamic password service process and the dynamic token password service process. Figure 2 The following is the configuration process for administrators. The system configuration process is the process for administrators to configure system information and manage business configurations. The process steps are as follows:

[0053] (1) The administrator operates and configures system information or dynamic password services through the "Management Service Interface Module";

[0054] (2) The "system configuration module" processes the configuration information, forms an internal storage format and synchronizes it to the "system configuration library";

[0055] (3) The “Management Service Interface Module” responds to the administrator with the configuration results

[0056] (4)End.

[0057] like Figure 3 The figure shows the message-based dynamic password business process. The message-based dynamic password business is a password verification function. In the actual application process, password verification is divided into two steps: password generation and password verification.

[0058] Step 1: Generate a message-type dynamic password.

[0059] (1) First, the "dynamic password authentication interface module" of the external service layer receives the dynamic password generation request;

[0060] (2) The “quantum key interface module” applies for a quantum key from the quantum network based on the dynamic password service configuration information obtained in the “system configuration module”;

[0061] (3) The quantum key returned by the quantum network is received by the “quantum key interface module”;

[0062] (4) The received quantum key is temporarily stored in the "dynamic password cache pool" by the "temporary password management module" corresponding to the dynamic password;

[0063] (5) The first step is completed.

[0064] Step 2: Verify the message-type dynamic password.

[0065] (1) The "dynamic password authentication interface module" receives a dynamic password authentication request

[0066] (2) According to the dynamic password business configuration obtained in the "system configuration module", the "encryption and authentication module" calls the "temporary password management module" to retrieve the corresponding dynamic password in the cache pool and verify the correctness of the received dynamic password

[0067] (3) "Dynamic Password Authentication Interface Module" responds with verification results

[0068] (4) The second step is completed.

[0069] like Figure 4 The dynamic token business process shown in the figure has two stages: production and use:

[0070] Phase 1: Production of dynamic tokens - Dynamic token seed generation.

[0071] (1) First, the "management service interface module" of the external service layer receives the dynamic token production configuration plan formulated by the administrator;

[0072] (2) Obtaining the dynamic token production service configuration from the "system configuration module" according to the selected configuration scheme and applying for the quantum key from the quantum network through the "quantum key interface module";

[0073] (3) The "Quantum Key Interface Module" receives the distributed quantum key (at the same time, the token manufacturer of another party is also distributed the same quantum key, and the manufacturer will use the distributed quantum key to seed the dynamic token);

[0074] (4) The received quantum key is handed over to the "seed key management module" and stored in the "token seed key library" corresponding to the business;

[0075] (5) Phase 1 ends.

[0076] Phase 2: Use dynamic token - dynamic token dynamic password verification.

[0077] (1) The "dynamic password authentication interface module" receives a dynamic password authentication request;

[0078] (2) Obtain the corresponding dynamic password service configuration from the "system configuration module" and call the "seed key management module" by the "encryption and authentication module" to retrieve the relevant seed key and use the token password algorithm to verify the received dynamic password;

[0079] (3) The system calls the "seed key management module" from the "encryption and authentication module" according to the dynamic password business configuration to retrieve the associated seed key and use the specific token password algorithm to verify the received dynamic password;

[0080] (4) The “dynamic password authentication interface module” responds with the verification result;

[0081] (5) Phase 2 ends.

[0082] like Figure 5 The message-type dynamic password business process of the quantum key-based dynamic password authentication system of the present invention is shown.

[0083] Based on the message dynamic password technology, the quantum key is used as the dynamic password, and the key identifier is used as the dynamic password serial number. First, the dynamic password and serial number are distributed to the dynamic password authentication system and the third-party communication tool / proxy server respectively, and then sent to the user through the third-party communication tool for the user to log in to the application system. Specific authentication process:

[0084] 1. The user uses the client to request to log in to the application server;

[0085] 2. The application server applies to the dynamic password authentication system for generating a dynamic password;

[0086] 3. The dynamic password authentication system applies for a dynamic password (quantum key) from the quantum network;

[0087] 4. The quantum system generates and distributes the quantum key (dynamic password) to the dynamic password authentication system, and at the same time distributes the same dynamic password to the third-party communication tool / proxy server;

[0088] 5. The dynamic password authentication system receives and stores the temporary dynamic password. Meanwhile, the third-party communication tool / proxy server also receives the dynamic password and sends it to the user through the communication tool.

[0089] 6. The dynamic password authentication system responds with the dynamic password serial number to the application server;

[0090] 7. The application server forwards the dynamic password serial number to the logged-in client;

[0091] 8. The user confirms that the dynamic password serial number is correct and enters the dynamic password, and then requests login authentication again;

[0092] 9. The application server receives the dynamic password from the client and requests verification from the dynamic password authentication system;

[0093] 10. The dynamic password authentication system performs password legitimacy checks and authentication based on relevant policies and temporarily stored dynamic passwords;

[0094] 11. The verification result is returned to the application server;

[0095] 12. The application server determines the login authentication result based on the verification result and returns it to the client.

[0096] In one embodiment, a token-type dynamic password utilizes the principle of quantum key distribution. The quantum key serves as the seed key of the dynamic token and is distributed to the dynamic password authentication system and the token manufacturer through the quantum network. The key of the dynamic password authentication system serves as the seed key of the user token and is stored within the system for use in subsequent dynamic password authentication. The quantum key received by the token manufacturer serves as the seed key for producing the dynamic token, and the copy outside the token is destroyed after the quantum key is burned into the token.

[0097] The dynamic token business process is divided into two stages: production and use. Figure 6 The following is the production process of dynamic tokens and dynamic passwords. The specific production process is as follows:

[0098] 1. The production of dynamic tokens is initiated by the dynamic token authentication system configuring the token scheme to generate the token seed key;

[0099] 2. The quantum system receives the request to generate a quantum key and distributes it to the dynamic password authentication system and token manufacturer at the same time;

[0100] 3. The dynamic password authentication system receives the quantum key and stores it as the token seed key within the system.

[0101] 4. At the same time, the token manufacturer burns the received quantum key into the token as the token seed key;

[0102] 5. The produced tokens are distributed to users.

[0103] like Figure 7 The following shows the usage phase of dynamic token and dynamic password. The specific process is as follows:

[0104] Authentication process of dynamic token and dynamic password:

[0105] 1. The user logs in to the application server through the client;

[0106] 2. The application server specifies challenge information based on the key information requested by the user;

[0107] 3. The application server sends the challenge information to the client;

[0108] 4. The user receives the challenge message and enters the dynamic token;

[0109] 5. Dynamic token generates dynamic password based on user input;

[0110] 6. The user enters the generated dynamic password into the client to continue the authentication request;

[0111] 7. The application server sends the client's request for a dynamic password and challenge information to the dynamic password authentication system, requesting dynamic password authentication;

[0112] 8. The dynamic password system finds the corresponding token seed based on the request information and generates and verifies the dynamic password.

[0113] 9. The verification result is returned to the application server.

[0114] In one embodiment, Figure 8 As shown, the dynamic password authentication system based on quantum key supports message-type dynamic password and token-type dynamic password applications.

[0115] The password of the message-type dynamic password corresponds to the quantum key of the quantum network key distribution. QKD quantum key distribution devices (QKD-2 and QKD-3) are configured in the dynamic password authentication system and the third-party communication server / proxy server. QKD is connected through the quantum network, and the quantum key (dynamic password) is distributed to the dynamic password authentication system and the third-party communication server / proxy server at the same time through the quantum network. The key distributed by QKD-2 is stored as a dynamic password by the dynamic password authentication system, and the key distributed by QKD-3 is received through the third-party communication server / proxy server and sent to the user through a third-party tool.

[0116] Token-type dynamic passwords use quantum keys distributed synchronously over quantum networks as the seed keys of tokens. QKD quantum key distribution devices (QKD-2 and QKD-1) are configured in the dynamic password authentication system and token manufacturer configuration environment. QKD is connected through the quantum network, and the quantum key (token seed key) is distributed to the dynamic password authentication system and token manufacturer at the same time through the quantum network. The key distributed by QKD-2 is stored as a token seed by the dynamic password authentication system, and the key distributed by QKD-1 is burned into the token by the token manufacturer.

[0117] It is easy for those skilled in the art to understand that, under the premise of no conflict, the above-mentioned advantageous methods can be freely combined and superimposed.

[0118] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention. The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art may make various improvements and variations without departing from the technical principles of the present invention, and such improvements and variations shall also be considered within the scope of protection of the present invention.

Claims

1. A dynamic password authentication system based on quantum keys, characterized in that: The dynamic password authentication system includes three layers: external service layer, internal logic layer and basic function layer; The external service layer provides a service interface for quantum key distribution (QKD), application systems, and management, and serves as a window for the dynamic password authentication system to communicate and process with the outside world. The internal logic layer is responsible for the business or management logic processing of the dynamic password authentication system. Its operating environment cannot be directly accessed by the external interface, and the basic function layer provides it with data access and security processing basic function support; and The basic function layer provides the necessary underlying support for the dynamic password authentication system, including basic components for data storage and secure computing; The external service layer includes a quantum key interface module, a dynamic password authentication interface module, and a management service interface module; The internal logic layer includes a temporary password management module, a seed key management module, an encryption and authentication module and a system configuration module; The basic function layer includes a dynamic password cache pool, a token seed key library, a security calculation component and a system configuration library; The temporary password management module processes message-type dynamic passwords. It receives the key obtained from the quantum key interface module as a dynamic password and stores it in the dynamic password cache pool according to the specific business configuration, and receives the authentication message from the dynamic password authentication interface module, and completes the dynamic password authentication processing with the assistance of the authentication module.

2. The dynamic password authentication system according to claim 1, characterized in that: The quantum key interface module is responsible for communicating with the quantum key distribution device of the quantum network, adapting to different quantum key distribution devices and protocols, and obtaining the quantum key from the quantum key system according to the quantum key configuration. The obtained key is stored by the internal logic layer as a message password in the dynamic password cache pool or as a seed key in the token key library.

3. The dynamic password authentication system according to claim 1, characterized in that: The dynamic password authentication interface module is responsible for receiving and parsing the dynamic password authentication request of the application system.

4. The dynamic password authentication system according to claim 1, characterized in that: The management service interface module provides a management portal through which the administrator can configure the dynamic password service and system management.

5. The dynamic password authentication system according to claim 1, characterized in that: The seed key management module processes token-type dynamic passwords. It receives the key obtained from the quantum key interface module as a seed key and securely stores it in the token seed key library with the assistance of the encryption and authentication modules. It also receives the authentication message from the dynamic password authentication interface module and completes the dynamic password authentication processing with the assistance of the encryption and authentication modules.

6. The dynamic password authentication system according to claim 1, characterized in that: The encryption and authentication module processes encryption and dynamic password authentication functions, and its security is guaranteed by the security computing component.

7. The dynamic password authentication system according to claim 1, characterized in that: The system configuration module processes the configuration requirements of the management interface module, provides dynamic token service configuration management and system configuration management functions; and provides access and reading services for configuration information for modules at the same layer.

8. The dynamic password authentication system according to claim 1, characterized in that: The dynamic password cache pool is used to temporarily store message-type dynamic passwords. When the dynamic password is verified or expires, it will be automatically cleared from the pool. The storage time and storage method are specifically configured according to the business.

9. The dynamic password authentication system according to claim 1, characterized in that: The token seed key library is used to store dynamic token seed keys. The seed key becomes invalid when the token becomes invalid, reported lost, or the token is disabled.

10. The dynamic password authentication system according to claim 1, characterized in that: The security calculation component provides encryption and authentication algorithms for the dynamic password authentication system and ensures the security of the system encryption scheme.

11. The dynamic password authentication system according to claim 1, characterized in that: The system configuration library is a static library used to store dynamic password service configuration information and system configuration information.

Images