Dynamic access verification method and system based on cloud database

Abstract

The invention discloses a dynamic access verification method and system based on a cloud database, and the method comprises the steps: employing a judgment feedback strategy to register an account number and store an account number mapping value and a password mapping value based on registration information obtained based on a secure transmission strategy, employing an identity authentication strategy to authenticate the identity of a user based on login information obtained based on the secure transmission strategy, if the identity authentication is successful, obtaining an access permission corresponding to the user; and calling accessible contents of the user in the system according to the access authority, recording the access time of the user, and performing intermittent verification according to a specified time interval to realize safe access of the system.

Description

Technical Field

[0001] The present invention relates to the field of access verification, and in particular to a dynamic access verification method and system based on a cloud database. Background Art

[0002] During system access, in order to ensure user access security, the system will set up some authentication procedures and access permission protection strategies to achieve access security. Among the existing system access verification methods, the mainstream solution in the user identity authentication process is to use account and password.

[0003] The invention patent with the existing publication number: CN118264469A proposes a system login permission management method, system and medium. Based on the access request instruction, the user is authenticated. If the authentication is successful, a group of accounts and passwords are randomly matched from the initial account library and password library for login. After the login is successful, the user's corresponding access rights are obtained, and the list of applications accessible to the user in the system is retrieved according to the access rights.

[0004] The existing technology improves system security by randomly matching account numbers and passwords, but the account numbers and passwords are stored in the initial database. If the initial database is leaked, the account numbers and passwords can still be obtained by brute force. At the same time, the randomly matched account numbers and passwords are easily intercepted when sent to users, which reduces system security. Summary of the invention

[0005] The purpose of the present invention is to provide a dynamic access verification method and system based on a cloud database, which realizes the confidential transmission of information between users and systems through a secure transmission strategy, generates a mapping value for the account and password through a one-way function and stores it in the cloud database, thereby improving the security of the system, and at the same time includes basic identity authentication, dynamic verification and locking protection functions.

[0006] The technical solution to achieve the purpose of the present invention is: A dynamic access verification method based on a cloud database comprises the following steps: The user initiates a registration request and fills in the registration information, which includes the account number and password. The registration information is sent to the system based on the secure transmission strategy. The system obtains the registration information and executes the judgment feedback strategy. The user initiates a login request, fills in the login information, which includes the account number and password, and sends the login information to the system based on the secure transmission strategy. The system obtains the login information and authenticates the user's identity through the identity authentication strategy; After the user's identity authentication is successful, the user's corresponding access rights are obtained, and the content accessible to the user in the system is retrieved based on the access rights, and the intermittent verification strategy is executed.

[0007] Furthermore, the secure transmission strategy includes ciphertext construction and ciphertext decryption; Ciphertext construction is to construct ciphertext by reassembling the data packets in blocks at the sending end and encrypting data blocks of different sizes using a cross encryption algorithm; Ciphertext decryption takes the exact opposite order of steps as ciphertext construction at the receiving end to restore the data packet from the ciphertext.

[0008] Furthermore, the ciphertext construction includes the following steps: Get data packets and packet sizes; Setting a first block granularity and a second block granularity, and calculating a granularity product, wherein the granularity product is the product of the first block granularity and the second block granularity; Determine whether the data packet size is an integer multiple of the granularity product. If not, add 0 to the end of the data packet to make the data packet size an integer multiple of the granularity product. Starting from the starting position of the information in the data packet after the 0-filling, read the information in units of integer multiples to obtain a total of sub-data packets equal to the size of the granularity product value; Divide all sub-data packets according to the second block granularity to obtain a total of groups equal in number to the first block granularity, and concatenate sub-data packets in different groups whose subscript differences are integer multiples of the second block granularity to obtain an output stream equal in number to the second block granularity; The output stream is processed using a cross encryption algorithm to generate ciphertext.

[0009] Furthermore, the cross encryption algorithm includes the following steps: Setting an encryption data ratio, splitting the output streams whose number is equal to the second block granularity size into sub-output streams whose number is equal to twice the second block granularity size according to the encryption data ratio; Encrypt the sub-output streams using a symmetric encryption algorithm and an asymmetric encryption algorithm respectively, and obtain encrypted files whose number is equal to twice the size of the second block granularity; Combine all encrypted files to generate ciphertext.

[0010] Furthermore, ciphertext decryption includes the following steps: Obtain ciphertext, first block granularity, second block granularity and multiple size; Decrypt the ciphertext using a symmetric encryption algorithm and an asymmetric encryption algorithm to obtain a sub-output stream whose number is equal to twice the size of the second block granularity, wherein the symmetric encryption algorithm and the asymmetric encryption algorithm of the decryption process are consistent with those of the encryption process; The first block granularity, the second block granularity and the multiple size are combined to obtain data packets by splicing sub-output streams according to the reverse scheme of block reorganization in ciphertext construction.

[0011] Furthermore, the feedback strategy includes the following steps: Obtain the account number in the registration information, and generate an account mapping value through the first one-way function; Query the index in the cloud database to check whether the account mapping value already exists; If the account mapping value already exists, a first tag is fed back, where the first tag indicates that the account has been registered; If the account mapping value does not exist, a password mapping value is generated through a second one-way function, the account mapping value is stored as an index and the password mapping value in a cloud database, and a second tag is fed back, where the second tag indicates successful registration.

[0012] Optionally, the first one-way function and the second one-way function may be the same or different one-way functions, and the one-way functions include MD5, SHA, and MAC.

[0013] Furthermore, the identity authentication strategy includes the following steps: Obtaining the account number and password in the login information, and using a first one-way function and a second one-way function to generate an account mapping value and a password mapping value respectively, wherein the first one-way function and the second one-way function are consistent with the judgment feedback strategy; Query the index in the cloud database to determine whether the account mapping value exists. If not, feedback a third tag indicating that the account is not registered. If it exists, index to the password mapping value in the cloud database. The password mapping value is further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification strategy is executed. If they are not the same, the login protection strategy is executed.

[0014] Furthermore, the login protection strategy includes the following steps: Record the current system time, generate a login time limit, and prohibit users from logging in within the login time limit; If the system fails to obtain the login information within the time limit of twice the login time limit, a fourth tag is fed back, indicating that no operation has been performed due to timeout. Otherwise, the account mapping value is further determined. If the account mapping value does not exist in the cloud database, the third tag is fed back, otherwise, the password mapping value is further determined; If the password mapping value is the same as the password mapping value in the cloud database, the secondary verification strategy is executed. If they are not the same, a login lock time is generated and the user is prohibited from logging in during the login lock time.

[0015] Furthermore, the secondary verification strategy includes the following steps: Obtain a secondary verification request, randomly generate a dynamic verification code, send it to the user based on the security transmission strategy, record the current system time, and set the waiting time; If the system does not obtain the confirmation verification code within the waiting time, the fourth tag is fed back, otherwise, it is further compared with the dynamic verification code; If the confirmation verification code is the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, a fifth tag is fed back to execute the verification protection strategy. The fifth tag indicates that the confirmation verification code is wrong.

[0016] Furthermore, the verification protection strategy includes the following steps: Record the current system time, generate a limited authentication time, and prohibit users from initiating secondary verification requests within the limited authentication time; If the secondary verification request or the confirmation verification code is not obtained within the time limit of the authentication time to twice the time limit of the authentication time, the fourth tag is fed back; If a secondary verification request is received within the time limit of up to twice the time limit, a dynamic verification code is randomly generated and sent to the user based on the secure transmission strategy, and a confirmation verification code is obtained and further compared with the dynamic verification code; If the verification code is confirmed to be the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, the verification protection strategy is executed and the verification lock time is generated. The user is prohibited from initiating a second verification request within the verification lock time.

[0017] Furthermore, the intermittent verification strategy includes the following steps: Record the user's access time and periodically generate verification refresh nodes according to the access time threshold; When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user based on the security transmission strategy; If the system does not obtain the confirmation verification code before the next verification refresh node, the user's access rights are terminated and the fourth tag is fed back; When the system obtains the confirmation verification code before the next verification refresh node, it compares the confirmation verification code with the dynamic verification code. If they are the same, the user's access rights are maintained. If they are not the same, the user's access rights are terminated and the fifth tag is fed back.

[0018] A dynamic access verification system based on a cloud database, which executes the above-mentioned dynamic access verification method based on a cloud database, includes a user registration module, an identity authentication module, a right access confirmation module, a secure transmission module and a data storage module; The user registration module executes the judgment feedback strategy according to the registration information, generates an account mapping value through the first one-way function, queries the index in the cloud database, and judges whether the account mapping value exists. If the account mapping value exists, the first label is fed back; if the account mapping value does not exist, the second label is fed back; The identity authentication module executes the identity authentication strategy based on the login information to confirm whether the user can access the system; The access confirmation module is used to confirm user access rights and implement intermittent verification strategies; The secure transmission module is used to implement secure transmission strategies for registration information, login information, dynamic verification codes, and confirmation verification codes to ensure confidentiality during the interaction process. It is also used to feedback tags and transmit account mapping values ​​and password mapping values ​​as indexes to the data storage module; The data storage module mainly realizes data storage function based on cloud database.

[0019] Further, the identity authentication module includes an identity query unit, a secondary verification unit, a login protection unit, a verification protection unit and a locking protection unit; The identity query unit generates an account mapping value and a password mapping value according to the acquired login information, queries the index in the cloud database, determines whether the account mapping value exists, and if not, feeds back the third tag; if so, indexes to the password mapping value in the cloud database, and compares whether the password mapping value is the same as the password mapping value in the cloud database; if they are the same, starts the secondary verification unit; if they are not the same, starts the login protection unit; The login protection unit records the current system time and generates a restricted login time. When the system time is within the restricted login time to twice the restricted login time and the login information is obtained, an account mapping value and a password mapping value are generated, and the index in the cloud database is queried. If the account mapping value does not exist, the third tag is fed back. If the account mapping value exists, the password mapping value in the cloud data is indexed, and the password mapping value is further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification unit is started. If they are not the same, the locking protection unit is started. When the system elapsed time is greater than twice the restricted login time and the login information is not obtained, the fourth tag is fed back. The secondary verification unit randomly generates a dynamic verification code, sends it to the user based on the secure transmission strategy, records the current system time, sets the waiting time, and if the system time is within the waiting time and the confirmation verification code is not obtained, then the fourth tag is fed back. If the system obtains the confirmation verification code within the waiting time, it is compared with the dynamic verification code. If they are the same, the user identity authentication is successful and the access confirmation module is started. If they are not the same, then the fifth tag is fed back and the verification protection unit is started. The verification protection unit records the current system time, generates a limited authentication time based on the verification protection policy, and when the system time is between the limited authentication time and twice the limited authentication time and the system obtains a secondary verification request, randomly generates a dynamic verification code, sends it to the user based on the secure transmission policy, obtains a confirmation verification code, and compares it with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the fifth tag is fed back, and the locking protection unit is started. When the system elapsed time is greater than twice the limited authentication time and the system does not obtain a secondary verification request or does not obtain a confirmation verification code, the fourth tag is fed back; The locking protection unit performs different operations based on the initiator. If the locking protection unit is initiated by the login protection unit, a login lock time is generated, and the user cannot initiate a login request during the login lock time. If the locking protection unit is initiated by the verification protection unit, a verification lock time is generated, and the user is prohibited from initiating a secondary verification request during the verification lock time.

[0020] Further, the access confirmation module includes a user confirmation unit and an intermittent verification unit; The user confirmation unit obtains the corresponding access rights of the user, retrieves the content accessible to the user in the system according to the access rights, and starts the intermittent verification unit; The intermittent verification unit generates a verification refresh node based on the user's access time according to the access time threshold. When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user. If the confirmation verification code is not obtained before the next verification refresh node, the user's access rights are terminated and the fourth tag is fed back. The confirmation verification code is obtained before the next verification refresh node to determine whether it is the same as the dynamic verification code. If they are the same, the user's access rights are maintained. If they are different, the user's access rights are terminated and the fifth tag is fed back.

[0021] Compared with the prior art, the present invention has the following significant advantages: 1. Based on the secure transmission strategy, the information transmitted during the interaction is reorganized into blocks and encrypted using a cross encryption algorithm to ensure the security of the information during the interaction; 2. Map the registration information through a one-way function and store the mapping value in the cloud database to ensure the security of the stored information. The subsequent access verification process is judged by the mapping value. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flow chart of a dynamic access verification method based on cloud database; Figure 2 It is a schematic diagram of a dynamic access verification system based on cloud database; Figure 3 A flow chart of the security transmission strategy; Figure 4Authentication policy flow chart. DETAILED DESCRIPTION

[0023] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Example

[0024] The embodiment provided by the present invention is a dynamic access verification method based on a cloud database, comprising the following steps: The user initiates a registration request and fills in the registration information, which includes the account number and password. The registration information is sent to the system based on the secure transmission strategy. The system obtains the registration information and executes the judgment feedback strategy. The user initiates a login request, fills in the login information, which includes the account number and password, and sends the login information to the system based on the secure transmission strategy. The system obtains the login information and authenticates the user's identity through the identity authentication strategy; After the user's identity authentication is successful, the user's corresponding access rights are obtained, and the content accessible to the user in the system is retrieved based on the access rights, and the intermittent verification strategy is executed.

[0025] Furthermore, the secure transmission strategy includes ciphertext construction and ciphertext decryption; Ciphertext construction is to construct ciphertext by reassembling the data packets in blocks at the sending end and encrypting data blocks of different sizes using a cross encryption algorithm; Ciphertext decryption takes the exact opposite order of steps as ciphertext construction at the receiving end to restore the data packet from the ciphertext.

[0026] Furthermore, the ciphertext construction includes the following steps: Get Data Packet , the packet size is ; Set the first block granularity and the second block granularity to and ; judge Is it the product of the first block granularity and the second block granularity? An integer multiple of , if not, then Add 0 to the end of , Size for An integer multiple of ; from Starting from the starting position of the information in the data size Read information for the unit, , a total of sub-packets, denoted as ; Before Subpackets ,for For each sub-packet in Integer multiples of sub-packets to get the output stream , among which Output streams ; Use cross encryption algorithm to process output stream , generate ciphertext .

[0027] Furthermore, the cross encryption algorithm includes the following steps: Set the encryption data ratio ,Will The output streams are Split into sub-output streams, starting with Output streams For example, Split into and ,and The amount of data is of times; The sub-output stream is encrypted using a symmetric encryption algorithm and an asymmetric encryption algorithm respectively, and the obtained Encrypted files, and For example, Obtained through symmetric encryption algorithm , Obtained through an asymmetric encryption algorithm ; combination Encrypted files, generate ciphertext .

[0028] Furthermore, ciphertext decryption includes the following steps: Get ciphertext , the first block granularity , the second block granularity and data size ; Use a symmetric encryption algorithm to Decrypt to get , using an asymmetric encryption algorithm Decrypt it to get , get The symmetric encryption algorithm and asymmetric encryption algorithm of the decryption process are consistent with those of the encryption process; Splicing and generate ; The output stream Combination , and , restore to obtain ,delete The 0 added at the end restores the data packet .

[0029] Furthermore, the feedback strategy includes the following steps: Obtain the account number in the registration information, and generate an account mapping value through the first one-way function; Query the index in the cloud database to check whether the account mapping value already exists; If the account mapping value already exists, the first tag is fed back; If the account mapping value does not exist, a password mapping value is generated through a second one-way function, the account mapping value is stored as an index and the password mapping value in a cloud database, and the second tag is fed back.

[0030] Optionally, the first one-way function and the second one-way function may be the same or different one-way functions, and the one-way functions include MD5, SHA, and MAC.

[0031] Furthermore, the identity authentication strategy includes the following steps: Obtaining the account number and password in the login information, and using a first one-way function and a second one-way function to generate an account mapping value and a password mapping value respectively, wherein the first one-way function and the second one-way function are consistent with the judgment feedback strategy; Query the index in the cloud database to determine whether the account mapping value exists. If not, feedback the third tag. If so, index to the password mapping value in the cloud database. Compare the password mapping value with the password mapping value in the cloud database to see if they are the same. If they are the same, execute the two-step verification strategy. If they are different, execute the login protection strategy.

[0032] Furthermore, the login protection strategy includes the following steps: Record the current system time , based on the login protection policy, generate a limit on the login time ,exist Internal users cannot initiate login requests; When the system time is to When the user initiates a login request again, the login information is sent to the system based on the secure transmission strategy. The system obtains the login information, generates an account mapping value and a password mapping value through the first one-way function and the second one-way function, queries the index in the cloud database, and if the account mapping value does not exist, the third tag is fed back. If it exists, the password mapping value in the cloud data is indexed, and the password mapping value is further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification strategy is executed. If they are not the same, the login lockout time is generated. ,exist Internal users cannot initiate login requests; When the system time is greater than When the system does not obtain the login request or the login information, the fourth tag is fed back.

[0033] Furthermore, the secondary verification strategy includes the following steps: Obtain the secondary verification request initiated by the user, randomly generate a dynamic verification code, send it to the user based on the security transmission strategy, and record the current system time , set the waiting time ; After the user obtains the dynamic verification code, he / she enters the confirmation verification code, which is sent to the system based on the security transmission strategy; If the system time is If the system does not obtain the verification code before, the fourth tag is fed back. The confirmation verification code is obtained before and compared with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the fifth tag is fed back and the verification protection strategy is executed.

[0034] Furthermore, the verification protection strategy includes the following steps: Record the current system time , based on the verification protection strategy to generate limited authentication time ,exist Internal users cannot initiate secondary verification requests; When the system time is to If the user has initiated a secondary verification request again, the system obtains the secondary verification request and randomly generates a dynamic verification code, which is sent to the user based on the security transmission policy. The user enters the confirmation verification code, which is sent to the system based on the security transmission policy. The system obtains the confirmation verification code and compares it with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the verification lock time is generated. ,exist Internal users cannot initiate a secondary verification request again; When the system time is greater than When the system does not obtain the secondary verification request or the confirmation verification code, the fourth tag is fed back.

[0035] Furthermore, the intermittent verification strategy includes the following steps: Record user access time , Generate access duration threshold based on intermittent verification strategy ; according to Generate verification refresh nodes for the cycle ; When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user based on the security transmission strategy; The user obtains a dynamic verification code, enters the confirmation code, and sends it to the system based on the security transmission strategy; If the system does not obtain the confirmation verification code before the next verification refresh node, the user's access rights are terminated and the fourth tag is fed back; Before the next verification refresh node, the system obtains the confirmation verification code, compares the confirmation verification code with the dynamic verification code, and if they are the same, maintains the user's access rights; if they are not the same, terminates the user's access rights and feeds back the fifth tag.

[0036] Example 2 The embodiment provided by the present invention is a dynamic access verification system based on a cloud database, which executes the above-mentioned dynamic access verification method based on a cloud database through the system, including a user registration module, an identity authentication module, a right confirmation access module, a secure transmission module and a data storage module; The user registration module is used to obtain registration information, execute the judgment feedback strategy, generate an account mapping value through a first one-way function, query the index in the cloud database, and judge whether the account mapping value exists. If the account mapping value exists, the first label is fed back; if the account mapping value does not exist, the second label is fed back; The identity authentication module is used to obtain login information, execute identity authentication policies, and confirm whether the user can access the system; The access authorization module is used to confirm the access rights of users who have successfully authenticated their identities, implement intermittent verification strategies, and confirm whether users are continuously accessing the system. The secure transmission module implements secure transmission strategies for registration information, login information, dynamic verification codes, and confirmation verification codes between users and the system to ensure confidentiality during the interaction process, and feedbacks labels. At the same time, it transmits the account mapping value and password mapping value as indexes to the data storage module; The data storage module mainly realizes data storage function based on cloud database.

[0037] Further, the identity authentication module includes an identity query unit, a secondary verification unit, a login protection unit, a verification protection unit and a locking protection unit; The identity query unit generates an account mapping value and a password mapping value by using the first one-way function and the second one-way function respectively according to the acquired login information, queries the index in the cloud database, determines whether the account mapping value exists, and if not, feeds back the third tag; if so, indexes to the password mapping value in the cloud database, compares whether the password mapping value is the same as the password mapping value in the cloud database, and if they are the same, starts the secondary verification unit; if they are not the same, starts the login protection unit; Login protection unit records current system time , generate a limit on login time , when the system time is to When the system obtains the login information, the account mapping value and the password mapping value are generated by the first one-way function and the second one-way function, and the index in the cloud database is queried. If the account mapping value does not exist, the third tag is fed back. If the account mapping value exists, the password mapping value in the cloud data is indexed, and the password mapping value is further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification unit is started. If they are not the same, the locking protection unit is started. When the system time is greater than If the system fails to obtain the login information, the fourth tag is fed back; The secondary verification unit randomly generates a dynamic verification code, sends it to the user based on the security transmission strategy, and records the current system time. , set the waiting time , if the system time is If the system fails to obtain the verification code before the fourth tag is fed back, The confirmation verification code is obtained before and compared with the dynamic verification code. If they are the same, the user identity authentication is successful and the access confirmation module is started. If they are not the same, the fifth tag is fed back and the verification protection unit is started; Verify that the protection unit records the current system time , based on the verification protection strategy to generate limited authentication time ,exist Users cannot initiate a secondary verification request when the system time is to When the system obtains a secondary verification request, it randomly generates a dynamic verification code and sends it to the user based on the secure transmission strategy. The confirmation verification code is obtained and compared with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the verification lock time is generated. ,exist The user cannot initiate a secondary verification request again when the system time is greater than If the system does not obtain the secondary verification request or the confirmation verification code, the fourth tag is fed back; The lock protection unit performs different operations based on the initiator. If the lock protection unit is started by the login protection unit, the login lock duration is generated. ,exist Internal users cannot initiate login requests. If the lock protection unit is started by the verification protection unit, the verification lock duration is generated. ,exist The user cannot initiate a secondary verification request again.

[0038] Further, the access confirmation module includes a user confirmation unit and an intermittent verification unit; The user confirmation unit obtains the corresponding access rights of the user, retrieves the content accessible to the user in the system according to the access rights, and starts the intermittent verification unit; Intermittent authentication unit based on user access time according to Generate verification refresh nodes for the cycle When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user. If the confirmation verification code is not obtained before the next verification refresh node, the user's access rights are terminated and the fourth tag is fed back. The confirmation verification code is obtained before the next verification refresh node, and the confirmation verification code is compared with the dynamic verification code. If they are the same, the user's access rights are maintained. If they are not the same, the user's access rights are terminated and the fifth tag is fed back.

[0039] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A dynamic access verification method based on cloud database, characterized in that: The following steps are involved: Obtain registration information sent based on the secure transmission strategy and execute the judgment feedback strategy; Obtaining login information sent based on the secure transmission policy, and authenticating the user identity through the identity authentication policy; After the user's identity authentication is successful, the corresponding access rights of the user are obtained, and the content accessible to the user is retrieved according to the access rights, and the intermittent verification strategy is executed; The secure transmission strategy includes ciphertext construction and ciphertext decryption; The ciphertext is constructed by reassembling the data packets in blocks at the sending end and encrypting the data blocks of different sizes using a cross encryption algorithm to construct the ciphertext; Ciphertext decryption takes the exact opposite order of steps as ciphertext construction at the receiving end to restore the data packet from the ciphertext.

2. A dynamic access verification method based on a cloud database as claimed in claim 1, characterized in that: The ciphertext construction comprises the following steps: Get data packets and packet sizes; Setting a first block granularity and a second block granularity, and calculating a granularity product, wherein the granularity product is the product of the first block granularity and the second block granularity; Determine whether the data packet size is an integer multiple of the granularity product. If not, add 0 to the end of the data packet to make the data packet size an integer multiple of the granularity product. Starting from the starting position of the information in the data packet after the 0-filling, read the information in units of integer multiples to obtain a total of sub-data packets equal to the size of the granularity product value; Divide all sub-data packets according to the second block granularity, obtain groups whose number is equal to the first block granularity, and splice sub-data packets whose subscript differences in different groups are integer multiples of the second block granularity to obtain an output stream whose number is equal to the second block granularity; The output stream is processed using a cross encryption algorithm to generate ciphertext.

3. A dynamic access verification method based on cloud database as claimed in claim 2, characterized in that: The cross encryption algorithm comprises the following steps: Setting an encryption data ratio, splitting the output streams whose number is equal to the second block granularity size into sub-output streams whose number is equal to twice the second block granularity size according to the encryption data ratio; Encrypt the sub-output streams using a symmetric encryption algorithm and an asymmetric encryption algorithm respectively, and obtain encrypted files whose number is equal to twice the size of the second block granularity; Combine all encrypted files to generate ciphertext.

4. A dynamic access verification method based on a cloud database as claimed in claim 3, characterized in that: The ciphertext decryption comprises the following steps: Obtain ciphertext, first block granularity, second block granularity and multiple size; Decrypt the ciphertext using a symmetric encryption algorithm and an asymmetric encryption algorithm to obtain sub-output streams whose number is equal to twice the size of the second block granularity, wherein the symmetric encryption algorithm and the asymmetric encryption algorithm of the decryption process are consistent with those of the encryption process; The sub-output streams are reassembled by combining the first block granularity, the second block granularity and the multiple size to obtain the data packet.

5. A dynamic access verification method based on cloud database as claimed in claim 1, characterized in that: The intermittent verification strategy includes the following steps: Record the user's access time and periodically generate verification refresh nodes according to the access time threshold; When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user based on the security transmission strategy; If the system does not obtain the confirmation verification code before the next verification refresh node, the user's access rights are terminated and the fourth tag is fed back; When the system obtains the confirmation verification code before the next verification refresh node, it compares the confirmation verification code with the dynamic verification code. If they are the same, the user's access rights are maintained. If they are not the same, the user's access rights are terminated and the fifth tag is fed back.

6. A dynamic access verification method based on cloud database as claimed in claim 1, characterized in that: The judgment feedback strategy includes the following steps: Obtain the account number in the registration information, and generate an account mapping value through the first one-way function; Query the index in the cloud database to check whether the account mapping value already exists; If the account mapping value already exists, a first tag is fed back, where the first tag indicates that the account has been registered; If the account mapping value does not exist, a password mapping value is generated through a second one-way function, the account mapping value is stored as an index and the password mapping value in a cloud database, and a second tag is fed back, where the second tag indicates successful registration.

7. A dynamic access verification method based on cloud database as claimed in claim 1, characterized in that: The identity authentication strategy includes the following steps: Obtaining the account number and password in the login information, and using a first one-way function and a second one-way function to generate an account mapping value and a password mapping value respectively, wherein the first one-way function and the second one-way function are consistent with the judgment feedback strategy; Query the index in the cloud database to determine whether the account mapping value exists. If not, feedback a third tag indicating that the account is not registered. If it exists, index to the password mapping value in the cloud database. The password mapping value is further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification strategy is executed. If they are not the same, the login protection strategy is executed.

8. A dynamic access verification method based on cloud database as claimed in claim 7, characterized in that: The login protection strategy includes the following steps: Record the current system time, generate a login time limit, and prohibit users from logging in within the login time limit; If the system fails to obtain the login information within the time limit of twice the login time limit, a fourth tag is fed back, indicating that no operation has been performed due to timeout. Otherwise, the account mapping value is further determined. If the account mapping value does not exist in the cloud database, the third tag is fed back, otherwise, the password mapping value is further determined; If the password mapping value is the same as the password mapping value in the cloud database, the secondary verification strategy is executed. If they are not the same, a login lock time is generated and the user is prohibited from logging in during the login lock time.

9. A dynamic access verification method based on cloud database as claimed in claim 8, characterized in that: The secondary verification strategy includes the following steps: Obtain a secondary verification request, randomly generate a dynamic verification code, send it to the user based on the security transmission strategy, record the current system time, and set the waiting time; If the system does not obtain the confirmation verification code within the waiting time, the fourth tag is fed back, otherwise, it is further compared with the dynamic verification code; If the confirmation verification code is the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, a fifth tag is fed back to execute the verification protection strategy. The fifth tag indicates that the confirmation verification code is wrong. The verification protection strategy includes the following steps: Record the current system time, generate a limited authentication time, and prohibit users from initiating secondary verification requests within the limited authentication time; If the secondary verification request or the confirmation verification code is not obtained within the time limit of the authentication time to twice the time limit of the authentication time, the fourth tag is fed back; If a secondary verification request is received within the time limit of up to twice the time limit, a dynamic verification code is randomly generated and sent to the user based on the secure transmission strategy, and a confirmation verification code is obtained and further compared with the dynamic verification code; If the confirmation verification code is the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, a verification lock time is generated, and the user is prohibited from initiating a second verification request within the verification lock time.

10. A dynamic access verification system based on a cloud database, which executes a dynamic access verification method based on a cloud database as claimed in any one of claims 1 to 9, comprising a user registration module, an identity authentication module and a secure transmission module; The user registration module is used to execute a judgment feedback strategy based on the registration information to determine whether the account already exists, and if not, register the account; The identity authentication module is used to execute the identity authentication strategy according to the login information to confirm whether the user can access the system; The secure transmission module is used to execute secure transmission strategies for registration information, login information, dynamic verification codes and confirmation verification codes, and is also used to feedback tags and transmit account mapping values ​​and password mapping values ​​to the data storage module; It also includes a rights confirmation access module and a data storage module; The access confirmation module is used to confirm access rights and execute intermittent verification strategies; The data storage module is used for data storage.

Images