A multi-level security authentication method and system based on digital examination

Abstract

The present invention discloses a multi-level security authentication method based on digital examination, including: the invigilator receives the personal information registration of the examination terminal, verifies it, and sends the verification information to the main invigilator system; obtains whether the network status of the main invigilator system and the invigilator is abnormal, when the network status is abnormal, the invigilator generates the identity authentication code of each examination terminal according to the submission security authentication rule set by the system; judges whether the backup network connection of the invigilator is available, if so, the invigilator sends the examination submission security authentication rule to the examination terminal through the backup network; the invigilator obtains the corresponding verification code input by the examination terminal according to the submission security authentication rule, judges whether the input verification code is the same as the generated identity authentication code, if so, the invigilator receives the examination submission data of the examination terminal after the authentication is successful, and generates a local encrypted file. The present invention ensures that the submission process of the examination data can be safe and reliable through the above steps, and can confirm the standard validity of the submitted answer data.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer security, and in particular, relates to a multi-level security authentication method and system based on digital examination. Background Art

[0002] At present, a variety of digital network examination systems have been launched on the market. Aiming at different examination application groups, such as various forms of online examinations, competitions, exercises and other applications in government, schools and enterprises, the network, paperless and automated examination work has been fully realized. The system adopts C / S, B / S or cloud service architecture for INTERNET and LAN online examinations, which can bear the needs of large-scale digital network examinations. Through the comprehensive examination service business middle-end management and big data background management functions, users can set the examination function according to their own needs, which can meet the needs of various digital examination organization and release and examination data submission management of enterprises, government agencies and education and training units.

[0003] The disadvantage of the existing technology is that the server of online examinations is usually deployed centrally, and the network service of the server cannot support the method of step-by-step transmission of examination results under the condition of network interruption. After the network is restored, the candidates need to log in to the system again, resulting in the inability to continue the online examination and the loss of test content data that the candidates have completed. At the same time, during the verification process, emergency processing cannot be carried out through the backup plan of the verification coding rules, and the emergency processing of data submission cannot be completed in a timely manner under the conditions of a distributed hybrid network environment.

[0004] In view of this, the present invention is proposed. Summary of the invention

[0005] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a multi-level security authentication method based on digital examinations. By checking personal information, generating an identity authentication code and inputting a verification code, the identity of the examination end is ensured to be authentic and reliable, cheating in the examination is effectively prevented, and the security of the examination is improved. When the invigilator detects that the network status is abnormal, the examination is ensured to be carried out by generating an identity authentication code, so as to avoid examination interruption or data loss due to network problems and reduce the impact of network abnormalities. A backup network is set up, and the invigilator determines whether the backup network connection is available, and sends relevant information to the examination end according to the submission security authentication rules set by the system, so as to ensure the stability and availability of the backup network and increase the reliability of the backup network. The invigilator receives the examination submission data of the examination end after the authentication is successful, and generates a local encrypted file to protect the confidentiality of the examination data and prevent unauthorized access and leakage. The problem that the data submission verification means in the prior art are relatively single in form, emergency processing cannot be performed through the backup scheme of the verification coding rules during the verification process, and the emergency processing of data submission and the alternative replacement of the verification scheme cannot be completed in time under the conditions of a distributed hybrid network environment.

[0006] In order to solve the above technical problems, the basic concept of the technical solution adopted by the present invention is: the present invention provides a multi-level security authentication method based on digital examination, comprising the following steps:

[0007] The invigilator receives and verifies the personal information registered by the examinee, and sends the verification information to the main invigilator system;

[0008] Obtain whether the network status between the main invigilation system and the invigilation terminal is abnormal. If the network status is abnormal, the invigilation terminal generates an identity verification code for each examination terminal according to the submission security authentication rules set by the system;

[0009] Determine whether the backup network connection of the invigilator is available. If so, the invigilator sends the test submission security authentication rules to the tester through the backup network.

[0010] The invigilator obtains the corresponding verification code input by the test end according to the submission security authentication rules, and determines whether the input verification code is the same as the generated identity authentication code. If so, the invigilator receives the test submission data from the test end after successful authentication and generates a local encrypted file.

[0011] Further, it is determined whether the backup network connection of the invigilation end is available. If not, the examination end is directly connected to the main invigilation system server.

[0012] Furthermore, the test terminal is directly connected to the main invigilation system server, including the following steps:

[0013] The test end obtains the set direct connection security verification rules and generates a direct connection verification code corresponding to the test end;

[0014] Obtain the verification code entered by the test end and compare it with the generated verification code for authentication. After successful authentication, the test end can send a test submission request to the main proctoring system server. The main proctoring system server allocates storage space according to the request and accepts the test submission data to generate an encrypted file.

[0015] Furthermore, when the network is abnormal, the method further includes: the invigilator performs login verification by means of reduced-bit verification, and exercises the submission and saving authority of the main invigilator system;

[0016] Specifically, the invigilator obtains the login code of the main invigilator system, masks part of the login code of the main invigilator system, and generates the first part of the verification code of the invigilator from the unmasked part;

[0017] Get the verification code input by the invigilator, and determine whether the verification code is the same as the verification code of the unmasked part. If so, the identity authentication is correct and the submission and saving permissions of the main invigilator system can be exercised. If not, the identity authentication is wrong.

[0018] Furthermore, the invigilator generates an identity verification code for each test terminal according to the submission security authentication rules set by the system, including the following steps:

[0019] The invigilator obtains the stored login code of the main invigilator system, masks the login code of the main invigilator system, and generates the first part of the identity verification code of the tester;

[0020] Obtain at least one piece of information including the IP address and number of the invigilator, and perform mask processing to generate the second part of the authentication code of the test end;

[0021] Obtain at least one of the test paper code, test terminal number, and IP address of each test terminal to generate the third part of the test terminal identity verification;

[0022] The identity verification code of each test terminal includes a first part, a second part and a third part which are arranged in sequence.

[0023] Furthermore, the test end enters the corresponding verification code according to the submission security authentication rules:

[0024] According to the set submission security authentication rules, the third part of the identity authentication code of each examination terminal is generated, including at least one of the test paper code, the examination terminal number, and the IP.

[0025] Furthermore, the test end obtains the set direct connection security verification rules and generates a direct connection verification code corresponding to the test end, including the following steps:

[0026] According to the set direct connection security verification rules, the tester obtains the stored direct connection security verification code, which includes: the first part: the server code of the main invigilation system, the second part: at least one of the IP and number of the test terminal, and the third part: the test paper code;

[0027] The set direct connection security verification rule is that any one of the first part, the second part and the third part of the direct connection security verification code replaces the other two parts to generate a direct connection verification code corresponding to the test.

[0028] Furthermore, the generated verification code uses the third part of the test paper code to replace the verification codes of the first and second parts.

[0029] Furthermore, the submission security authentication rules and direct connection security verification rules include: being announced on the invigilation end or the examination end in the form of a pop-up window, voice broadcast or distribution.

[0030] The present invention also discloses a multi-level security authentication system based on digital examination, which adopts any of the multi-level security authentication methods based on digital examination described above.

[0031] After adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art:

[0032] (1) The present invention ensures that the identity of the test-taker is authentic and reliable through the steps of verifying personal information, generating identity verification codes, and inputting verification codes, thereby effectively preventing cheating in the test and improving the security of the test. When the invigilator detects that the network status is abnormal, it generates an identity verification code to ensure the conduct of the test, thereby avoiding test interruption or data loss due to network problems and reducing the impact of network abnormalities. A backup network is set up, and the invigilator determines whether the backup network connection is available, and sends relevant information to the test-taker according to the submission security authentication rules set by the system, thereby ensuring the stability and availability of the backup network and increasing the reliability of the backup network. The invigilator receives the test submission data of the test-taker after successful authentication, and generates a local encrypted file to protect the confidentiality of the test data and prevent unauthorized access and leakage.

[0033] (2) This application ensures the authenticity and reliability of the identity of the examination end through direct connection security verification rules and verification code authentication, effectively prevents the occurrence of cheating in the examination, and improves the security of the examination; the examination end generates a direct connection verification code and performs authentication, reducing the impact of network delays and anomalies, and ensuring the real-time and accuracy of authentication; the verification process is directly integrated into the examination end, avoiding dependence on external authentication services, improving the convenience of operation; and simplifying the authentication process.

[0034] (3) This application protects the security of sensitive information and improves the security of identity authentication by masking the login code and related information of the main invigilation system. It combines multiple parts to form the identity authentication code at the examination end, making identity authentication more complicated and increasing the difficulty of cracking. It masks sensitive information to reduce the risk of information leakage and improve the protection of examination data and personal privacy.

[0035] The specific implementation modes of the present invention are further described in detail below in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings are part of the present invention and are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but do not constitute an improper limitation of the present invention. Obviously, the drawings described below are only some embodiments. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the accompanying drawings:

[0037] Figure 1 It is a flow chart of a multi-level security authentication method based on digital examination of the present invention;

[0038] Figure 2 It is a flow chart of generating identity authentication codes of each examination terminal in a multi-level security authentication method based on digital examination of the present invention;

[0039] Figure 3 It is a flow chart of the invigilator exercising the submission and saving authority of the main invigilator system in a multi-level security authentication method based on digital examination of the present invention;

[0040] Figure 4 It is a flow chart of a method for multi-level security authentication based on digital examination in the present invention, in which the examination terminal is directly connected to the main invigilation system server when the backup network is unavailable;

[0041] Figure 5 is a flow chart of another multi-level security authentication method based on digital examination of the present invention;

[0042] Figure 6 It is a multi-level security authentication method diagram of the present invention;

[0043] Figure 7 This is another multi-level security authentication method diagram of the present invention.

[0044] It should be noted that these drawings and textual descriptions are not intended to limit the conceptual scope of the present invention in any way, but are intended to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0045] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described below with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present invention. However, it is obvious that one or more embodiments may also be implemented without these specific details. In addition, in the following description, the description of known structures and technologies is omitted to avoid unnecessary confusion of the concepts of the present invention.

[0046] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0047] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0048] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0049] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some boxes or combinations thereof in the block diagrams and / or flow charts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions can create a device for implementing the functions / operations described in these block diagrams and / or flow charts when executed by the processor. The technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer program product on a computer-readable storage medium storing instructions, which can be used by an instruction execution system or used in conjunction with an instruction execution system.

[0050] like Figures 1 to 4 As shown, a multi-level security authentication method based on digital examination described in the present invention includes the following steps: S1, the invigilator receives the personal information registration of the examinee, verifies it, and sends the verification information to the main invigilator system.

[0051] S2. Obtain whether the network status between the main invigilation system and the invigilation terminal is abnormal. When the network status is abnormal, the invigilation terminal generates an identity verification code for each examination terminal according to the submission security authentication rules set by the system.

[0052] S3. Determine whether the backup network connection of the invigilator is available. If so, the invigilator sends the test submission security authentication rules to the test end through the backup network.

[0053] S4. The invigilator obtains the corresponding verification code input by the test end according to the submission security authentication rules, and determines whether the input verification code is the same as the generated identity authentication code. If so, the invigilator receives the test submission data of the test end after the authentication is successful, and generates a local encrypted file.

[0054] The present invention ensures that the identity of the test end is authentic and reliable through the steps of checking personal information, generating identity verification codes and inputting verification codes during the test, effectively preventing the occurrence of cheating in the test and improving the security of the test; when the invigilator detects that the network status is abnormal, it ensures the conduct of the test by generating an identity verification code, avoiding test interruption or data loss due to network problems and reducing the impact of network abnormalities; a backup network is set up, the invigilator determines whether the backup network connection is available, and sends relevant information to the test end according to the submission security authentication rules set by the system, ensuring the stability and availability of the backup network and increasing the reliability of the backup network; the invigilator receives the test submission data of the test end after the authentication is successful, and generates a local encrypted file to protect the confidentiality of the test data and prevent unauthorized access and leakage, thereby solving the problem that the data submission verification means in the prior art are relatively single in form, emergency processing cannot be performed through the backup scheme of the verification coding rules during the verification process, and the emergency processing of data submission and the alternative replacement of the verification scheme cannot be completed in time under the conditions of a distributed hybrid network environment.

[0055] When checking information, it includes: the system administrator completes the initialization of the digital test system data. The system administrator completes the registration of the network environment, server equipment, and test monitoring equipment. The system administrator completes the user definition and authority allocation of test management personnel;

[0056] The examination administrator completes personal information verification and registration of the examination administrator's front-end device through the main invigilation system.

[0057] Candidates complete the registration of personal information and the registration of candidate front-end devices through the examination system.

[0058] The examination management personnel completes the approval of examinees’ personal information through the examination invigilation system.

[0059] The digital exam starts at the scheduled time, and the exam service middle-office system distributes the exam questions in encrypted order at the scheduled time. Candidates log in to the exam terminal to obtain the exam questions and answer them. The answers can be submitted in a summarized or distributed manner, and the exam questions and papers have different coding information.

[0060] The above steps ensure the authentication of candidates, invigilators, and management personnel during the examination process to avoid incorrect examination information during the examination, which would cause a bad examination experience for candidates. At the same time, by numbering the examination papers and combining identity verification, it ensures that the candidates and examination papers are consistent to prevent cheating.

[0061] One implementation method is to set different response methods for different abnormal situations in the main invigilation system, the invigilation terminal and the examination terminal respectively when a network abnormality occurs during the examination, so as to fully intelligently implement the submission of examination data and confidentiality measures for examination information when an abnormality occurs in the examination. In this implementation method, different verification codes can be generated according to different examination terminals, and the verification code is unique. By combining the unique information of the computer terminal such as the IP and number of the invigilation terminal and the unique login information of the main invigilation system, the submission process of the examination data can be guaranteed to be safe and reliable, and the standardized validity of the submitted answer data can be confirmed.

[0062] Another implementation method is to authenticate identity through a semi-autonomous multi-level verification method. Because there are a large number of subjective questions in the exam that generate unstructured answer data and structured data generated by objective questions, it is necessary to support multiple iterations of data submission during the data submission process. The candidate's identity authentication review must also be completed during the submission process. If a service abnormality or network abnormality occurs during the submission process, the system empowers the examination room invigilator to confirm the compliance of the examination data submission through a semi-autonomous process of step-by-step authorization. The identity authentication rules are announced and determined by the invigilator. At the same time, after the system determines the identity authentication rules, when submitting the data, the candidate needs to enter the identity authentication rules that comply with the invigilator's announcement for submission, so as to prevent the submission of illegal data by non-registered devices during network interruptions, and solve the emergency process management of digital examination submission data in emergency environments.

[0063] Specifically, Figure 5 As shown: First, through step S100, the digital examination system is prepared; after the examination system is ready, step S200 is performed, the system administrator completes the data initialization of the digital examination system, the system administrator completes the network environment registration, the server equipment registration, the examination monitoring equipment registration, and the system administrator completes the user definition and authority allocation of the examination management personnel; the personnel definition and authority of the examination are determined, the examination efficiency is improved, and the examination process errors are avoided. Then step S300, the examination management personnel completes the personal information verification through the examination management front-end system and completes the front-end equipment registration of the examination management personnel.

[0064] After the personnel definition and personnel authority in the examination management system are completed, step S400 is then executed, the examinee completes the personal information registration and the examinee front-end device registration through the examination front-end system, and the examination management personnel completes the examinee personal information verification through the examination management front-end system; in this process, the main invigilation system and the invigilation end realize data interaction, and synchronously record and verify the personnel.

[0065] The above personnel definition rules are: the examinees who take the exam are called candidates; the personal information and self-selected terminals that the examinees need to provide are registered in the system; the roles of the examination management personnel are: examination supervisor, examination room invigilator, and system administrator.

[0066] There are four examination venue modes: Mode 1: The examination provides a unified examination venue and has multiple off-site examination venues; Mode 2: The examination provides a unified examination venue and has multiple local examination venues; Mode 3: The examination provides a unified examination venue and has only one examination venue; Mode 4: The examination does not provide a unified examination venue.

[0067] Corresponding to the three examination room modes, the personnel configuration of the examination roles must comply with the following rules: Examination room modes one and two: the examination supervisor and the examination invigilator must be performed by different personnel, and the system administrator must be a separate person and cannot hold other roles concurrently; Examination room mode three: the examination supervisor and the examination invigilator can be performed by the same person, and this person cannot also serve as the system administrator; Examination room mode four: the examination supervisor, the examination invigilator and the system administrator can be performed by the same person.

[0068] The main responsibilities of the examination management personnel in the application scenario of this patent are defined as follows: Examination Supervisor: the first person in charge of on-site monitoring of the entire examination process; the direct leader of all examination room invigilators; the direct leader of the system administrator; responsible for confirming the initiation and termination of the digital examination process; responsible for confirming the compliance and validity of the digital examination results; responsible for determining abnormal situations during the examination and authorizing the initiation of abnormal handling processes.

[0069] Examination room invigilator: the person in charge of monitoring the process in a single examination room; responsible for confirming the compliance and validity of the examination process and results in a single examination room to the examination supervisor; responsible for applying to the examination supervisor for handling abnormal situations in the examination room; responsible for initiating authorization to candidates to submit the test results required in the event of abnormal information system conditions.

[0070] System Administrator: Responsible for confirming to the examination supervisor the compliance and effectiveness of the examination technical support of the information system; responsible for determining the technical evaluation of abnormal situations in the examination room information system; responsible for applying to the examination supervisor for handling abnormal situations in the examination room information system.

[0071] After the verification is completed, step S500 is executed, the digital examination starts at the planned time, the examination service middle-end system distributes the encrypted sequential examination questions at the planned time, and the candidates log in to the examination front-end to obtain the examination questions and answer them; the answers can be submitted in a summary or in a distributed manner.

[0072] Step S600: If a network interruption occurs during the examination and the examiner is unable to connect to the Internet, the examiner shall submit an exception request to the system administrator and may confirm the exception offline; the system administrator shall collect the examination data submitted before the network interruption; the examiner supervisor shall distribute the verification code to the examiner offline after confirmation by the system administrator.

[0073] Then, step S700 is executed to determine whether the backup network link in the examination room is available.

[0074] After the backup network in the examination room is available, execute step S800, the examination room invigilator announces the verification code through the backup local network, and initiates on-site submission in the examination room on the examination management front-end device; the examinee continues to use the registration device to verify the ID card in the backup network environment according to the verification code decrement rule and then submits the examination result data file; after collecting all the examination results, the examination room invigilator generates a local encrypted examination data file.

[0075] After the backup network in the examination room is no longer available, step S900 is executed, the examination room invigilator announces the verification code reduction rule; the candidate generates a local encrypted file after verifying the ID card according to the verification code rule; the candidate chooses to submit the examination data file through direct device point-to-point method or offline entrusted submission method.

[0076] The above steps S800 and S900 can be performed using the method shown in FIG. Figure 7 Verification can be performed by any of the methods shown in, but is not limited to the above two verification methods.

[0077] Finally, after verification is normal and the examinee submits the test result, step S1000 is executed, the system confirms the receipt of the test result based on the data file, and sends a receipt confirmation message to the examinee.

[0078] like Figure 6 , taking the semi-autonomous three-level verification code mode as an example, the construction mode and use process of the semi-autonomous multi-level verification mode are briefly described as follows, the main invigilator, the invigilator and the examination end are divided into three levels; full code verification requires three sets of data, for example: the main invigilator needs to enter: AB; 1C; 2 6 three sets of data, after the network port is abnormal, the invigilator only needs to enter: **; 1C; 2 6 the last two sets of data, the first set of data is hidden; when the examination end is verifying, it only needs to enter one set of data: **; **; 2 6 for verification. Therefore, in this example, each level of verification code contains two characters, and the symbol * indicates that the hidden code of the current level is decremented. When selecting the verification of the decrement method, the above method can be used for verification.

[0079] like Figure 7Another verification method is shown: a substitution verification method. In the process of step-by-step reduction, the verification code of some segments can be used to replace other segmented verification codes; for example: the main invigilator is the highest level, the invigilator is the second level, and the examination end is the third level; when entering the verification code, the main invigilator needs to enter all three groups of passwords for verification, AB; 1C; 2 6. In the case of network abnormality, after selecting the decreasing verification, the invigilator can use 1C; 1C; 2 6. One of the groups of data in the verification information known by the invigilator can replace another group of data to generate three groups of data for verification. At the examination end, a group of data inherent to the examination end 1C; 1C; 1C can be used to replace the other two groups of data for verification.

[0080] The use of semi-autonomous multi-level verification codes to complete identity authentication can achieve the following: in the abnormal case of global network interruption, it can ensure the verification needs of data submission between independent local networks; ensure that the verification needs of data submission by direct device point-to-point can be completed in the scenario where there is no network at all; prevent illegal data submission by non-registered devices when the network is interrupted.

[0081] For example: adopting a semi-autonomous verification method, the decremental verification is carried out through a unified decoding broadcast decremental verification process, combined with manual broadcasting of decremental verification. For example, the first-level decremental verification can be carried out by the examination room supervisor of the main invigilation system manually switching to the backup network and initiating the decremental verification method in the examination management front-end system. A new decremental verification code can be issued through the backup network or manual broadcasting, and the decremental verification process can be started to facilitate candidates to submit test results in the backup network; after the candidate's verification code is verified, the candidate submits the test data file through the backup network or offline; the system can choose whether to confirm the receipt of the test data file according to the settings of the system administrator; when the submission process that should confirm the receipt is selected, the test data file is deemed to have been received when the candidate receives the receipt confirmation from the examination room invigilator.

[0082] The system platform structure design in this application is as follows: the front-end system for examination management provides desktop applications and mobile APPs; the front-end system for examinees taking the examination provides desktop applications and mobile APPs; the middle-end system for examination services provides monitoring applications and distributed deployment methods under multi-mode networks and data synchronization and sharing management support capabilities between servers; the back-end system for examination management provides management capabilities for storage and backup of examination database and question bank data.

[0083] The data file of the test answer results submitted by the examinee in this application should include: the sender of the data file, that is, the examinee's registered personal information; the time information of the examinee submitting the data file and the registered device information submitted; the recipient of the data file, that is, the personal information of the examination room invigilator; the time information of the examination room invigilator receiving the data file and the registered device information used to receive the file; the data file includes structured data, semi-structured data and unstructured data in the test questions; the data file can effectively express the content contained and can be retrieved and used at any time; the format of the data file is the same as the format when it was generated, sent or received, or the format is different but can accurately express the content originally generated, sent or received.

[0084] In step S2, it is further determined whether the backup network connection of the invigilation end is available. If not, the examination end is directly connected to the main invigilation system server.

[0085] During the examination, when a network anomaly is detected, the emergency management measures include determining whether the backup network connection of the invigilator is available. When it is unavailable, it means that the data submitted by the examinee is different from that submitted to the main invigilator system through the invigilator. The examination end needs to directly connect to the main invigilator system server to implement an offline file transfer protocol, such as FTP or TFTP. In this method, the device needs to manually transfer files to the server or manually download files from the server. In order to ensure the security of the data, identity authentication and data encryption are required. Identity authentication and data confidentiality are performed in combination with the verification rules automatically set by the system or the verification rules announced by the invigilator, so that the operating environment can continue to be executed in the examination system after offline and the test results can be saved to generate data files.

[0086] Furthermore, the test terminal is directly connected to the main invigilation system server, including the following steps:

[0087] S31. The examination end obtains and sets direct connection security verification rules, and generates a direct connection verification code corresponding to the examination end.

[0088] S32. Obtain the verification code input by the test end, and compare it with the generated verification code for authentication. After successful authentication, the test end can send a test submission request to the main invigilation system server. The main invigilation system server allocates storage space according to the request and accepts the test submission data to generate an encrypted file.

[0089] Specifically, the invigilation end sends the set direct connection security verification rules to the examination end, and the rules contain the information required to generate a verification code; the examination end uses a specific algorithm to generate a direct connection verification code corresponding to the examination end according to the direct connection security verification rules, and displays it on the examination end interface for the examinee to enter; the examinee enters the displayed direct connection verification code on the examination end, and the examination end compares the input verification code with the generated direct connection verification code for authentication. If the input verification code is consistent with the generated direct connection verification code, the authentication is successful; after the authentication is successful, the examination end can send an examination submission request to the main invigilation system server, requesting to send the examination submission data; the main invigilation system server accepts the request and allocates storage space: after receiving the examination submission request, the main invigilation system server allocates corresponding storage space according to the identity information of the examination end to store the examination submission data; after receiving the examination submission data from the examination end, the main invigilation system server generates an encrypted file to ensure the confidentiality of the examination data.

[0090] Through the above steps, through the direct connection security verification rules and verification code authentication, the identity of the test end is ensured to be authentic and reliable, the occurrence of cheating in the test is effectively prevented, and the security of the test is improved; the test end generates a direct connection verification code and performs authentication, reducing the impact of network delays and anomalies, and ensuring the real-time and accuracy of authentication; the verification process is directly integrated into the test end, avoiding dependence on external authentication services, improving the convenience of operation; simplifying the authentication process. For example: assuming that a certain test system adopts this multi-level security authentication method, the examinee sees a direct connection verification code "ABCD1234" on the test end, and the direct connection verification codes of different examinees are different, so the same verification code is entered on the test end; after the test end authentication is passed, the examinee successfully sends a test submission request to the main invigilation system server, and transmits the test submission data to the server. After receiving the data, the server generates an encrypted file; in this way, the examinee's test data is securely transmitted and stored, ensuring the legality and confidentiality of the test.

[0091] Furthermore, S21, when a network anomaly occurs, it also includes: S22, the invigilation terminal performs login verification by means of reduced-bit verification, and exercises the submission and saving authority of the main invigilation system.

[0092] Specifically, it includes: S221, the invigilator obtains the login code of the main invigilator system, masks part of the login code of the main invigilator system, and generates the first part of the verification code of the invigilator from the unmasked part.

[0093] S222. Obtain the verification code input by the invigilator, and determine whether the verification code is the same as the verification code of the unmasked part. If so, the identity authentication is determined to be correct and the submission and saving permissions of the main invigilator system can be exercised. If not, the identity authentication is determined to be incorrect.

[0094] Specifically, the invigilator obtains a login code from the main invigilator system, and the login code is used for identity authentication between the invigilator and the main invigilator system; the invigilator masks part of the login code of the main invigilator system, hides or replaces part of the sensitive information with specific symbols, and ensures that sensitive information is not leaked; the unmasked part of the login code of the main invigilator system is used as the first part of the verification code of the invigilator, and is prepared to be compared with the verification code input by the invigilator; the main invigilator receives the verification code input by the invigilator, and determines whether the verification code input by the invigilator is the same as the verification code of the unmasked part; if the verification code input by the invigilator is the same as the verification code of the unmasked part, it is determined that the identity authentication is correct, and the invigilator can exercise the submission and save permissions of the main invigilator system. If they are not the same, it is determined that the identity authentication is wrong, and the invigilator has no right to perform subsequent operations.

[0095] By masking the login code of the main invigilation system, sensitive information is ensured not to be leaked, and the security of identity authentication is improved; the login code of the main invigilation system is used as part of the verification code, which avoids additional verification steps, simplifies the identity authentication process, and improves the convenience of operation; only when the identity authentication is correct, the invigilation terminal has the submission and save permissions, effectively preventing unauthorized operations and protecting the security of the examination data. For example: assuming that the login code of a certain invigilation system is "AB1C26", the invigilation terminal masks part of the login code, such as replacing the middle two digits with "**", and the masked login code is "AB**26". The first part of the verification code generated by the invigilation terminal is the login code after the mask. The verification code entered by the invigilation terminal is "AB**26", in which ** is consistent with the masked part. Therefore, the identity authentication is successful, and the invigilation terminal can exercise the submission and save permissions of the main invigilation system to operate and save the examination data.

[0096] After the identity authentication of the invigilator is successful, the following steps are then performed. The invigilator generates an identity authentication code for each test terminal according to the submission security authentication rules set by the system.

[0097] Furthermore, the invigilator generates an identity verification code for each test terminal according to the submission security authentication rules set by the system, including the following steps:

[0098] S23. The invigilator obtains the stored login code of the main invigilator system, masks the login code of the main invigilator system, and generates the first part of the identity verification code of the tester.

[0099] S24. Obtain at least one piece of information including the IP address and number of the invigilator, and perform mask processing to generate the second part of the identity verification code of the test-end.

[0100] S25. Obtain at least one of the following information: the test paper code, test terminal number, and IP address of each test terminal, and generate the third part of the test terminal identity authentication.

[0101] S26. The identity verification code of each test terminal includes a first part, a second part and a third part arranged in sequence.

[0102] Specifically, the login code is obtained from the main invigilation system storage through the invigilation terminal, and some sensitive information is masked to ensure the security of the login code; the masked main invigilation system login code is used as the first part of the examination terminal identity verification code; the invigilation terminal obtains its own IP address and number, and masks at least one of the information to protect the security of sensitive information; the masked invigilation terminal IP and number information is used as the second part of the examination terminal identity verification code; the invigilation terminal obtains the test paper code, test terminal number and IP information from each test terminal, and masks at least one of the information to ensure the security of the test terminal information; the masked test paper code, test terminal number and IP information of the test terminal are used as the third part of the examination terminal identity verification code; the first part, the second part and the third part are sorted and combined in sequence to form the final identity verification code of the test terminal.

[0103] By masking the login code and related information of the main invigilation system, the security of sensitive information is protected and the security of identity authentication is improved. Multiple parts are combined to form the identity authentication code at the examination end, making identity authentication more complicated and increasing the difficulty of cracking. Sensitive information is masked to reduce the risk of information leakage and improve the protection of examination data and personal privacy.

[0104] For example: Assuming that the login code of the main invigilation system is "AB1C26", the IP is "192.168.1.1", the number is "001", the test paper code is "P123", the test end number is "E123", and the IP is "192.168.1.2", the login code "AB1C26" of the main invigilation system is masked to generate the first part "****26"; the IP "192.168.1.1" and the number "001" are masked to generate the second part "**92.168.1.*" and "**00"; the test paper code "P123", the test end number "E123" and the IP "192 .168.1.2" is masked to generate the third part "P***" and "E***" and "**92.168.1.*". The first part, the second part and the third part are sequentially arranged and combined into the authentication code of each test end: "****26", "**92.168.", "P*" or "E****", "**92.168.*". Any three of them are needed. You only need to follow the generated verification code and enter the unmasked part set to complete the authentication. Through the above steps, sensitive information such as the login code of the main invigilation system can be protected, the complexity and difficulty of guessing of the authentication code of the test end can be increased, and the security of the system can be improved. At the same time, combining the authentication codes of each test end can better ensure the security and reliability of the system.

[0105] Specifically, the test terminal enters the corresponding verification code according to the submission security authentication rules:

[0106] According to the set submission security authentication rules, the third part of the identity authentication code of each test terminal is generated, including at least one of the test paper code, test terminal number, and IP. By using the submission security authentication rules, the ability to prevent illegal access and malicious attacks can be increased, and the security of the system can be improved; the corresponding verification code is generated according to the test paper code, test terminal number, IP and other information, which can better ensure the uniqueness and difficulty of guessing the identity authentication code of each test terminal, and further improve the security of the system. For example, the test paper code is "P123", the test terminal number is "E123", and the IP is "192.168.1.2"; according to the set submission security authentication rules, the third part of the identity authentication code of each test terminal is generated, including at least one of the test paper code, test terminal number, and IP, and the test paper code, test terminal number, IP and other information are encrypted as part of the verification code; the encrypted test paper code, test terminal number, IP and other information are compared with the set rules to generate a unique verification code, and the complexity of the input password is reduced by selecting the reduction method.

[0107] Through the above steps, a unique verification code can be generated, which can increase the ability to prevent illegal access and malicious attacks and improve the security of the system. At the same time, using the submission security authentication rules can better ensure the uniqueness and difficulty of the authentication code of each test end, further improving the security of the system.

[0108] Furthermore, the test end obtains the set direct connection security verification rules and generates a direct connection verification code corresponding to the test end, including the following steps:

[0109] S311. According to the set direct connection security verification rules, the tester obtains the stored direct connection security verification code, which includes: the first part: the main invigilation system server code, the second part: at least one of the test terminal IP and number, and the third part: the test paper code.

[0110] Specifically: S312, the set direct connection security verification rule is that any one of the first part, the second part and the third part of the direct connection security verification code replaces the other two parts to generate a direct connection verification code corresponding to the test.

[0111] The test obtains the direct connection security verification code from the storage location, and the verification code includes the first part, the second part and the third part; according to the set direct connection security verification rules, the test end selects one part to replace the other two parts to generate a direct connection verification code corresponding to the test; the selected replacement part is combined with the other two parts in sequence to form a final direct connection verification code; the test end displays the generated direct connection verification code on the test interface, and the examinee verifies by entering the verification code; the verification code entered by the examinee is compared with the generated direct connection verification code to determine whether the verification results are consistent. If they are consistent, the authentication is successful; if not, the authentication fails.

[0112] Through the flexible application of direct connection security verification rules, a direct connection verification code corresponding to the test is generated, which increases the complexity and security of verification; by generating direct connection verification codes through replacement parts, the transmission and exposure of sensitive information is reduced, and the protection of test data and personal privacy is improved; the generation and verification process of direct connection verification codes is simple and intuitive, which reduces additional verification steps and improves the convenience of operation.

[0113] For example, if the set direct connection security verification rule is to select the first part instead of the other two parts to generate the direct connection verification code. The direct connection security verification code obtained by the test from the storage is: the first part is the main invigilation system server code, the second part is the test end IP address, and the third part is the test paper code. The examination end selects the first part (the main invigilation system server code) according to the rules, and combines it with the second part (the examination end IP address) and the third part (the test paper code) in sequence to generate a direct connection verification code; if the main invigilation system server code is "AB", the examination end IP address is "192.168.0.0", and the test paper code is "1C26", then the generated direct connection verification code is "AB-192.168.0.0-1C26". The examinee only needs to enter any one of the three types of "AB-AB-AB", "1C26-1C26-1C26", or "192.168.0.0-192.168.0.0-192.168.0.0" on the examination end as the direct connection verification code for verification, and the success or failure of the authentication is determined by comparing the verification results.

[0114] Preferably, the generated verification code uses the third part of the test paper code to replace the first part and the second part of the verification code.

[0115] Furthermore, the submission security authentication rules and direct connection security verification rules include: being announced on the invigilation end or the examination end in the form of a pop-up window, voice broadcast or distribution.

[0116] The system needs to provide semi-autonomous multi-level verification codes combined with distributed digital signatures in the front-end management program to complete verification, and the interrupts used by the system need to support the specifications used for digital signatures. The candidate's examination end system should be able to support offline operating environment examination process management, support the continued execution of the operating environment in the examination system after offline and save the test results to generate data files, and can still complete the submission of test results in the case of preset network environment interruptions. The examination system should support repeated modification of answers and questions that can be submitted in steps.

[0117] The platform system listed in this application needs to be able to record the self-service registration runtime environment parameters, the timestamp log record of each submission verification, and the mode change status of the comprehensive screening verification process. The system needs to be able to record the offline submission mode type supported by the single host mode, and the mode type of offline submission of the shared host distribution mode; multiple registration devices switch to synchronize data; self-service registration terminal devices including desktop systems and mobile systems must be equipped with autonomous batteries or delayed power supply. The backup network link includes a local area network and a Bluetooth link.

[0118] The platform system listed in this application provides verification log records for each submission. The log records include but are not limited to submitter information, test information, device information, submission timestamp, submission mode change timestamp and other log records. The log records can reflect the mode change status of the verification process and the main information in the system operation, which is convenient for monitoring the test process and data statistics.

[0119] The present invention also discloses a multi-level security authentication system based on digital examination, which adopts any of the multi-level security authentication methods based on digital examination described above.

[0120] The above is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as above in the preferred embodiment, it is not used to limit the present invention. Any technician familiar with the present application can make some changes or modifications to equivalent embodiments of equivalent changes using the technical contents suggested above without departing from the scope of the technical solution of the present invention. The implementation schemes in the above embodiments can also be further combined or replaced. However, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the solution of the present invention.

Claims

1. A multi-level security authentication method based on digital examination, characterized in that: The following steps are involved: The invigilator receives and verifies the personal information registered by the examinee, and sends the verification information to the main invigilator system; Obtain whether the network status between the main invigilation system and the invigilation terminal is abnormal. If the network status is abnormal, the invigilation terminal generates an identity verification code for each examination terminal according to the submission security authentication rules set by the system; Determine whether the backup network connection of the invigilator is available. If so, the invigilator sends the test submission security authentication rules to the tester through the backup network. The invigilator obtains the verification code corresponding to the verification code input by the tester according to the submission security authentication rules, and determines whether the verification code input is the same as the generated identity authentication code. If so, the invigilator receives the test submission data of the tester after successful authentication, and generates a local encrypted file; When the network is abnormal, the system also includes: the invigilator performs login verification by means of reduced-bit verification, and exercises the submission and saving authority of the main invigilator system; Specifically, the invigilator obtains the login code of the main invigilator system, masks part of the login code of the main invigilator system, and generates the first part of the verification code of the invigilator from the unmasked part; Get the verification code input by the invigilator, and determine whether the verification code is the same as the verification code of the unmasked part. If so, the identity authentication is correct and the submission and saving permissions of the main invigilator system can be exercised. If not, the identity authentication is wrong.

2. A multi-level security authentication method based on digital examination according to claim 1, characterized in that: Determine whether the backup network connection of the invigilation end is available. If not, the examination end is directly connected to the main invigilation system server.

3. A multi-level security authentication method based on digital examination according to claim 2, characterized in that: The test end is directly connected to the main invigilation system server, including the following steps: The test end obtains the set direct connection security verification rules and generates a direct connection verification code corresponding to the test end; Obtain the verification code entered by the test end and compare it with the generated verification code for authentication. After successful authentication, the test end can send a test submission request to the main proctoring system server. The main proctoring system server allocates storage space according to the request and accepts the test submission data to generate an encrypted file.

4. A multi-level security authentication method based on digital examination according to claim 1, characterized in that: The invigilator generates an identity verification code for each test terminal according to the submission security authentication rules set by the system, including the following steps: The invigilator obtains the stored login code of the main invigilator system, masks the login code of the main invigilator system, and generates the first part of the identity verification code of the tester; Obtain at least one piece of information, including the IP address and ID number of the invigilator, and perform mask processing to generate the second part of the authentication code of the test end; Obtain at least one of the test paper code, test terminal number, and IP address of each test terminal to generate the third part of the test terminal identity verification; The identity verification code of each test terminal includes a first part, a second part and a third part which are arranged in sequence.

5. A multi-level security authentication method based on digital examination according to claim 4, characterized in that: The test end enters the corresponding verification code according to the submission security authentication rules: According to the set submission security authentication rules, the third part of the identity authentication code of each examination terminal is generated, including at least one of the test paper code, the examination terminal number, and the IP.

6. A multi-level security authentication method based on digital examination according to claim 3, characterized in that: The test end obtains the set direct connection security verification rules and generates a direct connection verification code corresponding to the test end, including the following steps: According to the set direct connection security verification rules, the tester obtains the stored direct connection security verification code, which includes: the first part: the main invigilation system server code; the second part: at least one of the test end IP and number; the third part: the test paper code; The set direct connection security verification rule is that any one of the first part, the second part and the third part of the direct connection security verification code replaces the other two parts to generate a direct connection verification code corresponding to the test.

7. A multi-level security authentication method based on digital examination according to claim 5, characterized in that: The generated verification code uses the third part of the test paper code to replace the verification codes of the first and second parts.

8. A multi-level security authentication method based on digital examination according to any one of claims 1 to 7, characterized in that: The submission security authentication rules and direct connection security verification rules include: being announced on the invigilation end or the examination end in the form of a pop-up window, voice broadcast or distribution.

9. A multi-level security authentication system based on digital examination, characterized in that: A multi-level security authentication method based on digital examination is adopted as described in any one of claims 1-8.

Images