Two-factor authentication method and system

Abstract

The application relates to the technical field of computer security, and discloses a two-factor authentication method and system, which is based on a two-factor authentication technology of biological information and homomorphic encryption. In the method, a public key encryption scheme of homomorphic encryption and a hash function with a robust reserved predicate relation are used to realize an authentication process, and the method has the ability to resist replay attacks and tolerate an adversary obtaining a database. Specifically, the method uses a random number generated by a server to resist replay attacks, and uses two-factor authentication of a biological authentication factor and a private key authentication factor to tolerate an adversary obtaining the database of the server. Meanwhile, the method uses the hash function with the robust reserved predicate relation to protect biological feature information of a user, and uses the public key encryption scheme of homomorphic encryption to protect private key information of the user. The application significantly improves the security and efficiency of authentication, and can better meet the needs of users.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, in particular to identity authentication technology. BACKGROUND

[0002] This section is intended to provide background or context to the embodiments of the application recited in the claims. The description herein does not constitute admission that the prior art is prior art nor does it constitute an admission of any description in this section as prior art to an application described herein and / or in another application also owned by the applicant of the present application.

[0003] Homomorphic encryption is a special encryption method that allows certain calculations on ciphertext to produce results identical to those obtained by computing on the corresponding plaintext. In simple terms, it is to perform calculations in the ciphertext domain without decrypting to obtain plaintext. Homomorphic encryption can be used to protect data privacy while allowing data processing in encrypted state, thus realizing the security of data sharing and processing. Homomorphic encryption can be divided into two types: fully homomorphic encryption and partially homomorphic encryption. The former can perform any calculation, and the latter can only perform specific type of calculation. Homomorphic encryption has been widely applied in cloud computing, Internet of Things, blockchain and other fields.

[0004] Two-factor authentication scheme refers to an authentication scheme that uses two different identity authentication factors to verify user identity. Usually, the two factors include user's physical characteristics (such as fingerprint, facial recognition, iris scan, etc.) and a secret factor (such as password, private key, etc.). In the two-factor authentication scheme, the user needs to provide both factors to pass the identity verification. Compared with single-factor authentication, two-factor authentication scheme is more secure because an attacker needs to obtain both factors to successfully impersonate a user.

[0005] The following further introduces the two-factor authentication scheme in the prior art.

[0006] Referring to Figure 1 User registration phase to the server. In the registration phase, first, the user calls the key generation algorithm of homomorphic encryption to generate a pair of public and private keys (pk, sk) <- HE.KeyGen(1 λ ), and collects the user's facial information feature vector Γ = (Γ1, …, Γ k ). Then, call the encryption algorithm of homomorphic encryption to get c i = (α i , β i ) <- HE.Enc(pk, Γ i ). Send ID and ciphertext c1, …, c k and public key pk to the server, and the server stores them.

[0007] In the authentication phase, the BlindESED algorithm is used to represent the blind squared Euclidean distance algorithm.

[0008] Referring toFigure 2 When a user wants to authenticate, the following steps are performed:

[0009] Step 1: First, sample the facial biometric features to obtain Γ′=(Γ′1,…,Γ′). k ′), will include the user's ID and C i ′=(α i ,β i )←HE.Enc(pk,Γ i ′) is sent to the server.

[0010] Step 2: The server receives C i Afterwards, r0 and r1 are uniformly and randomly generated, and the blind squared Euclidean distance calculation algorithm is called to obtain the second-order ciphertext S. * =(α * ,β * Send it to the user.

[0011] Step 3: The user receives S * Then, the decryption algorithm s is called. * ←HE.Dec(sk,S) * Send it to the server.

[0012] Step 4: The server determines the server's actions based on the s data. * Calculate the threshold s and compare it with the standard threshold to determine whether authentication is successful.

[0013] However, the above solution has the following technical problems:

[0014] Unable to defend against replay attacks: Malicious users can pass authentication by replaying the first message without knowing the user's facial feature vector, so this scheme cannot prevent replay attacks.

[0015] The security model is weak because it doesn't consider the possibility of an adversary stealing database content. However, if we consider an adversary stealing registration information C from the server's database, once they obtain the user's private key authentication factor sk, they can decrypt C to obtain the user's biometric authentication factor Γ. This gives the adversary two authentication factors, allowing them to impersonate the user and pass authentication.

[0016] Low efficiency: This scheme uses a quadratic homomorphic encryption scheme, which has low encryption and decryption efficiency, and therefore may face efficiency problems in practical applications.

[0017] Therefore, the above solutions have low security and low efficiency, and cannot well meet the needs of users. Summary of the Invention

[0018] The purpose of this application is to provide a two-factor authentication method and system to solve the problems mentioned in the background art.

[0019] This application discloses a two-factor authentication method, including:

[0020] Step A: The server calls the public-key encryption key generation algorithm to generate the first public-private key pair, and samples the robust hash function that preserves the predicate relation to obtain h and sets it as a system parameter. The database is initialized to empty and stores the first public-private key pair and h.

[0021] Step B: During the user registration phase, the user generates a second public-private key pair using a homomorphic encryption key generation algorithm, samples their biometric features, and encrypts the ciphertext c using the biometric authentication factor w and the public key of the second public-private key pair. w Meanwhile, the user encrypts the random number s using the public key of the first private key pair to obtain c. s The second public-private key pair has its private key stored in the user's device, and the ciphertext c w c s The public key of the second public-private key pair is stored on the server;

[0022] Step C: In the user authentication phase, the user's private key information is protected by homomorphic public key encryption, and two-factor authentication using biometric authentication factor and private key authentication factor is used. The user's biometric information is protected by a robust hash function that preserves the predicate relation.

[0023] In a preferred embodiment, in step A, the server first calls the key generation algorithm for public-key cryptography (PKE) to generate a public-private key pair (pk). s ,sk s Then, the robust hash function RPPH that preserves predicate relations is sampled to obtain h, and h is used as the system parameter pp. 2fa Configure the settings and generate a public / private key pair (pk). s ,sk s ) and h are stored on the server, where pk s It is a public key generated by the server, used for encryption challenges and to verify the user's authentication factor, sk s It is the server's private key, used to decrypt received information.

[0024] In a preferred embodiment, in step B, the user generates a public-private key pair (pk) using a public-key key generation algorithm. c ,sk c )←PKE.KeyGen(1 λ The system samples its own biometric features w←Sample(W), then performs a hash operation on the biometric authentication factor w to obtain h(w), and then uniformly and randomly generates s∈{0,1}. λ s∈{0,1} λAdd h(w) and call pk c Encryption yields ciphertext c w Meanwhile, the user encrypts the random number s using the server's public key to obtain the ciphertext c. s User secret storage sk c , will (id) c c w c s , pk c ) and sent to the server, where id c The user's identity identifier is represented by w, the user's biometric authentication factor is represented by h. w pk represents the hash value obtained after performing a hash operation on the biometric authentication factor w. c sk represents the user-generated public key. c c represents the user-generated private key authentication factor. w c s The ciphertext is obtained using two public keys and a random number s, respectively.

[0025] In a preferred embodiment, the private key authentication factor is stored confidentially by the user, and only the user knows its value; no one else can obtain it.

[0026] In a preferred embodiment, the user's biometrics are one or any combination of the following: the user's facial image, the user's fingerprint, and the user's iris.

[0027] In a preferred embodiment, step C further includes the following steps:

[0028] The user requests a service from the server, sending a request message (id). c The request is sent to the server to initialize. Among them, Ψ C Indicates the user's current execution state, with Two states; Ψ S This indicates the current execution state of the server, with two states: {0, 1}. It is initialized to...

[0029] The server first initializes Retrieve the registration information corresponding to the user's identity identifier (idc) from the database. If not found, return Ψ. S =0, otherwise return the corresponding homomorphic encryption and biometric authentication factor ciphertext c. w c s PK with public key c Randomly generate string r s ←{0, 1} λ And send it to the user, the user receives r sThen, it samples the biometric features to obtain w′ and generates a random string r. c ←{0, 1} λ ; then the user client performs a PK c and r c Encryption yields the ciphertext cK, which is then used to PK. s encrypting with cK to obtain c1, and then using it to PK. s and h(w′)-r s -r c Encrypt the result to obtain c2, and return c = (c1, c2) to the server;

[0030] After the server receives c = (c1, c2), it first uses sk s Decrypt message m using c1 and then perform a PK on m. c The re-encryption below yields c m Encrypted PK s c1 gets cK, then pk c and r s Re-encrypt to obtain ciphertext c r Then call the ciphertext c. m ,cK,public key pk c The ciphertext c′ is obtained by performing the Eval operation in RPPH, and then the user's public key pk is used. c and c′, c r The ciphertext c is obtained by performing the Eval operation in RPPH. hw Then decrypt sk s c s Get s′, for pk c The ciphertext c is obtained by performing encryption operations on s′ in RPPH. s′ Call pk c c w and c s′ The ciphertext c is obtained by performing the Eval operation in RPPH. hw Immediately afterwards, the server called pk. c c hw′ c hw The Eval operation in RPPH is performed to generate the ciphertext c″. After that, the server randomly generates the string r←{0,1}. λ Call pk c The final ciphertext is obtained by performing the Eval operation in RPPH on r and c″. And calculate the hash value u = H(r) of r, and finally call H2(cK) and The encryption algorithm used to perform authentication encryption (AE) produces the ciphertext (ct), which is then sent to the user.

[0031] After receiving the encrypted ct, the user sets the state Ψ. CIf the condition is "finished", then the decryption algorithm of the authentication encryption scheme is called, using H2(cK) and ct to decrypt and obtain c′. If c′ = ⊥, then return and terminate; otherwise, divide c′ into... And for sk c , The PRPH decryption algorithm is run to obtain r′, then it checks if H(r′) = u exists; otherwise, the process terminates. Finally, the hash value v = H1((r′) is calculated. s ,c,ct,r′)) and send the result to the server; the server receives the hash value v, compares v with H1((r s Are c, ct, r′) equal?

[0032] In a preferred example, if v is equal to H1((r) s If c, ct, r) are equal, authentication is successful; otherwise, authentication fails.

[0033] This application also discloses a two-factor authentication system including:

[0034] Memory, used to store computer-executable instructions; and,

[0035] A processor configured to implement the steps of the method as described in any one of claims 1 to 8 when executing the computer-executable instructions.

[0036] This application also discloses a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 8.

[0037] This application presents a two-factor authentication scheme based on biometrics and homomorphic encryption, aiming to improve the security and efficiency of authentication. The scheme uses a public-key homomorphic encryption scheme and a robust hash function that preserves predicate relations to implement the authentication process, and is capable of resisting replay attacks and tolerating adversaries gaining access to the server's database. Specifically, the scheme resists replay attacks by having the server randomly generate random numbers; and uses two-factor authentication with both biometric and private key authentication factors to tolerate adversaries gaining access to the server's database. Simultaneously, the scheme uses a robust hash function that preserves predicate relations to protect the user's biometric information and a public-key homomorphic encryption scheme to protect the user's private key information. This application significantly improves the security and efficiency of authentication, better meeting user needs.

[0038] The specification of this application contains numerous technical features distributed across various technical solutions. Listing all possible combinations of these technical features (i.e., technical solutions) would make the specification excessively lengthy. To avoid this problem, the various technical features disclosed in the above-described invention, the various technical features disclosed in the following embodiments and examples, and the various technical features disclosed in the accompanying drawings can be freely combined to form various new technical solutions (all of which are considered to have been described in this specification), unless such a combination of technical features is technically infeasible. For example, one example discloses feature A+B+C, and another example discloses feature A+B+D+E. Features C and D are equivalent technical means that serve the same function, and technically only one needs to be used; they cannot be used simultaneously. Feature E can technically be combined with feature C. Therefore, the solution A+B+C+D should not be considered as described because it is technically infeasible, while the solution A+B+C+E should be considered as described. Attached Figure Description

[0039] Figure 1 This is a diagram illustrating the user registration process with the server in existing authentication technologies.

[0040] Figure 2 This is a diagram illustrating the user authentication process with the server in existing authentication technologies.

[0041] Figure 3 This is a flowchart illustrating a two-factor authentication method according to an embodiment of this application;

[0042] Figure 4 This is a schematic diagram of an experiment on the integrity of encrypted authentication according to an embodiment of this application;

[0043] Figure 5 This is a schematic diagram of a two-factor authentication protocol based on biometrics and homomorphic encryption technology in the two-factor authentication method of this application. Detailed Implementation

[0044] In the following description, many technical details are presented to help the reader better understand this application. However, those skilled in the art will understand that the technical solutions claimed in this application can be implemented even without these technical details and various variations and modifications based on the following embodiments.

[0045] Explanation of some concepts:

[0046] Authentication factors: Evidence provided by the party being authenticated that can prove their identity is called authentication factors. Authentication factors can be PIN values, password values, physical non-cloning function values, or inherent biometric features such as fingerprints or facial features.

[0047] Two-factor authentication: Two-factor authentication refers to authentication using two different authentication factors. Single-factor authentication refers to authentication using a single authentication factor. With the increasing prevalence of remote services, security requirements are rising, and single-factor authentication may not be sufficient. Therefore, two-factor authentication is increasingly being considered for application in some authentication schemes. Two-factor authentication is more secure than single-factor authentication. Its advantage is that even if one of the two authentication factors is obtained by an adversary, the other can still guarantee the security of the protocol.

[0048] Client-server authentication system: The system consists of one user and one server. The user authenticates with the server using a client device to obtain services. The server verifies the user's identity by executing an authentication protocol and then provides services to the authenticated user.

[0049] Adversary offensive behavior: Based on the nature of the adversary's offensive behavior, it can be divided into two categories.

[0050] (1) Passive attack: The adversary can observe every message or data sent or received in the communication, but cannot update or modify them. For example, eavesdropping is a passive attack.

[0051] (2) Active attack: The adversary can modify, replay, or intercept messages transmitted in the channel.

[0052] Security Model:

[0053] In a client-server authentication system, based on the adversary's role and the nature of the aforementioned attack behaviors, adversaries can be categorized into the following three types:

[0054] (1) Malicious server: Malicious server will target a client and try to obtain the user's privacy information related to authentication factors through some active attacks and passive attacks;

[0055] (2) Honest but curious server: An honest but curious server will target a client, execute the protocol normally, and try to learn the other party's private information from the process of executing the protocol normally, but the server will not launch a malicious active attack.

[0056] (3) Malicious users: Malicious users can launch both passive attacks and malicious active attacks against the server. They may even steal some of the target user's authentication factors (but not all of them) to impersonate the target user and achieve the purpose of authentication.

[0057] The above three adversaries can be combined to obtain the following two security models and security objectives:

[0058] Model 1: The adversary can be a malicious server or a malicious user.

[0059] Model 2: The enemy can be an honest but curious server, or a malicious user.

[0060] Security objectives: When the adversary is a malicious server or an honest but curious server, the goal of two-factor authentication is to prevent the adversary from obtaining the secret information supporting the user's authentication factors; when the adversary is a malicious user, the goal of two-factor authentication is to prevent the adversary from impersonating other legitimate users to pass authentication.

[0061] Based on the definition of adversary types, Model 1 is stronger than Model 2.

[0062] The specific application scenarios of this application are described below. This application can be applied to scenarios such as e-commerce and online banking, where users obtain services through two-factor authentication. Users must possess both authentication factors to pass authentication; if an adversary steals one authentication factor and the other is missing, authentication will fail. Compared to single-factor authentication, two-factor authentication significantly raises the authentication threshold and prevents unauthorized users from abusing the power of authorized users.

[0063] After in-depth research and analysis, the inventors of this application have creatively proposed a new two-factor authentication method and system to address the technical problems raised in the background art. This application designs a novel and efficient two-factor authentication protocol based on biometrics and homomorphic encryption technology.

[0064] The two-factor authentication method in this application is manifested as follows: one authentication factor is the user's biometric information. Another authentication factor is the user's private key sk. c .

[0065] The two-factor authentication protocol in this application considers a stronger security model (server-initiated malicious active attack), and the authentication effect to be achieved is as follows:

[0066] 1. Legitimate users possess two authentication factors: their biometric information and their private key. With the help of these two factors, users can authenticate their identity with the server.

[0067] 2. An adversary may steal one of the user's authentication factors (it may steal the user's biometric authentication factor or the user's private key authentication factor, but not both). The missing other authentication factor can ensure that the adversary cannot impersonate the user to authenticate to the server.

[0068] Therefore, the two-factor authentication proposed in this application is a more secure and efficient method of identity authentication, which can effectively defend against malicious attacks. In practical applications, this authentication protocol can be applied to various scenarios, such as identity authentication in finance, e-commerce, and the Internet of Things.

[0069] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0070] The first embodiment of this application relates to a two-factor authentication method, the process of which is as follows: Figure 3 As shown, the method includes the following steps:

[0071] Step 101: The server calls the public-key encryption key generation algorithm to generate the first pair of public and private keys, and samples the robust hash function that preserves the predicate relation to obtain h and sets it as a system parameter. The database DB is initialized to be empty and the first pair of public and private keys and h are stored.

[0072] Step 102: During the user registration phase, the user generates a second public-private key pair using a homomorphic encryption key generation algorithm, samples their biometric features, and encrypts the ciphertext c using the biometric authentication factor w and the public key of the second public-private key pair. w Meanwhile, the user encrypts the random number s using the public key of the first private key pair to obtain c. s The second public-private key pair has its private key stored in the user's device, and the ciphertext c w c s The public key of the second public-private key pair is stored on the server;

[0073] Step 103: In the user authentication phase, the user's private key information is protected by homomorphic public key encryption, and two-factor authentication using biometric authentication factor and private key authentication factor is used. The user's biometric information is protected by a robust hash function that preserves the predicate relation.

[0074] A homomorphic encryption scheme HE = (HE.KeyGen, HE.Enc, HE.Dec, HE.Eval) consists of four algorithms:

[0075] (pk, sk) ← HE.KeyGen(1 λ ): Input security parameter λ to generate a public-private key pair (pk, sk).

[0076] c←HE.Enc(pk, m): Input public key pk and message m, output ciphertext c.

[0077] m←HE.Dec(sk, c): Input private key sk and ciphertext c, output decrypted message value m.

[0078] c′←HE.Eval(pk,C,c1,…,c n Input public key pk, circuit C, and n ciphertexts c1, ..., cn: n Output the ciphertext c′.

[0079] Homomorphic encryption schemes are secure against plaintext attacks, which is equivalent to semantic security. The homomorphism of HE (Homomorphic Encryption Scheme) means that for a given family of circuits... If for all All circuit inputs x1, ..., x n have

[0080] Pr[HE.Dec(sk,HE.Eval(pk,C,c1,…,c n ))≠C(x1,…,x n )]=negl(λ),

[0081] Where (pk, sk) ← HE.KeyGen(1 λ And c i =HE.Enc(pk, x) i We use neggl(λ) to denote negligible quantities.

[0082] PKE = (PKE.KeyGen, PKE.Enc, PKE.Dec) constitutes a public-key encryption scheme. The definitions of these three algorithms are the same as the first three algorithms of the homomorphic encryption scheme mentioned above.

[0083] The definition of Robust Property-PreservingHash (RPPH) is explained below.

[0084] Definition 1: [Robust Property-Preserving Hash (RPPH)] for a predicate relation P with two inputs: {0, 1} n ×{0, 1} n →{0, 1, ⊥}, a robust family of predicate-predicate hashes H = {h: {0, 1} n →{0,1} m} is a family of functions that can be efficiently computed, and has the following two algorithms, which are compressible, correct and robust.

[0085] RPPH algorithm:

[0086] • Sample(λ) → h: This is a multinomial-time algorithm that produces a random hash function h;

[0087] • Eval(h, y1, y2) → 0 / 1: This is a deterministic multinomial-time algorithm given input And y1, y2∈{0,1} m Output a single bit.

[0088] RPPH compressibility: The length n of the hash input must be greater than the length m of the output.

[0089] Correctness of PPH: Yes The following equation holds true:

[0090]

[0091] Robustness of RPPH: for any polynomial adversary It was formally established

[0092]

[0093] In this example, the inventors consider predicate relations for Hamming distance. For 0 < t < n, Hamming distance predicate relation between two inputs (HAM) n，t (x1, x2) is defined as

[0094]

[0095] Among them, reference [2] ([2] Justin Holmgren, Minghao Liu, LaKyah Tyner, Daniel Wichs: Nearly Optimal Property Preserving Hashing. CRYPTO(3)2022:473-502) provides an efficient construction of RPPH for Hamming distance predicate relations.

[0096] Definition 2: [Authenticated Encryption (AE)] An authenticated encryption scheme consists of two algorithms:

[0097] c←AE.Enc(K, m): Encryption algorithm AE.Enc takes key K as input and message m as input, and outputs ciphertext c;

[0098] m′←AE.Dec(K, c): Decryption algorithm AE.Dec takes key K and ciphertext c as input and outputs message m′.

[0099] AE correctness. For all have

[0100] AE.Dec(K,AE.Enc(K,m))=m.

[0101] Definition 3: [Ciphertext Integrity of Authentication Encryption] An authentication encryption scheme possesses ciphertext integrity if it is true for all PPT adversaries. have

[0102]

[0103] like Figure 4 As shown.

[0104] Definition 4: [Semantic Security of Authentication Encryption] An authentication encryption scheme has ciphertext integrity if it is true for all PPT adversaries. have

[0105]

[0106] In this example, the specific construction of the two-factor authentication protocol based on biometrics and homomorphic encryption is as follows: Figure 5 The following describes each step in detail.

[0107] In step 101, the server first calls the public-key cryptography (PKE) key generation algorithm to generate a public-private key pair (pk). s ,sk s Then, the robust hash function RPPH, which preserves predicate relations, is sampled to obtain h. The database is initialized to empty, and h is used as the system parameter pp. 2fa Configure the settings and generate a public / private key pair (pk). s ,sk s ) and h are stored on the server, where pk s It is a public key generated by the server, used for encryption challenges and to verify the user's authentication factor, sk s It is the server's private key, used to decrypt received information.

[0108] In step 102, the user generates a public-private key pair (pk) using a public-key key generation algorithm. c ,sk c )←PKE.KeyGen(1 λ The system samples its own biometric features w←Sample(S), then performs a hash operation on the biometric authentication factor w to obtain h(w), and then uniformly and randomly generates s∈{0,1}. λ h(w) minus s∈{0,1} λ And call pk c Encryption yields ciphertext c w Meanwhile, the user encrypts the random number s using the server's public key to obtain the ciphertext c. s User secret storage sk c , will (id) c cw c s , pk c The data is sent to the server, and the server updates the database DB: = DB∪(id). c c w c s , pk c ).

[0109] Among them, id c The user's identity identifier is represented by w, the user's biometric authentication factor is represented by h. w pk represents the hash value obtained after performing a hash operation on the biometric authentication factor w. c This represents the user-generated public key, used to encrypt and send biometric authentication factors to the server. c This represents the user-generated private key authentication factor, used to decrypt the challenge number sent by the server during the authentication process to generate a response. w c s The ciphertext is obtained using two public keys and a random number s, respectively. The private key authentication factor is stored confidentially by the user, and only the user knows its value; others cannot obtain it.

[0110] In step 103, during the user authentication phase, the user requests a service from the server, sending a request message (id). c The request is sent to the server to initialize. Among them, Ψ C Indicates the user's current execution state, with Two states; Ψ S This indicates the current execution state of the server, with two states: {0, 1}. It is initialized to...

[0111] The server first initializes Retrieve the registration information corresponding to the user's identity identifier (idc) from the database. If not found, return Ψ. S =0, otherwise return the corresponding homomorphic encryption and biometric authentication factor ciphertext c. w c s PK with public key c Randomly generate string r s ←{0, 1} λ And send it to the user, the user receives r s Then, it samples the biometric features to obtain w′ and generates a random string r. c ←{0, 1} λ ; then the user client performs a PK c and r c Encryption yields the ciphertext cK, which is then used to PK. s encrypting with cK to obtain c1, and then using it to PK.s and h(w′)-r s -r c Encrypt the result to obtain c2, and return c = (c1, c2) to the server;

[0112] After the server receives c = (c1, c2), it first uses sk s Decrypt message m using c1 and then perform a PK on m. c The re-encryption below yields c m Encrypted PK s c1 gets cK, then pk c and r s Re-encrypt to obtain ciphertext c r Then call the ciphertext c. m ,cK,public key pk c The ciphertext c′ is obtained by performing the Eval operation in RPPH, and then the user's public key pk is used. c and c′, c r The ciphertext C is obtained by performing the Eval operation in RPPH. hw′ Then decrypt sk s c s Get s′, for pk c The ciphertext c is obtained by performing encryption operations on s′ in RPPH. s′ Call pk c c w and c s′ The ciphertext c is obtained by performing the Eval operation in RPPH. hw Immediately afterwards, the server called pk. c c hw′ c hw The Eval operation in RPPH is performed to generate the ciphertext c″. After that, the server randomly generates the string r←{0,1}. λ Call pk c The final ciphertext is obtained by performing the Eval operation in RPPH on r and c″. And calculate the hash value u = H(r) of r, and finally call H2(cK) and The encryption algorithm used to perform authentication encryption (AE) produces the ciphertext (ct), which is then sent to the user.

[0113] After receiving the encrypted ct, the user sets the state Ψ. C If the condition is "finished", then the decryption algorithm of the authentication encryption scheme is called, using H2(cK) and ct to decrypt and obtain c′. If c′ = ⊥, then return and terminate; otherwise, divide c′ into... And for sk c , The PRPH decryption algorithm is run to obtain r′, then it checks if H(r′) = u exists; otherwise, the process terminates. Finally, the hash value v = H1((r′) is calculated. s ,c,ct,r′)) and send the result to the server; the server receives the hash value v, compares v with H1((r s Are c, ct, r′) equal?

[0114] If v is equal to H1((r) s If c, ct, r) are equal, authentication is successful; otherwise, authentication fails.

[0115] Among them, (id) c (Request) refers to the request message sent by a user to a server when requesting a service, where id c This represents the user's identity identifier, and Request represents the content of the user's request. s This refers to the challenge number randomly generated by the server in specific step 202 below, used to prevent replay attacks. c It is a randomly generated string on the user side. In the specific step 203 below, pk s and h(w′)-r s -r c Encryption yields c2, for PK c and r c The encryption process yields c1, and c = (c1, c2) is returned to the server for authentication in subsequent steps. This method is resistant to replay attacks because a malicious attacker cannot know the true number of challenges r. s and r c This prevents the reuse of previous authentication requests.

[0116] This step embodies the characteristics of "using a homomorphic public-key encryption scheme to protect user private key information, thereby tolerating adversaries gaining access to the database", "using two-factor authentication with biometric and private key authentication factors to tolerate adversaries gaining access to the server's database", and "using a robust hash function that preserves predicate relations to protect user biometric information".

[0117] Optionally, this step may further include the following sub-steps:

[0118] Step 201: The user requests a service from the server, sending a request message (id). c The request is sent to the server to initialize.

[0119] Step 202: The server first initializes Retrieve user identification ID from the database. c If the corresponding registration information is not found, return Ψ.S =0. Otherwise, return the corresponding homomorphic encryption and biometric authentication factor ciphertext c. w c s PK with public key c Randomly generate string r s ←{0, 1} λ And send it to the user;

[0120] Step 203: The user receives r s Then, it samples the biometric features to obtain w′ and generates a random string r. c ←{0, 1} λ ; then the user client performs a PK c and r c Encryption to obtain cK, for PK s encrypting with cK to obtain c1, and then using it to PK. s and h(w′)-r s -r c Encrypt the result to obtain c2, and return c = (c1, c2) to the server;

[0121] This step demonstrates how to "use a homomorphic public-key encryption scheme to protect the user's private key information, thereby tolerating adversaries gaining access to the database." In this step, the user generates a random number r. c The random number r is sent to the server via encryption using both public and private keys on the user's end. The server cannot access the user's private key authentication factor and therefore cannot correctly decrypt the random number r. c The value is incorrect, thus preventing authentication.

[0122] Furthermore, this step also demonstrates "using two-factor authentication with biometric authentication factors and private key authentication factors to tolerate adversaries gaining access to the server's database." In this process, the user encrypts their own private key authentication factor and samples their own biometric data to obtain a biometric authentication factor. The two factors are then combined for authentication to ensure that the authentication request comes from a legitimate user.

[0123] Step 204:

[0124] After the server receives c = (c1, c2), it first uses sk s Decrypt message m using c1 and then perform a PK on m. c The re-encryption below yields c m Encrypted PK s c1 gets cK, then pk c and r s Re-encrypt to obtain ciphertext c r Then call the ciphertext c. m ,cK,public key pk cThe ciphertext c′ is obtained by performing the Eval operation in RPPH, and then the user's public key pk is used. c and c′, c r The ciphertext c is obtained by performing the Eval operation in RPPH. hw′ Then decrypt sk s c s Get s′, for pk c The ciphertext c is obtained by performing encryption operations on s′ in RPPH. s′ Call pk c c w and c s′ The ciphertext c is obtained by performing the Eval operation in RPPH. hw Immediately afterwards, the server called pk. c c hw′ c hw The Eval operation in RPPH is performed to generate the ciphertext c″. After that, the server randomly generates the string r←{0,1}. λ Call pk c The final ciphertext is obtained by performing the Eval operation in RPPH on r and c″. And calculate the hash value u = H(r) of r, and finally call H2(cK) and The encryption algorithm used to perform authentication encryption (AE) produces the ciphertext (ct), which is then sent to the user.

[0125] Step 205: After receiving the encrypted ct, the user sets the status Ψ. C The process is completed. Then, the decryption algorithm for the authentication encryption scheme is called, employing H2(cK) and ct to decrypt and obtain c′. If c′ = ⊥, the process returns and terminates. Otherwise, c′ is divided into... And for sk c , The PRPH decryption algorithm is run to obtain r′, then it checks if H(r′) = u exists; otherwise, the process terminates. Finally, the hash value v = H1((r′) is calculated. s ,c,ct,r′)) and send the results to the server;

[0126] Step 206: The server receives the hash value v and compares v with H1((r s Are c, ct, r′) equal?

[0127] Technical effects:

[0128] According to the above technical solution, the two-factor authentication scheme based on biometrics and homomorphic encryption aims to improve the security and efficiency of authentication. This scheme uses a public-key encryption scheme with homomorphic encryption and a robust hash function that preserves predicate relations to implement the authentication process, and it has the ability to resist replay attacks and tolerate adversaries gaining access to the database. Specifically, the scheme resists replay attacks by having the server randomly generate a challenge number in the second step and encrypt it using the user's public key; and it uses two-factor authentication with both biometric and private key authentication factors to tolerate adversaries gaining access to the server's database. Simultaneously, the scheme uses a robust hash function that preserves predicate relations to protect the user's biometric information and a semantically secure public-key encryption scheme to protect the user's private key information. The efficiency of this scheme is also optimized; compared to schemes using homomorphic encryption, this scheme is more efficient.

[0129] Technical effects:

[0130] As mentioned above, existing homomorphic encryption-based schemes suffer from the following technical problems: they cannot resist replay attacks; they cannot resist attacks from malicious servers; and they are inefficient. Compared with existing technologies, the technical solution of this application can resist replay attacks and attacks from malicious servers, while also being highly efficient. Specifically:

[0131] First, it is highly secure.

[0132] We analyze the security of the authentication protocol given in this patent under the following four scenarios:

[0133] The server involves a freshness number in both steps two and four, so each challenge is different. For an adversary to pass authentication, they must respond correctly to the freshness number; therefore, an adversary cannot replay the message to pass authentication.

[0134] An adversary only obtains the user's private key authentication factor, but lacks the user's other authentication factor—biometrics—and also the server's secret information. In this case, because the adversary does not possess the user's biometric information, due to the semantic security of PKE, it cannot forge or guess h. w The value of is thus lost, making it impossible to provide a ciphertext c that can be authenticated.

[0135] An adversary only obtains the user's biometric authentication factor, but does not have the user's other authentication factor—the private key—nor the server's secret information. In this case, since the adversary does not have the user's private key, according to the security definition of a semantically secure public-key encryption scheme, the adversary cannot correctly decrypt the value of the random number r′. Furthermore, according to the non-collision property of hash functions, the adversary cannot provide a hash value v that can pass authentication.

[0136] When an adversary steals the database containing user data stored on the server, they still cannot break the authentication scheme as long as they cannot simultaneously obtain both of the user's authentication factors. We will discuss the following two cases:

[0137] The adversary stole the server's database and obtained users' registration information (id). c c w c s , pk c At the same time, obtain the user's private key authentication factor sk c User registration information (id) in the database stolen by the adversary c c w c s , pk c In ), c w It is an encryption of h(w)-s using the user's public key. Even if an adversary decrypts it using the private key authentication factor, they can only obtain h(w)-s. Meanwhile, c s It is ciphertext encrypted with the server's public key and the blinding factor s. Due to the semantic security of PKE, an adversary cannot decipher the ciphertext from c. s The information of the blinding factor s is obtained. Because the blinding factor s masks h(w), the adversary cannot obtain any information about h(w), and therefore cannot impersonate the user to pass the server's authentication.

[0138] The adversary stole the server's database and obtained users' registration information (id). c c w c s , pk c At the same time, it obtains the user's biometric authentication factor. Due to the semantic security of PKE, adversaries cannot... The information about r is obtained from the hash function, and due to the collision resistance of the hash function, it is very difficult for an adversary to guess the hash value of r, thus failing to pass the server's authentication.

[0139] Second, scalability: The solution can be further extended to two-way authentication. While this protocol implements server-to-user authentication (one-way authentication), in steps two and four, the server can sign the messages it sends, and the user verifies the message signature. This enables user-to-server authentication, and ultimately, two-way authentication.

[0140] Furthermore, this application also provides a two-factor authentication system, including a memory for storing computer-executable instructions and a processor; the processor is used to implement the steps in the above-described method embodiments when executing the computer-executable instructions in the memory. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The aforementioned memory may be read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or solid-state drive, etc. The steps of the methods disclosed in the embodiments of this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

[0141] It should be noted that in this patent application, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. In this patent application, if it refers to performing an action according to an element, it means performing the action at least according to that element, including two cases: performing the action only according to that element, and performing the action according to that element and other elements. Expressions such as "multiple," "repeatedly," and "various" include two, two times, two kinds, and more than two, more than two times, and more than two kinds.

[0142] All documents mentioned in this application are considered to be incorporated in their entirety into the disclosure of this application so that they can serve as a basis for modifications if necessary. Furthermore, it should be understood that after reading the foregoing disclosure of this application, those skilled in the art can make various alterations or modifications to this application, and these equivalent forms also fall within the scope of protection claimed in this application.

Claims

1. A two-factor authentication method, characterized in that, include: Step A: The server calls a public-key encryption key generation algorithm to generate the first public-private key pair, and samples a robust hash function that preserves the predicate relation to obtain... This is set as a system parameter, the database is initialized to empty, and the first pair of public and private keys are stored. ; Step B: During the user registration phase, the user generates a second public-private key pair using a homomorphic encryption key generation algorithm, and samples their biometric features based on the biometric authentication factor. The ciphertext is obtained by encrypting the public key of the second public-private key pair. At the same time, the user uses the public key of the first private key pair to generate a random number. Encryption is performed to obtain The private key of the second public-private key pair is stored in the user's device, and the ciphertext... , The public key of the second public-private key pair is stored on the server; Step C: In the user authentication phase, the user's private key information is protected by homomorphic encryption of the public key, and two-factor authentication using biometric authentication factor and private key authentication factor is used. The user's biometric information is protected by a robust hash function that preserves the predicate relation. Step C further includes the following steps: The user requests a service from the server, sending a request message. Send to server, initialize ;in, Indicates the user's current execution state, with Two states; This indicates the current execution status of the server. Two states, initialized to ; The server first initializes Retrieve user identity identifier from database If the corresponding registration information is not found, return [the relevant information]. Otherwise, return the corresponding homomorphic encryption and biometric authentication factor ciphertext. , and public key Randomly generate strings And sent to the user, who received it. Subsequently, it obtained samples of biometric features. And generate a random string ; then the user end and Encryption to obtain ciphertext ,right and Encryption ,right and Encryption ,return Give it to the server; The server received Then, first use and Decryption yields the message and on conduct The re-encryption obtained ;use and Decryption Then to and Re-encrypt to obtain ciphertext Then call the ciphertext. , Public key The ciphertext is obtained by performing addition operations in homomorphic encryption. Then use the user's public key and , The ciphertext is obtained by performing addition operations in homomorphic encryption. Then decrypt , get ,right , The ciphertext is obtained by performing encryption operations in homomorphic encryption. , call , and The ciphertext is obtained by performing addition operations in homomorphic encryption. Immediately afterwards, the server made a call. , , Generate ciphertext by performing addition operations in homomorphic encryption After that, the server randomly generates a string. , call , , The final ciphertext is obtained by performing addition operations in homomorphic encryption. and calculate hash value Ultimately, the call and Perform authentication and encryption AE The encryption algorithm obtains the ciphertext Send to users; User received encrypted message Then, set the status. To complete this, the decryption algorithm of the authentication encryption scheme is then called. and Decryption ,like If it returns true, then terminate; otherwise, return true. Divided into And on , Running the homomorphic encryption decryption algorithm yields Then check if there is Otherwise, terminate; finally, calculate the hash value. The result is sent to the server; the server receives the hash value. ,Compare and Are they equal? 2. The method as described in claim 1, characterized in that, In step A, the server first uses the public key to encrypt. PKE The key generation algorithm generates a public-private key pair. Then, a robust hash function that preserves predicate relations is used. RPPH Sampling was performed and will As system parameters Configure the settings and generate a public / private key pair. and Stored in the server, where, It is a public key generated by the server, used to encrypt challenges and verify the user's authentication factor. It is the server's private key, used to decrypt received information.

3. The method as described in claim 2, characterized in that, In step B, the user generates a public-private key pair using a public-key key generation algorithm. And sample their own biometrics. Then, biometric authentication factors Perform a hash operation to obtain Then generate uniformly and randomly , and call Encryption yields ciphertext At the same time, the user uses the server's public key to generate a random number. Encryption yields ciphertext User secret storage ,Will And sent to the server, where, This represents the user's identity identifier. This represents the user's biometric authentication factor. Indicates the biometric authentication factor The hash value obtained after performing a hash operation. This represents the public key generated by the user. This represents the authentication factor of the user-generated private key. , To use two public keys and a random number respectively The obtained ciphertext.

4. The method as described in claim 3, characterized in that the private key authentication factor is stored confidentially by the user, and only the user knows its value, which cannot be obtained by others.

5. The method as described in claim 3, characterized in that, The user's biometrics are one of the following or any combination thereof: the user's facial image, the user's fingerprint, and the user's iris.

6. The method as described in claim 1, characterized in that, if and If they are equal, authentication is successful; otherwise, authentication fails.

7. A two-factor authentication system, characterized in that, include: Memory is used to store executable instructions for a computer; as well as, A processor configured to implement the steps of the method as described in any one of claims 1 to 6 when executing the computer-executable instructions.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 7.

Images