Identity authentication system and method based on national secret algorithm

Abstract

The present invention proposes an identity authentication method based on a national secret algorithm, which relates to the technical field of identity authentication. The method comprises: in response to a first input of a user, performing a first verification through a national secret algorithm; the first verification comprises user name and password verification; through the first verification, obtaining the user's first information, device information and location information; obtaining the user's login risk score according to the first verification, device information and location information, and determining whether to enter multi-level authentication according to the login risk score; real-time monitoring of each link in the authentication process and recording log information; determining abnormal authentication according to the log information; issuing an early warning and determining the lockout duration according to the abnormal authentication; and effectively improving the security and user experience of online services by integrating advanced cryptography technology and intelligent authentication strategies, which not only prevents malicious attacks but also avoids excessive restrictions on legitimate users.

Description

Technical Field

[0001] The present application relates to the field of identity authentication technology, and in particular to an identity authentication system and method based on a national secret algorithm. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent, especially in the field of user identity authentication. The traditional username and password verification method can no longer meet the growing security needs.

[0003] Traditional authentication methods, such as using only usernames and passwords, can no longer fully protect the security of user accounts. On the one hand, passwords may become unreliable due to various reasons (such as weak passwords, password leaks, etc.); on the other hand, changes in device and location information may also indicate potential security threats; traditional authentication mechanisms often cannot automatically adjust their security policies based on changes in user behavior, device information, or location information, resulting in an inability to respond to new attacks in a timely manner. Many authentication systems do not have a comprehensive risk scoring mechanism and cannot accurately assess the risk level of each login attempt, making it difficult to maintain user experience while ensuring security. Existing anomaly detection models may be too simple to distinguish between minor, moderate, and severe abnormal behaviors, resulting in either a high false alarm rate or the failure to identify real threats in a timely manner; in existing authentication methods, there is often a lack of real-time monitoring and logging during the authentication process, as well as an effective processing mechanism for abnormal authentication behaviors; this makes it difficult to detect and respond to security incidents in a timely manner, increasing the security risks of the system. Summary of the invention

[0004] In response to the above problems, this application proposes an identity authentication system and method based on the national secret algorithm. By integrating advanced cryptographic technology and intelligent authentication strategies, it effectively improves the security of online services and user experience, prevents malicious attacks, and avoids excessive restrictions on legitimate users.

[0005] The purpose of this application is achieved by the following technical solutions:

[0006] In a first aspect, the present application provides an identity authentication method based on a national secret algorithm, the method comprising:

[0007] In response to a first input from a user, a first verification is performed using a national encryption algorithm; the first verification includes a user name and password verification;

[0008] Obtaining the user's first information, device information, and location information through the first verification;

[0009] If the user's current location information is not in the preset area list, multi-level verification is performed;

[0010] Or, if the current user location information is in the preset area list, the login risk score of the user at the current location is obtained according to the user's current login device, login time, historical login device, historical login time, login frequency and verification process, and whether to enter the multi-level authentication is determined according to the user login risk score; wherein, the first preset time is determined by the frequency of changes in the user's login area in the historical records; within the first preset time, the user's historical normal login area is obtained as the preset area list;

[0011] Monitor each link of the authentication process in real time and record log information; determine abnormal authentication based on log information; issue warnings and determine the lockout duration based on abnormal authentication.

[0012] Preferably, the first verification includes:

[0013] In response to a first input from the user terminal through the login interface, the input password is calculated using the SM3 algorithm to generate a hash value;

[0014] Compare the generated hash value with the corresponding user hash value stored in the database; obtain a comparison result;

[0015] Obtain the user's device information and location information, and record the verification operation.

[0016] Preferably, the method comprises:

[0017] If the user's current location information is not in the preset area list, multi-level verification is performed;

[0018] If the current user location information is in the preset area list, the user's login device, login frequency and verification process at the location are obtained;

[0019] Obtain the login risk score of the user at the current location based on the user's current login device, login time, historical login device, historical login time, login frequency, and verification process;

[0020] If the generated hash value matches the stored hash value, the password verification is successful; determine whether to enter multi-level verification based on the login risk score;

[0021] If the generated hash value does not match the stored hash value, an error message will be fed back to the user, indicating that the username or password is incorrect; based on the login risk score and user settings, it is determined whether to pass another level of verification or repeat the first verification within a preset number of times.

[0022] Preferably, the method for obtaining the preset area list includes:

[0023] Obtain the change frequency of the user's login area in the historical records, and determine the first preset time according to the change frequency;

[0024] S = k * (Jc / Ja) * (N + 1) * Sy / Ny

[0025] Wherein, S is the first preset time of the user, N is the total number of changes in the logged-in area of the user in the past T days; k is adjusted as a coefficient, k > 0; Sy is the reference first preset time; Ny is the reference total number of changes in the logged-in area of the user in the past T days; Ny is greater than or equal to 1; Jc is the interval between the login time and the previous login time when the user makes the most recent location change, and Ja is the average value of the normal login time intervals between two adjacent location changes of the user in the past T days;

[0026] Within the first preset time, obtain the historical normal logged-in areas of the user as the preset area list.

[0027] Preferably, the obtaining the login risk score of the user at the current location according to the user's current logged-in device, login time, historical logged-in devices, historical login times, login frequency, and verification process includes:

[0028] Obtain the first score at this location based on the historical login frequency and the verification process;

[0029]

[0030] Wherein, Pi is the first score of the user at the i-th location; Fi is the login frequency of the user at the i-th location; Fa is the average value of the login frequencies of the user at multiple locations; Czi is the total number of logins of the user at the i-th location; Cci is the number of locked logins of the user at the i-th location; m is the number of login locations of the user;

[0031] w1 and w2 are weight coefficients;

[0032] Obtain the login risk score of the user at this location according to the user's current logged-in device, login time, and the first score; the login risk score is Pi2 = (1 + x1 + x2) * Pi

[0033] Wherein, if the current logged-in device is the same as the historical logged-in device at this location, then x1 = 0; if the current logged-in device is different from the historical normal logged-in device at this location, then 0 < x1 < 0.5; if the current login time is within the range of the historical normal login time at this location, then x2 = 0; if the current login time is different from the range of the historical normal login time at this location, then 0 < x2 < 0.5.

[0034] Preferably, the method includes:

[0035] If the login risk score is greater than the preset score threshold, a multi-level authentication prompt will be displayed; if the login risk score is less than or equal to the preset score threshold, the user will log in directly;

[0036] If the login risk score is less than or equal to the preset score threshold, but the current username or password is incorrect, determine whether to select other levels of verification based on the user's pre-settings; or repeat the first verification within a preset number of times.

[0037] Preferably, the multi-level authentication includes dynamic password, biometric identification and / or challenge response; including:

[0038] Generate a one-time password using a seed key and SM1 / SM3 algorithm based on the current time or event count, and perform dynamic password verification using the one-time password;

[0039] The user's biometric data is collected through a biometric device; the feature data is encrypted using a national encryption algorithm. After the server receives the encrypted biometric data, it is decrypted and compared with the stored feature template to obtain the biometric verification result through comparison;

[0040] Generate a random number as a challenge and send it to the user; obtain the response generated by the user based on the challenge, his or her own private key and the national encryption algorithm; verify the correctness of the response through the user's public key to obtain the challenge response result.

[0041] Preferably, the real-time monitoring of each link in the authentication process, recording log information; determining abnormal authentication according to the log information; issuing an early warning and determining the lockout duration according to the abnormal authentication, includes:

[0042] Collect log information during the user authentication process, including authentication time, authentication method, authentication result, device information, and location information;

[0043] Different evaluation dimensions are divided, including number of failures, device changes, geographic location changes, and time factors;

[0044] Calculate the score of each dimension; sum the weighted scores of each dimension to get the total abnormality score;

[0045] The abnormality levels are divided according to the total abnormality score; the abnormality levels include: slight abnormality, medium abnormality and severe abnormality; for severe abnormalities, the account is locked and the locking time is set.

[0046] Preferably, the lock duration is obtained by the following formula:

[0047] like

[0048] but:

[0049]

[0050] like

[0051] but:

[0052]

[0053] like

[0054] Then Bs=p*By;

[0055] Among them, Bs is the target account lock duration; Abz is the target account current login anomaly total score; Aby is the severe anomaly score threshold; r is the total number of authentications of the target account within the preset time; e is the number of times the target account has been locked in the preset time; Jlast is the time interval between the current time and the previous authentication; D j is the time of the target account's jth authentication, D j-1 is the time of the j-1th authentication of the target account, By is the reference lock-up period; h is the coefficient, h>1.

[0056] This application provides an identity authentication system based on a national secret algorithm, the system comprising:

[0057] A first verification module, configured to perform a first verification using a national encryption algorithm in response to a first input from a user; the first verification includes a user name and password verification;

[0058] A first acquisition module, used to acquire the user's first information, device information and location information through the first verification;

[0059] A determination module, used to perform multi-level verification if the user's current location information is not in the preset area list;

[0060] Or, if the current user location information is in the preset area list, the login risk score of the user at the current location is obtained according to the user's current login device, login time, historical login device, historical login time, login frequency and verification process, and whether to enter the multi-level authentication is determined according to the user login risk score; wherein, the first preset time is determined by the frequency of changes in the user's login area in the historical records; within the first preset time, the user's historical normal login area is obtained as the preset area list;

[0061] The monitoring module is used to monitor each link of the authentication process in real time and record log information; determine abnormal authentication based on log information; issue warnings and determine the lockout duration based on abnormal authentication.

[0062] The beneficial effects of the present invention include: dynamically generating a user login risk score based on the user's behavior, historical data and real-time verification results to determine whether an additional authentication layer needs to be started; automatically updating the preset security area based on the change frequency and time interval of the user's past login area to enhance the effectiveness of location verification; when the risk score exceeds the threshold, enabling multiple authentication methods such as dynamic passwords, biometrics or challenge responses to increase the complexity and security of authentication. By real-time monitoring of various indicators in the authentication process, such as the number of failures, equipment and geographical location changes, abnormal behavior is automatically identified and corresponding measures are taken, such as early warning and account locking; based on the quantitative analysis of abnormal behavior, the account locking time is dynamically adjusted, which not only prevents malicious attacks, but also avoids excessive restrictions on legitimate users. The hierarchical management and intelligent response of abnormal behavior reduce misjudgments and improve the overall stability and reliability of the system. The dynamic update mechanism of the preset area list enables the system to adapt to changes in user behavior and enhances the flexibility and effectiveness of the authentication mechanism. The multi-level authentication mechanism is activated when necessary to avoid unnecessary user interference and provide additional security in high-risk scenarios; the intelligent locking strategy reduces the ineffective occupation of system resources and ensures timely response to abnormal behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a schematic diagram of an identity authentication method based on a national secret algorithm provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] Below, the present application is further described in conjunction with the accompanying drawings and specific implementation methods. It should be noted that, under the premise of no conflict, the various embodiments or technical features described below can be arbitrarily combined to form a new embodiment.

[0065] See also Figure 1 , the embodiment of the present application provides an identity authentication method based on a national secret algorithm, the method comprising:

[0066] In response to a first input from a user, a first verification is performed using a national encryption algorithm; the first verification includes a user name and password verification;

[0067] Obtaining the user's first information, device information, and location information through the first verification;

[0068] If the user's current location information is not in the preset area list, multi-level verification is performed;

[0069] Or, if the current user location information is in the preset area list, the login risk score of the user at the current location is obtained according to the user's current login device, login time, historical login device, historical login time, login frequency and verification process, and whether to enter the multi-level authentication is determined according to the user login risk score; wherein, the first preset time is determined by the frequency of changes in the user's login area in the historical records; within the first preset time, the user's historical normal login area is obtained as the preset area list;

[0070] Monitor each link of the authentication process in real time and record log information; determine abnormal authentication based on log information; issue warnings and determine the lockout duration based on abnormal authentication.

[0071] The working principle and effect of the above technical solution are as follows: when the user makes the first input (usually inputs the username and password), the first verification is first performed through the national secret algorithm. This step uses the high security characteristics of the national secret algorithm to encrypt and verify the username and password submitted by the user to ensure the authenticity and integrity of the user's identity information. After passing the first verification, the system further obtains the user's first information (such as user ID, permission level, etc.), device information (such as device model, MAC address, etc.) and location information (such as IP address, geographic location, etc.). This information will serve as an important basis for subsequent risk assessment. Based on the collected user's first information, device information and location information, combined with the preset risk assessment model, the user's login risk score is calculated. The score reflects the risk level of the current login attempt. According to the login risk level, the system decides whether to enter the multi-level authentication process. If the risk score is low, it indicates that the current login attempt is relatively safe, and the user may be allowed to log in directly; if the risk score is high, the multi-level authentication mechanism is triggered, requiring the user to perform additional verification steps (such as dynamic passwords, biometrics, etc.) to improve the security of authentication.

[0072] During the entire authentication process, the operation of each link is monitored in real time, and the log information is recorded in detail. These log information include user input, verification results, risk assessment process, abnormal behavior, etc., which provide important basis for subsequent audit and security analysis. According to the abnormal patterns or specific rules in the log information, abnormal authentication behavior is automatically detected. Once an abnormal authentication is detected, the system immediately triggers the early warning mechanism to notify the administrator or user to pay attention to the potential security risks. At the same time, according to the nature and severity of the abnormal authentication, the corresponding lockout period is determined. During the lockout period, the system will limit or prohibit the user's login attempts to prevent further security risks.

[0073] In summary, the identity authentication method based on the national secret algorithm provides users with a comprehensive, multi-level identity authentication solution by combining the high security of the national secret algorithm, the flexibility of the multi-level authentication mechanism, the integrity of real-time monitoring and log records, and the timeliness of abnormal authentication detection and processing. This method not only improves the security of identity authentication, but also enhances the system's responsiveness and defense capabilities, providing more reliable security protection for Internet applications.

[0074] In some embodiments, the first verification includes:

[0075] In response to a first input from the user terminal through the login interface, the input password is calculated using the SM3 algorithm to generate a hash value;

[0076] Compare the generated hash value with the corresponding user hash value stored in the database; obtain a comparison result;

[0077] Obtain the user's device information and location information, and record the verification operation.

[0078] In some embodiments, the method comprises:

[0079] If the user's current location information is not in the preset area list, multi-level verification is performed;

[0080] If the current user location information is in the preset area list, the user's login device, login frequency and verification process at the location are obtained;

[0081] Obtain the login risk score of the user at the current location based on the user's current login device, login time, historical login device, historical login time, login frequency, and verification process;

[0082] If the generated hash value matches the stored hash value, the password verification is successful; determine whether to enter multi-level verification based on the login risk score;

[0083] If the generated hash value does not match the stored hash value, an error message is fed back to the user, indicating that the username or password is incorrect; based on the login risk score and user settings, it is determined whether to pass another level of verification or repeat the first verification within a preset number of times.

[0084] The working principle of the above technical solution is as follows: when the user enters the username and password through the login interface on the user side, the SM3 algorithm is first used to calculate the input password to generate a hash value; as one of the national secret algorithms, the SM3 algorithm has a high degree of security and anti-collision, ensuring the security of the password during transmission and storage. Subsequently, the generated hash value is compared with the corresponding user hash value stored in the database; this comparison process is performed on the server side, ensuring the confidentiality of the user password, because the user's original password has never been sent to the server. According to the comparison result, if the two hash values ​​match, it means that the password verification is successful; if they do not match, an error message is fed back to the user, indicating that the username or password is incorrect.

[0085] At the same time or after password verification, the system will also obtain the user's device information (such as device model, MAC address, etc.) and location information (such as IP address, geographic location, etc.); this information is crucial for assessing login risks. First, check whether the user's current location information is in the preset area list; if not, this may mean that the user is trying to log in from an unauthorized location, so multi-level verification will be performed directly to increase security. If the user's current location is in the preset area list, further information such as the user's login device, login frequency, and previous verification process at this location will be obtained. This information will be used to generate the first risk score for the user's login at the current location.

[0086] Based on the user's current login device, login time, previous login device, previous login time, login frequency, and verification process, the first risk score of the user's login at the current location is comprehensively evaluated. This score reflects the risk level of the current login attempt. If the password verification is successful and the login risk score is low, it means that the current login attempt is relatively safe, and the system may directly allow the user to log in without additional multi-level verification.

[0087] If the password verification succeeds but the login risk score is high, or the password verification fails but the login risk score indicates that further verification is required (such as the user has set up other verification methods when the risk is high), the system may decide whether to enter the multi-level verification process based on the specific situation, or allow the user to repeat the first verification within a preset number of times. In multi-level verification, the system may require the user to provide additional verification information (such as dynamic passwords, biometric information, etc.) to further confirm the user's identity.

[0088] During the entire verification process, the operation of each link is monitored in real time and detailed log information is recorded. This log information will be used for subsequent audits and security analysis. If abnormal authentication behavior is detected (such as multiple failed login attempts, login requests from high-risk areas, etc.), it will immediately trigger the early warning mechanism and may take corresponding security measures (such as locking accounts, sending alarm notifications, etc.) according to the nature and severity of the abnormality.

[0089] In summary, this authentication method provides users with a secure and flexible login authentication experience by combining the high security of the SM3 algorithm, risk assessment of location and device information, the flexibility of the multi-level verification process, and real-time monitoring and exception handling mechanisms.

[0090] The effects of the above technical solution are: triggering multi-level verification when the user's location is not in the preset area or the risk score is high, increasing the difficulty for attackers to successfully log in. Even if the attacker has mastered some verification information, it is difficult to pass all verification levels; dynamically adjusting the verification process according to the user's location information is convenient for users (no additional verification is required in common locations) and improves security (adding verification in unfamiliar locations); allowing users to set verification strategies and retries according to their own security needs, providing a personalized security experience; comprehensively considering multiple factors such as user login devices, time, and frequency to generate risk scores, reducing false positives caused by abnormal single factors, and also improving sensitivity to potential risks; real-time recording of each link in the verification process is convenient for subsequent audits and security analysis, which helps to timely discover and deal with potential security threats. In the case of low risk, users can quickly complete login verification without cumbersome multi-level verification. When password verification fails, targeted error prompts and subsequent operation suggestions are provided based on risk scores and user settings, reducing user confusion and dissatisfaction.

[0091] In some embodiments, the method for obtaining the preset area list includes:

[0092] Obtain the change frequency of the user's login area in the historical records, and determine the first preset time according to the change frequency;

[0093] S=k*(Jc / Ja)*(N+1)*Sy / Ny

[0094] Wherein, S is the user's first preset time, N is the total number of changes in the login area of ​​the user in the past T days; k is adjusted as a coefficient, k>0; Sy is the reference first preset time; Ny is the reference total number of changes in the login area of ​​the user in the past T days; Ny is greater than or equal to 1; Jc is the interval between the login time of the user's most recent location change and the previous login time, and Ja is the average of the normal login time intervals between two adjacent location changes of the user in the past T days;

[0095] Within a first preset time, the historical normal login areas of the user are obtained as a preset area list.

[0096] The working principle and effect of the above technical solution are:

[0097] First, the user's historical login records are collected and analyzed, especially focusing on the changes in the frequency of users logging in between different areas; by counting the total number of changes N in the user's login area in the past T days, the system can initially understand the user's mobility and activity range.

[0098] Different users have different mobility and range of activities; some users may frequently log in from different locations due to work, study or life needs (such as business people who travel frequently, college students moving between different campuses, etc.), while other users may log in relatively fixedly at one or a few locations (such as housewives, office workers, etc.).

[0099] For users who frequently change their login locations, if the preset time is set too short, it may cause users to perform additional security verification in many cases, thereby reducing the user experience. Therefore, by increasing the preset time length, the system can better adapt to the mobile patterns of such users and reduce unnecessary verification steps.

[0100] On the contrary, for users who rarely change their login locations, if the preset time is set too long, it may increase security risks, because once the user's account information is leaked or stolen, the attacker will have a longer time to perform malicious operations without being detected. Therefore, shortening the preset time length for such users will help to detect and prevent potential security threats in a timely manner.

[0101] The first preset time is calculated using the given formula S=k*(Jc / Ja)*(N+1)*Sy / Ny; the formula combines multiple factors to determine an appropriate preset time length:

[0102] k is an adjustment coefficient, which is used to adjust the length of the preset time according to actual needs to ensure that it is neither too long nor too short; Jc represents the interval between the login time of the user's most recent location change and the previous login time, which reflects the user's recent movement speed or activity pattern; Ja is the average of the normal login time intervals between the user's two adjacent location changes in the past T days, providing a benchmark for the frequency of user location changes. N+1 is because the total number of changes including the current location is used in the calculation, although the last change may still be ongoing. Sy and Ny are the reference total number of changes in the first preset time and the user's login area in the past T days, respectively. These parameters may be based on system experience, industry standards or user group statistics, and are used to standardize and normalize the calculation results. Within the calculated first preset time S, the system further screens out the user's historical normal login areas as a preset area list. These areas are places that users have frequently visited in the past period of time and are considered safe.

[0103] When a user tries to log in, the system will compare the user's current location information to see if it belongs to the preset area list. If it is not in the list, it may trigger more stringent security verification measures; if it is in the list, the risk will be further assessed based on other factors (such as login device, frequency, etc.), and multiple levels of verification may be performed.

[0104] The preset area list is not static, but will be dynamically updated based on the user's subsequent login behavior. Whenever a user successfully logs in to a new area and shows a stable login pattern after a period of time, the area may be added to the preset area list.

[0105] By comprehensively considering the user's historical login behavior (especially the frequency of changing login locations) and calculating a series of parameters, the length of the preset time is dynamically adjusted, thereby improving the user experience while ensuring security; the design not only reflects the respect for the user's personalized needs, but also reflects the system's keen perception and flexible response capabilities to security risks.

[0106] In some embodiments, the

[0107] The login risk score of the user at the current location is obtained based on the user's current login device, login time, historical login device, historical login time, login frequency, and verification process.

[0108] include:

[0109] Get the first score for the location based on historical login frequency and verification process;

[0110]

[0111] Where, Pi is the first score of the user at the i-th position; Fi is the login frequency of the user at the i-th position; Fa is the average of the login frequencies of the user at multiple positions; Czi is the total number of logins of the user at the i-th position; Cci is the number of locked logins of the user at the i-th position; m is the number of login positions of the user;

[0112] w1 and w2 are weight coefficients;

[0113] According to the user's current login device, login time, and the first score, obtain the login risk score of the user at this position; the login risk score is Pi2 = (1 + x1 + x2) * Pi

[0114] Where, if the current login device is the same as the historical login device at this position, then x1 = 0; if the current login device is different from the historical normal login device at this position, then 0 < x1 < 0.5; if the current login time is within the range of the historical normal login time at this position, then x2 = 0; if the current login time is different from the range of the historical normal login time at this position, then 0 < x2 < 0.5.

[0115] The working principle of the above technical solution is: comprehensively analyze the user's login behavior at the current position (including login device, login time) and its historical login behavior (including login frequency, verification process, historical login device, historical login time, etc.) to calculate the first risk score of the user at this position; specifically as follows:

[0116] First, calculate a frequency-related scoring part based on the login frequency (Fi) of the user at the i-th position and the average of the login frequencies of the user at all positions (Fa). This part of the score reflects the activity level of the user at this position and the degree of deviation from its overall activity level.

[0117] Secondly, the verification process of the user at this position is also considered. Specifically, calculate a verification-related scoring part by comparing the total number of logins (Czi) and the number of locked logins (Cci) of the user at this position. This part of the score reflects the frequency of security challenges encountered by the user when logging in at this position, thereby indirectly evaluating the security of the user's behavior.

[0118] Finally, the system weights and sums these two parts of the scores through the weight coefficients (w1, w2) to obtain the first score (Pi) of the user at this position. The selection of the weight coefficients can be adjusted according to the actual situation to balance the importance of the frequency and the verification process in the scoring.

[0119] On the basis of the first score (Pi), the influence of the user's current login device and login time is further considered. These two factors are used to modify the first score by introducing additional adjustment factors (x1, x2), thereby obtaining a more accurate login risk score (Pi2).

[0120] If the current login device is consistent with the historical login device at this location, it means that the user may have logged in using a common device at this location, which reduces the risk, so x1 = 0, and no additional adjustment is made to the score. If it is inconsistent, an x1 value between 0 and 0.5 is assigned according to the degree of inconsistency to increase the score (i.e., increase the risk).

[0121] Similarly, if the current login time is consistent with the historical normal login time range of the location, it also means that the user behavior is normal, and x2 = 0. If it is inconsistent, an x2 value between 0 and 0.5 is assigned according to the degree of inconsistency to increase the score.

[0122] Finally, the login risk score (Pi2) is calculated by the formula (1-x1-x2)*Pi. This score takes into account multiple factors such as the user's login frequency, verification process, login device, and login time at the location, providing a basis for the system's subsequent security decisions.

[0123] Through the above working principle, the system can dynamically evaluate the risks of users' login behaviors in different locations, and take corresponding security measures based on the evaluation results, such as strengthening verification, restricting login permissions, etc., to ensure the security of user accounts.

[0124] The effect of the above technical solution is: since the scoring system is built based on the historical behavior data of individual users, it is possible to formulate personalized security policies according to the characteristics and habits of different users. This means that for users who travel frequently or work in different locations, the system can adjust the verification requirements and frequency more flexibly and reduce interference with normal behavior. By reducing unnecessary verification steps and restrictions, the user experience can be improved while ensuring security. For users who log in during common devices and time periods, the risk score can be automatically lowered, thereby avoiding frequent security verification processes and enabling users to access required services faster. The scoring system can be dynamically adjusted as user behavior changes. For example, if a user suddenly starts to log in frequently at a new location, the system may temporarily increase the risk score of the location and require stricter verification. However, as the user establishes a stable login pattern at the location, the risk score will gradually decrease until it returns to normal levels. This method not only provides risk assessment for a single login event, but also provides valuable data for the analysis of overall user behavior patterns. By collecting and analyzing this data over a long period of time, normal and abnormal patterns of user behavior can be identified, thereby optimizing security policies and verification processes.

[0125] In some embodiments, the method comprises:

[0126] If the login risk score is greater than the preset score threshold, a multi-level authentication prompt will be displayed; if the login risk score is less than or equal to the preset score threshold, the user will log in directly;

[0127] If the login risk score is less than or equal to the preset score threshold, but the current username or password is incorrect, determine whether to select other levels of verification based on the user's pre-settings; or repeat the first verification within a preset number of times.

[0128] The working principle and effect of the above technical solution are:

[0129] When a user attempts to log in to the system, the current login risk score is first calculated based on a series of predefined risk assessment rules (such as login time, location, device, historical login pattern, etc.). These rules may include abnormal login attempts (such as multiple failed logins in a short period of time), logging in from unknown locations, using unauthorized devices, etc.

[0130] If the calculated login risk score is greater than the preset score threshold, indicating that the login attempt has a high risk, the user will be prompted to perform multi-level authentication. Multi-level authentication may include other verification methods besides passwords, such as SMS verification codes, email verification, biometrics (fingerprint, facial recognition), etc., to increase login security.

[0131] If the login risk score is less than or equal to the preset score threshold, indicating that the risk of this login attempt is low, the user is allowed to log in directly without additional verification steps.

[0132] Even if the login risk score is low, basic username and password verification will still be performed. If the current username or password is incorrect, the subsequent operation will be determined based on the user's pre-set settings. If the user has pre-set the option to select additional levels of verification when the password is incorrect, these additional verification methods will be provided for the user to choose to complete the login. If the user has not set or chooses not to use additional levels of verification, and the system allows the first verification (i.e. password entry) to be repeated within a certain number of times, the user can try to enter the password repeatedly within the preset number of times. Once the preset number of times is reached and there is still no success, the account may be locked or a higher level of verification may be required.

[0133] The design of this process takes into account both security and user experience. Through the preset risk scoring threshold and flexible verification mechanism, the system can reduce the login friction of normal users while ensuring account security, thus improving the overall user experience.

[0134] Continuously monitor changes in login behavior and risk scores, and adjust preset scoring thresholds and verification strategies based on actual conditions to respond to new security threats and maintain effective system protection.

[0135] In summary, this login verification process provides more comprehensive and flexible security protection for user accounts through risk scoring, multi-level authentication and flexible verification strategies.

[0136] In some embodiments, the real-time monitoring of each link in the authentication process, recording log information; determining abnormal authentication according to the log information; issuing an early warning and determining the lockout duration according to the abnormal authentication include:

[0137] Collect log information during the user authentication process, including authentication time, authentication method, authentication result, device information, and location information;

[0138] Different evaluation dimensions are divided, including number of failures, device changes, geographic location changes, and time factors;

[0139] Calculate the score of each dimension; sum the weighted scores of each dimension to get the total abnormality score;

[0140] The abnormality levels are divided according to the total abnormality score; the abnormality levels include: slight abnormality, medium abnormality and severe abnormality; for severe abnormalities, the account is locked and the locking period is set.

[0141] In some embodiments, the lock duration is obtained by the following formula:

[0142] like

[0143] but:

[0144]

[0145] like

[0146] but:

[0147]

[0148] like

[0149] Then Bs=p*By;

[0150] Among them, Bs is the target account lock duration; Abz is the target account current login anomaly total score; Aby is the severe anomaly score threshold; r is the total number of authentications of the target account within the preset time; e is the number of times the target account has been locked in the preset time; Jlast is the time interval between the current time and the previous authentication; D jis the time of the target account's jth authentication, D j-1 is the time of the j-1th authentication of the target account, By is the reference lock-up period; h is the coefficient, h>1.

[0151] The working principle of the above technical solution is:

[0152] During the user authentication process (such as logging in), the system will collect relevant log information in real time. This log information includes but is not limited to authentication time, authentication method (such as password, SMS verification code, biometrics, etc.), authentication result (success or failure), device information (such as device model, IP address, etc.) and location information (such as GPS coordinates or network location).

[0153] The collected log information is divided according to different evaluation dimensions, which may include the number of failures, device changes (i.e., whether the user frequently changes the device to log in), geographic location changes (whether the user's login location changes abnormally), and time factors (such as unusual login time).

[0154] For each dimension, the system calculates a score that reflects the degree of abnormality of user behavior under that dimension. The score may be calculated based on preset rules or algorithms, such as the more failures, the higher the score; the greater the change in device or geographic location, the higher the score.

[0155] Divide different evaluation dimensions, such as number of failures, device changes, geographic location changes, time factors, etc.

[0156] Set specific scoring rules for each dimension, for example:

[0157] Number of failures: 1 point for 3 consecutive failures, 3 points for 5 consecutive failures, and so on.

[0158] Equipment changes: 2 points for logging into a new device, and 5 points for frequent equipment changes (such as more than 3 times a day).

[0159] Changes in geographical location: A sudden change in the login location (such as suddenly changing from logging in from domestic to overseas) will be awarded 3 points, and appearing in a high-risk area will be awarded 5 points.

[0160] Time factor: Logging in outside working hours will be awarded 1 point, and multiple login attempts within a short period of time (such as within 5 minutes) will be awarded 2 points.

[0161] Calculate the score for each dimension based on the log information and scoring rules;

[0162] The scores of each dimension are weighted and summed to get the total score of the anomaly. For example, the weight of the number of failures score can be set to 0.3, the weight of the device change score to 0.25, the weight of the geographic location change score to 0.25, and the weight of the time factor score to 0.2.

[0163] Continuously optimize scoring rules and weight distribution based on actual operation conditions and user feedback; regularly evaluate the effectiveness of early warning and locking measures, and make necessary adjustments to improve accuracy and effectiveness.

[0164] Based on the total abnormality score, the system divides the user's authentication behavior into different abnormality levels, such as minor abnormality, medium abnormality and severe abnormality. These levels are based on preset thresholds or ranges. For example, a threshold can be set, such as a total abnormality score of more than 10 points, which is considered a high-risk abnormality.

[0165] Take appropriate warning and locking measures according to the degree of abnormality. For example:

[0166] Minor abnormality (total score below 5 points): Send warning notifications to users and administrators to remind them to pay attention to account security.

[0167] Moderate abnormality (total score 5-10 points): In addition to sending an early warning notification, users are also required to perform a secondary verification (such as SMS verification code, email verification, etc.).

[0168] Serious abnormality (total score of 10 or more): Immediately lock the account, conduct in-depth investigation, collect more evidence for subsequent processing, and notify the user and administrator at the same time.

[0169] For user accounts that are judged to be seriously abnormal, the system will lock them to prevent potential security risks.

[0170] The calculation of the lockout duration is based on a series of complex factors, including the total abnormality score of the current login, the score threshold for severe abnormalities, the total number of authentications within the preset time, the number of historical lockouts, the time interval between the current time and the previous authentication, the sum of the time differences between each authentication, and the reference lockout duration.

[0171] The lockout duration is calculated through a series of conditional judgments and formulas, aiming to dynamically determine an appropriate lockout duration based on the user's specific behavior and history. This duration is neither too long to affect the user experience nor too short to effectively prevent security risks.

[0172] When an account is locked, the system may send a warning notification to the user, informing him that the account has been locked and the reason for the lock. This helps the user to understand the account status in time and take corresponding measures (such as changing the password, checking the device security, etc.).

[0173] The system should continuously monitor user behavior and log information during the authentication process, and adjust the evaluation dimensions, score calculation rules, anomaly level classification standards, and lock time calculation formula according to actual conditions to respond to new security threats and maintain effective protection of the system.

[0174] In summary, this working principle provides users with a secure and flexible authentication protection mechanism through real-time monitoring, log analysis, anomaly assessment and dynamic lock duration calculation.

[0175] The effect of the above technical solution is: through real-time monitoring and log recording, the system can timely detect and respond to potential abnormal login behaviors, effectively preventing unauthorized access and account theft. Account locking for serious anomalies can quickly cut off security risks and prevent further losses. The setting of dynamic lock duration takes into account a variety of factors, such as the user's abnormality level, historical behavior, etc., avoiding a one-size-fits-all long-term lock and reducing the inconvenience of normal users. Early warning notifications for minor and moderate anomalies allow users to understand the account status in a timely manner and take necessary measures, such as checking device security, changing passwords, etc., to avoid account locks. By dividing different evaluation dimensions and calculating the total score of anomalies, the system can more comprehensively evaluate the user's authentication behavior and provide a more accurate basis for subsequent decision-making. The calculation formula for the lock duration takes into account a variety of variables, such as the number of authentications, the number of historical locks, time intervals, etc., so that the system can flexibly adjust the lock duration according to actual conditions to cope with different risk levels.

[0176] The present application embodiment provides an identity authentication system based on a national secret algorithm, the system comprising:

[0177] A first verification module, configured to perform a first verification using a national encryption algorithm in response to a first input from a user; the first verification includes a user name and password verification;

[0178] A first acquisition module, used to acquire the user's first information, device information and location information through the first verification;

[0179] A determination module, used to perform multi-level verification if the user's current location information is not in the preset area list;

[0180] Or, if the current user location information is in the preset area list, the login risk score of the user at the current location is obtained according to the user's current login device, login time, historical login device, historical login time, login frequency and verification process, and whether to enter the multi-level authentication is determined according to the user login risk score; wherein, the first preset time is determined by the frequency of changes in the user's login area in the historical records; within the first preset time, the user's historical normal login area is obtained as the preset area list;

[0181] The monitoring module is used to monitor each link of the authentication process in real time and record log information; determine abnormal authentication based on log information; issue warnings and determine the lockout duration based on abnormal authentication.

[0182] In some embodiments, the first verification includes:

[0183] In response to a first input from the user terminal through the login interface, the input password is calculated using the SM3 algorithm to generate a hash value;

[0184] Compare the generated hash value with the corresponding user hash value stored in the database; obtain a comparison result;

[0185] Obtain the user's device information and location information, and record the verification operation.

[0186] In some embodiments, the determination module includes:

[0187] A first determination unit, configured to perform multi-level verification if the user's current location information is not in the preset area list;

[0188] A first acquisition unit, configured to acquire the login device, login frequency, and verification process of the user at the location if the current user location information is within the preset area list;

[0189] A risk score acquisition unit, used to obtain a login risk score of the user at the current location according to the user's current login device, login time, historical login device, historical login time, login frequency, and verification process;

[0190] A second determination unit is used to determine whether to enter multi-level verification if the generated hash value matches the stored hash value, indicating that the password verification is successful; and determine whether to enter multi-level verification according to the login risk score;

[0191] The third determination unit is used to feed back an error message to the user if the generated hash value does not match the stored hash value, indicating that the username or password is incorrect; determine whether to pass another level of verification or repeat the first verification within a preset number of times based on the login risk score and user settings.

[0192] In some embodiments, the method for obtaining the preset area list includes:

[0193] Obtain the change frequency of the user's login area in the historical records, and determine the first preset time according to the change frequency;

[0194] S=k*(Jc / Ja)*(N+1)*Sy / Ny

[0195] Wherein, S is the user's first preset time, N is the total number of changes in the login area of ​​the user in the past T days; k is adjusted as a coefficient, k>0; Sy is the reference first preset time; Ny is the reference total number of changes in the login area of ​​the user in the past T days; Ny is greater than or equal to 1; Jc is the interval between the login time of the user's most recent location change and the previous login time, and Ja is the average of the normal login time intervals between two adjacent location changes of the user in the past T days;

[0196] Within a first preset time, obtain the historical normal login areas of the user as a preset area list.

[0197] In some embodiments, the risk score acquisition unit includes:

[0198] A first scoring subunit, configured to obtain a first score for this location based on the historical login frequency and the verification process;

[0199]

[0200] Wherein, Pi is the first score of the user at the i-th location; Fi is the login frequency of the user at the i-th location; Fa is the average value of the login frequencies of the user at multiple locations; Czi is the total number of logins of the user at the i-th location; Cci is the number of locked logins of the user at the i-th location; m is the number of login locations of the user;

[0201] w1 and w2 are weight coefficients;

[0202] A risk scoring subunit, according to the user's current login device, login time and the first score; obtain the login risk score of the user at this location; the login risk score is Pi2 = (1 + x1 + x2) * Pi

[0203] Wherein, if the current login device is the same as the historical login device at this location, then x1 = 0; if the current login device is different from the historical normal login device at this location, then 0 < x1 < 0.5; if the current login time is within the same range as the historical normal login time at this location, then x2 = 0; if the current login time is different from the historical normal login time range at this location, then 0 < x2 < 0.5.

[0204] In some embodiments, the determination module includes:

[0205] A fourth determination unit, configured to, if the login risk score is greater than a preset score threshold, prompt for multi-level authentication; if the login risk score is less than or equal to the preset score threshold; then directly log in;

[0206] A fifth determination unit, if the login risk score is less than or equal to the preset score threshold, but the current username or password is incorrect, then determine whether to select other levels of verification according to the user's pre-setting; or repeat the first verification within a preset number of times.

[0207] In some embodiments, the multi-level authentication includes dynamic password, biometric identification and / or challenge response; including:

[0208] Generate a one-time password using a seed key and SM1 / SM3 algorithm based on the current time or event count, and perform dynamic password verification using the one-time password;

[0209] The user's biometric data is collected through a biometric device; the feature data is encrypted using a national encryption algorithm. After the server receives the encrypted biometric data, it is decrypted and compared with the stored feature template to obtain the biometric verification result through comparison;

[0210] Generate a random number as a challenge and send it to the user; obtain the response generated by the user based on the challenge, his or her own private key and the national encryption algorithm; verify the correctness of the response through the user's public key to obtain the challenge response result.

[0211] In some embodiments, the monitoring module includes:

[0212] A first collecting unit, used to collect log information during the user authentication process, wherein the log information includes authentication time, authentication method, authentication result, device information, and location information;

[0213] An evaluation dimension division unit is used to divide different evaluation dimensions, including the number of failures, device changes, geographic location changes, and time factors;

[0214] The abnormal total score acquisition unit is used to calculate the score of each dimension; the scores of each dimension are weighted and summed to obtain the abnormal total score;

[0215] The level classification unit is used to classify the abnormality level according to the total abnormality score; the abnormality level includes: slight abnormality, medium abnormality and severe abnormality; the account is locked for severe abnormality and the locking time is set.

[0216] In some embodiments, the lock duration is obtained by the following formula:

[0217] like

[0218] but:

[0219]

[0220] like

[0221] but:

[0222]

[0223] like

[0224] Then Bs=p*By;

[0225] Among them, Bs is the target account lock duration; Abz is the target account current login anomaly total score; Aby is the severe anomaly score threshold; r is the total number of authentications of the target account within the preset time; e is the number of times the target account has been locked in the preset time; Jlast is the time interval between the current time and the previous authentication; D j is the time of the target account's jth authentication, D j-1 is the time of the j-1th authentication of the target account, By is the reference lock-up period; h is the coefficient, h>1.

[0226] The working principle and effect of the above technical solution are the same as those in the embodiment of the method of the present application and will not be described in detail here.

[0227] This application is explained from the perspectives of purpose of use, effectiveness, progress and novelty, and has met the functional enhancement and usage requirements emphasized by the Patent Law. The above description and drawings of this application are only the preferred embodiments of this application, and are not intended to limit this application. Therefore, all structures, devices, features, etc. that are similar or identical to this application, that is, all equivalent replacements or modifications made in accordance with the scope of the patent application of this application, should fall within the scope of protection of the patent application of this application.

Claims

1. The identity authentication method based on the national secret algorithm is characterized by: The method includes: In response to the user's first input, perform a first verification through the national cryptographic algorithm; the first verification includes username and password verification; After passing the first verification, obtain the user's first information, device information, and location information; If the user's current location information is not within the preset area list, perform multi-level verification; Or, if the current user location information is within the preset area list, obtain the login risk score of the user at the current location based on the user's current logged-in device, login time, historical logged-in devices, historical login times, login frequency, and verification process, and determine whether to enter multi-level authentication based on the user's login risk score; wherein, determine the first preset time based on the change frequency of the user's login areas in the historical record; within the first preset time, obtain the user's historical normal login areas as the preset area list; Monitor each link in the authentication process in real time, record log information; determine abnormal authentication based on the log information; issue a warning and determine the lock duration based on the abnormal authentication; The method for obtaining the preset area list includes: Obtain the change frequency of the user's login areas in the historical record, and determine the first preset time based on the change frequency; ； Wherein, S is the user's first preset time, N is the total number of changes in the user's login areas in the past T days; k is an adjusted coefficient, k>0; Sy is the reference first preset time; Ny is the reference total number of changes in the user's login areas in the past T days; Ny is greater than or equal to 1; Jc is the interval between the login time when the user's last location change occurred and the previous login time, and Ja is the average of the normal login time intervals between two adjacent location changes of the user in the past T days; Within the first preset time, obtain the user's historical normal login areas as the preset area list; The obtaining of the login risk score of the user at the current location based on the user's current logged-in device, login time, historical logged-in devices, historical login times, login frequency, and verification process includes: Obtain the first score at this location based on the historical login frequency and verification process; ； in, Give the user the first rating at the i-th position; is the login frequency of the user at the i-th position; is the average of the user's login frequencies at multiple locations; Czi is the total number of logins of the user at the i-th location; Cci is the number of logins of the user that were locked at the i-th location; m is the number of login locations of the user; w1 and w2 are weight coefficients; Based on the user's current logged-in device, login time, and the first score, obtain the login risk score of the user at this location; the login risk score is Pi2 = (1 + x1 + x2) * Pi; Wherein, if the current logged-in device is the same as the historical logged-in device at this location, then x1 = 0; if the current logged-in device is different from the historical normal logged-in device at this location, then 0 < x1 < 0.5; if the current login time is within the same range as the historical normal login time at this location, then x2 = 0; if the current login time is different from the historical normal login time range at this location, then 0 < x2 < 0.

5.

2. The method according to claim 1, characterized in that The first verification includes: In response to the first input from the user end through the login interface, calculate the input password through the SM3 algorithm to generate a hash value; Compare the generated hash value with the corresponding user hash value stored in the database; obtain the comparison result; Obtain the user's device information and location information, and record the verification operation.

3. The method according to claim 2, characterized in that The method includes: If the user's current location information is not within the preset area list, perform multi-level verification; If the current user location information is in the preset area list, the user's login device, login frequency and verification process at the location are obtained; Obtain the login risk score of the user at the current location based on the user's current login device, login time, historical login device, historical login time, login frequency, and verification process; If the generated hash value matches the stored hash value, the password verification is successful; determine whether to enter multi-level verification based on the login risk score; If the generated hash value does not match the stored hash value, an error message will be fed back to the user, indicating that the username or password is incorrect; based on the login risk score and user settings, it is determined whether to pass another level of verification or repeat the first verification within a preset number of times.

4. The method according to claim 3, characterized in that The method comprises: If the login risk score is greater than the preset score threshold, a multi-level authentication prompt will be displayed; if the login risk score is less than or equal to the preset score threshold, the user will log in directly; If the login risk score is less than or equal to the preset score threshold, but the current username or password is incorrect, determine whether to select other levels of verification based on the user's pre-settings; or repeat the first verification within a preset number of times.

5. The method according to claim 1, characterized in that The multi-level authentication includes dynamic password, biometric identification and / or challenge response; including: Generate a one-time password using a seed key and SM1 / SM3 algorithm based on the current time or event count, and perform dynamic password verification using the one-time password; The user's biometric data is collected through a biometric identification device; the feature data is encrypted using a national encryption algorithm. After the server receives the encrypted biometric data, it is decrypted and compared with the stored feature template to obtain the biometric verification result through comparison; Generate a random number as a challenge and send it to the user; obtain the response generated by the user based on the challenge, his or her own private key and the national encryption algorithm; verify the correctness of the response through the user's public key to obtain the challenge response result.

6. The method according to claim 1, characterized in that The real-time monitoring of each link in the authentication process and recording of log information; Determine abnormal authentication based on log information; Based on abnormal authentication, early warning is issued and the lockout duration is determined, including: Collect log information during the user authentication process, including authentication time, authentication method, authentication result, device information, and location information; Different evaluation dimensions are divided, including number of failures, device changes, geographic location changes, and time factors; Calculate the score of each dimension; sum the weighted scores of each dimension to get the total abnormality score; The abnormality levels are divided according to the total abnormality score; the abnormality levels include: slight abnormality, medium abnormality and severe abnormality; for severe abnormalities, the account is locked and the locking period is set.

7. The method according to claim 1, characterized in that The lock duration is obtained by the following formula: like , but: ; like , but: ; like , but ; Among them, Bs is the target account lock duration; Abz is the target account current login anomaly total score; Aby is the severe anomaly score threshold; r is the total number of authentications of the target account within the preset time; e is the number of times the target account has been locked in the preset time; Jlast is the time interval between the current time and the previous authentication; D j is the time of the target account's jth authentication, D j-1 is the time of the j-1th authentication of the target account, By is the reference lock-up period; h is the coefficient, h>1.

8. The identity authentication system based on the national secret algorithm is characterized by: The system comprises: A first verification module, configured to perform a first verification using a national encryption algorithm in response to a first input from a user; the first verification includes a user name and password verification; A first acquisition module, used to acquire the user's first information, device information and location information through the first verification; A determination module, which is used to perform multi-level verification if the current location information of the user is not within the preset area list; or, if the current location information of the user is within the preset area list, obtain the login risk score of the user at the current location based on the user's current logged-in device, login time, historical logged-in devices, historical login times, login frequency, and the verification process, and determine whether to enter multi-level authentication based on the user's login risk score; wherein, the first preset time is determined by the change frequency of the user's logged-in areas in the historical record; within the first preset time, obtain the user's historical normal logged-in areas as the preset area list; A monitoring module, which is used to monitor each link in the authentication process in real time and record log information; determine abnormal authentication based on the log information; perform early warning and determine the lock-up duration according to the abnormal authentication; The method for obtaining the preset area list includes: Obtain the change frequency of the user's logged-in areas in the historical record, and determine the first preset time according to the change frequency; ； Wherein, S is the first preset time of the user, N is the total number of changes in the logged-in areas of the user in the past T days; k is an adjusted coefficient, k > 0; Sy is the reference first preset time; Ny is the reference total number of changes in the logged-in areas of the user in the past T days; Ny is greater than or equal to 1; Jc is the interval between the login time and the previous login time when the user's location changed last time, and Ja is the average value of the normal login time intervals between two consecutive location changes of the user in the past T days; Within the first preset time, obtain the user's historical normal logged-in areas as the preset area list; The obtaining of the login risk score of the user at the current location based on the user's current logged-in device, login time, historical logged-in devices, historical login times, login frequency, and the verification process includes: Obtain the first score at this location based on the historical login frequency and the verification process; ； in, Give the user the first rating at the i-th position; is the login frequency of the user at the i-th position; is the average of the user's login frequencies at multiple locations; Czi is the total number of logins of the user at the i-th location; Cci is the number of logins of the user that were locked at the i-th location; m is the number of login locations of the user; w1 and w2 are weight coefficients; Obtain the login risk score of the user at this location according to the user's current logged-in device, login time, and the first score; the login risk score is Pi2 = (1 + x1 + x2) * Pi; Wherein, if the current logged-in device is the same as the historical logged-in device at this location, then x1 = 0; if the current logged-in device is different from the historical normal logged-in device at this location, then 0 < x1 < 0.5; if the current login time is within the same range as the historical normal login time at this location, then x2 = 0; if the current login time is different from the historical normal login time range at this location, then 0 < x2 < 0.5.

Images