A challenge-response based user device authentication method

Abstract

The present invention provides an adversarial user device authentication method based on challenge response, including: registering the authentication credentials of the user device; configuring a payload and delivering it to the user device; receiving an authentication token generated by the payload according to the device information of the user device; receiving an identity authentication request including the authentication credentials from the user device, and initiating a verification challenge when the authentication credentials are valid; receiving a response to be verified generated by the payload; obtaining the authentication token of the user device, and generating a verification response according to the authentication token and the verification challenge; comparing whether the response to be verified and the verification response are consistent to obtain an authentication result of the user device. This method is applied to calculate the authentication token and the token to be verified in real time during the user device registration and authentication stages based on the payload delivery method to perform user device identity authentication. The attributes of the token can verify the consistency of the user device operating environment, avoiding adversarial attacks caused by attackers impersonating the device owner to initiate authentication after the device is compromised.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a challenge-response-based adversarial user equipment authentication method. Background Art

[0002] Phishing is one of the most common techniques used by attackers to gain initial access to a victim's device or system. By using fake login pages or emails sent from trusted entities, attackers trick victims into entering their login credentials or installing malware such as remote control Trojans, ultimately gaining initial access to the victim's device or system. Multi-factor authentication mechanisms, such as SMS / email verification codes and one-time passwords, can mitigate phishing threats to a certain extent. However, attackers can still exploit real-time phishing (man-in-the-middle attacks) to obtain verification codes and circumvent multi-factor authentication.

[0003] Existing identity authentication technology to prevent phishing threats relies on dedicated security hardware. Users need to load this dedicated hardware onto their devices. The hardware device has a trusted computing base. The authentication client located in the trusted computing base initiates an identity authentication request. The authentication service provider identifies the proprietary hardware on the user side and then determines that the person issuing the authentication request is a legitimate user rather than an attacker.

[0004] However, the dedicated security hardware that existing anti-phishing identity authentication technologies rely on is expensive to use, so dedicated security hardware is usually set to be permanently valid or have a long validity period. If the dedicated security hardware used for identity authentication is lost, the identity authentication system will face the risk of losing the private key in the trusted computing base of the dedicated hardware, causing the trusted computing base on the service side of the authentication system to fail. After the dedicated anti-phishing security hardware is loaded onto the user's device, if the device has an unknown vulnerability / backdoor, an attacker may exploit the vulnerability / backdoor to impersonate the device owner and call the security hardware to initiate identity authentication. For such attackers who have already compromised the target user's device and attempt to use this device to collect user credentials and carry out larger-scale lateral movement attacks, existing anti-phishing identity authentication technologies cannot address this type of adversarial attack behavior.

[0005] Therefore, it is necessary to provide a user device authentication method that can prevent phishing threats from attackers stealing user login credentials and block adversarial attacks from attackers impersonating device owners. Summary of the Invention

[0006] The purpose of the present invention is to provide a challenge-response-based adversarial user device authentication method to prevent phishing threats in which attackers steal user login credentials and block adversarial attacks carried out by attackers impersonating device owners.

[0007] In a first aspect, the present invention provides an adversarial user device authentication method based on challenge response, including: receiving a registration request from a user device and registration information submitted by the user device, registering the authentication credentials of the user device according to the registration information and feeding back the authentication credentials to the user device; configuring a payload according to the characteristics of the user device, and delivering the payload to the user device; receiving an authentication token generated by the payload according to the device information of the user device, and storing the authentication token and the registration information of the user device in a token library in correspondence; receiving an identity authentication request from a registered user device, the identity authentication request including the authentication credentials, verifying the authentication credentials, and when the authentication credentials are valid, initiating a verification challenge to the user device to be authenticated; receiving a response to be verified generated by the payload in the user device to be authenticated, wherein the response to be verified is generated according to the device information of the user device to be authenticated and the verification challenge; obtaining the authentication token corresponding to the user device to be authenticated in the token library, and generating a verification response according to the authentication token and the verification challenge; comparing whether the response to be verified and the verification response are consistent, and obtaining the authentication result of the user device to be authenticated based on the comparison result.

[0008] The beneficial effects of the challenge-response-based adversarial user device authentication method provided by the present invention are: based on the load delivery method, a token for user device identity authentication is generated according to the software and hardware information and operating environment of the user device, and the authentication token and the token to be authenticated are obtained by real-time load calculation in multiple stages such as user device registration and authentication. The user device identity is authenticated by the authentication token and the token to be authenticated. The attributes of the authentication token and the token to be authenticated can verify the consistency of the user device operating environment during registration and authentication, thereby avoiding adversarial attacks caused by the attacker impersonating the device owner to initiate authentication after the device is compromised.

[0009] In a possible embodiment, the payload is configured according to the characteristics of the user device, including: setting in the payload that when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; and generating an authentication token corresponding to the user identity and user device based on the unique identifier, user identity, login credentials and operating environment of the user device.

[0010] In another possible embodiment, the payload is configured according to the characteristics of the user device, including: setting in the payload that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier, and an authentication token to be verified corresponding to the user identity and user device is generated according to the unique identifier, user identity, login credentials and operating environment; and a response to be verified is calculated based on the authentication token to be verified and the verification challenge.

[0011] In other possible embodiments, the response to be verified and the verification response are compared to see if they are consistent, and an authentication result of the user device to be authenticated is obtained based on the comparison result, including: when the response to be verified and the verification response are consistent, the identity authentication of the user device to be authenticated passes; when the response to be verified and the verification response are inconsistent, the identity authentication of the user device to be authenticated fails and an abnormal warning is issued.

[0012] In a second aspect, the present invention further provides a challenge-response-based adversarial user equipment authentication device, comprising:

[0013] The system further comprises a registration unit configured to receive a registration request from a user device and registration information submitted by the user device, register the authentication credentials of the user device based on the registration information, and feed the authentication credentials back to the user device; a payload delivery unit configured to configure a payload based on the characteristics of the user device and deliver the payload to the user device; a token storage unit configured to receive an authentication token generated by the payload based on the device information of the user device and store the authentication token in a token library in correspondence with the registration information of the user device; a credential verification unit configured to receive an identity authentication request from a registered user device, the identity authentication request including the authentication credentials, verify the authentication credentials, and, when the authentication credentials are valid, initiate a verification challenge to the user device to be authenticated; a response receiving unit configured to receive a response to be authenticated generated by the payload in the user device to be authenticated, wherein the response to be authenticated is generated based on the device information of the user device to be authenticated and the verification challenge; a verification response generation unit configured to obtain an authentication token corresponding to the user device to be authenticated from the token library and generate a verification response based on the authentication token and the verification challenge; and an authentication unit configured to compare the response to be authenticated with the verification response to determine whether they are consistent, and derive an authentication result for the user device to be authenticated based on the comparison result.

[0014] Among them, the payload delivery unit configures the payload according to the characteristics of the user device, including: setting in the payload that when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; and generating an authentication token corresponding to the user identity and user device based on the unique identifier, user identity, login credentials and operating environment of the user device.

[0015] The payload delivery unit configures the payload according to the characteristics of the user device, including: setting in the payload that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier, and generating a to-be-verified authentication token corresponding to the user identity and user device according to the unique identifier, user identity, login credentials and operating environment; and calculating a to-be-verified response based on the to-be-verified authentication token and the verification challenge.

[0016] The authentication unit compares whether the response to be verified and the verification response are consistent, and obtains the authentication result of the user equipment to be authenticated based on the comparison result, including: when the response to be verified and the verification response are consistent, the identity authentication of the user equipment to be authenticated is passed; when the response to be verified and the verification response are inconsistent, the identity authentication of the user equipment to be authenticated fails and an abnormal warning is issued.

[0017] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned challenge-response-based adversarial user device authentication method when executed by a processor.

[0018] In a fourth aspect, the present invention also provides an electronic device comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device performs the above-mentioned challenge-response-based adversarial user device authentication method.

[0019] For the beneficial effects of the second to fourth aspects, please refer to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flowchart of a challenge-response-based adversarial user equipment authentication method provided by an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of an adversarial anti-phishing identity authentication system provided in an authentication server applying an adversarial user device authentication method based on challenge response according to an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of the operational flow of user device authentication by the adversarial anti-phishing identity authentication system provided in an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of a challenge-response-based adversarial user equipment authentication device provided by an embodiment of the present invention;

[0024] Figure 5A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the present invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0026] This embodiment provides a challenge-response-based adversarial user device authentication method. Figure 1 , the method comprising:

[0027] S101: receiving a registration request from a user device and registration information submitted by the user device, registering an authentication credential of the user device according to the registration information, and feeding back the authentication credential to the user device.

[0028] In one possible embodiment, a challenge-response-based adversarial user device authentication method is configured in an authentication server for authenticating a user device, and the authentication server is in communication with the user device. The authentication server receives a registration request from the user device and registration information submitted by the user device, registers the user device's authentication credentials based on the registration information, and returns the authentication credentials to the user device.

[0029] In one possible embodiment, when a user device registers, the user device sends a registration request to the authentication server and submits registration information to register the authentication credentials. The registration information mentioned by the user device can be the user's personal information of the user device, the user's biometric information, etc. The authentication server receives the registration request from the user device and the registration information submitted by the user device, reviews and confirms the user's registration information, and registers and saves the authentication credentials of the user device after the review and confirmation that the registration information is correct. Among them, the methods for reviewing and confirming the user's registration information include multi-factor authentication, user biometric verification, or manual identity verification by the administrator, etc., and strengthen the security of the user's registration information review and confirmation through various methods.

[0030] S102: Configure a payload according to the characteristics of the user equipment, and deliver the payload to the user equipment.

[0031] In a possible embodiment, for a user device that has been registered after the registration information is verified to be correct, the authentication server configures a payload according to the characteristics of the user device and delivers the payload to the user device.

[0032] In a specific embodiment, a payload that can run safely on the user device is configured based on the operating system type, kernel version, processor architecture and other characteristics of the user device, and the configured payload is delivered to the user device.

[0033] In a possible embodiment, the payload is configured according to the characteristics of the user device, including setting in the payload: when the payload is delivered to the user device, obtaining the hardware information, operating system and application information of the user device to generate a unique identifier; based on the unique identifier of the user device, user identity, login credentials and operating environment, generating a security token corresponding to the user identity and user device, and the security token serves as the obtained authentication token.

[0034] In a possible embodiment, the payload is configured according to the characteristics of the user device, including the following settings in the payload: when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; based on the unique identifier of the user device, user identity, login credentials and operating environment, a security token corresponding to the user identity and user device is generated, the security token is used as a private key and the corresponding public key is calculated, and the public key is used as the generated authentication token.

[0035] In a possible embodiment, a payload is configured according to the characteristics of the user device, including setting in the payload that when a verification challenge is sent to the user device to be authenticated, hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier; based on the unique identifier of the user device, user identity, login credentials and operating environment, an authentication token to be verified corresponding to the user identity and user device is generated; and a response to be verified is calculated based on the authentication token to be verified and the verification challenge.

[0036] In a specific embodiment, a challenge-response-based adversarial user device authentication method generates a unique security token for each registered user device. This security token is then calculated twice during user device authentication for challenge-response authentication. Both security token generation processes require obtaining user device information and performing calculations at predetermined timings. Therefore, when configuring a payload, the payload's operation is configured so that the authentication server can receive the security token via the payload.

[0037] Exemplarily, it is set in the payload: after the payload is delivered to the user device, the payload runs on the user device to generate a unique identifier for the user device based on the user device's hardware information (including but not limited to CPU model and serial number, network card MAC address, motherboard serial number, etc.), operating system and application information (including but not limited to operating system security patch version, operating system version, installed application list, registry entries, etc.), etc., and use the device's unique identifier, user identity, login credentials, operating environment (including but not limited to the payload's code segment, data segment, function call stack, etc.) and other information to generate a security token corresponding to the user identity and user device, and transmit the security token as an authentication token back to the authentication server through a secure channel.

[0038] When authenticating a user device, the user device will receive a verification challenge from the authentication server. This is set in the payload: When the verification challenge is sent to the user device, it triggers the payload running on the user device to execute the following process: Obtain the user device's hardware information, operating system, and application information to generate a unique identifier. Then, based on the user device's unique identifier, user identity, login credentials, and operating environment, generate a security token corresponding to the user identity and user device. The security token generated at this time serves as the authentication token to be verified for the user device calculated when authenticating the user device. A response to be verified is calculated based on the authentication token to be verified and the verification challenge, and the response to be verified is returned to the authentication server.

[0039] S103: Receive the authentication token generated by the payload according to the device information of the user device, and store the authentication token and the registration information of the user device in a token library in correspondence.

[0040] In a possible embodiment, based on the configuration of the payload, the authentication server will be able to receive the authentication token generated according to the device information of the user device returned by the payload, and store the authentication token and the registration information of the user device in the token library corresponding to each other, so that the authentication server records the authentication token corresponding to the registered user device and the user identity information in the user device at the time of registration.

[0041] S104: Receive an identity authentication request from a registered user device, the identity authentication request including authentication credentials, verify the authentication credentials, and when the authentication credentials are valid, initiate a verification challenge to the user device to be authenticated.

[0042] In one possible embodiment, when a registered user device requires authentication, the authentication server receives an authentication request from the user device. The authentication request includes the authentication credentials obtained during user registration. The authentication server verifies the authentication credentials included in the authentication request based on its stored authentication credentials. If the verification result indicates that the authentication credentials are valid, the authentication request is valid, the user device issuing the authentication request is the user device to be authenticated, and the authentication server issues a verification challenge to the user device to be authenticated. If the verification result indicates that the authentication credentials are invalid, the authentication request is deemed invalid, and the response is terminated.

[0043] In one possible embodiment, the authentication credentials are standard credentials based on a shared secret, such as <password, password hash>, <private key, public key>, etc. The authentication server verifies the authentication credentials attached to the identity authentication request based on the authentication credentials it stores. This can be: the user sets his or her own password during the registration phase, and the server stores the hash corresponding to the password in the database. When the user logs in, the user enters the password he or she sets, and the authentication server hashes the password and compares it with the password hash stored in the database. If they are consistent, the verification is passed. It should be noted that the authentication credentials described in the present invention are not limited, and a verification code mechanism can also be used. A similar consistency check is also performed during the verification, so that in the eyes of the user, the authentication method of the present invention is no different from conventional authentication, has high adaptability, and does not require the user to perform additional operations.

[0044] For example, when the verification result shows that the authentication credentials are valid, the authentication server will initiate a verification challenge to the user device to be authenticated by sending a challenge C to the user device, where the challenge C is a random string. Specifically, the generation method of the challenge C can be configured according to different policies.

[0045] In a possible embodiment, challenge C can be understood as a random number with entropy, which is generally generated in the following ways: 1. Simple random number generation: Challenge C is generated by a high-quality random number generator to ensure that each challenge is unpredictable - a cryptographically secure pseudo-random number generator (CSPRNG) is used to generate the challenge. 2. Time-based random number generation: Challenge C is a unique identifier generated based on the current time of the system, usually combined with a timestamp and random number generation - a certain amount of random entropy is added to the timestamp to prevent attackers from predicting future challenges. 3. Counter-based: Challenge C is an incrementing counter value, and the counter increases with each request - the counter is incremented for each authentication request, and it is ensured that the counter is not reused, combined with random numbers and anti-replay mechanisms to prevent attackers from cracking.

[0046] S105: Receive a response to be verified generated by a payload in the user equipment to be authenticated, wherein the response to be verified is generated according to device information of the user equipment to be authenticated and a verification challenge.

[0047] In a possible embodiment, based on the setting of the payload, after the verification challenge is sent to the user device to be authenticated, the payload running in the user device to be authenticated can receive the information that the user device to be authenticated receives the verification challenge, thereby triggering the payload to generate a response to be verified based on the device information of the user device to be authenticated and the verification challenge.

[0048] Exemplarily, the process of generating a pending verification response by the payload includes: obtaining the user device's hardware information, operating system, and application information to generate a unique identifier; generating a pending verification authentication token corresponding to the user identity and user device based on the user device's unique identifier, user identity, login credentials, and operating environment; calculating a pending verification response based on the pending verification authentication token and the verification challenge; and returning the pending verification response to the authentication server. The generated pending verification response is generated based on the user device's configuration information at the time the pending verification challenge is received, as well as device information on the user device, such as the identity of the user logged in at the time, and the verification challenge.

[0049] S106: Obtain an authentication token corresponding to the user device to be authenticated from the token library, and generate a verification response according to the authentication token and the verification challenge.

[0050] In one possible embodiment, the authentication token corresponding to the user device to be authenticated in the token library is generated by delivering a payload to the user device during user device registration, based on the user device's configuration information at the time and the user's identity, etc., which is then returned to the authentication server for storage in the token library. The verification response generated based on the authentication token corresponding to the user device obtained from the token library and the verification challenge is generated based on the user device's configuration information at the time of user device registration, the user's identity, etc., which is the user's identity, etc., and the verification challenge.

[0051] S107: Compare the response to be verified and the verification response to see if they are consistent, and obtain an authentication result of the user equipment to be authenticated according to the comparison result.

[0052] In one possible embodiment, the response to be verified and the verification response are generated based on the authentication server's response to the user device's authentication request, the user device's configuration information during registration, and the user's identity, etc., as well as the device information and verification challenge on the user device. Furthermore, as described in S102, the device information on the user device used includes the user device's hardware and software information, such as the user device's hardware information, operating system and application information, user identity, login credentials, and operating environment. Therefore, by comparing the response to be verified and the verification response for consistency, it is possible to analyze whether various factors, such as the operating environment, user identity information, and user device characteristics, of the user device during registration and authentication are consistent, thereby deriving an authentication result for the user device to be authenticated.

[0053] In a possible embodiment, the response to be verified and the verification response are compared to determine whether they are consistent, and an authentication result of the user device to be authenticated is obtained based on the comparison result, including: when the response to be verified and the verification response are consistent, the identity authentication of the user device to be authenticated passes; when the response to be verified and the verification response are inconsistent, the identity authentication of the user device to be authenticated fails and an abnormal warning is issued.

[0054] The challenge-response-based adversarial user device authentication method provided by the present invention uses a payload delivery method to generate a security token based on the user device's hardware and software information and operating environment. This security token is then used as the encryption key for the challenge-response authentication process in the subsequent identity authentication phase. Furthermore, the method binds authentication credentials to the user device, identity, and authentication environment, providing anti-phishing properties. During multiple stages, such as user registration and authentication, the security token is calculated using a real-time payload. Based on the security token, an authentication token and a token to be authenticated are generated for user device identity authentication. The properties of the security token ensure consistency in the user device's operating environment during registration and authentication, preventing adversarial attacks caused by attackers impersonating the device owner to initiate authentication after the device is compromised.

[0055] The challenge-response-based adversarial user device authentication method of the present invention delivers a payload to a registered user device, which runs on the user device to calculate and generate a unique security token based on the software and hardware information and characteristics of the user device. An authentication token is obtained based on the security token, and then the authentication token is used as a key (including but not limited to a symmetric encryption key and an asymmetric encryption key) in the challenge-response identity authentication process, thereby solving the problem of login credential theft caused by phishing threats. The payload calculates the security token corresponding to a certain user identity and the corresponding user device in real time based on information such as user device characteristics, user information, login credentials, and operating environment. The calculation of the security token takes into account many factors. The identity authentication initiated by a legitimate user (device owner) and the identity authentication initiated by an attacker impersonating a user will be different due to the differences in the above-mentioned many factors, resulting in different generated security tokens. Based on the security token, an authentication token and a token to be authenticated are obtained, and the identity authentication result of the user device is determined based on the authentication token, the token to be authenticated, and the verification challenge. This can solve the adversarial attack behavior in which an attacker has already compromised the target device and attempts to impersonate the owner of this device to carry out lateral movement.

[0056] In a possible embodiment, an adversarial anti-phishing identity authentication system is set in the authentication server that applies the adversarial user device authentication method based on challenge response provided by the present invention. Figure 2 ,The adversarial anti-phishing identity authentication system includes : payload delivery module, payload ,data receiving module, token library, identity authentication interface and ,decision module.

[0057] Among them, the payload delivery module is used to prepare a payload that can be safely run on the user device according to the characteristics of the user device (including but not limited to the operating system type, kernel version, processor architecture, etc.) when the user device requests registration, and deliver the payload to the user device (the user's true identity is guaranteed by the system administrator when the user device registers, such as manual confirmation, use of biometric authentication, etc.).

[0058] The payload is used to run on the user device to calculate the security token when the user device requests registration and, based on this, determine the authentication token to be transmitted back to the adversarial anti-phishing identity authentication system. This authentication token will serve as the key for the subsequent challenge-response authentication process (the keys used in the challenge-response authentication process include but are not limited to symmetric encryption algorithms and asymmetric encryption algorithms. The authentication token is used as the encryption key. When a symmetric encryption algorithm is used, the payload transmits the security token directly back to the identity authentication system as the authentication token; when an asymmetric encryption algorithm is used, the payload uses the security token as the private key, calculates its corresponding public key, and transmits the public key back to the identity authentication system as the authentication token). The payload is also used to calculate the security token as the token to be authenticated when the user device requests authentication, and calculates the corresponding response to be verified based on the verification challenge and the token to be authenticated, and transmits the response to be verified back to the adversarial anti-phishing identity authentication system. The process of real-time calculation of security tokens by user devices includes: generating a unique identifier for the user device based on the hardware information, operating system and application information of the user device, and using the unique identifier, user identity, login credentials, operating environment (including but not limited to the code segment, data segment, function call stack, etc. of the payload) and other information to generate a security token corresponding to this user identity and user device.

[0059] The data receiving module is used to receive information sent by the payload running on the user device, including the key used in the challenge-response authentication process calculated when the user device registers, and the response to be verified calculated by the payload when the user device performs identity authentication; and pass the received information to the decision module.

[0060] The token library is used to record the encryption keys associated with the security token corresponding to the user identity and device from the payload.

[0061] The identity authentication interface is used to receive a registration request from a user when the user device requests registration; when the user device requests identity authentication, it receives an identity authentication request from the user device and preliminarily determines the user identity based on the authentication credentials in the identity authentication request. If the authentication credentials are correct, the identity authentication request is valid, and the identity authentication notification decision module starts the challenge-response authentication process; otherwise, the identity authentication request is rejected.

[0062] The decision module is used to save the encryption key and the corresponding identity in the token library according to the encryption key and user identity from the data receiving module when the user device is registered; when the user device performs identity authentication, after the identity authentication interface determines that the user's authentication credentials are correct, a verification challenge is generated and sent to the payload on the user device, and the correctness of the response to be verified returned by the payload is judged according to the encryption key corresponding to the user identity in the token library; if the response to be verified is correct, the authentication is passed, otherwise, an exception is output and an alarm is issued.

[0063] In a specific embodiment, the challenge-response-based adversarial user device authentication method of the present invention is used to set up an adversarial anti-phishing identity authentication system to perform user device authentication. The operation process is as follows: Figure 3 As shown, in this embodiment, the authentication system uses a challenge-response authentication method based on a symmetric encryption algorithm. Specifically, the operation process can be divided into a pre-configuration phase and an identity authentication phase.

[0064] Exemplarily, the pre-configuration phase is the user registration phase, during which the authentication system completes user identity registration and saves security tokens, including: 1. User registration: The user registers with the authentication system, submits personal information, and registers login credentials with the identity authentication interface. The identity authentication interface can be configured with multiple methods to enhance authentication security, such as multi-factor authentication, user biometric verification, or administrator manual identity verification. After confirming that the registration information is correct, the identity authentication interface saves the login credentials and notifies the decision-making module. 2. Payload delivery: The authentication system's payload delivery module prepares the appropriate payload and delivers it to the user's device. 3. Token calculation: The payload obtains the user device's hardware information (including but not limited to the CPU model and serial number, network card MAC address, motherboard serial number, etc.), operating system and application information (including but not limited to the operating system security patch version, operating system version, installed application list, registry entries, etc.) to generate a unique identifier for the device. It uses the device's unique identifier, user identity, login credentials, and operating environment (including but not limited to the payload runtime code segment, data segment, partial information of the function call stack, etc.) to generate a unique security token K1 corresponding to this user identity, user device, and operating environment. Since this authentication process uses a symmetric encryption algorithm, the security token K1 is directly returned to the authentication system as the encryption key. 4. Save the token: After receiving the security token K1, the authentication system saves K1 and the user identity in the token library according to the registered user information. This completes the user registration process.

[0065] After completing user registration in the pre-configuration phase, the authentication system has obtained the encryption key corresponding to the user's identity and can provide authentication services to the user. The interaction during the authentication phase is as follows: 1. User Requests Authentication: The user initiates an authentication request to the authentication system using their registered user device. This request includes the authentication credentials used during registration. 2. Challenge Issuance: The authentication interface verifies the user's authentication credentials and, if valid, notifies the decision module; otherwise, the request is deemed invalid. Upon receiving the notification from the authentication interface, the decision module sends Challenge C to the requesting user (Challenge C is a random string, and its generation method can be configured according to different policies). 3. Real-time Calculation of Token K2: After receiving Challenge C, the payload recalculates the authentication token K2 according to the method in step 3 of the pre-configuration phase, which serves as the encryption key for the challenge-response authentication process. 4. Calculate and Return Response: The payload calculates the response R1 based on the encryption key K2 and Challenge C and returns R1 to the authentication system. 5. Authentication system calculates the response: The decision module of the authentication system queries the corresponding pre-configured encryption key K1 in the token library according to the identity of the user requesting authentication, and uses K1 and challenge C to calculate the response R2. 6. Verify the response: The decision module of the authentication system verifies whether R1 and R2 are consistent. If they are consistent, the authentication is passed and the authentication success is returned; otherwise, an abnormal alarm is issued.

[0066] See the instructions attached Figure 4 This embodiment also provides a challenge-response-based adversarial user equipment authentication device, which is used to implement the above method embodiment. The device includes:

[0067] The registration unit 201 is configured to receive a registration request from a user equipment and registration information submitted by the user equipment, register the authentication credentials of the user equipment according to the registration information, and feed back the authentication credentials to the user equipment.

[0068] The payload delivery unit 202 is configured to configure a payload according to the characteristics of the user equipment and deliver the payload to the user equipment.

[0069] The token storage unit 203 is configured to receive the authentication token generated by the payload according to the device information of the user device, and store the authentication token and the registration information of the user device in a token library in correspondence with each other.

[0070] The credential verification unit 204 is configured to receive an identity authentication request from a registered user device, the identity authentication request including authentication credentials, verify the authentication credentials, and initiate a verification challenge to the user device to be authenticated when the authentication credentials are valid.

[0071] The response receiving unit 205 is configured to receive a response to be verified generated by a payload in the user equipment to be authenticated, wherein the response to be verified is generated according to device information of the user equipment to be authenticated and a verification challenge.

[0072] The verification response generating unit 206 is configured to obtain an authentication token corresponding to the user device to be authenticated from the token library, and generate a verification response according to the authentication token and the verification challenge.

[0073] The authentication unit 207 is configured to compare the response to be authenticated with the authentication response to determine whether they are consistent, and obtain an authentication result of the user equipment to be authenticated based on the comparison result.

[0074] Among them, the payload delivery unit 202 configures the payload according to the characteristics of the user device, including: setting in the payload that when the payload is delivered to the user device, the hardware information, operating system and application information of the user device are obtained to generate a unique identifier; and generating an authentication token corresponding to the user identity and user device based on the unique identifier of the user device, user identity, login credentials and operating environment.

[0075] The payload delivery unit 202 configures the payload according to the characteristics of the user device, including: setting in the payload that when the verification challenge is sent to the user device to be authenticated, the hardware information, operating system and application information of the user device to be authenticated are obtained to generate a unique identifier, and based on the unique identifier, user identity, login credentials and operating environment, an authentication token to be verified corresponding to the user identity and user device is generated; and a response to be verified is calculated based on the authentication token to be verified and the verification challenge.

[0076] The authentication unit 207 compares whether the response to be verified and the verification response are consistent, and obtains the authentication result of the user device to be authenticated based on the comparison result, including: when the response to be verified and the verification response are consistent, the identity authentication of the user device to be authenticated is passed; when the response to be verified and the verification response are inconsistent, the identity authentication of the user device to be authenticated fails and an abnormal warning is issued.

[0077] All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0078] In other embodiments of the present application, the present application discloses an electronic device, such as Figure 5 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more applications (not shown); and one or more computer programs 304. The above components may be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions, which may be used to execute the following: Figure 1 、 Figure 4 and each step in the corresponding embodiment.

[0079] Through the description of the above embodiments, those skilled in the art will clearly understand that for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0080] The functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0081] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk.

[0082] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A challenge-response based adversarial user device authentication method, characterized in that: include: Receive a registration request from a user device and registration information submitted by the user device, register the authentication credentials of the user device according to the registration information, and feed the authentication credentials back to the user device; Configuring a payload according to the characteristics of the user equipment, and delivering the payload to the user equipment; receiving an authentication token generated by the payload according to the device information of the user device, and storing the authentication token and the registration information of the user device in a token library in correspondence with each other; receiving an identity authentication request from a registered user device, the identity authentication request including the authentication credentials, verifying the authentication credentials, and when the authentication credentials are valid, initiating a verification challenge to the user device to be authenticated; Receiving a response to be verified generated by a payload in the user equipment to be authenticated, wherein the response to be verified is generated according to the device information of the user equipment to be authenticated and the verification challenge; Obtaining an authentication token corresponding to the user device to be authenticated from the token library, and generating a verification response according to the authentication token and the verification challenge; The response to be verified is compared with the verification response to determine whether they are consistent, and an authentication result of the user equipment to be authenticated is obtained according to the comparison result.

2. The method according to claim 1, characterized in that Configuring a payload according to characteristics of the user equipment includes: Setting in the payload that when the payload is delivered to the user device, hardware information, operating system and application information of the user device are obtained to generate a unique identifier; An authentication token corresponding to the user identity and the user device is generated based on the unique identifier of the user device, the user identity, the login credentials, and the operating environment.

3. The method according to claim 1, characterized in that Configuring a payload according to characteristics of the user equipment includes: The payload is configured to obtain hardware information, operating system, and application information of the user device to be authenticated to generate a unique identifier after the verification challenge is sent to the user device to be authenticated, and generate an authentication token to be verified corresponding to the user identity and user device based on the unique identifier, user identity, login credentials, and operating environment; A response to be verified is calculated based on the authentication token to be verified and the verification challenge.

4. The method according to claim 1, wherein Comparing the response to be verified with the verification response to determine whether they are consistent, and obtaining an authentication result of the user equipment to be authenticated based on the comparison result, including: When the response to be verified is consistent with the verification response, the identity authentication of the user equipment to be authenticated is passed; When the response to be verified is inconsistent with the verification response, the identity authentication of the user equipment to be authenticated fails and an abnormality warning is issued.

5. A challenge-response-based adversarial user equipment authentication device, characterized in that: The device comprises: a registration unit, configured to receive a registration request from a user device and registration information submitted by the user device, register an authentication credential of the user device according to the registration information, and feed the authentication credential back to the user device; a payload delivery unit, configured to configure a payload according to characteristics of the user equipment and deliver the payload to the user equipment; a token storage unit, configured to receive an authentication token generated by the payload according to the device information of the user device, and store the authentication token in a token library in correspondence with the registration information of the user device; a credential verification unit, configured to receive an identity authentication request from a registered user device, the identity authentication request including the authentication credential, verify the authentication credential, and, when the authentication credential is valid, initiate a verification challenge to the user device to be authenticated; a response receiving unit, configured to receive a response to be verified generated by a payload in the user equipment to be authenticated, wherein the response to be verified is generated according to the device information of the user equipment to be authenticated and the verification challenge; a verification response generating unit, configured to obtain an authentication token corresponding to the user device to be authenticated from the token library, and generate a verification response according to the authentication token and the verification challenge; The authentication unit is configured to compare the response to be verified with the verification response to determine whether they are consistent, and to obtain an authentication result of the user equipment to be authenticated based on the comparison result.

6. The device according to claim 5, characterized in that The payload delivery unit configures the payload according to the characteristics of the user equipment, including: Setting in the payload that when the payload is delivered to the user device, hardware information, operating system and application information of the user device are obtained to generate a unique identifier; An authentication token corresponding to the user identity and the user device is generated based on the unique identifier of the user device, the user identity, the login credentials, and the operating environment.

7. The device according to claim 5, characterized in that The payload delivery unit configures the payload according to the characteristics of the user equipment, including: The payload is configured to obtain hardware information, operating system, and application information of the user device to be authenticated to generate a unique identifier after the verification challenge is sent to the user device to be authenticated, and generate an authentication token to be verified corresponding to the user identity and user device based on the unique identifier, user identity, login credentials, and operating environment; A response to be verified is calculated based on the authentication token to be verified and the verification challenge.

8. The device according to claim 5, characterized in that The authentication unit compares the response to be verified with the verification response to determine whether they are consistent, and obtains an authentication result of the user equipment to be authenticated according to the comparison result, including: When the response to be verified is consistent with the verification response, the identity authentication of the user equipment to be authenticated is passed; When the response to be verified is inconsistent with the verification response, the identity authentication of the user equipment to be authenticated fails and an abnormality warning is issued.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the challenge-response-based adversarial user equipment authentication method according to any one of claims 1 to 4 is implemented.

10. An electronic device, characterized in that: include: processor and memory; The memory is used to store computer programs; The processor is configured to execute the computer program stored in the memory, so as to enable the electronic device to perform the challenge-response-based adversarial user equipment authentication method according to any one of claims 1 to 4.

Images