A method for two-factor protection for clients

Abstract

The present invention relates to the field of client protection, and in particular to a method for performing two-factor protection on a client. The present invention sets a number of disguised nodes, configures unique serial number labels for the disguised nodes and builds association relationships, and sets a supervision server connected to each of the disguised nodes to supervise each of the disguised nodes. The present invention sets a real node in the disguised node, and the serial number of the real node is continuously switched so that it changes in the disguised node, and the access sequence is included in the verification, and the supervision is performed through the supervision server. After the real node is found, the sending end and the receiving end of the two-factor verification information adopt different forms, and then the two-factor verification process is protected in multiple dimensions, the risk of breaking through the verification after the verification information is stolen is reduced, and the security of the access end accessing the client is improved.

Description

Technical Field

[0001] The present invention relates to the field of client protection, and in particular to a method for performing double-factor protection on a client. Background Art

[0002] Two-Factor Authentication (2FA) is an enhanced security measure that requires users to provide two different types of authentication factors during the login process. Two-factor authentication can be implemented through a gateway on the internal network or through an authentication service provided by a cloud service provider's server node. The purpose of this method is to provide an additional layer of security to ensure that even if one factor (such as a password) is leaked, there is security redundancy and the account still has a certain degree of security.

[0003] For example, Chinese patent publication number: CN110022559A discloses a network user authentication method, including a terminal performing a first verification operation on an identity identification number and a password; sending a login authentication request message to a first sensor node; the first sensor node generates a first secret key material, and sends the first secret key material and the login authentication request message to a gateway node; the gateway node performs a second verification operation on the first sensor node, and the gateway node performs a third verification operation on the login authentication request message; the gateway node generates a second secret key material, and sends the second secret key material to a second sensor node; the second sensor node performs a fourth verification operation on the gateway node; the second sensor node generates a third secret key material, and sends the third secret key material to the user; performs a fifth verification operation on the gateway node; and calculates a session key according to the result of the fifth operation. The network user authentication method of this application adopts a two-factor user authentication method, which greatly improves the security of user accounts.

[0004] However, there are still the following problems in the prior art:

[0005] In the prior art, a gateway node is usually used to perform two-factor authentication on the access terminal. However, when a single gateway is used for authentication, if the authentication gateway is attacked or there is a thief who steals the authentication information returned by the access terminal for authentication, there may be certain security issues and the safety factor is not high. Summary of the invention

[0006] To this end, the present invention provides a method for two-factor protection for a client, so as to overcome the problem that a gateway node is usually used to perform two-factor verification on an access terminal in the prior art. However, when a single gateway is used for verification, if the verification gateway is attacked or there is a thief who steals the verification information returned by the access terminal for verification, there may be certain security issues and a low safety factor.

[0007] To achieve the above object, the present invention provides a method for performing two-factor protection on a client, which comprises:

[0008] Step S1, calling a number of disguised nodes, configuring a unique serial number label for each of the disguised nodes, and setting an association relationship between the disguised nodes, wherein the number of calls of the disguised nodes is determined based on the number of times the client is accessed within a predetermined time;

[0009] Step S2, setting a supervision server connected to each of the camouflage nodes, setting a storage set in the supervision server to store the real node sequence number switched according to a predetermined rule, wherein the supervision server can obtain the access record of each of the camouflage nodes and control the data output of the camouflage nodes,

[0010] Step S3, after receiving the access request from the access terminal, the supervision server verifies the identity information of the access terminal, calls the real node serial number stored in the current stage in the storage set, and synchronously generates a serial number sequence to feed back to the access terminal;

[0011] Step S4, the access end accesses each disguised node one by one according to the corresponding sequence number, and the supervision server verifies the access sequence according to the access records of each disguised node. After the verification, the disguised node is controlled to output the sequence number label of its associated node and send the two-factor verification information to the access end;

[0012] Step S5: The access terminal feeds back information to the associated node for verification by the associated node. If the predetermined conditions are met, the supervision server determines that the access terminal is allowed to access the client.

[0013] The predetermined condition includes that, during the two-factor authentication process, the verification feedback information of the associated node meets the standard, the number of visits to the associated node meets the predetermined standard, and the number of visits to the remaining camouflage nodes meets the predetermined standard.

[0014] Furthermore, in the step S1, in the association relationship of the constructed camouflage nodes,

[0015] The association is set synchronously when the call to the fake node is completed;

[0016] Each masquerade node has a one-to-one correspondence with the associated masquerade node.

[0017] Furthermore, in the step S1, the number of calls of the disguised node is positively correlated with the number of times the client is accessed within a predetermined time.

[0018] Furthermore, in step S1, the process of calling the real node serial number stored in the current stage in the storage set and synchronously generating the serial number sequence includes:

[0019] Determining the number of digits of the sequence at a predetermined ratio based on the number of the invoked camouflage nodes;

[0020] A random number sequence of corresponding digits is generated, and the real node serial number is placed at the end of the random number sequence to obtain the serial number sequence.

[0021] Furthermore, in step S4, the corresponding camouflaged nodes are determined and accessed in sequence according to the sequence numbers in the sequence number sequence.

[0022] Furthermore, in step S3, the process of verifying whether the access sequence verification is passed includes:

[0023] Call the access records of each disguised node, determine the number of visits and access time of each disguised node by the current access end, generate an actual access sequence according to the time sequence, and compare it with the sequence number sequence,

[0024] If the actual access sequence is different from the sequence of serial numbers, it is determined that the access sequence verification fails;

[0025] If the actual access sequence is the same as the sequence of serial numbers, it is determined that the access sequence verification has been passed.

[0026] Furthermore, in step S4, the access terminal determines a corresponding associated node according to the received serial number tag, so as to send feedback information generated based on the two-factor authentication information to the associated node.

[0027] Furthermore, in step S5, during the two-factor authentication process, the associated node is only allowed to be accessed once, and the remaining disguised nodes are not allowed to be accessed.

[0028] If the number of visits to the associated node and / or the remaining disguised nodes is greater than a predetermined standard, the supervision server determines that the number of visits does not meet the predetermined standard.

[0029] Furthermore, in step S2, the real node sequence number is replaced at predetermined intervals, and the replaced real node sequence number is the same as the sequence number corresponding to at least one camouflaged node.

[0030] Furthermore, in step S3, the supervisory server performs identity authentication including verifying whether the access terminal holds a digital signature.

[0031] Compared with the prior art, the present invention sets up several camouflage nodes, configures unique serial number tags for the camouflage nodes and builds association relationships, and sets up a supervision server connected to each of the camouflage nodes to supervise each camouflage node. The present invention sets the real node in the camouflage node, and the serial number of the real node is continuously switched to change it in the camouflage node, and the access order is included in the verification, and the supervision is performed through the supervision server. After finding the real node, the sender and the receiver of the two-factor verification information adopt different forms, and then the two-factor verification process is protected in multiple dimensions, reducing the risk of breaking through the verification after the verification information is stolen, and improving the security of the access end accessing the client.

[0032] In particular, the present invention considers setting up multiple disguised nodes to disguise the nodes used to send two-factor verification information. The access end needs to access in a predetermined order, and uses a regulatory server to monitor the access order in real time, and incorporates the access order into the verification, thereby reducing the risk of the thief stealing the verification information and then traversing the verification, and reducing the risk of the node sending the two-factor verification information being attacked. In addition, in actual situations, the access order of each access by the access end is different. Due to the continuous switching of the real node sequence number, the sending end of each two-factor verification information is also different. The two-factor verification process is protected in multiple dimensions through the above-mentioned means, reducing the risk of breaking through the verification after the verification information is stolen, and improving the security of the access end accessing the client.

[0033] In particular, the present invention sets an associated node for each disguised node. After passing the access sequence verification, the access end finds the node that sends the two-factor verification, uses the two-factor verification node to send verification information, and the disguised node associated with it performs verification. Therefore, it is convenient to include the sending object of the corresponding feedback information after the access end receives the verification information into the verification, and protects the two-factor verification process in multiple dimensions while reducing the risk of breaking through the verification after the verification information is stolen, thereby improving the security of the access end accessing the client.

[0034] In particular, the verification end of the present invention also supervises the two-factor verification process. In the case of multiple disguised nodes, the sending object of the corresponding feedback information after the access end receives the verification information is included in the verification, thereby protecting the two-factor verification process in multiple dimensions, reducing the risk of breaking through the verification after the verification information is stolen, and improving the security of the access end accessing the client. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of the steps of a method for performing two-factor protection on a client according to an embodiment of the invention;

[0036] Figure 2 It is a logical decision diagram for access sequence verification of an embodiment of the invention;

[0037] Figure 3A logical decision diagram for determining whether to allow access to a client according to an embodiment of the invention;

[0038] Figure 4 This is a logical decision diagram of whether to control the disguised node to send two-factor authentication information according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0040] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0041] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0042] See also Figures 1 to 3 As shown, Figure 1 This is a schematic diagram of the steps of a method for performing two-factor protection on a client according to an embodiment of the invention. Figure 2 It is the access sequence verification logic decision diagram of the embodiment of the invention, Figure 3 The logical decision diagram of determining whether to allow access to a client according to an embodiment of the invention is as follows:

[0043] Step S1, calling a number of disguised nodes, configuring a unique serial number label for each of the disguised nodes, and setting an association relationship between the disguised nodes, wherein the number of calls of the disguised nodes is determined based on the number of times the client is accessed within a predetermined time;

[0044] Step S2, setting a supervision server connected to each of the camouflage nodes, setting a storage set in the supervision server to store the real node sequence number switched according to a predetermined rule, wherein the supervision server can obtain the access record of each of the camouflage nodes and control the data output of the camouflage nodes,

[0045] Step S3, after receiving the access request from the access terminal, the supervision server verifies the identity information of the access terminal, calls the real node serial number stored in the current stage in the storage set, and synchronously generates a serial number sequence to feed back to the access terminal;

[0046] Step S4, the access end accesses each disguised node one by one according to the corresponding sequence number, and the supervision server verifies the access sequence according to the access records of each disguised node. After the verification, the disguised node is controlled to output the sequence number label of its associated node and send the two-factor verification information to the access end;

[0047] Step S5: The access terminal feeds back information to the associated node for verification by the associated node. If the predetermined conditions are met, the supervision server determines that the access terminal is allowed to access the client.

[0048] The predetermined condition includes that, during the two-factor authentication process, the verification feedback information of the associated node meets the standard, the number of visits to the associated node meets the predetermined standard, and the number of visits to the remaining camouflage nodes meets the predetermined standard.

[0049] Specifically, the present invention does not limit the specific form of the camouflage node, which can be a network entity that can perform identity authentication tasks. For example, the camouflage node can be a single sub-gateway under a multi-gateway architecture, or a single server node in a server cluster. This will not be repeated.

[0050] Specifically, the present invention does not limit the form of configuring the serial number tag. Preferably, in the present invention, the serial number tag is a digital tag, which only needs to be able to represent the difference between the corresponding camouflaged nodes.

[0051] Specifically, the present invention does not limit the form of generating a digital signature during identity authentication. A digital signature can be generated using a private key pre-distributed to the client and verified using a public key. This is a prior art and will not be described in detail.

[0052] Specifically, the present invention does not limit the form of sending the two-factor verification information. For example, a verification code is sent as the verification information.

[0053] When verifying whether the feedback information meets the standards, determine whether the feedback verification code is correct. If correct, determine that the feedback information meets the standards. If incorrect, determine that the feedback information does not meet the standards. Of course, other forms can also be used. This is existing technology and will not be repeated.

[0054] Specifically, in the step S1, in the association relationship of the constructed camouflage nodes,

[0055] The association is set synchronously when the call to the fake node is completed;

[0056] Each masquerade node has a one-to-one correspondence with the associated masquerade node.

[0057] Specifically, in step S1, the number of calls to the disguised node is positively correlated with the number of times the client is accessed within a predetermined time.

[0058] Specifically, optional,

[0059] The access count N is compared with a preset first access count comparison threshold N1 and a second access count comparison threshold N2,

[0060] If N>N2, the call quantity is [0.6Nm];

[0061] If N1≤N<N2, the call quantity is [0.4Nm];

[0062] If N<N1, the call quantity is [0.2Nm];

[0063] Among them, N2=1.2N0, N1=0.8N0, N0 represents the average number of visits measured in advance, and Nm represents the total number of callable camouflage nodes.

[0064] The present invention considers setting up multiple disguised nodes to disguise the nodes used to send two-factor verification information. The access end needs to access in a predetermined order, and uses a regulatory server to monitor the access order in real time, and incorporates the access order into the verification, thereby reducing the risk of the thief stealing the verification information and then traversing the verification, and reducing the risk of the node sending the two-factor verification information being attacked. In addition, in actual situations, the access order of each access by the access end is different. Due to the continuous switching of the real node sequence number, the sending end of each two-factor verification information is also different. The two-factor verification process is protected in multiple dimensions through the above-mentioned means, reducing the risk of breaking through the verification after the verification information is stolen, and improving the security of the access end accessing the client.

[0065] Specifically, in step S1, the process of calling the real node serial number stored in the current stage in the storage set and synchronously generating the serial number sequence includes:

[0066] Determining the number of digits of the sequence at a predetermined ratio based on the number of the invoked camouflage nodes;

[0067] A random number sequence of corresponding digits is generated, and the real node serial number is placed at the end of the random number sequence to obtain the serial number sequence.

[0068] In this embodiment, taking the total number of called camouflage nodes as 10 as an example, the predetermined ratio is 0.5, then a 5-digit random number sequence is generated, and the real node sequence number is set at the end to obtain a 6-digit random number sequence, and finally the sequence number sequence is obtained.

[0069] Specifically, in step S4, the corresponding camouflaged nodes are determined and accessed in sequence according to the sequence numbers in the sequence number sequence.

[0070] In this embodiment, the serial numbers in the serial number sequence are called one by one in order, and the corresponding camouflaged node is found and accessed according to the called serial number.

[0071] Specifically, in step S3, the process of verifying whether the access sequence verification is passed includes:

[0072] Call the access records of each disguised node, determine the number of visits and access time of each disguised node by the current access end, generate an actual access sequence according to the time sequence, and compare it with the sequence number sequence,

[0073] If the actual access sequence is different from the sequence of serial numbers, it is determined that the access sequence verification fails;

[0074] If the actual access sequence is the same as the sequence of serial numbers, it is determined that the access sequence verification has been passed.

[0075] It is understandable that if there is no external interference, the access end performs access according to the sequence of serial numbers, and the corresponding generated actual access sequence is the same as the sequence of serial numbers.

[0076] In some possible implementations,

[0077] The actual access sequence can be continuously generated during the access process. It is understandable that the actual access sequence at this time has an uncertain number of sequence bits due to the number of visited camouflage nodes, but it can still be compared with the subsequence of the corresponding number of bits called by the sequence front end in the sequence number sequence to determine whether the sequence verification is passed and to discover problems in time. This will not be repeated here.

[0078] Specifically, see Figure 4 As shown, the supervision server needs to determine whether the access sequence verification is passed. If the access sequence verification is passed, the camouflage node is controlled to output the two-factor verification information.

[0079] Specifically, in step S4, the access terminal determines the corresponding associated node according to the received serial number tag, so as to send feedback information generated based on the two-factor authentication information to the associated node.

[0080] Specifically, in step S5, during the two-factor authentication process, the associated node is only allowed to be accessed once, and the remaining disguised nodes are not allowed to be accessed.

[0081] If the number of visits to the associated node and / or the remaining disguised nodes is greater than a predetermined standard, the supervision server determines that the number of visits does not meet the predetermined standard.

[0082] Specifically, the two-factor authentication process includes two-factor authentication information being sent out until the associated node receives feedback information returned by the access terminal.

[0083] The present invention sets an associated node for each disguised node. After passing the access sequence verification, the access end finds the node that sends the two-factor verification, uses the two-factor verification node to send verification information, and the disguised node associated with it performs verification. Furthermore, it is convenient to include the sending object of the corresponding feedback information after the access end receives the verification information into the verification. While protecting the two-factor verification process in multiple dimensions, it reduces the risk of breaking through the verification after the verification information is stolen, and improves the security of the access end accessing the client.

[0084] Specifically, in step S2, the real node sequence number is replaced at predetermined intervals, and the replaced real node sequence number is the same as the sequence number corresponding to at least one camouflaged node.

[0085] It is understandable that the real node needs to be equivalent to one of the serial numbers of several fake nodes.

[0086] Specifically, in step S3, the supervisory server performs identity authentication including verifying whether the digital signature held by the access terminal is correct,

[0087] If the digital signature is present and correct, the identity verification is considered successful.

[0088] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A method for performing two-factor protection on a client, characterized in that: include: Step S1, calling a number of disguised nodes, configuring a unique serial number label for each of the disguised nodes, and setting an association relationship between the disguised nodes, wherein the number of calls of the disguised nodes is determined based on the number of times the client is accessed within a predetermined time; Step S2, setting a supervision server connected to each of the camouflage nodes, setting a storage set in the supervision server to store the real node sequence number switched according to a predetermined rule, wherein the supervision server can obtain the access record of each of the camouflage nodes and control the data output of the camouflage nodes, Step S3, after receiving the access request from the access terminal, the supervision server verifies the identity information of the access terminal, calls the real node serial number stored in the current stage in the storage set, and synchronously generates a serial number sequence to feed back to the access terminal; Step S4, the access end accesses each disguised node one by one according to the corresponding sequence number, and the supervision server verifies the access sequence according to the access records of each disguised node. After the verification, the disguised node is controlled to output the sequence number label of its associated node and send the two-factor verification information to the access end; Step S5, the access terminal feeds back information to the associated node for verification by the associated node, and the supervision server determines that the access terminal is allowed to access the client after meeting the predetermined conditions; The predetermined condition includes that, during the two-factor authentication process, the verification feedback information of the associated node meets the standard, the number of visits to the associated node meets the predetermined standard, and the number of visits to the remaining camouflage nodes meets the predetermined standard; In step S1, the process of calling the real node serial number stored in the current stage in the storage set and synchronously generating the serial number sequence includes: Determining the number of digits of the sequence at a predetermined ratio based on the number of the called camouflage nodes; A random number sequence of corresponding digits is generated, and the real node serial number is placed at the end of the random number sequence to obtain the serial number sequence.

2. The method for performing two-factor protection on a client according to claim 1, characterized in that: In the step S1, in the association relationship of the constructed camouflage nodes, The association is set synchronously when the call to the fake node is completed; Each masquerade node has a one-to-one correspondence with the associated masquerade node.

3. The method for performing two-factor protection on a client according to claim 1, characterized in that: In the step S1, the number of calls to the disguised node is positively correlated with the number of times the client is accessed within a predetermined time.

4. The method for performing two-factor protection on a client according to claim 1, characterized in that: In the step S4, the corresponding camouflaged nodes are determined and accessed in sequence according to the sequence numbers in the sequence number sequence.

5. The method for performing two-factor protection on a client according to claim 1, characterized in that: In step S3, the process of verifying whether the access sequence verification is passed includes: Call the access records of each disguised node, determine the number of visits and access time of each disguised node by the current access end, generate an actual access sequence according to the time sequence, and compare it with the sequence number sequence, If the actual access sequence is different from the sequence of serial numbers, it is determined that the access sequence verification has not been passed; If the actual access sequence is the same as the sequence of serial numbers, it is determined that the access sequence verification has been passed.

6. The method for performing two-factor protection on a client according to claim 1, characterized in that: In the step S4, the access terminal determines the corresponding associated node according to the received serial number tag, so as to send feedback information generated based on the two-factor authentication information to the associated node.

7. The method for performing two-factor protection on a client according to claim 1, characterized in that: In step S5, during the two-factor authentication process, the associated node is only allowed to be accessed once, and the remaining disguised nodes are not allowed to be accessed. If the number of visits to the associated node and / or the remaining disguised nodes is greater than a predetermined standard, the supervision server determines that the number of visits does not meet the predetermined standard.

8. The method for performing two-factor protection on a client according to claim 1, characterized in that: In the step S2, the real node serial number is replaced at a predetermined interval, and the replaced real node serial number is the same as the serial number corresponding to at least one camouflaged node.

9. The method for performing two-factor protection on a client according to claim 1, characterized in that: In step S3, the supervisory server performs identity authentication including verifying whether the access terminal holds a digital signature.

Images