An adaptive password authentication method and device, a storage medium and an electronic device

Abstract

The application discloses a kind of self-adapting password authentication method, device, storage medium and electronic equipment, the method includes: receiving the access request of terminal;Extract the performance information in access request, and according to performance information matching corresponding strength password authentication algorithm;Password authentication algorithm corresponding identification information and server identification information are sent to terminal for two-way authentication.By implementing the present application, the access request of terminal is obtained, and the corresponding strength password authentication algorithm is matched for terminal based on the performance information in access request for two-way authentication, which realizes the scheduling of self-adapting password authentication algorithm based on different performance terminals, and solves the technical problem of lack of adaptive authentication mechanism for terminal security requirements.Therefore, the authentication method can adapt to heterogeneous terminal encryption authentication, support the needs of mass high-concurrency access, high interactivity, high real-time scene multi-type terminal access authentication, and solve the problem of unified control of heterogeneous power terminals.

Description

Technical Field

[0001] This invention relates to the fields of network communication and information security technology, specifically to an adaptive cryptographic authentication method, apparatus, storage medium, and electronic device. Background Technology

[0002] With the development of new power systems, the number of connected IoT terminals will increase exponentially, becoming more diverse in type, performance requirements, and security risks. Different types of terminals with different services require flexible configuration of cryptographic algorithms and authentication methods tailored to their specific needs. In the power IoT environment, a large number of resource-constrained devices constitute the device network. The characteristics of these devices dictate that ensuring the security of data from these constrained devices requires consideration of both the applicability and security of the security scheme, as well as factors such as the complexity and energy consumption of the scheme. Designing authentication schemes based on resource-constrained devices requires the comprehensive use of multiple technologies, such as key pre-distribution, distributed authentication, and secret sharing.

[0003] In recent years, domestic universities and research institutions have conducted extensive research on lightweight encryption authentication technologies, proposing a series of lightweight cryptographic algorithms and authentication protocols suitable for IoT terminal applications. Researchers have also conducted significant research on RFID (Radio Frequency Identification) authentication protocols, with many scholars proposing lightweight two-way authentication protocols. However, analysis has revealed widespread shortcomings in these protocols, including poor security, incomplete functionality, and low efficiency. The biggest problem with currently popular key exchange protocols in lightweight network nodes is their overly complex interaction, which can lead to substantial communication overhead and power consumption. Many existing solutions suffer from security issues or system model limitations, making them difficult to meet current needs.

[0004] Finding a balance between performance and security in cryptographic algorithms under constrained environments is a problem worthy of in-depth research. On one hand, this involves lightweight design and implementation; on the other hand, it requires consideration of the potential security issues of lightweight components and the ability to conduct detailed security evaluations of lightweight designs. However, current research is relatively scarce, and there is an urgent need to establish a lightweight adaptive authentication mechanism for terminal security needs and design security protocols to solve the challenge of unified management and control of heterogeneous power terminals. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide an adaptive cryptographic authentication method, apparatus, storage medium, and electronic device to solve the technical problem of the lack of an adaptive authentication mechanism for terminal security needs in the prior art.

[0006] The technical solution proposed in this invention is as follows:

[0007] A first aspect of this invention provides an adaptive cryptographic authentication method, comprising: receiving an access request from a terminal, the access request including performance information of the terminal; extracting the performance information from the access request; matching a cryptographic authentication algorithm of corresponding strength according to the performance information; and sending identification information corresponding to the cryptographic authentication algorithm and server identification information to the terminal for two-way authentication.

[0008] Optionally, matching a corresponding strength of cryptographic authentication algorithm based on the performance information includes: obtaining the computing power in the performance information; determining the difference between the computing power and a preset threshold; when the computing power is lower than the preset threshold, determining whether to share a key with the terminal; if the key is shared, matching the terminal with a first strength cryptographic authentication algorithm; if the key is not shared, authentication fails.

[0009] Optionally, matching a cryptographic authentication algorithm of corresponding strength based on the performance information further includes: when the computing power is higher than a preset threshold, matching a corresponding cryptographic authentication algorithm based on the storage capacity, communication capacity, and security requirements in the performance information.

[0010] Optionally, matching a corresponding cryptographic authentication algorithm based on the storage capacity, communication capacity, and security requirements in the performance information includes: performing a weighted summation of the storage capacity, communication capacity, and security requirements in the performance information to obtain a capability score for the terminal; comparing the capability score with the terminal's average capability score; and matching a corresponding cryptographic authentication algorithm for the terminal based on the comparison result.

[0011] Optionally, matching a corresponding cryptographic authentication algorithm to the terminal based on the comparison result includes: when the capability score is less than the average capability score of the terminal, classifying the terminal into three levels and matching a first-strength cryptographic authentication algorithm to the terminal based on a shared key; when the capability score is greater than the average capability score of the terminal but less than twice the average capability score of the terminal, classifying the terminal into two levels and matching a second-strength cryptographic authentication algorithm to the terminal; when the capability score is greater than twice the average capability score of the terminal, classifying the terminal into one level and matching a third-strength cryptographic authentication algorithm to the terminal, wherein the key strength of the third-strength cryptographic authentication algorithm is greater than the key strength of the second-strength cryptographic authentication algorithm, and the key strength of the second-strength cryptographic authentication algorithm is greater than the key strength of the first-strength cryptographic authentication algorithm.

[0012] Optionally, before matching a password authentication algorithm of corresponding strength based on the performance information, the method includes: extracting the terminal identifier from the access request; and performing a valid verification of the terminal based on the terminal identifier and the performance information.

[0013] Optionally, sending the identification information corresponding to the password authentication algorithm and the server identification information to the terminal for two-way authentication includes: sending the identification information corresponding to the password authentication algorithm and the server identification information to the terminal; receiving the response information sent by the terminal; and performing two-way authentication with the terminal using the password authentication algorithm based on the response information.

[0014] A second aspect of this invention provides an adaptive password authentication device, comprising: a request receiving module for receiving an access request from a terminal, the access request including performance information of the terminal; a matching module for extracting the performance information from the access request and matching a password authentication algorithm of corresponding strength according to the performance information; and an authentication module for sending identification information corresponding to the password authentication algorithm and server identification information to the terminal for two-way authentication.

[0015] Optionally, the matching module includes: a computing power acquisition module, used to acquire the computing power in the performance information; a computing power judgment module, used to judge the size of the computing power and a preset threshold; and a key judgment module, used to judge whether to share a key with the terminal when the computing power is lower than the preset threshold. If the key is shared, the first strength password authentication algorithm is matched for the terminal; if the key is not shared, the authentication fails.

[0016] Optionally, the matching module further includes a matching submodule, used to match a corresponding cryptographic authentication algorithm based on the storage capacity, communication capacity, and security requirements in the performance information when the computing power is higher than a preset threshold.

[0017] Optionally, the matching submodule includes: a capability score calculation module, used to perform a weighted summation based on the storage capacity, communication capacity, and security requirements in the performance information to obtain the terminal's capability score; and a comparison module, used to compare the capability score with the terminal's average capability score, and match the terminal with a corresponding cryptographic authentication algorithm based on the comparison result.

[0018] Optionally, the comparison module is specifically configured to: when the capability score is less than the average capability score of the terminal, classify the terminal into three levels and match a first-strength cryptographic authentication algorithm for the terminal based on the shared key; when the capability score is greater than the average capability score of the terminal but less than twice the average capability score of the terminal, classify the terminal into two levels and match a second-strength cryptographic authentication algorithm for the terminal; when the capability score is greater than twice the average capability score of the terminal, classify the terminal into one level and match a third-strength cryptographic authentication algorithm for the terminal, wherein the key strength of the third-strength cryptographic authentication algorithm is greater than the key strength of the second-strength cryptographic authentication algorithm, and the key strength of the second-strength cryptographic authentication algorithm is greater than the key strength of the first-strength cryptographic authentication algorithm.

[0019] Optionally, the adaptive cryptographic authentication device further includes: a legitimacy verification module, specifically used to extract the terminal identifier from the access request; and to perform legitimacy verification on the terminal based on the terminal identifier and performance information.

[0020] A third aspect of the present invention provides a computer-readable storage medium storing computer instructions for causing the computer to perform the adaptive cryptographic authentication method as described in the first aspect and any one of the first aspects of the present invention.

[0021] A fourth aspect of the present invention provides an electronic device, including: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the adaptive cryptographic authentication method as described in the first aspect and any one of the first aspects of the present invention.

[0022] The technical solution provided by this invention has the following effects:

[0023] The adaptive cryptographic authentication method, apparatus, storage medium, and electronic device provided in this invention obtain access requests from terminals and match corresponding cryptographic authentication algorithms based on performance information in the access requests for two-way authentication. This achieves the scheduling of adaptive cryptographic authentication algorithms based on terminals with different performance levels, solving the technical problem of lacking an adaptive authentication mechanism tailored to terminal security needs. Therefore, this authentication method can adapt to heterogeneous terminal encryption authentication, supporting the needs of multi-type terminal access authentication in scenarios with massive high-concurrency access, high interactivity, and high real-time performance, and solving the problem of unified management and control of heterogeneous power terminals. Attached Figure Description

[0024] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0025] Figure 1 This is a flowchart of an adaptive cryptographic authentication method according to an embodiment of the present invention;

[0026] Figure 2 This is a schematic diagram illustrating an application scenario of the adaptive cryptographic authentication method according to an embodiment of the present invention;

[0027] Figure 3 This is a schematic diagram of the interaction authentication between the terminal and the server in the adaptive cryptographic authentication method according to an embodiment of the present invention;

[0028] Figure 4 This is a flowchart of an adaptive cryptographic authentication method according to another embodiment of the present invention;

[0029] Figure 5 This is a structural block diagram of an adaptive cryptographic authentication device according to an embodiment of the present invention;

[0030] Figure 6 This is a schematic diagram of the structure of a computer-readable storage medium provided according to an embodiment of the present invention;

[0031] Figure 7 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] The terms "first," "second," "third," "fourth," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] According to an embodiment of the present invention, an adaptive cryptographic authentication method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] This embodiment provides an adaptive password authentication method that can be used in electronic devices, etc. Figure 1 This is a flowchart of an adaptive cryptographic authentication method according to an embodiment of the present invention, such as... Figure 1 and Figure 2As shown, the method includes the following steps:

[0036] Step S101: Receive an access request from the terminal, the access request including the terminal's performance information; specifically, this cryptographic authentication method is used for authentication between the terminal and the edge server. The terminal is a power IoT terminal, such as a power mobile terminal, a power smart terminal, and a power fixed terminal. In other embodiments, the terminal can also be other types of terminals, and this embodiment of the invention does not limit this. During authentication, the terminal first sends an access request to the edge server, the access request carrying the terminal type and a distinguishable identifier ID. c It also includes the terminal's performance information. This identifiable identifier can be the terminal's identity information. It should be noted that the edge server performs initialization before receiving access requests.

[0037] Step S102: Extract performance information from the access request and match a corresponding strength of password authentication algorithm based on the performance information. Specifically, when the edge server receives an access request from a terminal, it extracts the performance information from the access request and matches a corresponding strength of password authentication algorithm for it. To implement this matching process, the correspondence between different performance information and different strength password authentication algorithms is pre-stored in the edge server. For example, a higher strength password authentication algorithm is matched for terminals with higher performance, and a lower strength password authentication algorithm is matched for terminals with lower performance. This allows the terminal to select the appropriate password authentication algorithm for authentication based on its own capabilities.

[0038] Step S103: Send the identification information corresponding to the password authentication algorithm and the server identification information to the terminal for two-way authentication. Specifically, when a password authentication algorithm of corresponding strength is matched, the identification information corresponding to the algorithm and the edge server identification information are sent to the terminal for two-way authentication. Different identification information is pre-set for different strength password authentication algorithms to represent their strengths, and the identification information is different for different password authentication algorithms. The edge server identification information is specifically the edge server's identity information. Sending the edge server's identification information to the terminal facilitates subsequent two-way authentication between the terminal and the edge server.

[0039] The adaptive cryptographic authentication method provided in this invention obtains the terminal's access request and matches a cryptographic authentication algorithm of corresponding strength to the terminal based on the performance information in the access request for two-way authentication. This achieves the scheduling of adaptive cryptographic authentication algorithms based on terminals with different performance levels, solving the technical problem of lacking an adaptive authentication mechanism tailored to terminal security needs. Therefore, this authentication method can adapt to heterogeneous terminal encryption authentication, supporting the needs of multi-type terminal access authentication in scenarios with massive high-concurrency access, high interactivity, and high real-time performance, and solving the problem of unified management and control of heterogeneous power terminals.

[0040] In one embodiment, before matching a password authentication algorithm of corresponding strength based on the performance information, the method includes: extracting a terminal identifier from the access request; and performing a valid verification of the terminal based on the terminal identifier and performance information. To perform valid verification of the terminal, the terminal identifier and the terminal's performance information are pre-stored in a database on the edge server. For example, during the terminal registration phase, the identifier and performance information of the registered terminal are stored in the database. The terminal identifier is the identifiable identifier of the terminal sent with the access request. The identifier and the terminal's performance information are extracted. First, it is determined whether the identifier is stored in the database; if it is, the terminal is valid. Then, the performance information is compared with the pre-stored performance information; if they match, the verification is successful; if the verification fails, the access request is rejected.

[0041] In one embodiment, matching a corresponding strength of cryptographic authentication algorithm based on the performance information includes: obtaining the computing power in the performance information; determining the magnitude of the computing power and a preset threshold; when the computing power is lower than the preset threshold, determining whether to share a key with the terminal; if the key is shared, matching a first strength cryptographic authentication algorithm for the terminal; if the key is not shared, authentication fails.

[0042] Specifically, the performance information includes the terminal's computing power. When the terminal's computing power is below a preset threshold, indicating low computing power, it is determined whether the terminal and the edge server have shared a key. If so, the terminal is matched with a first-strength cryptographic authentication algorithm, i.e., a lightweight symmetric cryptographic authentication algorithm, such as LBlock, AES, and PRESENT. The LBlock algorithm uses a lightweight block cipher with a key and block length of 80 and 64 bits, respectively. The Advanced Encryption Standard (AES) in cryptography replaced the original DES (Data Encryption Standard). AES symmetric cryptography is generally divided into stream ciphers (such as OFB, CFB, etc.) and block ciphers (such as ECB, CBC, etc.). For stream ciphers, the block cipher needs to be converted to stream mode. For block ciphers (or block encryption), if data exceeding the block size needs to be encrypted, padding and chaining encryption modes are required. The PRESENT block cipher algorithm uses an SPN structure with a block length of 64 bits and supports 80-bit and 128-bit key lengths.

[0043] When the terminal's computing power is low, a shared key is used, and a lightweight symmetric cryptographic authentication algorithm is assigned to the terminal. In this case, the terminal's computing power is low, and by sharing the key, the terminal does not need to perform key calculations, avoiding the problem of being unable to perform key calculations due to low computing power. The preset threshold is set according to actual computing needs.

[0044] In one embodiment, matching a cryptographic authentication algorithm of corresponding strength based on the performance information further includes: when the computing power is higher than a preset threshold, matching a corresponding cryptographic authentication algorithm based on the storage capacity, communication capacity, and security requirements in the performance information.

[0045] Matching a corresponding cryptographic authentication algorithm to the storage capacity, communication capacity, and security requirements in the performance information includes: weighting and summing the storage capacity, communication capacity, and security requirements in the performance information to obtain a terminal capability score; comparing the capability score with the terminal's average capability score, and matching a corresponding cryptographic authentication algorithm to the terminal based on the comparison result. Specifically, the capability score of terminal c is calculated using the following formula: (c) = 1T meo (c)+2T com ()+K3T sec (); where T meo(c) T com(c) and T sec (c) represent the storage capacity, communication capacity, and security requirements of terminal c, respectively, K1+2+3=1, K i (=1,2,3) represents the weighting coefficients of each indicator, and their set values ​​can be changed according to actual needs. The average capability score of the terminal is calculated using the following formula: The average terminal capability score can be calculated by the power IoT sensing layer through pre-survey and calculation of the capability score T(j) for each terminal of the same type. Then, the capability scores of the same type are averaged to obtain the average terminal capability score, where n represents the number of terminals of the same type. By comparing the terminal capability score with the average terminal capability score, a quantitative evaluation of terminal performance can be achieved. Based on the comparison results, an appropriate cryptographic authentication algorithm is assigned to the terminal.

[0046] The method for matching a corresponding cryptographic authentication algorithm to a terminal based on the comparison result includes: when the capability score is less than the average capability score of the terminal, the terminal is divided into three levels, and a first-strength cryptographic authentication algorithm is matched to the terminal based on the shared key; when the capability score is greater than the average capability score of the terminal but less than twice the average capability score of the terminal, the terminal is divided into two levels, and a second-strength cryptographic authentication algorithm is matched to the terminal; when the capability score is greater than twice the average capability score of the terminal, the terminal is divided into one level, and a third-strength cryptographic authentication algorithm is matched to the terminal, wherein the key strength of the third-strength cryptographic authentication algorithm is greater than the key strength of the second-strength cryptographic authentication algorithm, and the key strength of the second-strength cryptographic authentication algorithm is greater than the key strength of the first-strength cryptographic authentication algorithm.

[0047] Specifically, terminals are divided into three levels based on a comparison of terminal ability scores and average ability scores; when the terminal ability score T(c) satisfies When the terminal's performance is poor, it indicates that although its computing power meets the preset threshold, other performance aspects are insufficient for key computation. Therefore, it is determined whether to share a key with the terminal. If a key is shared, a lightweight symmetric cryptographic authentication algorithm is assigned to the terminal. When the terminal's capability score T(c) satisfies... If the terminal's performance is above average but not exceptionally high, then a second-strength cryptographic authentication algorithm, i.e., a stronger public-key cryptographic authentication algorithm, such as the SM9 national cryptographic algorithm, is assigned to the terminal. When the terminal's capability score meets... If the terminal's performance is high enough, then a third-strength cryptographic authentication algorithm, such as the SM2 national cryptographic algorithm or RSA algorithm, should be assigned to the terminal. This not only meets the terminal's performance requirements but also increases the security of the authentication.

[0048] In one embodiment, sending the identification information corresponding to the password authentication algorithm and the server identification information to the terminal for two-way authentication includes: sending the identification information corresponding to the password authentication algorithm and the server identification information to the terminal; receiving response information sent by the terminal; and performing two-way authentication with the terminal using the password authentication algorithm based on the response information. Specifically, when the edge server matches a password authentication algorithm, it sends the identification information of the password authentication algorithm and the identification information of the edge server to the terminal. The terminal responds with the identification information of the edge server and the identification information of the password authentication algorithm, and returns it to the server, confirming that the password authentication algorithm is used for authentication. When the edge server receives the response information, it performs two-way authentication with the terminal using the password authentication algorithm. If both parties successfully authenticate, the terminal access is completed; otherwise, the access fails.

[0049] In one implementation, such as Figure 3As shown, the adaptive cryptographic authentication method is implemented through the following process: A power terminal C (including power mobile terminals, power smart terminals, and power fixed terminals, etc.) sends an access request to a server S. This access request includes the terminal type, identifiable identifier, and the terminal's current storage capacity, computing power, communication capacity, and security requirements. The server S extracts key information such as storage capacity, computing power, communication capacity, and security requirements from the access request. Based on this key information, it performs adaptive algorithm scheduling, matching a cryptographic authentication algorithm with appropriate intensity, such as cryptographic authentication algorithm A. The server S sends the identifier information of algorithm A and the server identifier information to the power terminal C. The power terminal C responds with the server's identifier information and the identifier information of cryptographic authentication algorithm A, and returns it to the server, confirming the use of cryptographic authentication algorithm A for authentication. After receiving the response from the power terminal C, the server S performs two-way authentication with the power terminal C using cryptographic authentication algorithm A. If authentication is successful, the access of the power terminal C is completed.

[0050] In one implementation, such as Figure 4 As shown, this adaptive password authentication method is implemented using the following process:

[0051] (1) The terminal sends an access request or authentication request to the server, selecting the terminal type and identifiable identifier ID when sending the request. c and the terminal's current storage capacity T meo Computational power T cal , communication capability T com and security requirements T sec The information is sent to the server together;

[0052] (2) Server initialization: Receive relevant information and extract key information. First, verify the identifiable identifier ID. c The system checks whether the information is legal and whether it matches the requirements for storage capacity, computing power, communication capacity, and security. If all information is legal and matches, the verification is successful, and the system enters the scheduling state.

[0053] (3) Determine the current computing power T of power terminal C. cal Is it greater than the preset threshold T? val If it is lower than the preset threshold T val If the key is shared, then determine whether the key is shared and execute (4); if the value is higher than the preset threshold T ... execute (4). val If so, then execute (5);

[0054] (4) If a shared key has been allocated, then directly schedule a lightweight symmetric cryptographic authentication algorithm for it; otherwise, the verification fails.

[0055] (5) Based on the current storage capacity T of power terminal C meo , communication capability T com and security requirements Tsec As evaluation indicators, the capability score T(c) of the power terminal C and the average capability score of the surveyed terminals in the power Internet of Things sensing layer are calculated. The formula for calculating the terminal C ability score is:

[0056] T(c) = K1T meo (c)+K2T com (c)+K3T sec (c)

[0057] Where K1+K2+K3=1, K i (i = 1, 2, 3) represents the weight coefficient of each indicator, and its set value can be changed according to the actual needs of the power IoT system.

[0058] The average capability score of power IoT terminals can be used as a reference to judge the overall condition of power IoT terminals. The calculation formula is as follows:

[0059]

[0060] (6) Classify the level according to the capability score and schedule the corresponding cryptographic authentication algorithm; specify the level algorithm according to the capability score of the terminal device; Level I terminal is defined as the highest capability level, and when the terminal device is at this level, a strong public key cryptographic authentication algorithm can be assigned; Level II terminal is defined as a relatively high capability level, and a relatively strong public key cryptographic authentication algorithm can be assigned to it; Level III terminal is defined as a relatively low capability level, and it is scheduled to (4).

[0061] Take in the hierarchical strategy The specific tiered strategy is as follows:

[0062]

[0063] (7) After the server schedules and the terminal adapts the password authentication algorithm A, it sends the authentication algorithm A identification information and the server identification information to the power terminal.

[0064] (8) The terminal responds to the server with the identification information and authentication algorithm A identification information, and returns it to the server to confirm that the password authentication algorithm A is used for authentication;

[0065] (9) The server and the terminal use password authentication algorithm A to achieve two-way authentication. If both parties successfully authenticate, the access is completed. Otherwise, the access failure is returned.

[0066] This invention also provides an adaptive cryptographic authentication device, such as... Figure 5 As shown, the device includes:

[0067] The request receiving module is used to receive access requests from the terminal, the access requests including the terminal's performance information; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0068] The matching module is used to extract performance information from the access request and match a password authentication algorithm of corresponding strength based on the performance information; for details, please refer to the corresponding part of the above method embodiment, which will not be repeated here.

[0069] The authentication module is used to send the identification information corresponding to the password authentication algorithm and the server identification information to the terminal for two-way authentication. For details, please refer to the corresponding section of the above method embodiment, which will not be repeated here.

[0070] For a detailed description of the functions of the adaptive cryptographic authentication device provided in the embodiments of the present invention, please refer to the description of the adaptive cryptographic authentication method in the above embodiments.

[0071] Optionally, the matching module includes: a computing power acquisition module, used to acquire the computing power in the performance information; a computing power judgment module, used to judge the size of the computing power and a preset threshold; and a key judgment module, used to judge whether to share a key with the terminal when the computing power is lower than the preset threshold. If the key is shared, the first strength password authentication algorithm is matched for the terminal; if the key is not shared, the authentication fails.

[0072] Optionally, the matching module further includes a matching submodule, used to match a corresponding cryptographic authentication algorithm based on the storage capacity, communication capacity, and security requirements in the performance information when the computing power is higher than a preset threshold.

[0073] Optionally, the matching submodule includes: a capability score calculation module, used to perform a weighted summation based on the storage capacity, communication capacity, and security requirements in the performance information to obtain the terminal's capability score; and a comparison module, used to compare the capability score with the terminal's average capability score, and match the terminal with a corresponding cryptographic authentication algorithm based on the comparison result.

[0074] Optionally, the comparison module is specifically configured to: when the capability score is less than the average capability score of the terminal, classify the terminal into three levels and match a first-strength cryptographic authentication algorithm for the terminal based on the shared key; when the capability score is greater than the average capability score of the terminal but less than twice the average capability score of the terminal, classify the terminal into two levels and match a second-strength cryptographic authentication algorithm for the terminal; when the capability score is greater than twice the average capability score of the terminal, classify the terminal into one level and match a third-strength cryptographic authentication algorithm for the terminal, wherein the key strength of the third-strength cryptographic authentication algorithm is greater than the key strength of the second-strength cryptographic authentication algorithm, and the key strength of the second-strength cryptographic authentication algorithm is greater than the key strength of the first-strength cryptographic authentication algorithm.

[0075] Optionally, the adaptive cryptographic authentication device further includes: a legitimacy verification module, specifically used to extract the terminal identifier from the access request; and to perform legitimacy verification on the terminal based on the terminal identifier and performance information.

[0076] This invention also provides a storage medium, such as... Figure 6 As shown, a computer program 601 is stored on it. When executed by a processor, this program implements the steps of the adaptive cryptographic authentication method described in the above embodiments. The storage medium also stores audio and video stream data, feature frame data, interactive request signaling, encrypted data, and a preset data size. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0077] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0078] This invention also provides an electronic device, such as... Figure 7 As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 7 Taking the example of a connection between China and Israel via a bus.

[0079] Processor 51 can be a central processing unit (CPU). Processor 51 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0080] The memory 52, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the corresponding program instructions / modules in the embodiments of the present invention. The processor 51 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 52, thereby implementing the adaptive cryptographic authentication method in the above method embodiments.

[0081] The memory 52 may include a program storage area and a data storage area. The program storage area may store applications required for operating the device and at least one function; the data storage area may store data created by the processor 51, etc. Furthermore, the memory 52 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 52 may optionally include memory remotely located relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0082] The one or more modules are stored in the memory 52, and when executed by the processor 51, they perform the following: Figure 1 The adaptive cryptographic authentication method in the embodiment shown in Figure 2.

[0083] For specific details regarding the aforementioned electronic devices, please refer to the relevant documentation. Figures 1 to 2 The relevant descriptions and effects in the illustrated embodiments are for understanding purposes only and will not be repeated here.

[0084] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and all such modifications and variations fall within the scope defined by the appended claims.

Claims

1. An adaptive cryptographic authentication method, characterized in that, include: Receive an access request from a terminal, the access request including the terminal's performance information; Extract performance information from the access request, and match a password authentication algorithm of corresponding strength based on the performance information; The identification information corresponding to the password authentication algorithm and the server identification information are sent to the terminal for two-way authentication. Matching a password authentication algorithm of corresponding strength based on the performance information includes: Obtain the computing power from the performance information; Determine the magnitude of the computing power and the preset threshold; When the computing power is higher than a preset threshold, the terminal's capability score is obtained by weighted summation based on the storage capacity, communication capacity, and security requirements in the performance information. When the capability score is less than the average capability score of the terminal, the terminal is divided into three levels, and a first-strength cryptographic authentication algorithm is matched for the terminal according to the shared key; When the capability score is greater than the terminal's average capability score by less than twice the terminal's average capability score, the terminal is divided into two levels, and a second-strength password authentication algorithm is matched for the terminal. When the capability score is greater than twice the average capability score of the terminal, the terminal is classified into Level 1, and a third-strength cryptographic authentication algorithm is matched for the terminal. The key strength of the third-strength cryptographic authentication algorithm is greater than the key strength of the second-strength cryptographic authentication algorithm, and the key strength of the second-strength cryptographic authentication algorithm is greater than the key strength of the first-strength cryptographic authentication algorithm.

2. The adaptive cryptographic authentication method according to claim 1, characterized in that, Matching a password authentication algorithm of corresponding strength based on the performance information includes: When the computing power is lower than a preset threshold, determine whether to share the key with the terminal; If a shared key is used, a first-strength cryptographic authentication algorithm is matched for the terminal. Authentication fails if the key is not shared.

3. The adaptive cryptographic authentication method according to claim 1, characterized in that, Before matching a password authentication algorithm of corresponding strength based on the performance information, the following steps are included: Extract the terminal identifier from the access request; The terminal is verified for legitimacy based on its identifier and performance information.

4. The adaptive cryptographic authentication method according to claim 1, characterized in that, Sending the identification information corresponding to the password authentication algorithm and the server identification information to the terminal for two-way authentication includes: Send the identification information corresponding to the password authentication algorithm and the server identification information to the terminal; Receive response information sent by the terminal; Based on the response information, the terminal performs two-way authentication using the password authentication algorithm.

5. An adaptive cryptographic authentication device, characterized in that, include: A request receiving module is used to receive access requests from terminals, wherein the access requests include the performance information of the terminals; The matching module is used to extract performance information from the access request and match a password authentication algorithm of corresponding strength based on the performance information. The authentication module is used to send the identification information corresponding to the password authentication algorithm and the server identification information to the terminal for two-way authentication; Matching a password authentication algorithm of corresponding strength based on the performance information includes: Obtain the computing power from the performance information; Determine the magnitude of the computing power and the preset threshold; When the computing power is higher than a preset threshold, the terminal's capability score is obtained by weighted summation based on the storage capacity, communication capacity, and security requirements in the performance information. When the capability score is less than the average capability score of the terminal, the terminal is divided into three levels, and a first-strength cryptographic authentication algorithm is matched for the terminal according to the shared key; When the capability score is greater than the terminal's average capability score by less than twice the terminal's average capability score, the terminal is divided into two levels, and a second-strength password authentication algorithm is matched for the terminal. When the capability score is greater than twice the average capability score of the terminal, the terminal is classified into Level 1, and a third-strength cryptographic authentication algorithm is matched for the terminal. The key strength of the third-strength cryptographic authentication algorithm is greater than the key strength of the second-strength cryptographic authentication algorithm, and the key strength of the second-strength cryptographic authentication algorithm is greater than the key strength of the first-strength cryptographic authentication algorithm.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to perform the adaptive cryptographic authentication method as described in any one of claims 1-4.

7. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory storing computer instructions, and the processor executing the computer instructions to perform the adaptive cryptographic authentication method as described in any one of claims 1-4.

Images