A dynamic access verification method and system based on cloud database

Abstract

The present invention discloses a dynamic access verification method and system based on a cloud database. Based on the registration information obtained by the security transmission policy, a judgment feedback policy is adopted to register an account and store the account mapping value and the password mapping value. Based on the login information obtained by the security transmission policy, an identity authentication policy is adopted to authenticate the user identity. If the identity authentication is successful, the corresponding access rights of the user are obtained; according to the access rights, the user's accessible content in the system is retrieved, the user's access time is recorded, and intermittent verification is performed at specified time intervals to achieve secure access to the system.

Description

Technical Field

[0001] The present invention relates to the field of access verification, and in particular to a dynamic access verification method and system based on a cloud database. Background Art

[0002] During the system access process, in order to ensure user access security, the system will set up some authentication procedures and access permission protection strategies to achieve access security. Among the existing system access verification methods, the mainstream solution in the user identity authentication process is to use account and password.

[0003] The invention patent with the existing publication number: CN118264469A proposes a system login permission management method, system and medium. Based on the access request instruction, the user is authenticated. If the identity authentication is successful, a set of account numbers and passwords are randomly matched from the initial account library and password library for login. After the login is successful, the user's corresponding access rights are obtained, and the list of applications accessible to the user in the system is retrieved based on the access rights.

[0004] Existing technologies improve system security by randomly matching account numbers and passwords. However, the account numbers and passwords are stored in an initial database. If the initial database is leaked, the account numbers and passwords can still be obtained through brute force. At the same time, randomly matched account numbers and passwords can be easily intercepted when sent to users, reducing system security. Summary of the Invention

[0005] The purpose of the present invention is to provide a dynamic access verification method and system based on a cloud database, which realizes the confidential transmission of information between users and the system through a secure transmission strategy, generates a mapping value from the account and password through a one-way function and stores it in the cloud database, thereby improving system security. It also includes basic identity authentication, dynamic verification and lock protection functions.

[0006] The technical solutions for achieving the purpose of the present invention are:

[0007] A dynamic access verification method based on a cloud database includes the following steps:

[0008] The user initiates a registration request and fills in the registration information, which includes the account number and password. The registration information is sent to the system based on the secure transmission strategy. The system obtains the registration information and executes the judgment and feedback strategy.

[0009] The user initiates a login request, fills in the login information, which includes the account number and password, and sends the login information to the system based on the secure transmission policy. The system obtains the login information and authenticates the user's identity through the identity authentication policy;

[0010] After the user identity authentication is successful, the corresponding access rights of the user are obtained, and the content accessible to the user in the system is called according to the access rights, and the intermittent verification strategy is executed.

[0011] Furthermore, the secure transmission strategy includes ciphertext construction and ciphertext decryption;

[0012] Ciphertext construction is done by reassembling the data packets into blocks at the sending end and encrypting data blocks of different sizes using a cross encryption algorithm to construct the ciphertext;

[0013] Ciphertext decryption takes the exact opposite order of steps as ciphertext construction at the receiving end to restore the data packet from the ciphertext.

[0014] Furthermore, ciphertext construction includes the following steps:

[0015] Get data packets and packet sizes;

[0016] Setting a first block granularity and a second block granularity, and calculating a granularity product, where the granularity product is the product of the first block granularity and the second block granularity;

[0017] Determine whether the data packet size is an integer multiple of the granularity product. If not, add zeros to the end of the data packet to make the data packet size an integer multiple of the granularity product.

[0018] Starting from the starting position of the data packet after the zero padding, read the information in units of integer multiples to obtain a total of sub-data packets equal to the size of the granularity product value;

[0019] Divide all sub-data packets according to the second block granularity to obtain a total number of groups equal to the first block granularity, and concatenate sub-data packets in different groups whose subscript differences are integer multiples of the second block granularity to obtain an output stream equal to the second block granularity;

[0020] The output stream is processed using a cross encryption algorithm to generate ciphertext.

[0021] Furthermore, the cross encryption algorithm includes the following steps:

[0022] Setting an encryption data ratio, splitting the output streams whose number is equal to the second block granularity into sub-output streams whose number is equal to twice the second block granularity according to the encryption data ratio;

[0023] Encrypt the sub-output stream using a symmetric encryption algorithm and an asymmetric encryption algorithm respectively, and obtain encrypted files whose number is equal to twice the size of the second block granularity;

[0024] Combine all encrypted files to generate ciphertext.

[0025] Furthermore, ciphertext decryption includes the following steps:

[0026] Obtain ciphertext, first block granularity, second block granularity and multiple size;

[0027] Decrypt the ciphertext using a symmetric encryption algorithm and an asymmetric encryption algorithm to obtain sub-output streams whose number is equal to twice the second block granularity size, wherein the symmetric encryption algorithm and the asymmetric encryption algorithm of the decryption process are consistent with those of the encryption process;

[0028] The first block granularity, the second block granularity and the multiple size are combined to obtain data packets by splicing sub-output streams according to the reverse scheme of block reassembly in ciphertext construction.

[0029] Furthermore, the feedback strategy includes the following steps:

[0030] Obtain the account number in the registration information and generate an account mapping value through the first one-way function;

[0031] Query the index in the cloud database to see if the account mapping value already exists;

[0032] If the account mapping value already exists, a first tag is fed back, which indicates that the account has been registered.

[0033] If the account mapping value does not exist, a password mapping value is generated through a second one-way function, the account mapping value is used as an index and the password mapping value is stored in a cloud database, and a second tag is fed back, which indicates that the registration is successful.

[0034] Optionally, the first one-way function and the second one-way function may be the same or different one-way functions, and the one-way functions include MD5, SHA, and MAC.

[0035] Furthermore, the authentication strategy includes the following steps:

[0036] Obtain the account number and password in the login information, and generate an account mapping value and a password mapping value using a first one-way function and a second one-way function, respectively, wherein the first one-way function and the second one-way function are consistent with the judgment feedback strategy;

[0037] Query the index in the cloud database to determine whether the account mapping value exists. If not, return a third tag indicating that the account is not registered. If it exists, index to the password mapping value in the cloud database.

[0038] The password mapping value is further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification strategy is executed. If they are not the same, the login protection strategy is executed.

[0039] Furthermore, the login protection strategy includes the following steps:

[0040] Record the current system time, generate a login time limit, and prohibit users from logging in within the login time limit;

[0041] If the system fails to obtain login information within the time limit of twice the login time limit, a fourth tag is fed back, indicating that no operation was performed due to timeout. Otherwise, the account mapping value is further determined.

[0042] If the account mapping value does not exist in the cloud database, the third tag is fed back; otherwise, the password mapping value is further determined;

[0043] If the password mapping value is the same as the password mapping value in the cloud database, the secondary verification strategy is executed. If they are different, a login lock time is generated and the user is prohibited from logging in during the login lock time.

[0044] Furthermore, the secondary verification strategy includes the following steps:

[0045] Obtain a secondary verification request, randomly generate a dynamic verification code, send it to the user based on the secure transmission strategy, record the current system time, and set the waiting time;

[0046] If the system does not obtain the confirmation verification code within the waiting time, the fourth tag is fed back. Otherwise, it is further compared with the dynamic verification code;

[0047] If the confirmation verification code is the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, a fifth tag is fed back to execute the verification protection strategy. The fifth tag indicates that the confirmation verification code is wrong.

[0048] Furthermore, the verification protection strategy includes the following steps:

[0049] Record the current system time, generate a limited authentication time, and prohibit users from initiating secondary verification requests within the limited authentication time;

[0050] If no secondary verification request or confirmation verification code is obtained within the time limit of the authentication time limit to twice the authentication time limit, the fourth tag is fed back;

[0051] If a secondary verification request is received between the limited authentication time and twice the limited authentication time, a dynamic verification code is randomly generated and sent to the user based on the secure transmission policy. A confirmation verification code is obtained and further compared with the dynamic verification code.

[0052] If the verification code is confirmed to be the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, the verification protection policy is executed and the verification lock time is generated. The user is prohibited from initiating a second verification request within the verification lock time.

[0053] Furthermore, the intermittent verification strategy includes the following steps:

[0054] Record the user's access time and periodically generate verification refresh nodes according to the access time threshold;

[0055] When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user based on the secure transmission strategy;

[0056] If the system does not obtain the confirmation verification code before the next verification refresh node, the user's access rights are terminated and the fourth tag is fed back;

[0057] When the system obtains the confirmation verification code before the next verification refresh node, it compares the confirmation verification code with the dynamic verification code. If they are the same, the user's access rights are maintained. If they are different, the user's access rights are terminated and the fifth tag is fed back.

[0058] A cloud database-based dynamic access verification system, which implements the above-mentioned cloud database-based dynamic access verification method, includes a user registration module, an identity authentication module, an access authorization module, a secure transmission module, and a data storage module;

[0059] The user registration module executes a judgment feedback strategy based on the registration information, generates an account mapping value through a first one-way function, queries the index in the cloud database, and determines whether the account mapping value exists. If the account mapping value exists, the first tag is fed back; if the account mapping value does not exist, the second tag is fed back;

[0060] The identity authentication module executes the identity authentication strategy based on the login information to confirm whether the user can access the system;

[0061] The access confirmation module is used to confirm user access rights and implement intermittent verification strategies;

[0062] The secure transmission module is used to implement secure transmission strategies for registration information, login information, dynamic verification codes, and confirmation verification codes to ensure confidentiality during the interaction process. It is also used to feedback tags and transmit account mapping values and password mapping values as indexes to the data storage module.

[0063] The data storage module mainly realizes data storage function based on cloud database.

[0064] Furthermore, the identity authentication module includes an identity query unit, a secondary verification unit, a login protection unit, a verification protection unit, and a lock protection unit;

[0065] The identity query unit generates an account mapping value and a password mapping value based on the obtained login information, queries the index in the cloud database, determines whether the account mapping value exists, and if not, feeds back the third tag; if so, indexes to the password mapping value in the cloud database, compares the password mapping value with the password mapping value in the cloud database to see if they are the same; if they are the same, activates the secondary verification unit; if they are not the same, activates the login protection unit;

[0066] The login protection unit records the current system time and generates a restricted login time. When the system time is between the restricted login time and twice the restricted login time and the login information is obtained, an account mapping value and a password mapping value are generated, and an index in the cloud database is queried. If the account mapping value does not exist, the third tag is fed back. If the account mapping value exists, the password mapping value in the cloud data is indexed and further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification unit is activated. If they are not the same, the lock protection unit is activated. When the system time is greater than twice the restricted login time and the login information is not obtained, the fourth tag is fed back;

[0067] The secondary verification unit randomly generates a dynamic verification code, sends it to the user based on the secure transmission strategy, records the current system time, and sets a waiting time. If the system time is within the waiting time and the confirmation verification code is not obtained, the fourth tag is fed back. If the system obtains the confirmation verification code within the waiting time, it is compared with the dynamic verification code. If they are the same, the user identity authentication is successful and the access confirmation module is activated. If they are not the same, the fifth tag is fed back and the verification protection unit is activated.

[0068] The verification protection unit records the current system time and generates a limited authentication time based on the verification protection policy. When the system time is between the limited authentication time and twice the limited authentication time and the system obtains a secondary verification request, it randomly generates a dynamic verification code, sends it to the user based on the secure transmission policy, obtains a confirmation verification code, and compares it with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the fifth tag is fed back and the locking protection unit is started. When the system time is greater than twice the limited authentication time and the system does not obtain a secondary verification request or does not obtain a confirmation verification code, the fourth tag is fed back;

[0069] The locking protection unit performs different operations based on the initiator. If the locking protection unit is started by the login protection unit, a login lock time is generated, and the user cannot initiate a login request during the login lock time. If the locking protection unit is started by the verification protection unit, a verification lock time is generated, and the user is prohibited from initiating a secondary verification request during the verification lock time.

[0070] Furthermore, the access confirmation module includes a user confirmation unit and an intermittent verification unit;

[0071] The user authentication unit obtains the user's corresponding access rights, retrieves the user-accessible content in the system based on the access rights, and starts the intermittent verification unit;

[0072] The intermittent verification unit generates a verification refresh node based on the user's access time according to the access time threshold. When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user. If the confirmation verification code is not obtained before the next verification refresh node, the user's access rights are terminated and the fourth tag is fed back. The confirmation verification code is obtained before the next verification refresh node, and it is determined whether it is the same as the dynamic verification code. If they are the same, the user's access rights are maintained. If they are different, the user's access rights are terminated and the fifth tag is fed back.

[0073] Compared with the prior art, the present invention has the following significant advantages:

[0074] 1. Based on the secure transmission strategy, the information transmitted during the interaction is divided into blocks and reorganized, and encrypted using a cross-encryption algorithm to ensure the security of the information during the interaction;

[0075] 2. Map the registration information through a one-way function and store the mapping value in the cloud database to ensure the security of the stored information. The mapping value will be used for judgment in the subsequent access verification process. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 This is a flow chart of a dynamic access verification method based on a cloud database;

[0077] Figure 2 A schematic diagram of a dynamic access verification system based on a cloud database;

[0078] Figure 3 A flow chart of the secure transmission strategy;

[0079] Figure 4 This is a flowchart of the authentication policy. DETAILED DESCRIPTION

[0080] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Example

[0081] The present invention provides an embodiment of a dynamic access verification method based on a cloud database, comprising the following steps:

[0082] The user initiates a registration request and fills in the registration information, which includes the account number and password. The registration information is sent to the system based on the secure transmission strategy. The system obtains the registration information and executes the judgment and feedback strategy.

[0083] The user initiates a login request, fills in the login information, which includes the account number and password, and sends the login information to the system based on the secure transmission policy. The system obtains the login information and authenticates the user's identity through the identity authentication policy;

[0084] After the user identity authentication is successful, the corresponding access rights of the user are obtained, and the content accessible to the user in the system is called according to the access rights, and the intermittent verification strategy is executed.

[0085] Furthermore, the secure transmission strategy includes ciphertext construction and ciphertext decryption;

[0086] Ciphertext construction is done by reassembling the data packets into blocks at the sending end and encrypting data blocks of different sizes using a cross encryption algorithm to construct the ciphertext;

[0087] Ciphertext decryption takes the exact opposite order of steps as ciphertext construction at the receiving end to restore the data packet from the ciphertext.

[0088] Furthermore, ciphertext construction includes the following steps:

[0089] Get data packet , the packet size is ;

[0090] Set the first block granularity and the second block granularity to be and ;

[0091] judge Is it the product of the first block granularity and the second block granularity? An integer multiple of , if not, then Add 0 to the end of , Size for an integer multiple of ;

[0092] from Starting from the starting position of the information in the data size Read information for the unit, , a total of sub-data packets, denoted as ;

[0093] Before Sub-packets ,for For each sub-packet in Integer multiples of sub-packets to get the output stream , among which output streams ;

[0094] Use cross encryption algorithm to process output stream , generate ciphertext .

[0095] Furthermore, the cross encryption algorithm includes the following steps:

[0096] Set the encrypted data ratio ,Will Output streams are Split into sub-output streams, starting with output streams For example, Split into and ,and The amount of data is of times;

[0097] Use symmetric encryption algorithm and asymmetric encryption algorithm to encrypt the sub-output stream, and get Encrypted files, and For example, Obtained through symmetric encryption algorithm , Obtained through asymmetric encryption algorithm ;

[0098] combination Encrypted files, generate ciphertext .

[0099] Furthermore, ciphertext decryption includes the following steps:

[0100] Get ciphertext , first block granularity , the second block granularity and data size ;

[0101] Use symmetric encryption algorithm Decrypt and get , using an asymmetric encryption algorithm Decrypt and get , get The symmetric encryption algorithm and asymmetric encryption algorithm of the decryption process are consistent with those of the encryption process;

[0102] Splicing and generate ;

[0103] The output stream Combine 、 and , restore and obtain ,delete The 0 added at the end restores the data packet .

[0104] Furthermore, the feedback strategy includes the following steps:

[0105] Obtain the account number in the registration information and generate an account mapping value through the first one-way function;

[0106] Query the index in the cloud database to see if the account mapping value already exists;

[0107] If the account mapping value already exists, the first tag is fed back;

[0108] If the account mapping value does not exist, a password mapping value is generated through a second one-way function, the account mapping value is used as an index and the password mapping value is stored in a cloud database, and the second tag is fed back.

[0109] Optionally, the first one-way function and the second one-way function may be the same or different one-way functions, and the one-way functions include MD5, SHA, and MAC.

[0110] Furthermore, the authentication strategy includes the following steps:

[0111] Obtain the account number and password in the login information, and generate an account mapping value and a password mapping value using a first one-way function and a second one-way function, respectively, wherein the first one-way function and the second one-way function are consistent with the judgment feedback strategy;

[0112] Query the index in the cloud database to determine whether the account mapping value exists. If not, feedback the third tag. If so, index to the password mapping value in the cloud database.

[0113] Compare the password mapping value with the password mapping value in the cloud database to see if they are the same. If they are the same, execute the two-step verification strategy. If they are different, execute the login protection strategy.

[0114] Furthermore, the login protection strategy includes the following steps:

[0115] Record the current system time , based on the login protection policy to generate a limit on the login time ,exist Internal users cannot initiate login requests;

[0116] When the system time is to When the user initiates a login request again, the login information is sent to the system based on the secure transmission strategy. The system obtains the login information, generates an account mapping value and a password mapping value through the first one-way function and the second one-way function, queries the index in the cloud database, and if the account mapping value does not exist, the third tag is fed back. If it exists, the password mapping value in the cloud data is indexed and further compared with the password mapping value in the cloud database to see if they are the same. If they are the same, the secondary verification strategy is executed. If they are not the same, the login lockout time is generated. ,exist Internal users cannot initiate login requests;

[0117] When the system time is greater than When the system does not obtain the login request or the login information, the fourth tag is fed back.

[0118] Furthermore, the secondary verification strategy includes the following steps:

[0119] Obtain the secondary verification request initiated by the user, randomly generate a dynamic verification code, send it to the user based on the security transmission strategy, and record the current system time , set the waiting time ;

[0120] After the user obtains the dynamic verification code, he / she enters the confirmation code, which is sent to the system based on the secure transmission policy;

[0121] If the system time is If the system does not obtain the verification code before the fourth tag is fed back, the system The confirmation verification code is obtained before and compared with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the fifth tag is fed back and the verification protection strategy is executed.

[0122] Furthermore, the verification protection strategy includes the following steps:

[0123] Record the current system time , based on the verification protection strategy to generate limited authentication time ,exist Internal users cannot initiate secondary verification requests;

[0124] When the system time is to If the user initiates a secondary verification request again, the system obtains the secondary verification request and randomly generates a dynamic verification code. It is sent to the user based on the secure transmission strategy. The user enters the confirmation verification code, which is sent to the system based on the secure transmission strategy. The system obtains the confirmation verification code and compares it with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the verification lock time is generated. ,exist Internal users cannot initiate a secondary verification request again;

[0125] When the system time is greater than If the system does not obtain the secondary verification request or the confirmation verification code, the fourth tag is fed back.

[0126] Furthermore, the intermittent verification strategy includes the following steps:

[0127] Record user access time , based on the intermittent verification strategy to generate access time threshold ;

[0128] according to Generate verification refresh nodes for the cycle ;

[0129] When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user based on the secure transmission strategy;

[0130] The user obtains a dynamic verification code, enters the confirmation code, and sends it to the system based on the secure transmission policy;

[0131] If the system does not obtain the confirmation verification code before the next verification refresh node, the user's access rights will be terminated and the fourth tag will be fed back;

[0132] Before the next verification refresh node, the system obtains the confirmation verification code, compares the confirmation verification code with the dynamic verification code, and if they are the same, maintains the user's access rights; if they are different, terminates the user's access rights and feeds back the fifth tag.

[0133] Example 2

[0134] The embodiment provided by the present invention is a dynamic access verification system based on a cloud database, which executes the above-mentioned dynamic access verification method based on a cloud database through the system, including a user registration module, an identity authentication module, an access right confirmation module, a secure transmission module and a data storage module;

[0135] The user registration module is used to obtain registration information, execute the judgment feedback strategy, generate an account mapping value through a first one-way function, query the index in the cloud database, and determine whether the account mapping value exists. If the account mapping value exists, the first tag is fed back; if the account mapping value does not exist, the second tag is fed back;

[0136] The identity authentication module is used to obtain login information, execute identity authentication policies, and confirm whether the user can access the system;

[0137] The access authorization module is used to confirm the access rights of users who have successfully authenticated their identities, implement intermittent verification strategies, and confirm whether users are continuously accessing the system.

[0138] The secure transmission module implements secure transmission strategies for registration information, login information, dynamic verification codes, and confirmation verification codes between users and the system to ensure confidentiality during the interaction process, and provides feedback on tags. It also transmits the account mapping value and password mapping value used as indexes to the data storage module.

[0139] The data storage module mainly realizes data storage function based on cloud database.

[0140] Furthermore, the identity authentication module includes an identity query unit, a secondary verification unit, a login protection unit, a verification protection unit, and a lock protection unit;

[0141] The identity query unit generates an account mapping value and a password mapping value using a first one-way function and a second one-way function respectively based on the obtained login information, queries the index in the cloud database, determines whether the account mapping value exists, and if not, feeds back the third tag; if so, indexes to the password mapping value in the cloud database, compares the password mapping value with the password mapping value in the cloud database to see if they are the same, and if so, activates the secondary verification unit; if not, activates the login protection unit;

[0142] Login protection unit records current system time , generate a limit on login time , when the system time is to When the system obtains the login information, it generates the account mapping value and the password mapping value through the first one-way function and the second one-way function, queries the index in the cloud database, and if the account mapping value does not exist, it feeds back the third tag. If the account mapping value exists, it indexes to the password mapping value in the cloud data, and further compares the password mapping value with the password mapping value in the cloud database to see if they are the same. If they are the same, it starts the secondary verification unit. If they are not the same, it starts the locking protection unit. When the system time is greater than If the system fails to obtain the login information, the fourth tag is fed back;

[0143] The secondary verification unit randomly generates a dynamic verification code, sends it to the user based on the security transmission strategy, and records the current system time. , set the waiting time If the system time is If the system does not obtain the verification code before the fourth tag is fed back, The confirmation verification code is obtained before and compared with the dynamic verification code. If they are the same, the user identity authentication is successful and the access confirmation module is started. If they are not the same, the fifth tag is fed back and the verification protection unit is started;

[0144] Verify that the protection unit records the current system time , based on the verification protection strategy to generate limited authentication time ,exist Users cannot initiate secondary verification requests when the system time is to When the system obtains a secondary verification request, it randomly generates a dynamic verification code and sends it to the user based on the secure transmission strategy. The confirmation verification code is obtained and compared with the dynamic verification code. If they are the same, the user identity authentication is successful. If they are not the same, the verification lock time is generated. ,exist The user cannot initiate a secondary verification request again when the system time is greater than If the system does not obtain the secondary verification request or the confirmation verification code, the fourth tag is fed back;

[0145] The lock protection unit performs different operations based on the initiator. If the lock protection unit is started by the login protection unit, the login lock duration is generated. ,exist Internal users cannot initiate login requests. If the lock protection unit is started by the verification protection unit, the verification lock time is generated. ,exist The user cannot initiate a secondary verification request again.

[0146] Furthermore, the access confirmation module includes a user confirmation unit and an intermittent verification unit;

[0147] The user authentication unit obtains the user's corresponding access rights, retrieves the user-accessible content in the system based on the access rights, and starts the intermittent verification unit;

[0148] Intermittent authentication unit based on user access time according to Generate verification refresh nodes for the cycle When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user. If the confirmation verification code is not obtained before the next verification refresh node, the user's access permission is terminated and the fourth tag is fed back. Before the next verification refresh node, the confirmation verification code is obtained, and the confirmation verification code is compared with the dynamic verification code. If they are the same, the user's access permission is maintained. If they are different, the user's access permission is terminated and the fifth tag is fed back.

[0149] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A dynamic access verification method based on cloud database, characterized in that: The following steps are involved: Obtaining registration information sent based on a secure transmission policy, executing a judgment feedback policy, the feedback policy including obtaining an account number in the registration information, generating an account mapping value using a first one-way function, querying an index in a cloud database, comparing whether the account mapping value already exists, and if so, feeding back a first tag indicating that the account has been registered; if the account mapping value does not exist, generating a password mapping value using a second one-way function, storing the account mapping value as an index and the password mapping value in the cloud database, and feeding back a second tag indicating that the registration was successful; Obtaining login information sent based on the secure transmission policy, and authenticating the user's identity through an identity authentication policy, wherein the identity authentication policy includes: Obtain the account number and password in the login information, and use a first one-way function and a second one-way function to generate an account mapping value and a password mapping value respectively, wherein the first one-way function and the second one-way function are consistent with the judgment feedback strategy, query the index in the cloud database, determine whether the account mapping value exists, and if not, feedback the third tag; if so, index to the password mapping value in the cloud database, and compare the password mapping value with the password mapping value in the cloud database to see if they are the same. If they are the same, execute the secondary verification strategy; if they are not the same, execute the login protection strategy; After successful user authentication, the corresponding access rights of the user are obtained. Based on the access rights, the user's accessible content is retrieved and an intermittent verification strategy is implemented. The intermittent verification strategy is used to record the user's access time and generate a dynamic verification code. The user enters a confirmation verification code and determines whether to terminate the user's access rights by verifying whether the system obtains the confirmation verification code before refreshing the node. The secure transmission strategy includes ciphertext construction and ciphertext decryption; The ciphertext is constructed by reassembling the data packets at the sending end in blocks and encrypting the data blocks of different sizes using a cross encryption algorithm to construct the ciphertext. The cross encryption algorithm includes: Setting an encryption data ratio, splitting an output stream equal to the second block granularity into sub-output streams equal to twice the second block granularity according to the encryption data ratio, encrypting the sub-output streams using a symmetric encryption algorithm and an asymmetric encryption algorithm respectively, obtaining encrypted files equal to twice the second block granularity, and combining all the encrypted files to generate a ciphertext; Ciphertext decryption takes the exact opposite order of steps as ciphertext construction at the receiving end to restore the data packet from the ciphertext.

2. A dynamic access verification method based on a cloud database according to claim 1, characterized in that: The ciphertext construction includes the following steps: Get data packets and packet sizes; Setting a first block granularity and a second block granularity, and calculating a granularity product, where the granularity product is the product of the first block granularity and the second block granularity; Determine whether the data packet size is an integer multiple of the granularity product. If not, add zeros to the end of the data packet to make the data packet size an integer multiple of the granularity product. Starting from the starting position of the data packet after the zero padding, read the information in units of integer multiples to obtain a total of sub-data packets equal to the size of the granularity product value; Divide all sub-data packets according to the second block granularity to obtain groups with a number equal to the first block granularity, and concatenate sub-data packets in different groups whose subscript differences are integer multiples of the second block granularity to obtain an output stream with a number equal to the second block granularity; The output stream is processed using a cross encryption algorithm to generate ciphertext.

3. A dynamic access verification method based on a cloud database as claimed in claim 2, characterized in that: The ciphertext decryption comprises the following steps: Obtain ciphertext, first block granularity, second block granularity and multiple size; Decrypt the ciphertext using a symmetric encryption algorithm and an asymmetric encryption algorithm to obtain sub-output streams whose number is equal to twice the second block granularity size, wherein the symmetric encryption algorithm and the asymmetric encryption algorithm of the decryption process are consistent with those of the encryption process; The sub-output streams are reassembled by combining the first block granularity, the second block granularity and the multiple size to obtain the data packet.

4. A dynamic access verification method based on a cloud database according to claim 1, characterized in that: The intermittent verification strategy includes the following steps: Record the user's access time and periodically generate verification refresh nodes according to the access time threshold; When the user's access time reaches the verification refresh node, a dynamic verification code is randomly generated and sent to the user based on the secure transmission strategy; If the system does not obtain the confirmation verification code before the next verification refresh node, the user's access rights will be terminated and the fourth tag will be fed back; When the system obtains the confirmation verification code before the next verification refresh node, it compares the confirmation verification code with the dynamic verification code. If they are the same, the user's access rights are maintained. If they are not the same, the user's access rights are terminated and the fifth tag is fed back.

5. A dynamic access verification method based on a cloud database as claimed in claim 4, characterized in that: The login protection strategy includes the following steps: Record the current system time, generate a login time limit, and prohibit users from logging in within the login time limit; If the system fails to obtain login information within the time limit of twice the login time limit, a fourth tag is fed back, indicating that no operation was performed due to timeout. Otherwise, the account mapping value is further determined. If the account mapping value does not exist in the cloud database, the third tag is fed back; otherwise, the password mapping value is further determined; If the password mapping value is the same as the password mapping value in the cloud database, the secondary verification strategy is executed. If they are different, a login lock time is generated and the user is prohibited from logging in during the login lock time.

6. A dynamic access verification method based on a cloud database according to claim 5, characterized in that: The secondary verification strategy includes the following steps: Obtain a secondary verification request, randomly generate a dynamic verification code, send it to the user based on the secure transmission strategy, record the current system time, and set the waiting time; If the system does not obtain the confirmation verification code within the waiting time, the fourth tag is fed back. Otherwise, it is further compared with the dynamic verification code; If the verification code is confirmed to be the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, a fifth tag is fed back to execute the verification protection strategy. The fifth tag indicates that the verification code is confirmed to be incorrect. The verification protection strategy includes the following steps: Record the current system time, generate a limited authentication time, and prohibit users from initiating secondary verification requests within the limited authentication time; If the secondary verification request or confirmation code is not obtained within the time limit of the authentication time limit to twice the authentication time limit, the fourth tag is fed back; If a secondary verification request is received between the limited authentication time and twice the limited authentication time, a dynamic verification code is randomly generated and sent to the user based on the secure transmission policy. A confirmation verification code is obtained and further compared with the dynamic verification code. If the verification code is confirmed to be the same as the dynamic verification code, the user identity authentication is successful. If they are not the same, a verification lock time is generated, and the user is prohibited from initiating a second verification request within the verification lock time.

7. A dynamic access verification system based on a cloud database, which implements a dynamic access verification method based on a cloud database as claimed in any one of claims 1 to 6, comprising a user registration module, an identity authentication module and a secure transmission module; The user registration module is used to execute a judgment feedback strategy based on the registration information to determine whether the account already exists. If not, register the account; The feedback strategy includes obtaining the account number in the registration information, generating an account mapping value through a first one-way function, querying the index in the cloud database, comparing whether the account mapping value already exists, and if so, feeding back a first tag indicating that the account has been registered; if the account mapping value does not exist, generating a password mapping value through a second one-way function, storing the account mapping value as an index and the password mapping value in the cloud database, and feeding back a second tag indicating that the registration was successful; The identity authentication module is used to execute the identity authentication strategy based on the login information to confirm whether the user can access the system; The authentication strategy includes: Obtain the account number and password in the login information, and use a first one-way function and a second one-way function to generate an account mapping value and a password mapping value respectively, wherein the first one-way function and the second one-way function are consistent with the judgment feedback strategy, query the index in the cloud database, determine whether the account mapping value exists, and if not, feedback the third tag; if so, index to the password mapping value in the cloud database, and compare the password mapping value with the password mapping value in the cloud database to see if they are the same. If they are the same, execute the secondary verification strategy; if they are not the same, execute the login protection strategy; The secure transmission module is used to execute secure transmission strategies for registration information, login information, dynamic verification codes, and confirmation verification codes, and is also used to feedback tags and transmit account mapping values and password mapping values to the data storage module; It also includes a rights confirmation access module and a data storage module; The access confirmation module is used to confirm access rights and implement an intermittent verification strategy. The intermittent verification strategy is used to record the user's access time and generate a dynamic verification code. The confirmation verification code is input and the system determines whether to suspend the user's access rights by verifying whether the confirmation verification code is obtained before the refresh node. The data storage module is used for data storage.

Images