A unified identity authentication method based on dual factors

Abstract

The present invention discloses a unified identity authentication method based on two factors: 1) User registration: The user to be registered sets a password and provides biometric information. The hash value of the password and biometric information is calculated, and the corresponding public-private key pair is generated using the hash value. The user uses the private key to calculate the registration signature, and sends the relevant information and signature to the administrator for verification. After verification, the user's public key is uploaded to the blockchain through a smart contract, and an ID corresponding to the user's public key is generated. 2) Permission authorization: When a registered user requests permission to be authorized for a certain system, he or she must provide identity information and signature for verification by the administrator. After the administrator verifies the validity, the user's system permission is added to the system authorization list on the blockchain. 3) User login: When a user logs into a certain system, he or she provides identity information and signature for verification by the system server. The system server uses a smart contract to verify that the user is legitimate and allows the user to log in to the system. The present invention has the characteristics of high security and strong compatibility.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security and relates to a unified identity authentication method based on dual factors. Background Art

[0002] Identity authentication technology, which verifies a user's true identity, is a crucial component of information security systems and plays a crucial role in areas such as computer networks, e-commerce, and financial transactions. In traditional businesses, user identities are typically verified using identification documents (such as ID cards, household registration books, and passports), with paper or electronic images of these documents stored as business authorization credentials.

[0003] Since the advent of the digital age, account plus password and digital certificate plus private key have become the two mainstream digital identity security authentication technologies. However, while existing identity authentication technologies are convenient to use, they still need further improvement, enrichment, and perfection in terms of security and management, mainly in the following two aspects:

[0004] (1) Single-factor authentication is a single method. Once the password is lost, the user account will be leaked.

[0005] (2) Identity authentication in the PKI system involves cumbersome certificate management, which increases operating costs. Summary of the Invention

[0006] In response to the technical problems existing in the prior art, the purpose of the present invention is to provide a unified identity authentication method based on two factors. By leveraging the public verifiability, tamper-proofness, and reliable auditability of blockchain technology, a unified two-factor authentication system with trusted registration, autonomous authorization, and reliable auditing is provided to facilitate access, use, and management of various application systems. This patent uses two factors, passwords, keys, or biometrics, for identity authentication. Even if the user's password is lost or leaked, the account security can still be guaranteed, meeting the system's requirements for secure and reliable unified identity authentication.

[0007] For the purpose of the present invention, the present invention proposes a unified two-factor authentication method, which specifically includes the following three steps:

[0008] Step 1. Registration phase (Register): The registration server registers the user according to the password pwd set by the user and the collected user biometric information P i , calculate the user's private key Public key pk = g sk ; and get the current registration timestamp ts r , calculate the registration signature σ r =sign sk (M r ,ts r), the above processing is completed on the registration server. After the processing is completed, the registration server will apply for registration information M r , registration timestamp ts r , public key pk, registration signature σ r Sent to the verification server. The verification server automatically verifies the registration timestamp ts r If it is valid, run the verification algorithm verf pk (M r ,ts r ,σ r ) is calculated to see if it is 1. If it is 1, the Submit function of the smart contract is used to upload the pk to the blockchain, and the corresponding user id is generated and returned to the user, indicating that the registration is complete.

[0009] Step 2. Authorization: When the user requests permission to access a target application in the authorized system server, he needs to enter the password pwd and biometric information P i , and generate request permission information M a , M a The authorized application and permission information requested by the user. Then, get the authorization timestamp ts of the current time a And calculate the private key Then calculate the request permission signature σ based on the private key sk a =sign sk (M a ,ts a ,id). The above processing is completed on the user side. After the processing is completed, the user will request permission information M a , authorization timestamp ts a And the request permission signature σ a Sent to the system server. The subsequent processing is completed on the system server. The system server automatically verifies the authorization timestamp ts a If valid, the Check(id) algorithm in the smart contract is run to verify whether the user id exists. If it exists, the user's public key pk is used to verify σ a If valid, the corresponding pk information is added to the system authorization list List of the blockchain, indicating that the user is authorized to request the target application permission in the system server.

[0010] Step 3. Login: When a user logs into a target application in the system, he needs to enter the password pwd and biometric information P i , and generate request login information M l , M l The application information requested by the user to log in. Then, get the current login timestamp tsl And calculate the private key Then calculate the login signature σ based on the private key sk l =sign sk (M l ,ts l ,id). The above processing is completed on the user side. After the processing is completed, the user will request login information M l , login timestamp ts l And request login signature σ l Sent to the system server. The system server calls the Check(id,System) algorithm in the smart contract for verification, where System is the identifier of the target application in this system server. If the result is 1, it means that the user has been authorized by this system, and the system further calls verf pk (M l ,ts l ,σ l ) algorithm, if the result is 1, the user is allowed to log in to the target application in the system, otherwise the login is denied.

[0011] The advantages of the present invention are as follows:

[0012] Most existing identity authentication systems rely on a single password authentication method, using the less secure MD5 hash algorithm. This authentication method is relatively insecure. While some two-factor authentication systems exist, these require the server to store the user's password, key, and biometric information. If the server is compromised, this private information could be compromised, making it difficult to meet security, reliability, and efficiency requirements.

[0013] This invention designs a unified identity authentication protocol based on two factors: a password, a key, or biometrics. This unified authentication method ensures account security even if a user's password is lost or leaked. Furthermore, this method eliminates the need to store user passwords, keys, and biometric information on the server side. Only public information is stored on the blockchain, effectively reducing the risk of user information being leaked due to server compromise. Furthermore, this invention can be combined with existing digital signature algorithms such as ECDSA, Schnorr, and SM2, offering strong system compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is an implementation flow chart of the present invention. DETAILED DESCRIPTION

[0015] The present invention will be described in further detail below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0016] An implementation process of the present invention is as follows Figure 1 As shown, it includes the user end, verification end, registration server, system server, and blockchain. The specific user registration, permission authorization, and user login process are as follows:

[0017] 1) User Registration: The user to be registered sets a password and provides biometric information. The hash value of the password and biometric information is calculated, and the corresponding public-private key pair is generated from the hash value. The user uses the private key to calculate the registration signature containing the timestamp and registration information. The registration information, registration timestamp, public key, and registration signature are sent to the verification server for verification. After the verification server verifies that the user is valid, it calls the identity information registration function in the smart contract, uploads the user's public key to the blockchain, and generates an ID corresponding to the user's public key, indicating that the user has successfully registered.

[0018] 2) Permission Authorization: When a registered user requests permission for a target application on an authorized system server, they must enter their password and biometric information. The hash value of the password and biometric information is calculated, and the corresponding public-private key pair is generated using the hash value. The user uses their private key to calculate a request authorization signature containing a timestamp, user ID, and requested authorization information. The request authorization information, authorization timestamp, public key, user ID, and request authorization signature are then sent to the system server for verification. The system server invokes the verification algorithm in the smart contract to verify that the user ID is registered and the signature is valid. It then adds the corresponding public key information to the blockchain's system authorization list, indicating that the user is authorized to access the requested target application on the system server.

[0019] 3) User Login: When a user logs into a target application on a system server, they enter their password and biometric information. A hash value is calculated for the password and biometric information, and the corresponding public-private key pair is generated using the hash value. The user uses their private key to calculate a login signature containing the login timestamp, user ID, and login information. The user then sends the login information, timestamp, public key, user ID, and login signature to the system server for verification. The server then invokes the verification algorithm in the smart contract for verification. If the user ID is verified to be authorized and the signature is valid, the user is allowed to log into the target application in the system; otherwise, the user is denied login.

[0020] Example 1

[0021] 1. Symbols and Definitions

[0022] g: Generator of the multiplicative group.

[0023] Hash function.

[0024] ts: timestamp.

[0025] pk: user's public key.

[0026] sk: user's private key.

[0027] pwd: Password set by the user.

[0028] P i : User's biometric information.

[0029] M: User request message.

[0030] σ: The signer's signature on the message.

[0031] sign sk (·): Signature algorithm, the signer calls this algorithm to complete the signing of the message.

[0032] verf pk (·): Signature verification algorithm, which the verifier calls to complete the verification of the signature.

[0033] Submit: The smart contract submission algorithm used to upload pk to the blockchain.

[0034] Check(·): The smart contract verification algorithm used to verify the validity of user permissions.

[0035] 2. The two-factor unified identity authentication solution mainly includes three parts: registration phase (Register), authorization phase (Authorization), and login phase (Login). The details are as follows:

[0036] Step 1. Registration phase (Register): The registration server registers the user according to the password pwd set by the user and the collected user biometric information P i , calculate the user's private key Public key pk = g sk ; and get the current registration timestamp ts r , calculate the registration signature σ r =sign sk (M r ,ts r ), the above processing is completed on the registration server. After the processing is completed, the registration server will apply for registration information M r , registration timestamp ts r , public key pk, registration signature σ r Sent to the verification server. The verification server automatically verifies the registration timestamp ts r If it is valid, run the verification algorithm verf pk (M r ,ts r ,σ r) is calculated to see if it is 1. If it is 1, the Submit function of the smart contract is used to upload the pk to the blockchain, and the corresponding user id is generated and returned to the user, indicating that the registration is complete.

[0037] Step 2. Authorization: When the user requests permission to access a target application in the authorized system server, he needs to enter the password pwd and biometric information P i , and generate request permission information M a , M a The authorized application and permission information requested by the user. Then, obtain the authorization timestamp ts of the current time a And calculate the private key Then calculate the request permission signature σ based on the private key sk a =sign sk (M a ,ts a ,id). The above processing is completed on the user side. After the processing is completed, the user will request permission information M a , authorization timestamp ts a And the request permission signature σ a Sent to the system server. The subsequent processing is completed on the system server. The system server automatically verifies the authorization timestamp ts a If it is valid, the Check(id) algorithm in the smart contract is run to verify whether the user id exists. If it exists, the user's public key pk is used to verify σ a If valid, the corresponding pk information is added to the system authorization list List of the blockchain, indicating that the user is authorized to request the target application permission in the system server.

[0038] Step 3. Login: When a user logs into a target application in the system, he needs to enter the password pwd and biometric information P i , and generate request login information M l , M l The application information requested by the user to log in. Then, get the current login timestamp ts l And calculate the private key Then calculate the login signature σ based on the private key sk l =sign sk (M l ,ts l ,id). The above processing is completed on the user side. After the processing is completed, the user will request login information M l , login timestamp ts l And request login signature σ lSent to the system server. The system server calls the Check(id,System) algorithm in the smart contract for verification, where System is the identifier of the target application in this system server. If the result is 1, it means that the user has been authorized by this system, and the system further calls verf pk (M l ,ts l ,σ l ) algorithm, if the result is 1, the user is allowed to log in to the target application in the system, otherwise the login is denied.

[0039] While specific embodiments of the present invention have been disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosure of the preferred embodiments, and the scope of protection claimed in the present invention shall be determined by the scope of the claims.

Claims

1. A unified identity authentication method based on two factors, comprising the following steps: Registration phase: The registration server collects the user's biometric information P i And the password pwd set by the user, calculate the user's private key sk and public key pk; And use the current registration timestamp ts r Calculate the registration signature σ r ; Then the registration server will apply for registration information M r , registration timestamp ts r , public key pk and registration signature σ r Send it to the verification end for verification. After the verification is passed, the verification end uploads the user's public key pk to the blockchain and generates a corresponding user id and returns it to the user; Authorization phase: When the user requests permission for a target application in the system server, the user terminal will authorize the user according to the target application and permission requested by the user, the password pwd entered, and the biometric information P i Generate request permission information M a , get the current authorization timestamp ts a And calculate the private key sk, and then according to the private key sk, request permission information M a and authorization timestamp ts a Calculate the request permission signature σ a ; Then the user terminal will request permission information M a , authorization timestamp ts a And the request permission signature σ a Send it to the system server for verification. If the verification passes, the corresponding public key pk is added to the system authorization list List of the blockchain; Login stage: When the user logs in to the system server, the user terminal enters the password pwd and biometric information P i And generate login request information M l , get the current login timestamp ts l And calculate the private key sk, and then calculate the request login signature σ based on the private key sk l Then the user terminal will log in the request information M l , login timestamp ts l And request login signature σ l The system server sends the data to the user for verification. If the verification is successful, the user is allowed to log in to the system server and access the requested target application within the corresponding permission range. Otherwise, the user is denied access to the system server.

2. The method according to claim 1, characterized in that The system server first verifies the timestamp ts a If valid, verify whether the user id exists. If it exists, use the public key pk to verify σ a If it is valid, the verification is passed and the corresponding public key pk is added to the system authorization list List of the blockchain, indicating that the user is allowed to access the requested target application and permissions.

3. The method according to claim 1, characterized in that The system server calls the verification algorithm Check(id, System) in the smart contract for verification, where System is the identifier of the system server. If the result is 1, it is determined that the user has obtained the authorization of the system server; then the signature verification algorithm verf is called. pk (M l ,ts l ,σ l ) for verification, if the result is 1, the user is allowed to log in to the system server and access the requested target application within the corresponding permission range.

4. The method according to claim 1, 2 or 3, characterized in that: Private Key Public key pk = g sk , registration signature σ r =sign sk (M r ,ts r ), permission signature σ a =sign sk (M a ,ts a , id), request login signature σ l =sign sk (M l ,ts l , id); among them, is the hash function, g is the generator of the multiplicative group, sign sk (·) is the signature algorithm.

5. The method according to claim 1, 2 or 3, characterized in that: The verification end uses a smart contract to upload the user's public key pk to the blockchain.

6. A unified identity authentication system based on dual factors, characterized in that: Including registration server, system server, verification terminal and user terminal; The registration server is used to collect the user's biometric information P i The user's private key sk and public key pk are calculated using the password pwd set by the user; And use the current registration timestamp ts r Calculate the registration signature σ r ; Then apply for registration information M r , registration timestamp ts r , public key pk and registration signature σ r Send to the verification end for verification; The verification terminal is used to verify the received information. After the verification is passed, the user's public key pk is uploaded to the blockchain and a corresponding user id is generated and returned to the user; The user terminal is used in the authorization stage to process the target application and permissions requested by the user, the input password pwd and the biometric information P i Generate request permission information M a , get the authorization timestamp ts a And calculate the private key sk, and then according to the private key sk, request permission information M a and authorization timestamp ts a Calculate the request permission signature σ a ; Then request permission information M a , authorization timestamp ts a And the request permission signature σ a Send it to the system server for verification; if the verification is successful, the system server adds the corresponding public key pk to the system authorization list List of the blockchain; And in the login phase, it is used to input the password pwd and biometric information P according to the user i And generate login request information M l , get the login timestamp ts l And calculate the private key sk, and then calculate the request login signature σ based on the private key sk l Then the user terminal will log in the request information M l , login timestamp ts l And request login signature σ l The system server sends the data to the user for verification. If the verification is successful, the user is allowed to log in to the system server and access the requested target application within the corresponding permission range. Otherwise, the user is denied access to the system server.

Images