A multiple identity authentication method, device and storage medium

Abstract

The application provides a multi-identity authentication method, device and storage medium, which uses a hardware device to encrypt biological feature information of a user and applies the encrypted biological feature information to identity authentication. The application combines biological feature information, a hardware device and a network environment, uses an IP, a MAC address of a server where a software service is located and biological features input by the user as identity authentication factors to perform identity authentication, and realizes identity authentication with a higher security level and simplifies an authentication process.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of encryption technology, in particular to a multi-identity authentication method, device and storage medium, which can be used in the identity authentication process of different data nodes in a network environment. BACKGROUND

[0002] Identity verification is the process of determining whether a person or thing is actually what it claims to be. Identity verification technology provides access control for a system by checking whether a user's credentials match those in an authorized user database or data identity verification server. In this process, identity verification ensures secure systems, secure processes, and enterprise information security.

[0003] There are several types of identity verification. For the purpose of user identity, a user ID is usually used to identify a user, and identity verification occurs when the user provides credentials such as a password that matches their user ID. The practice of requiring a user ID and password is called single-factor authentication (SFA). In recent years, companies have strengthened identity verification by requiring additional identity verification factors, such as a unique code provided to the user via a mobile device when attempting to log in or a biometric signature. This is called two-factor authentication (2FA).

[0004] Identity verification factors can even go further than SFA, which requires a user ID and password or 2FA, which requires a user ID, password, and biometric signature. When three or more identity verification factors are used for identity verification, such as a user ID and password, a biometric signature, and a personal question that the user must answer - it is called multi-factor authentication (MFA).

[0005] Identity verification allows organizations to only allow authenticated users or processes to access their protected resources, thereby securing their networks. This can include computer systems, networks, databases, websites, and other web-based applications or services. To make 2FA as secure as possible, additional steps can be added to the process. For example, a customer may be asked to enter a personal identification number (PIN) and a piece of biometric information. In these cases, the process is called multi-factor authentication (mFA). The more steps a customer is required to complete, the more secure the process. However, adding steps also makes the process more cumbersome for the customer. SUMMARY

[0006] The present application aims to solve the problem of low security or cumbersome steps of the prior art identity authentication, and proposes a new multi-identity authentication method, device and storage medium. The identity authentication method comprises a user registration stage and a user login stage, wherein the user registration stage comprises:

[0007] Step one: the local server receives the user's registration information, starts the information collector to obtain and store the user's feature information, and returns the feature information to the local server;

[0008] Step two: the local server obtains the IP address and MAC address of the local device network card, generates a random salt s, and uses a hash function to generate the IP parameter P of the IP address, the MAC parameter I of the MAC address, and the parameters x and v, and the generation formula is as follows, wherein g is a fixed parameter in a fixed large prime number N range:

[0009] P = Hash (IP address + feature information + random number)

[0010] I = Hash (MAC address + feature information)

[0011] x = Hash (random salt s, P)

[0012] v = g^x

[0013] Step three: start the key management device to encrypt the feature information and parameter P, and return the encrypted feature information and parameter P to the local server; the local server stores the registration information, parameter I, encrypted parameter P, and encrypted feature information in the first database, and sends the registration information, parameter I, parameter v, and random salt s to the identity authentication server;

[0014] Step four: the identity authentication server stores the received parameter I, parameter v, and random salt s in the second database, and sends the user registration completion information to the local server.

[0015] Specifically, the information collector includes a fingerprint collector, a face collector, and an iris collector; the feature information is the fingerprint feature, face feature, and iris feature corresponding to the information collector.

[0016] Further, the user login stage includes:

[0017] Step one: the user sends a login request to the local server, and the local server starts the information collector to collect the feature information;

[0018] Step two: the key management device encrypts the feature information and returns it to the local server; the local server searches in the first database according to the encrypted feature information to obtain the corresponding parameter I and encrypted parameter P; the key management device decrypts the encrypted parameter P to obtain the parameter P and returns it to the local server;

[0019] Step three: the local server calculates the parameter A = g^a, wherein a is a random number and g is a fixed parameter in the system, and sends the parameter I and parameter A to the identity authentication server;

[0020] Step four: the identity authentication server finds the parameter v and the parameter s in the second database according to the parameter I, and calculates the parameter B=kvg^b, wherein the parameter k=Hash(N, g), N is a fixed large prime number, and g is fixed as a number in N;

[0021] Step five: the identity authentication server sends the parameter s and the parameter B to the local server;

[0022] Step six: the local server and the identity authentication server calculate the parameter u=Hash(A, B) at the same time, the local server calculates the parameter x=Hash(s, P), the parameter S1=(B-kg^x)^(a+ux), and the parameter K1=Hash(S1), the identity authentication server calculates the parameter S2=(Av^u)^b, and K2=Hash(S2);

[0023] Step seven: the local server calculates the parameter M1=Hash(Hash(N)xor Hash(g), Hash(I), s, A, B, K1) and sends it to the identity authentication server;

[0024] Step eight: the identity authentication server also calculates the parameter M2 and verifies the received parameter M1, and stores the parameter K1 as a session key in the memory after verification;

[0025] Step nine: the identity authentication server calculates Hash(A, M2, K2) and returns the hash value to the local server;

[0026] Step ten: the local server receives Hash(A, M2, K2), also calculates Hash(A, M1, K1) for verification, and stores the parameter K2 as a session key in the memory after verification.

[0027] Specifically, after the verification of step ten is passed, the parameter K1 and the parameter K2 are trusted tokens of the user.

[0028] Further, the first database is a local storage system of the local server, and the second database is a local storage system of the identity authentication server; the local server and the identity authentication server can be a data circuit termination device such as a hub and a switch and / or a data terminal device such as a host and a server.

[0029] Further, the key management device is a mobile device that can encrypt and decrypt information.

[0030] The application also provides a multiple identity authentication system, comprising a user terminal and a server, wherein the user terminal comprises an information collector and a key management device.

[0031] The application further provides a computer device, comprising a memory and a processor, the memory stores executable code, and the processor executes the executable code to implement any of the above methods.

[0032] The application further provides a computer readable storage medium, characterized in that the computer readable storage medium stores computer executable instructions, and the computer executable instructions, when called and executed by a processor, cause the processor to implement any of the above methods.

[0033] Compared with the prior art, the application solves the problem of complicated multiple identity authentication steps and low security in the prior art: first, by adding an information collection step, it is ensured that a user can perform identity authentication according to a personal identification code or a piece of biological identification information, and biological information is encrypted in a mobile encryption and decryption device to ensure that data is not exposed. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 A user registration flowchart in an embodiment of the application is shown.

[0035] Figure 2 A user login flowchart in an embodiment of the application is shown.

[0036] Figure 3 A computer device architecture diagram provided by an embodiment of the application is shown. DETAILED DESCRIPTION

[0037] The application will be described in detail below with reference to the drawings, taking text recognition as an example.

[0038] This embodiment is implemented on the premise of the technical solution of the application, and detailed implementation modes and specific operation processes are given, but the protection scope of the application is not limited to the following embodiments.

[0039] The application provides a multiple identity authentication method, and this embodiment takes collection of fingerprint information by an information collector as an example to describe the specific steps of the identity authentication method provided by the embodiment. The identity authentication comprises two stages, namely a user registration stage and a user login stage. Figure 1 The steps of the user registration stage are as follows:

[0040] Step 1: The local server receives the registration information of a user, starts an information collector to acquire and store characteristic information of the user, and returns the characteristic information to the local server;

[0041] In the embodiment of the present application, the local server is deployed in the terminal (desktop, notebook computer) of the user, and mainly functions to interact with the fingerprint collection device and the hardware encryption device such as Ukey to complete the collection and identification of the fingerprint, and encrypt the key parameters. The local server opens a registration interface to the user to receive the registration information of the user, mainly the name, gender, etc. When the user inputs the registration information, the local server starts the driver program of the fingerprint collector and waits for the user to press the identification area. When the fingerprint collector collects the fingerprint of the user, the fingerprint features are stored in the fingerprint collector and returned to the local server.

[0042] Step two: the local server acquires the IP address and MAC address of the local device network card, generates a random salt s, and generates the IP parameter P of the IP address, the MAC parameter I of the MAC address, and the parameters x and v by using a hash function, and the generation formula is as follows, wherein g is a fixed parameter in a large prime number N range:

[0043] P = Hash (IP address + feature information + random number)

[0044] I = Hash (MAC address + feature information)

[0045] x = Hash (random salt s, P)

[0046] v = g^x

[0047] In the embodiment of the present application, the random number in the parameter P is not limited and can be any natural number. After the above parameters are generated, the key management device is started. The key management device is a mobile device that can encrypt and decrypt information, and in the embodiment of the present application, the Ukey is preferred.

[0048] Step three: the key management device encrypts the feature information and the parameter P, and returns the encrypted feature information and the parameter P to the local server; the local server stores the registration information, the parameter I, the encrypted parameter P, and the encrypted feature information in the first database, and sends the registration information, the parameter I, the parameter v, and the random salt s to the identity authentication server;

[0049] Step four: the identity authentication server stores the received parameter I, parameter v, and random salt s in the second database, and sends the user registration completion information to the local server.

[0050] The identity authentication method provided by the embodiment of the present application avoids information leakage, information tampering or impersonation when registering identity information in a network through offline identity information registration in the user registration stage, and adds the biological characteristics of the user, thereby enhancing security without increasing operation steps. In the subsequent user login and encrypted transmission process, the IP and MAC address of the server where the software service is located can be used as an identity authentication factor for identity authentication. Once the network environment changes, identity authentication fails, and subsequent operations will be terminated.

[0051] Further, referring to Figure 2 , the user login stage comprises the following steps:

[0052] Step one: the user sends a login request to the local server, and the local server starts an information collector to collect characteristic information;

[0053] In the embodiment of the present application, after the user requests a login interface from the local server, the local server starts the driver program of the fingerprint collector, collects fingerprints, and sends the collected fingerprint characteristics to the key management device Ukey.

[0054] Step two: the key management device encrypts the characteristic information and returns it to the local server; the local server searches the first database according to the encrypted characteristic information to obtain the corresponding parameter I and the encrypted parameter P; the key management device decrypts the encrypted parameter P to obtain the parameter P and returns it to the local server;

[0055] Step three: the local server calculates the parameter A = g^a, where a is a random number and g is a fixed parameter in the system, and sends the parameter I and the parameter A to the identity authentication server;

[0056] Step four: the identity authentication server finds the parameter v and the parameter s in the second database according to the parameter I, and calculates the parameter B = kv + g^b, where the parameter k = Hash(N, g), N is a fixed large prime number, and g is fixed as a number in N;

[0057] Step five: the identity authentication server sends the parameter s and the parameter B to the local server;

[0058] Step six: the local server and the identity authentication server simultaneously calculate the parameter u = Hash(A, B), the local server calculates the parameter x = Hash(s, P), the parameter S1 = (B-kg^x)^(a+ux), and the parameter K1 = Hash(S1), the identity authentication server calculates the parameter S2 = (Av^u)^b, and K2 = Hash(S2);

[0059] Step seven: the local server calculates parameter M1=Hash(Hash(N)xor Hash(g), Hash(I), s, A, B, K1) and sends to the identity authentication server;

[0060] Step eight: the identity authentication server also calculates parameter M2 and checks with the received parameter M1, and stores parameter K1 as a session key in the memory after the check is passed;

[0061] Step nine: the identity authentication server calculates Hash(A, M2, K2) and returns the hash value to the local server;

[0062] Step ten: the local server receives Hash(A, M2, K2), also calculates Hash(A, M1, K1) for checking, and stores parameter K2 as a session key in the memory after the check is passed.

[0063] In the embodiment of the application, the fingerprint information is combined with the traditional identity authentication method, and the fingerprint feature is added to the parameter operation, so that the security of the identity authentication is improved without increasing the operation steps. In the embodiment of the application, the information collector can also collect iris information, face information, voiceprint information and other biological characteristics, and the fingerprint information is taken as an example in the embodiment of the application.

[0064] The embodiment of the application also provides a multiple identity authentication system, which comprises a user terminal and a server. The user terminal comprises an information collector and a key management device. The system operation method is the same as the above-mentioned embodiment, and will not be described in detail.

[0065] The embodiment of the application also provides a computer device, which refers to Figure 3 The computer device comprises a processor and a memory. The processor is used to execute the executable modules stored in the memory, such as a computer program.

[0066] The memory can comprise a high-speed random access memory (RAM) and can also comprise a non-volatile memory, such as at least one disk memory. The memory is used to store a program, and the processor executes the above-mentioned program after receiving an execution instruction. The method disclosed in any one of the above-mentioned embodiments of the application can be applied to the processor or realized by the processor.

[0067] The processor can be an integrated circuit chip having a processing capability of signals. In the implementation process, each step of the above method can be completed by integrated logic circuits of hardware in the processor or instructions in the form of software. The processor described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc. ; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Each method, step and logic block diagram disclosed in the embodiment of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the embodiment of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium in the storage is read by the processor, and the hardware thereof is combined to complete the steps of the above method.

[0068] The identity authentication method, device and computer readable storage medium computer program product provided by the embodiment of the present application include a computer readable storage medium storing program codes, and the instructions included in the program codes can be used to execute the method described in the foregoing method embodiment. The specific implementation can be referred to the method embodiment, and will not be described here.

[0069] The embodiment of the present application adds two hardware of information collector and key management device on the basis of the traditional identity authentication method, and uses the encrypted biological feature information for identity authentication, which simplifies the process of identity authentication, strengthens the security of identity authentication, and protects the personal information of the user from being leaked.

[0070] The protection scope of the present application is defined by the appended claims, and the technology and method can be used for text recognition, speech recognition, image recognition and video signal processing. If the activation function constructed by the present application is used as a component of a neural network for text recognition, speech recognition, image recognition and video signal processing, it should be regarded as part of the claimed protection of the specification and should be protected by relevant laws.

Claims

1. A multiple identity authentication method, characterized by, The method comprises a user registration stage and a user login stage; the user registration stage comprises: Step one: the local server receives the registration information of a user, starts an information collector to acquire and store the characteristic information of the user, and returns the characteristic information to the local server; Step two: the local server acquires the IP address and MAC address of the local device network card, generates a random salt s, and uses a hash function to generate the IP parameter P of the IP address, the MAC parameter I of the MAC address, and parameters x and v, and the generation formula is as follows: ； ； ； v ； Wherein, g is a fixed parameter in a fixed large prime number N range; Step three: a key management device is started to encrypt the characteristic information and the parameter P, and the encrypted characteristic information and the parameter P are returned to the local server; the local server stores the registration information, the parameter I, the encrypted parameter P, and the encrypted characteristic information in a first database, and sends the registration information, the parameter I, the parameter v, and the random salt s to an identity authentication server; Step four: the identity authentication server stores the received parameter I, parameter v, and random salt s in a second database, and sends user registration completion information to the local server.

2. The multiple identity authentication method of claim 1, wherein, The information collector comprises a fingerprint collector, a face collector, and an iris collector; the characteristic information is the fingerprint characteristics, face characteristics, and iris characteristics corresponding to the information collector.

3. The multiple identity authentication method of claim 1, wherein, The user login stage comprises: Step one: a user sends a login request to the local server, the local server starts the information collector to collect the characteristic information; Step two: the key management device encrypts the characteristic information and returns it to the local server; the local server searches in the first database according to the encrypted characteristic information to acquire the corresponding parameter I and the encrypted parameter P; the key management device decrypts the encrypted parameter P to obtain the parameter P and returns it to the local server; Step three: the local server calculates parameter A = g^a, wherein a is a random number and g is a fixed parameter in the system, and sends the parameter I and the parameter A to the identity authentication server; Step four: the identity authentication server finds the parameter v and the parameter s in the second database according to the parameter I, and calculates parameter B = kv + g^b, wherein parameter k = Hash(N, g); Step five: the identity authentication server sends the parameter s and the parameter B to the local server; Step six: the local server and the identity authentication server simultaneously calculate parameter u = Hash(A, B), the local server calculates the parameter x = Hash(s, P), parameter S1 = (B - kg^x) ^ (a + ux), and parameter K1 = Hash(S1), the identity authentication server calculates parameter S2 = (Av^u) ^ b, and K2 = Hash(S2). Step seven: the local server calculates parameter M1 = Hash(Hash(N) xor Hash(g), Hash(I), s, A, B, K1) and sends to the identity authentication server; Step eight: the identity authentication server also calculates parameter M2 and checks with the received parameter M1, and stores the parameter K1 as session key in memory after the check is passed; Step nine: the identity authentication server calculates Hash(A, M2, K2) and returns the hash value to the local server; Step ten: the local server receives Hash(A, M2, K2) and also calculates Hash(A, M1, K1) for check, and stores the parameter K2 as session key in memory after the check is passed.

4. The multiple identity authentication method of claim 2, wherein, Further comprising: When the check in step ten is passed, the parameter K1 and the parameter K2 are used as the trusted token of the user.

5. The multiple identity authentication method of claim 1, wherein, The first database is the local storage system of the local server, and the second database is the local storage system of the identity authentication server; the local server and the identity authentication server can be hub, switch and other data circuit termination equipment and / or host, server and other data terminal equipment.

6. The multiple identity authentication method of claim 1, wherein, The key management device is a mobile device that can encrypt and decrypt information.

7. A computer device, comprising a memory and a processor, the memory stores executable code, and the processor executes the executable code to implement the method in any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer executable instructions, and the computer executable instructions, when called and executed by the processor, cause the processor to implement an identity authentication method as claimed in any one of claims 1-6.

Images