An authentication method based on digital signature technology

Abstract

The present invention relates to an authentication method based on digital signature technology and belongs to the field of computer technology. The method includes: obtaining a shared key through key exchange, obtaining user ciphertext information based on user biometric information, the user's public key, the shared key, and a timestamp, verifying the timestamp to obtain a verification result, obtaining registration ciphertext information and a registration result based on the verification result and the verified timestamp, collecting the biometric information of the user to be logged in according to the user login request, signing the biometric information of the user to be logged in to obtain signature information, obtaining login ciphertext information based on the biometric information of the user to be logged in, the signature information, and the login timestamp, the server decrypts the ciphertext information through the shared key, performs biometric matching by calling a database based on the biometric information of the user to be logged in to obtain a matching result and a login verification ciphertext, and the client verifies the login verification ciphertext to obtain an identity verification result, improving the security of information transmission and the accuracy of user identity authentication.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and particularly relates to an authentication method based on digital signature technology. Background Art

[0002] With the rapid development of computer technology and network communication technology, while the Internet brings convenience to people, the transmission and processing of information have gradually changed from the traditional offline paper mode to the network medium. However, the complexity and openness of the network environment make the transmission and storage of information face a series of security threats, such as information being intercepted, tampered with, forged, and the identity confirmation problem between the sender and the receiver.

[0003] Currently, in identity authentication technology, digital signature technology is an important technology for data integrity verification and ensuring the reliability of data sources. However, digital signature technology has security problems caused by the lack of connection between the key and the legitimate user. In addition, in the open Internet, once the biometric identification-based identity verification system is attacked, not only the privacy of biometric templates is leaked, but also significant losses may be brought to the rights and interests of users. And the commonly used identity authentication schemes are basically centralized authentication, and the authentication data and authentication logs are extremely easy to be tampered with, and it is impossible to effectively trace after being tampered with. Summary of the Invention

[0004] To solve the above problems existing in the prior art, the present invention provides an authentication method based on digital signature technology. A shared key is obtained through key exchange according to the user registration request. The user biometric feature vector is obtained by feature extraction according to the user biometric information. The biometric feature value is obtained according to the user biometric feature vector. The user ciphertext information is obtained by using the biometric feature value, the user public key, the shared key and the time stamp. The verification result is obtained by verifying the time stamp. The biometric feature value and the user public key are stored in the database. The registration ciphertext information is obtained according to the verification result and the verification time stamp. The verification result and the verification time stamp are obtained according to the registration ciphertext information. The registration result is obtained by verifying the verification time stamp. The biometric information of the user to be logged in is collected according to the user login request. The signature information is obtained by signing the biometric information of the user to be logged in. The login ciphertext information is obtained according to the biometric information of the user to be logged in, the signature information and the login time stamp, and the login ciphertext information is uploaded to the server. The server decrypts the ciphertext information by using the shared key. The matching result is obtained by performing biometric feature matching on the biometric information of the user to be logged in by calling the database according to the matching result. The second verification result and the second verification time stamp are obtained by verifying the signature information, and the login verification ciphertext is obtained through the encryption algorithm, and the login verification ciphertext is sent to the client. The client verifies the login verification ciphertext to obtain the identity verification result.

[0005] The object of the present invention can be achieved by the following technical solutions:

[0006] An authentication method based on digital signature technology specifically includes the following steps:

[0007] S1: Obtain a user registration request, perform key exchange according to the user registration request to obtain a shared key, and the shared key carries a timestamp;

[0008] S2: Collect user biometric information, obtain a user biometric feature vector through feature extraction according to the user biometric information, obtain a biometric feature value according to the user biometric feature vector, call the user's public key, and process the biometric feature value, the user's public key, the shared key, and the timestamp through an encryption algorithm to obtain user ciphertext information, and upload the ciphertext information to the server;

[0009] S3: The server receives the user ciphertext information, processes the ciphertext information through a decryption algorithm to obtain the biometric feature value, the user's public key, the shared key, and the timestamp, verifies the timestamp to obtain a verification result, the verification result carries a verification timestamp, stores the biometric feature value and the user's public key in the database according to the verification result, processes the verification result and the verification timestamp through an encryption algorithm to obtain registration ciphertext information, and transmits the registration ciphertext information to the client. The client receives the registration ciphertext information, processes the registration ciphertext information through a decryption algorithm to obtain the verification result and the verification timestamp, and verifies the verification timestamp to obtain a registration result;

[0010] S4: Obtain a user login request, collect the biometric information of the user to be logged in according to the user login request, sign the biometric information of the user to be logged in to obtain signature information, the signature information includes the requested login time, obtain a login timestamp according to the requested login time, and process the biometric information of the user to be logged in, the signature information, and the login timestamp through an encryption algorithm to obtain login ciphertext information, and upload the login ciphertext information to the server;

[0011] S5: The server decrypts the ciphertext information through the shared key to obtain the biometric information of the user to be logged in, the signature information, and the login timestamp, performs biometric feature matching on the biometric information of the user to be logged in by calling the database to obtain a matching result, verifies the signature information according to the matching result to obtain a second verification result and a second verification timestamp, and obtains login verification ciphertext through an encryption algorithm according to the second verification result and the second verification timestamp, and sends the login verification ciphertext to the client;

[0012] S6: The client decrypts the login verification ciphertext to obtain the second verification result and the second verification timestamp, verifies the second verification timestamp to obtain an identity verification result, and the identity verification result includes successful user identity verification and failed user verification.

[0013] Preferably, step S1 specifically includes the following steps:

[0014] S101: The key exchange includes a terminal initialization, a key exchange phase, and a key calculation phase. Among them, the terminal initialization includes determining security parameters, a cyclic group, and a generator, obtaining a client private key and a server private key, obtaining a client public key according to the generator and the client private key, obtaining a server public key according to the generator and the server private key, and issuing a client certificate and a server certificate to the client and the server by a CA institution;

[0015] S102: The key exchange phase includes the client determining a client random number and a first exchange timestamp, obtaining client signature information through client signature according to the client random number and the first exchange timestamp, sending the client signature information and the client certificate to the server, the server determining a server random number and a second exchange timestamp according to the client signature information and the client certificate, obtaining server signature information through server signature according to the server random number and the second exchange timestamp, and sending the server signature information and the server certificate to the client;

[0016] S103: The key calculation phase includes the client verifying the server certificate to obtain a first verification result, verifying the client signature information according to the first verification result to obtain a first verification result, calculating the shared key according to the first verification result, the server verifying the client certificate to obtain a second verification result, verifying the client signature information according to the second verification result to obtain a second verification result, and calculating the shared key according to the second verification result.

[0017] Preferably, the client signature in step S102 specifically includes, according to the client random number combined with the generator, obtaining a client secret value through the formula g a = g a wherein, g a represents the client secret value, g represents the generator, a represents the client random number, determining a client message according to the client secret value and the first exchange timestamp, and the client message is expressed as m a = g a ||T a, sign the client message, and obtain the first signature information through the formula where m a represents the client message, determine the secondary random number, and obtain the secondary secret value according to the secondary random number through the formula g a1 = g a1 Calculate the secondary secret value, and calculate the second signature information according to the secondary secret value combined with the client public key through the formula Calculate the client signature information according to the first signature information and the second signature information, where h1 represents the first signature information and h2 represents the second signature information.

[0018] Preferably, the server signature in step S102 specifically includes obtaining the server secret value according to the server random number combined with the generator through the formula g b = g b where g b represents the server secret value, g represents the generator, b represents the server random number, determine the server message according to the server secret value and the second exchange timestamp, and the server message is expressed as m b = g b ||T b , sign the server message, and obtain the third signature information through the formula Determine its secondary random number, obtain the secondary secret value according to the secondary random number through the formula g b1 = g b1 Calculate the secondary secret value, and calculate the fourth signature information according to the secondary secret value combined with the server public key through the formula Calculate the server signature information according to the third signature information and the fourth signature information, where h b represents the server comprehensive signature information, h 11 represents the third signature information, h 22 represents the fourth signature information, and b1 represents the secondary random number.

[0019] Preferably, step S103 specifically includes the following steps:

[0020] The first verification result includes verification success and verification failure. When the verification fails, the key exchange fails. When the verification is successful, calculate the server secret value and the second exchange timestamp; obtain the current timestamp, and verify the second exchange timestamp according to the current timestamp through the discriminant, and the discriminant is expressed as |T b - T now|<T thr , where T b represents the second exchange timestamp, T now represents the current timestamp, T thr represents a preset threshold. When the second exchange timestamp does not satisfy the discriminant, the key exchange is stopped. When the second exchange timestamp satisfies the discriminant, through the formula F1(m b ) = l2|h 11 verify the server message. When the verification fails, the key exchange is terminated. When the verification is successful, the server signature information is successfully verified, and the shared key is calculated according to the client random value and the server secret value through the formula as = (g b ) a where as represents the shared key, g b represents the server secret value, and a represents the client random value;

[0021] The second verification result includes verification success and verification failure. When the verification fails, the key exchange fails. When the verification is successful, calculate the client secret value and the first exchange timestamp, obtain the current timestamp, and verify the first exchange timestamp according to the current timestamp through the discriminant. The discriminant is expressed as |T a - T now | < T thr , where T a represents the first exchange timestamp, T now represents the current timestamp, T thr represents a preset threshold. When the first exchange timestamp does not satisfy the discriminant, the key exchange is stopped. When the first exchange timestamp satisfies the discriminant, through the formula F1(m a ) = l2|h1 to verify the client message. When the verification fails, the key exchange is terminated. When the verification is successful, the client signature information is successfully verified, and the shared key is calculated according to the server random value and the client secret value through the formula ak = (g a ) b where ak = as, ak represents the shared key, g a represents the client secret value, and b represents the server random value.

[0022] Preferably, step S4 specifically includes obtaining a first login signature according to the to-be-logged-in user information through the formula , selecting a random number, calculating a secret value according to the random number through the formula R = g R and calculating h2 = H(y according to the secret value and the client public key through the formulaa ,R) to calculate the second login signature, where h2 represents the second login signature, and y a represents the client public key, R represents the secret value, and the signature information is calculated based on the first signature information and the second signature information.

[0023] The beneficial effects of the present invention are as follows:

[0024] 1. By binding the user's biometric information with the digital signature and performing hybrid authentication on the user's biometric information and the digital signature, the security of identity authentication is improved.

[0025] 2. At the beginning of each communication, the two communicating parties will perform key exchange to obtain a new shared key. This new shared key ensures that even if the previous key is leaked, it will not pose a threat to this communication, improving the confidentiality of information transmission.

[0026] 3. The server receives the user ciphertext information, processes the ciphertext information through a decryption algorithm to obtain the biometric value, the user public key, the shared key, and the timestamp, verifies the timestamp to obtain a verification result, the verification result carries the verification timestamp, stores the biometric value and the user public key in the database according to the verification result, processes the verification result and the verification timestamp through an encryption algorithm to obtain the registration ciphertext information, and transmits the registration ciphertext information to the client. The client receives the registration ciphertext information, processes the registration ciphertext information through a decryption algorithm to obtain the verification result and the verification timestamp, verifies the verification timestamp to obtain a registration result. The two-way verification ensures that when an attacker tampers with the intercepted ciphertext information, the verifier cannot decrypt it, which has the advantage of anti-tampering, and the signature information in the ciphertext information also ensures the integrity of information transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] For the convenience of those skilled in the art to understand, the present invention will be further described below with reference to the accompanying drawings.

[0028] Figure 1 FIG. is a schematic flowchart of the authentication method based on digital signature technology of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0029] To further elaborate on the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following will describe in detail the specific embodiments, structures, features, and effects of the present invention with reference to the accompanying drawings and preferred embodiments.

[0030] Please refer to Figure 1 , an authentication method based on digital signature technology, specifically including the following steps:

[0031] S1: Obtain a user registration request, perform key exchange according to the user registration request to obtain a shared key, and the shared key carries a timestamp.

[0032] S2: Collect user biometric information, obtain a user biometric feature vector through feature extraction according to the user biometric information, obtain a biometric feature value according to the user biometric feature vector, call the user public key, and process the biometric feature value, the user public key, the shared key, and the timestamp through an encryption algorithm to obtain user ciphertext information, and upload the ciphertext information to the server.

[0033] S3: The server receives the user ciphertext information, processes the ciphertext information through a decryption algorithm to obtain the biometric feature value, the user public key, the shared key, and the timestamp, verifies the timestamp to obtain a verification result, the verification result carries a verification timestamp, stores the biometric feature value and the user public key in the database according to the verification result, processes the verification result and the verification timestamp through an encryption algorithm to obtain registration ciphertext information, and transmits the registration ciphertext information to the client. The client receives the registration ciphertext information, processes the registration ciphertext information through a decryption algorithm to obtain the verification result and the verification timestamp, and verifies the verification timestamp to obtain a registration result.

[0034] S4: Obtain a user login request, collect the biometric information of the user to be logged in according to the user login request, sign the biometric information of the user to be logged in to obtain signature information, the signature information includes the requested login time, obtain a login timestamp according to the requested login time, and process the biometric information of the user to be logged in, the signature information, and the login timestamp through an encryption algorithm to obtain login ciphertext information, and upload the login ciphertext information to the server.

[0035] S5: The server decrypts the ciphertext information through the shared key to obtain the biometric information of the user to be logged in, the signature information, and the login timestamp, performs biometric feature matching on the biometric information of the user to be logged in by calling the database to obtain a matching result, verifies the signature information according to the matching result to obtain a second verification result and a second verification timestamp, and obtains a login verification ciphertext through an encryption algorithm according to the second verification result and the second verification timestamp, and sends the login verification ciphertext to the client.

[0036] S6: The client decrypts the login verification ciphertext to obtain the second verification result and the second verification timestamp, and verifies the second verification timestamp to obtain an identity verification result, and the identity verification result includes successful user identity verification and failed user verification.

[0037] Preferably, step S1 specifically includes the following steps:

[0038] S101: The key exchange includes terminal initialization, a key exchange phase, and a key calculation phase. Among them, the terminal initialization includes determining security parameters, a cyclic group, and a generator, obtaining a client private key and a server private key, obtaining a client public key according to the generator and the client private key, obtaining a server public key according to the generator and the server private key, and issuing a client certificate and a server certificate to the client and the server by a CA institution;

[0039] S102: The key exchange phase includes the client determining a client random number and a first exchange timestamp, obtaining client signature information through client signature according to the client random number and the first exchange timestamp, sending the client signature information and the client certificate to the server, the server determining a server random number and a second exchange timestamp according to the client signature information and the client certificate, obtaining server signature information through server signature according to the server random number and the second exchange timestamp, and sending the server signature information and the server certificate to the client;

[0040] S103: The key calculation phase includes the client verifying the server certificate to obtain a first verification result, verifying the client signature information according to the first verification result to obtain a first verification result, calculating the shared key according to the first verification result, the server verifying the client certificate to obtain a second verification result, verifying the client signature information according to the second verification result to obtain a second verification result, and calculating the shared key according to the second verification result.

[0041] Preferably, the client signature in step S102 specifically includes, according to the client random number combined with the generator, through the formula g a = g a to calculate the client secret value, where g a represents the client secret value, g represents the generator, a represents the client random number, determining the client message according to the client secret value and the first exchange timestamp, and the client message is expressed as m a = g a ||T a , signing the client message, and obtaining the first signature information through the formula where m aRepresents the client message, determines a secondary random number, and calculates a secondary secret value according to the secondary random number through the formula g a1 = g a1 Calculates the second signature information according to the secondary secret value in combination with the client public key through the formula Calculates the client signature information according to the first signature information and the second signature information, where h a Represents the comprehensive signature information, h1 represents the first signature information, and h2 represents the second signature information.

[0042] Preferably, the server signature in step S102 specifically includes calculating a server secret value according to the server random number in combination with the generator through the formula g b = g b Where g b Represents the server secret value, g represents the generator, b represents the server random number, determines the server message according to the server secret value and the second exchange timestamp, and the server message is expressed as m b = g b ||T b Signs the server message, and calculates the third signature information through the formula Determines its secondary random number, calculates a secondary secret value according to the secondary random number through the formula g b1 = g b1 Calculates the fourth signature information according to the secondary secret value in combination with the server public key through the formula Calculates the server signature information according to the third signature information and the fourth signature information, where h b Represents the server comprehensive signature information, h 11 Represents the third signature information, and h 22 Represents the fourth signature information.

[0043] Preferably, step S103 specifically includes the following steps:

[0044] The first verification result includes verification success and verification failure. When the verification fails, the key exchange fails. When the verification is successful, calculate the server secret value and the second exchange timestamp; obtain the current timestamp, and verify the second exchange timestamp according to the current timestamp through the discriminant, and the discriminant is expressed as |T b - T now | < T thr , where T b Represents the second exchange timestamp, and T nowRepresents the current timestamp, T thr Represents a preset threshold. When the second exchange timestamp does not satisfy the discriminant, the key exchange is stopped. When the second exchange timestamp satisfies the discriminant, through the formula F1(m b ) = l2|h 11 Verify the server message. When the verification fails, the key exchange is terminated. When the verification is successful, the server signature information is verified successfully, and according to the client random value and the server secret value, through the formula as = (g b ) a Calculate the shared key, where as represents the shared key, g b Represents the server secret value, a represents the client random value;

[0045] The second verification result includes verification success and verification failure. When the verification fails, the key exchange fails. When the verification is successful, calculate the client secret value and the first exchange timestamp, obtain the current timestamp, and verify the first exchange timestamp according to the current timestamp through the discriminant. The discriminant is expressed as |T a -T now |<T thr , where T a Represents the first exchange timestamp, T now Represents the current timestamp, T thr Represents a preset threshold. When the first exchange timestamp does not satisfy the discriminant, the key exchange is stopped. When the first exchange timestamp satisfies the discriminant, through the formula F1(m a ) = l2|h1 to verify the client message. When the verification fails, the key exchange is terminated. When the verification is successful, the client signature information is verified successfully, and according to the server random value and the client secret value, through the formula ak = (g a ) b Calculate the shared key, where ak = as, ak represents the shared key, g a Represents the client secret value, b represents the server random value.

[0046] Preferably, the step S4 specifically includes obtaining the first login signature according to the to-be-logged-in user information through the formula Obtain a random number, calculate the secret value according to the random number through the formula R = g R Calculate the second login signature according to the secret value and the client public key through the formula h2 = H(y a ,R), where h2 represents the second login signature, y aDenote the client public key as \(P\), and \(R\) denote the secret value. The signature information is calculated based on the first signature information and the second signature information.

[0047] The working principle and usage process of the present invention are as follows:

[0048] Perform key exchange according to the user registration request to obtain a shared key, extract the user's biometric feature vector through feature extraction based on the user's biometric information, obtain the biometric value according to the user's biometric feature vector, obtain the user ciphertext information from the biometric value, user public key, shared key, and timestamp, verify the timestamp to obtain the verification result, store the biometric value and user public key in the database, obtain the registration ciphertext information according to the verification result and verification timestamp, obtain the verification result and verification timestamp from the registration ciphertext information, verify the verification timestamp to obtain the registration result, collect the biometric information of the user to be logged in according to the user login request, sign the biometric information of the user to be logged in to obtain the signature information, obtain the login ciphertext information from the biometric information of the user to be logged in, signature information, and login timestamp, and upload the login ciphertext information to the server. The server decrypts the ciphertext information using the shared key, performs biometric matching by calling the database according to the biometric information of the user to be logged in to obtain the matching result, verifies the signature information according to the matching result to obtain the second verification result and the second verification timestamp, and obtains the login verification ciphertext through an encryption algorithm, and sends the login verification ciphertext to the client. The client verifies the login verification ciphertext to obtain the identity verification result.

[0049] The program code included in the method in the embodiments of the present invention can be transmitted by any suitable medium, including but not limited to wireless, wire, optical cable, etc., or any suitable combination of the above. The computer program code for performing the operations of the present invention can be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0050] The above are only the preferred embodiments of the present invention, and do not impose any form of limitation on the present invention. Although the present invention has been disclosed above with the preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some changes or modifications to equivalent embodiments with equivalent changes within the scope of the technical solution of the present invention. However, as long as it does not depart from the content of the technical solution of the present invention, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. An authentication method based on digital signature technology, characterized in that, Specifically, it includes the following steps: S1: Obtain a user registration request, perform key exchange according to the user registration request to obtain a shared key, and the shared key carries a timestamp; S2: Collect user biometric information, obtain a user biometric feature vector through feature extraction according to the user biometric information, obtain a biometric feature value according to the user biometric feature vector, call the user's public key, and process the biometric feature value, the user's public key, the shared key, and the timestamp through an encryption algorithm to obtain user ciphertext information, and upload the ciphertext information to the server; S3: The server receives the user ciphertext information, processes the ciphertext information through a decryption algorithm to obtain the biometric feature value, the user's public key, the shared key, and the timestamp, verify the timestamp to obtain a verification result, the verification result carries a verification timestamp, store the biometric feature value and the user's public key in the database according to the verification result, process the verification result and the verification timestamp through an encryption algorithm to obtain registration ciphertext information, and transmit the registration ciphertext information to the client. The client receives the registration ciphertext information, processes the registration ciphertext information through a decryption algorithm to obtain the verification result and the verification timestamp, and verify the verification timestamp to obtain a registration result; S4: Obtain a user login request, collect the biometric information of the user to be logged in according to the user login request, sign the biometric information of the user to be logged in to obtain signature information, the signature information includes the requested login time, obtain a login timestamp according to the requested login time, and process the biometric information of the user to be logged in, the signature information, and the login timestamp through an encryption algorithm to obtain login ciphertext information, and upload the login ciphertext information to the server; S5: The server decrypts the ciphertext information through the shared key to obtain the biometric information of the user to be logged in, the signature information, and the login timestamp, performs biometric matching on the biometric information of the user to be logged in by calling the database to obtain a matching result, verifies the signature information according to the matching result to obtain a second verification result and a second verification timestamp, and obtains a login verification ciphertext through an encryption algorithm according to the second verification result and the second verification timestamp, and sends the login verification ciphertext to the client; S6: The client decrypts the login verification ciphertext to obtain the second verification result and the second verification timestamp, and verifies the second verification timestamp to obtain an identity verification result, and the identity verification result includes successful user identity verification and failed user verification.

2. The authentication method based on digital signature technology according to claim 1, wherein The step S1 specifically includes the following steps: S101: The key exchange includes a terminal initialization phase, a key exchange phase, and a key calculation phase. Among them, the terminal initialization includes determining security parameters, a cyclic group, and a generator, obtaining a client private key and a server private key, obtaining a client public key based on the generator and the client private key, obtaining a server public key based on the generator and the server private key, and issuing a client certificate and a server certificate to the client and the server by a CA institution; S102: The key exchange phase includes the client determining a client random number and a first exchange timestamp, obtaining client signature information through client signature based on the client random number and the first exchange timestamp, sending the client signature information and the client certificate to the server, the server determining a server random number and a second exchange timestamp based on the client signature information and the client certificate, obtaining server signature information through server signature based on the server random number and the second exchange timestamp, and sending the server signature information and the server certificate to the client; S103: The key calculation phase includes the client verifying the server certificate to obtain a first verification result, verifying the client signature information based on the first verification result to obtain a first validation result, calculating the shared key based on the first validation result, the server verifying the client certificate to obtain a second verification result, verifying the client signature information based on the second verification result to obtain a second validation result, and calculating the shared key based on the second validation result.

Images