Contragitive user equipment authentication method based on challenge response

Abstract

The invention provides a challenge response-based antagonistic user equipment authentication method. The challenge response-based antagonistic user equipment authentication method comprises the following steps of: registering an authentication credential of user equipment; configuring a load and delivering the load to the user equipment; receiving an authentication letter generated by the load according to the equipment information of the user equipment; receiving an identity authentication request including an authentication credential from the user equipment, and initiating a verification challenge when the authentication credential is valid; receiving a to-be-verified response generated by the load; acquiring an authentication letter of the user equipment, and generating a verification response according to the authentication letter and the verification challenge; and comparing whether the to-be-verified response and the verification response are consistent to obtain an authentication result of the user equipment. According to the method, on the basis of a load delivery mode, real-time calculation is carried out in a user equipment registration and authentication stage to obtain an authentication letter and a to-be-authenticated letter so as to carry out user equipment identity authentication, and the attribute of the letter can verify the consistency of a user equipment operation environment; and an adversarial attack behavior caused by the fact that an attacker pretends to initiate authentication as an equipment owner after the equipment is attacked is avoided.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a challenge-response-based adversarial user device authentication method. Background Art

[0002] Phishing threats are one of the most common attack techniques used by attackers to gain initial access to victim devices / systems. Attackers use fake login pages or emails sent by trusted entities to trick victims into entering login credentials or installing malware such as remote control Trojans, ultimately gaining initial access to victim devices / systems. Using multi-factor authentication mechanisms such as SMS / email verification codes and one-time password devices can mitigate phishing threats to a certain extent, but attackers can still use real-time phishing (real-time man-in-the-middle attacks) to obtain verification codes, thereby breaking through multi-factor authentication.

[0003] Existing identity authentication technology to prevent phishing threats relies on dedicated security hardware. Users need to load the dedicated hardware onto their devices. The hardware device has a trusted computing base. The authentication client located in the trusted computing base initiates an identity authentication request. The authentication service provider identifies the proprietary hardware on the user side and then determines that the person issuing the authentication request is a legitimate user rather than an attacker.

[0004] However, the dedicated security hardware that existing anti-phishing authentication technologies rely on is expensive to use, so dedicated security hardware is usually set to be permanently valid or have a long validity period. If the dedicated security hardware used for authentication is lost, the authentication system will face the risk of losing the private key in the trusted computing base of the proprietary hardware, causing the risk of failure of the trusted computing base on the service side of the authentication system. After the dedicated anti-phishing security hardware is loaded onto the user's device, if the device has an unknown vulnerability / backdoor, the attacker may use the vulnerability / backdoor to impersonate the device owner and call the security hardware to initiate authentication. For such attackers who have already compromised the target user's device and are trying to use this device to collect user credentials and carry out larger-scale lateral movement attacks, the existing anti-phishing authentication technology cannot solve this type of adversarial attack behavior.

[0005] Therefore, it is necessary to provide a user device authentication method that can prevent phishing threats from attackers stealing user login credentials and block adversarial attacks from attackers impersonating device owners. Summary of the invention

[0006] The purpose of the present invention is to provide a challenge-response-based adversarial user device authentication method to prevent phishing threats in which attackers steal user login credentials and block adversarial attacks carried out by attackers impersonating device owners.

[0007] In a first aspect, the challenge-response-based adversarial user device authentication method provided by the present invention includes: receiving a registration request from a user device and registration information submitted by the user device, registering the authentication credentials of the user device according to the registration information and feeding back the authentication credentials to the user device; configuring a payload according to the characteristics of the user device, and delivering the payload to the user device; receiving an authentication token generated by the payload according to the device information of the user device, and storing the authentication token and the registration information of the user device in a token library in correspondence; receiving an identity authentication request from a registered user device, the identity authentication request including the authentication credentials, verifying the authentication credentials, and when the authentication credentials are valid, initiating a verification challenge to the user device to be authenticated; receiving a response to be authenticated generated by the payload in the user device to be authenticated, wherein the response to be authenticated is generated according to the device information of the user device to be authenticated and the verification challenge; obtaining the authentication token corresponding to the user device to be authenticated in the token library, and generating a verification response according to the authentication token and the verification challenge; comparing whether the response to be authenticated is consistent with the verification response, and obtaining the authentication result of the user device to be authenticated according to the comparison result.

[0008] The beneficial effects of the challenge-response-based adversarial user device authentication method provided by the present invention are: based on the payload delivery method, a token for user device identity authentication is generated according to the software and hardware information and the operating environment of the user device, and the authentication token and the token to be authenticated are obtained by running the payload in real time during multiple stages such as user device registration and authentication. The user device identity is authenticated by the authentication token and the token to be authenticated. The attributes of the authentication token and the token to be authenticated can verify the consistency of the user device operating environment during registration and authentication, thereby avoiding adversarial attacks caused by attackers impersonating the device owner to initiate authentication after the device is compromised.

[0009] In a possible embodiment, the payload is configured according to the characteristics of the user device, including: setting in the payload that when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; and generating an authentication token corresponding to the user identity and user device according to the unique identifier of the user device, the user identity, the login credentials and the operating environment.

[0010] In another possible embodiment, the payload is configured according to the characteristics of the user device, including: setting in the payload that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier; based on the unique identifier, user identity, login credentials and operating environment, an authentication token to be verified corresponding to the user identity and user device is generated; and a response to be verified is calculated based on the authentication token to be verified and the verification challenge.

[0011] In other possible embodiments, the response to be verified and the verification response are compared for consistency, and the authentication result of the user device to be authenticated is obtained based on the comparison result, including: when the response to be verified and the verification response are consistent, the identity authentication of the user device to be authenticated passes; when the response to be verified and the verification response are inconsistent, the identity authentication of the user device to be authenticated fails and an abnormal warning is issued.

[0012] In a second aspect, the present invention further provides a challenge-response-based adversarial user equipment authentication device, comprising:

[0013] A registration unit, configured to receive a registration request from a user device and registration information submitted by the user device, register the authentication credentials of the user device according to the registration information and feed the authentication credentials back to the user device; a payload delivery unit, configured to configure a payload according to the characteristics of the user device and deliver the payload to the user device; a token storage unit, configured to receive an authentication token generated by the payload according to the device information of the user device, and store the authentication token and the registration information of the user device in a token library in correspondence; a credential verification unit, configured to receive an identity authentication request from a registered user device, the identity authentication request including the authentication credentials, verify the authentication credentials, and when the authentication credentials are valid, initiate a verification challenge to the user device to be authenticated; a response receiving unit, configured to receive a response to be authenticated generated by the payload in the user device to be authenticated, wherein the response to be authenticated is generated according to the device information of the user device to be authenticated and the verification challenge; a verification response generation unit, configured to obtain the authentication token corresponding to the user device to be authenticated in the token library, and generate a verification response according to the authentication token and the verification challenge; an authentication unit, configured to compare whether the response to be authenticated is consistent with the verification response, and obtain the authentication result of the user device to be authenticated according to the comparison result.

[0014] Among them, the payload delivery unit configures the payload according to the characteristics of the user device, including: setting in the payload that after the payload is delivered to the user device, obtaining the hardware information, operating system and application information of the user device to generate a unique identifier; and generating an authentication token corresponding to the user identity and user device according to the unique identifier of the user device, user identity, login credentials and operating environment.

[0015] The payload delivery unit configures the payload according to the characteristics of the user device, including: setting in the payload that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier; based on the unique identifier, user identity, login credentials and operating environment, an authentication token to be verified corresponding to the user identity and user device is generated; and a response to be verified is calculated based on the authentication token to be verified and the verification challenge.

[0016] The authentication unit compares whether the response to be verified and the verification response are consistent, and obtains the authentication result of the user device to be authenticated according to the comparison result, including: when the response to be verified and the verification response are consistent, the identity authentication of the user device to be authenticated passes; when the response to be verified and the verification response are inconsistent, the identity authentication of the user device to be authenticated fails and an abnormal warning is issued.

[0017] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the above-mentioned challenge-response-based adversarial user device authentication method is implemented.

[0018] In a fourth aspect, the present invention also provides an electronic device, comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device performs the above-mentioned challenge-response based adversarial user device authentication method.

[0019] For the beneficial effects of the second to fourth aspects, reference may be made to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flowchart of a challenge-response-based adversarial user equipment authentication method provided by an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of an adversarial anti-phishing identity authentication system provided in an authentication server applying an adversarial user device authentication method based on challenge response provided in an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of the operation flow of performing user device authentication in the adversarial anti-phishing identity authentication system provided in an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of a challenge-response-based adversarial user equipment authentication device provided by an embodiment of the present invention;

[0024] Figure 5A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0026] This embodiment provides a challenge-response-based adversarial user device authentication method. Figure 1 , the method comprising:

[0027] S101: receiving a registration request from a user device and registration information submitted by the user device, registering an authentication credential of the user device according to the registration information and feeding back the authentication credential to the user device.

[0028] In a possible embodiment, the challenge-response-based adversarial user device authentication method is configured in an authentication server for authenticating the user device, and the authentication server is in communication connection with the user device. The authentication server receives a registration request from the user device and registration information submitted by the user device, registers the authentication credentials of the user device according to the registration information, and feeds back the authentication credentials to the user device.

[0029] In a possible embodiment, when a user device is registered, the user device sends a registration request to the authentication server and submits registration information to register the authentication credentials. The registration information mentioned by the user device may be the user's personal information of the user device, the user's biometric information, etc. The authentication server receives the registration request of the user device and the registration information submitted by the user device, reviews and confirms the user's registration information, and registers and saves the authentication credentials of the user device after the registration information is reviewed and confirmed to be correct. Among them, the methods for reviewing and confirming the user's registration information include multi-factor authentication, user biometric verification, or manual identity verification by the administrator, etc., and the security of the user's registration information review and confirmation is enhanced in a variety of ways.

[0030] S102: Configure a payload according to the characteristics of the user equipment, and deliver the payload to the user equipment.

[0031] In a possible embodiment, for a user device that has been registered after the registration information has been verified to be correct, the authentication server configures a payload according to the characteristics of the user device and delivers the payload to the user device.

[0032] In a specific embodiment, a payload that can run safely on the user device is configured based on the operating system type, kernel version, processor architecture and other characteristics of the user device, and the configured payload is delivered to the user device.

[0033] In a possible embodiment, the payload is configured according to the characteristics of the user device, including the following settings in the payload: when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; based on the unique identifier of the user device, the user identity, the login credentials and the operating environment, a security token corresponding to the user identity and the user device is generated, and the security token serves as the obtained authentication token.

[0034] In a possible embodiment, the payload is configured according to the characteristics of the user device, including the following settings in the payload: when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; a security token corresponding to the user identity and the user device is generated according to the unique identifier of the user device, the user identity, the login credentials and the operating environment, the security token is used as a private key and the corresponding public key is calculated, and the public key is used as the generated authentication token.

[0035] In a possible embodiment, a payload is configured according to characteristics of a user device, including setting in the payload that when a verification challenge is sent to the user device to be authenticated, hardware information, operating system, and application information of the user device to be authenticated are obtained to generate a unique identifier; an authentication token to be verified corresponding to the user identity and the user device is generated according to the unique identifier, user identity, login credentials, and operating environment of the user device; and a response to be verified is calculated based on the authentication token to be verified and the verification challenge.

[0036] In a specific embodiment, the challenge-response-based adversarial user device authentication method generates a unique security token for the registered user device, and calculates the security token of the user device twice when authenticating the user device to perform challenge-response authentication. Both security tokens need to obtain information on the user device side and perform calculations according to set timings. Therefore, when configuring the payload, the operation of the payload is set so that the authentication server can receive the security token through the payload.

[0037] Exemplarily, it is set in the payload: after the payload is delivered to the user device, the payload runs on the user device to generate a unique identifier for the user device based on the hardware information of the user device (including but not limited to CPU model and serial number, network card MAC address, motherboard serial number, etc.), operating system and application information (including but not limited to operating system security patch version, operating system version, installed application list, registry entries, etc.), etc., and use the device unique identifier, user identity, login credentials, operating environment (including but not limited to the payload's code segment, data segment, function call stack, etc.) and other information to generate a security token corresponding to the user identity and user device, and transmit the security token as an authentication token back to the authentication server through a secure channel.

[0038] When authenticating a user device, the user device will receive a verification challenge from the authentication server. Set in the payload: When the verification challenge is sent to the user device, it will trigger the payload running in the user device to execute the following process: Obtain the user device's hardware information, operating system, and application information to generate a unique identifier, and generate a security token corresponding to the user identity and the user device based on the user device's unique identifier, user identity, login credentials, and operating environment. The security token generated at this time is the authentication token to be verified for the user device calculated when authenticating the user device. Calculate the response to be verified based on the authentication token to be verified and the verification challenge, and return the response to be verified to the authentication server.

[0039] S103: Receive the authentication token generated by the payload according to the device information of the user device, and store the authentication token and the registration information of the user device in a token library in correspondence with each other.

[0040] In a possible embodiment, based on the configuration of the payload, the authentication server will be able to receive the authentication token generated according to the device information of the user device and returned by the payload, and store the authentication token and the registration information of the user device in the token library in correspondence, so that the authentication server records the authentication token corresponding to the registered user device and the user identity information in the user device during registration.

[0041] S104: receiving an identity authentication request from a registered user device, the identity authentication request including authentication credentials, verifying the authentication credentials, and when the authentication credentials are valid, initiating a verification challenge to the user device to be authenticated.

[0042] In a possible embodiment, when a registered user device has an authentication requirement, the authentication server will receive an authentication request from the user device, and the information included in the authentication request includes the authentication credentials obtained when the user registered. The authentication server will verify the authentication credentials included in the authentication request based on the authentication credentials it saves. When the verification result is that the authentication credentials are valid, the authentication request is valid, the user device that issued the authentication request is the user device to be authenticated, and the authentication server will initiate a verification challenge to the user device to be authenticated. When the verification result is that the authentication credentials are invalid, the authentication request is considered invalid and the response ends.

[0043] In a possible embodiment, the authentication credentials are standard credentials based on a shared secret, such as <password, password hash>, <private key, public key>, etc. The authentication server verifies the authentication credentials attached to the identity authentication request based on the authentication credentials it stores. This can be: the user sets his own password during the registration phase, and the server stores the hash corresponding to the password in the database. When the user logs in, the user enters the password he sets, and the authentication server hashes the password and compares it with the password hash stored in the database. If they are consistent, the verification passes. It should be noted that the authentication credentials described in the present invention are not limited, and a verification code mechanism can also be used. When verifying, a similar consistency check is also performed, so that in the eyes of the user, the authentication method of the present invention is no different from conventional authentication, has a high degree of adaptability, and does not require the user to perform additional operations.

[0044] Exemplarily, when the verification result is that the authentication credentials are valid, the authentication server will initiate a verification challenge to the user device to be authenticated by sending a challenge C to the user device, where the challenge C is a random string. Specifically, the generation method of the challenge C can be configured according to different policies.

[0045] In a possible embodiment, challenge C can be understood as a random number with entropy, which is generally generated in the following ways: 1. Simple random number generation: Challenge C is generated by a high-quality random number generator to ensure that each challenge is unpredictable - a cryptographically secure pseudo-random number generator (CSPRNG) is used to generate challenges. 2. Time-based random number generation: Challenge C is a unique identifier generated based on the current time of the system, usually combined with a timestamp and random number generation - a certain amount of random entropy is added to the timestamp to prevent attackers from predicting future challenges. 3. Counter-based: Challenge C is an incremental counter value, and the counter increases with each request - the counter is incremented for each authentication request, and it is ensured that the counter is not reused, combined with random numbers and anti-replay mechanisms to prevent attackers from cracking.

[0046] S105: Receive a response to be verified generated by a payload in the user equipment to be authenticated, wherein the response to be verified is generated according to device information of the user equipment to be authenticated and a verification challenge.

[0047] In a possible embodiment, based on the setting of the payload, when the verification challenge is sent to the user device to be authenticated, the payload running in the user device to be authenticated can receive information that the user device to be authenticated receives the verification challenge, thereby triggering the payload to generate a response to be verified based on the device information of the user device to be authenticated and the verification challenge.

[0048] Exemplarily, the process of the payload generating a response to be verified includes: obtaining the hardware information, operating system and application information of the user device to generate a unique identifier, generating an authentication token to be verified corresponding to the user identity and the user device according to the unique identifier of the user device, the user identity, the login credentials and the operating environment, calculating the response to be verified according to the authentication token to be verified and the verification challenge, and returning the response to be verified to the authentication server. The generated response to be verified is generated according to the configuration information of the user device when the user device to be verified receives the verification challenge, and the device information of the user device such as the user identity logged in on the user device at that time and the verification challenge.

[0049] S106: Obtain an authentication token corresponding to the user device to be authenticated from the token library, and generate a verification response according to the authentication token and the verification challenge.

[0050] In a possible embodiment, the authentication token corresponding to the user device to be authenticated in the token library is, when the user device is registered, a payload is delivered to the user device so that the payload is generated according to the configuration information of the user device at that time and the device information on the user device such as the identity of the user logged in on the user device at that time, and then returned to the authentication server to be stored in the token library. The authentication response generated according to the authentication token corresponding to the user device obtained from the token library and the authentication challenge is generated according to the configuration information of the user device when the user device is registered and the device information on the user device such as the identity of the user logged in on the user device at that time and the authentication challenge.

[0051] S107: Compare the response to be authenticated and the authentication response to see if they are consistent, and obtain an authentication result of the user equipment to be authenticated according to the comparison result.

[0052] In a possible embodiment, since the response to be verified and the verification response are generated based on the authentication server's response to the authentication request of the user device and the configuration information of the user device when the user device is registered, as well as the device information and verification challenge of the user device such as the identity of the user logged in at that time, and according to S102, the device information on the user device used includes the hardware and software information of the user device, such as the hardware information, operating system and application information, user identity, login credentials, and operating environment of the user device. Therefore, by comparing whether the response to be verified and the verification response are consistent, it is possible to analyze whether many factors such as the operating environment, user identity information, and user device characteristics of the user device at the time of registration and authentication are consistent, thereby obtaining the authentication result of the user device to be authenticated.

[0053] In a possible embodiment, the response to be verified and the verification response are compared for consistency, and an authentication result of the user device to be authenticated is obtained based on the comparison result, including: when the response to be verified and the verification response are consistent, the identity authentication of the user device to be authenticated passes; when the response to be verified and the verification response are inconsistent, the identity authentication of the user device to be authenticated fails and an abnormal warning is issued.

[0054] The challenge-response-based adversarial user device authentication method provided by the present invention generates a security token based on the software and hardware information and operating environment of the user device based on the load delivery method, and uses the security token as the encryption key for the challenge-response authentication process in the subsequent identity authentication stage. The method binds the authentication credentials with the user device, identity, and authentication environment, and has anti-phishing properties. The load is run in real time during multiple stages such as user registration and authentication to calculate the security token, and the authentication token and the token to be authenticated are obtained based on the security token for user device identity authentication. The properties of the security token ensure the consistency of the user device operating environment during registration and authentication, and avoid adversarial attacks caused by attackers impersonating the device owner to initiate authentication after the device is compromised.

[0055] The challenge-response-based adversarial user device authentication method of the present invention is applied by delivering a payload to a registered user device, and the payload runs on the user device to calculate and generate a unique security token based on the software and hardware information and characteristics of the user device. An authentication token is obtained based on the security token, and then the authentication token is used as a key (including but not limited to a symmetric encryption key and an asymmetric encryption key) in the challenge-response identity authentication process, thereby solving the problem of login credential theft caused by phishing threats. The payload calculates the security token corresponding to a certain user identity and the corresponding user device in real time based on information such as user device characteristics, user information, login credentials, and operating environment. The calculation of the security token takes into account many factors. The identity authentication initiated by a legitimate user (device owner) and the identity authentication initiated by an attacker pretending to be a user will be different due to the differences in the above-mentioned many factors, so that the generated security token is also different. Based on the security token, an authentication token and a token to be authenticated are obtained, and the identity authentication result of the user device is determined based on the authentication token, the token to be authenticated, and the verification challenge. It can solve the adversarial attack behavior that the attacker has already captured the target device and attempts to impersonate the owner of this device to implement lateral movement.

[0056] In a possible embodiment, a confrontational anti-phishing identity authentication system is set in the authentication server to which the challenge-response-based confrontational user device authentication method provided by the present invention is applied. Figure 2 ,The adversarial anti-phishing identity authentication system includes : a payload delivery module, a payload ,data receiving module, a credential library, an identity authentication interface and a ,decision module.

[0057] Among them, the payload delivery module is used to prepare a payload that can be safely run on the user device according to the characteristics of the user device (including but not limited to the operating system type, kernel version, processor architecture, etc.) when the user device requests to register, and deliver the payload to the user device (the user's true identity is guaranteed by the system administrator when the user device registers, such as manual confirmation, use of biometric authentication, etc.).

[0058] The payload is used to run on the user device to calculate the security token when the user device requests registration and determine the authentication token based on it to be transmitted back to the adversarial anti-phishing identity authentication system. This authentication token will be used as the key for the subsequent challenge-response authentication process (the keys used in the challenge-response authentication process include but are not limited to symmetric encryption algorithms and asymmetric encryption algorithms. The authentication token is used as the encryption key. When a symmetric encryption algorithm is used, the payload directly transmits the security token as the authentication token to the identity authentication system; when an asymmetric encryption algorithm is used, the payload uses the security token as a private key, calculates its corresponding public key, and transmits the public key as the authentication token back to the identity authentication system). The payload is also used to calculate the security token as the token to be authenticated when the user device requests authentication, and calculates the corresponding response to be authenticated based on the verification challenge and the token to be authenticated, and transmits the response to be authenticated back to the adversarial anti-phishing identity authentication system. The process of real-time calculation of security tokens by user devices includes: generating a unique identifier for the user device based on the hardware information, operating system and application information of the user device, and using the unique identifier, user identity, login credentials, operating environment (including but not limited to the code segment, data segment, function call stack, etc. of the payload) and other information to generate a security token corresponding to this user identity and user device.

[0059] The data receiving module is used to receive information sent from the payload running on the user device, including the key used for the challenge-response authentication process calculated when the user device is registered, and the response to be verified calculated by the payload when the user device performs identity authentication; and pass the received information to the decision module.

[0060] The credential library is used to record the encryption keys associated with the security credentials corresponding to the user identity and device from the payload.

[0061] The identity authentication interface is used to receive a registration request from a user when the user device requests registration; when the user device requests identity authentication, it receives an identity authentication request from the user device and preliminarily determines the user identity based on the authentication credentials in the identity authentication request. If the authentication credentials are correct, the identity authentication request is valid, and the identity authentication notification decision module starts the challenge-response authentication process, otherwise the identity authentication request is rejected.

[0062] The decision module is used to save the encryption key and the corresponding identity in the credential library according to the encryption key and user identity from the data receiving module when the user device is registered; when the user device is authenticated, after the authentication interface determines that the user's authentication credentials are correct, a verification challenge is generated and sent to the payload on the user device, and the correctness of the response to be verified returned by the payload is determined according to the encryption key corresponding to the user identity in the credential library; if the response to be verified is correct, the authentication is passed, otherwise, an exception is output and an alarm is given.

[0063] In a specific embodiment, the operation process of applying the challenge-response-based adversarial user device authentication method of the present invention to set up an adversarial anti-phishing identity authentication system to perform user device authentication is as follows: Figure 3 As shown, in this embodiment, the authentication system uses a challenge-response authentication of a symmetric encryption algorithm. Specifically, the operation process can be divided into a pre-configuration phase and an identity authentication phase.

[0064] Exemplarily, the pre-configuration phase is the user registration phase, during which the authentication system completes the registration of the user's identity and the preservation of the security token, including: 1. User registration: The user registers with the authentication system, submits personal information and registers login credentials to the identity authentication interface. The identity authentication interface can be configured with multiple methods such as multi-factor authentication, user biometric verification, or administrator manual identity verification to enhance the security of authentication; after the identity authentication interface confirms that the registration information is correct, it saves the login credentials and notifies the decision-making module. 2. Payload delivery: The payload delivery module of the authentication system prepares the appropriate payload and delivers it to the user's device. 3. Token calculation: The payload obtains the user device's hardware information (including but not limited to CPU model and serial number, network card MAC address, motherboard serial number, etc.), operating system and application information (including but not limited to operating system security patch version, operating system version, installed application list, registry entries, etc.) to generate a unique identifier for the device, and uses the device's unique identifier, user identity, login credentials, and operating environment (including but not limited to the payload runtime code segment, data segment, partial information of the function call stack, etc.) to generate a unique security token K1 corresponding to this user identity, user device and operating environment; since this authentication process uses a symmetric encryption algorithm, the security token K1 is directly returned to the authentication system as an encryption key. 4. Save the token: After receiving the security token K1, the authentication system saves K1 and the user identity in the token library according to the registered user information; the user registration process is now completed.

[0065] After completing the user registration work in the pre-configuration phase, the authentication system has obtained the encryption key for authentication corresponding to the user identity and can provide authentication services to the user. The interaction in the authentication phase is as follows: 1. User request authentication: The user uses the user device that has been registered to initiate an authentication request to the authentication system, and the request is accompanied by the authentication credentials used by the user when registering. 2. Initiate a challenge: The authentication interface verifies the user authentication credentials. If valid, it notifies the decision module; otherwise, the request is considered invalid; after receiving the notification from the authentication interface, the decision module sends a challenge C to the user who initiated the request (Challenge C is a random string, and the generation method of Challenge C can be configured according to different strategies). 3. Real-time calculation of token K2: After receiving Challenge C, the payload calculates the authentication token K2 again according to the method in step 3 of the pre-configuration phase as the encryption key for the challenge-response authentication process. 4. Calculate and return the response: The payload calculates the response R1 based on the encryption key K2 and Challenge C, and returns R1 to the authentication system. 5. The authentication system calculates the response: The decision module of the authentication system queries the corresponding pre-configured encryption key K1 in the token library according to the identity of the user requesting authentication, and uses K1 and challenge C to calculate the response R2. 6. Verify the response: The decision module of the authentication system verifies whether R1 and R2 are consistent. If they are consistent, the authentication is passed and the authentication success is returned; otherwise, an abnormal alarm is issued.

[0066] See the instruction manual Figure 4 This embodiment also provides a challenge-response-based adversarial user equipment authentication device, which is used to implement the above method embodiment. The device includes:

[0067] The registration unit 201 is configured to receive a registration request from a user device and registration information submitted by the user device, register the authentication credentials of the user device according to the registration information, and feed back the authentication credentials to the user device.

[0068] The load delivery unit 202 is used to configure the load according to the characteristics of the user equipment and deliver the load to the user equipment.

[0069] The token storage unit 203 is used to receive the authentication token generated by the payload according to the device information of the user device, and store the authentication token and the registration information of the user device in the token library in correspondence.

[0070] The credential verification unit 204 is used to receive an identity authentication request from a registered user device, the identity authentication request including authentication credentials, verify the authentication credentials, and when the authentication credentials are valid, initiate a verification challenge to the user device to be authenticated.

[0071] The response receiving unit 205 is configured to receive a response to be verified generated by a payload in the user equipment to be authenticated, wherein the response to be verified is generated according to device information of the user equipment to be authenticated and a verification challenge.

[0072] The verification response generation unit 206 is used to obtain the authentication token corresponding to the user equipment to be authenticated in the token library, and generate a verification response according to the authentication token and the verification challenge.

[0073] The authentication unit 207 is used to compare whether the response to be authenticated is consistent with the authentication response, and obtain an authentication result of the user equipment to be authenticated according to the comparison result.

[0074] Among them, the payload delivery unit 202 configures the payload according to the characteristics of the user device, including: setting in the payload that when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; and generating an authentication token corresponding to the user identity and the user device according to the unique identifier of the user device, the user identity, the login credentials and the operating environment.

[0075] The payload delivery unit 202 configures the payload according to the characteristics of the user device, including: setting in the payload that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier; based on the unique identifier, user identity, login credentials and operating environment, an authentication token to be verified corresponding to the user identity and user device is generated; and a response to be verified is calculated based on the authentication token to be verified and the verification challenge.

[0076] The authentication unit 207 compares whether the response to be verified is consistent with the verification response, and obtains the authentication result of the user device to be authenticated according to the comparison result, including: when the response to be verified is consistent with the verification response, the identity authentication of the user device to be authenticated passes; when the response to be verified is inconsistent with the verification response, the identity authentication of the user device to be authenticated fails and an abnormal warning is issued.

[0077] All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0078] In other embodiments of the present application, the present application discloses an electronic device, such as Figure 5 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more applications (not shown); and one or more computer programs 304. The above components may be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions, which may be used to execute the following: Figure 1 , Figure 4 And each step in the corresponding embodiment.

[0079] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0080] Each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0081] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk.

[0082] The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the embodiment of the present application should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims

1. A challenge-response based adversarial user device authentication method, characterized in that: include: Receive a registration request from a user device and registration information submitted by the user device, register the authentication credentials of the user device according to the registration information and feed the authentication credentials back to the user device; Configuring a payload according to the characteristics of the user equipment, and delivering the payload to the user equipment; receiving an authentication token generated by the payload according to the device information of the user device, and storing the authentication token and the registration information of the user device in a token library in correspondence with each other; Receiving an identity authentication request from a registered user device, the identity authentication request including the authentication credential, verifying the authentication credential, and when the authentication credential is valid, initiating a verification challenge to the user device to be authenticated; Receiving a response to be verified generated by a payload in the user equipment to be authenticated, wherein the response to be verified is generated according to the device information of the user equipment to be authenticated and the verification challenge; Obtaining an authentication token corresponding to the user device to be authenticated from the token library, and generating a verification response according to the authentication token and the verification challenge; The response to be verified is compared with the verification response to see whether they are consistent, and an authentication result of the user equipment to be authenticated is obtained according to the comparison result.

2. The method according to claim 1, characterized in that Configuring a load according to the characteristics of the user equipment includes: In the payload, it is set that after the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; An authentication token corresponding to the user identity and the user device is generated based on the unique identifier of the user device, the user identity, the login credentials and the operating environment.

3. The method according to claim 1, characterized in that Configuring a load according to the characteristics of the user equipment includes: In the payload, it is set that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier, and an authentication token to be verified corresponding to the user identity and the user device is generated according to the unique identifier, user identity, login credentials and operating environment; A response to be verified is calculated based on the authentication token to be verified and the verification challenge.

4. The method according to claim 1, characterized in that: Comparing whether the response to be verified is consistent with the verification response, and obtaining an authentication result of the user equipment to be authenticated according to the comparison result, includes: When the response to be verified is consistent with the verification response, the identity authentication of the user equipment to be authenticated is passed; When the response to be verified is inconsistent with the verification response, the identity authentication of the user equipment to be authenticated fails and an abnormal warning is issued.

5. A challenge-response-based adversarial user equipment authentication device, characterized in that: The device comprises: A registration unit, configured to receive a registration request from a user device and registration information submitted by the user device, register the authentication credentials of the user device according to the registration information and feed the authentication credentials back to the user device; A load delivery unit, configured to configure a load according to a feature of the user equipment and deliver the load to the user equipment; a token storage unit, configured to receive the authentication token generated by the payload according to the device information of the user device, and store the authentication token and the registration information of the user device in a token library in correspondence with each other; The credential verification unit is used to receive an identity authentication request of a registered user device, the identity authentication request includes the authentication credential, verify the authentication credential, and when the authentication credential is valid, initiate a verification challenge to the user device to be authenticated; a response receiving unit, configured to receive a response to be verified generated by a load in the user equipment to be authenticated, wherein the response to be verified is generated according to the device information of the user equipment to be authenticated and the verification challenge; a verification response generating unit, configured to obtain an authentication token corresponding to the user device to be authenticated from the token library, and generate a verification response according to the authentication token and the verification challenge; The authentication unit is used to compare whether the response to be authenticated is consistent with the authentication response, and obtain an authentication result of the user equipment to be authenticated according to the comparison result.

6. The device according to claim 5, characterized in that The load delivery unit configures the load according to the characteristics of the user equipment, including: In the payload, it is set that after the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; An authentication token corresponding to the user identity and the user device is generated based on the unique identifier of the user device, the user identity, the login credentials and the operating environment.

7. The device according to claim 5, characterized in that The load delivery unit configures the load according to the characteristics of the user equipment, including: In the payload, it is set that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier, and an authentication token to be verified corresponding to the user identity and the user device is generated according to the unique identifier, user identity, login credentials and operating environment; A response to be verified is calculated based on the authentication token to be verified and the verification challenge.

8. The device according to claim 5, characterized in that The authentication unit compares whether the response to be verified is consistent with the verification response, and obtains the authentication result of the user equipment to be authenticated according to the comparison result, including: When the response to be verified is consistent with the verification response, the identity authentication of the user equipment to be authenticated is passed; When the response to be verified is inconsistent with the verification response, the identity authentication of the user equipment to be authenticated fails and an abnormal warning is issued.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the challenge-response-based adversarial user equipment authentication method according to any one of claims 1 to 4 is implemented.

10. An electronic device, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the electronic device performs the challenge-response-based adversarial user device authentication method according to any one of claims 1 to 4.

Images