Security authentication method and system for preventing authentication credential from being stolen
Through asymmetric encryption algorithm and random data mechanism, the problem that static passwords and identification of traditional authentication methods are easily cracked is solved, achieving higher data security and authentication process flexibility.
Patent Information
- Application Number
- CN202411450726.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-17
- Publication Date
- 2025-01-07
AI Technical Summary
Traditional authentication methods have security risks of static passwords being guessed or cracked, and authentication identifiers are easily intercepted and reused, resulting in threats to user privacy and data security.
Asymmetric encryption algorithm is used to initially encrypt sensitive authentication information, and then decrypt it with the private key on the server side to verify it, generate unique random data as authentication identifier, dynamic encryption processing is performed in combination with timestamps and usernames, and clear using timing tasks. Expired data, ensuring that only legitimate requests are processed.
It greatly enhances the security of data transmission and storage, reduces the risk of static storage and misappropriation of authentication identifiers, and improves the flexibility of the authentication process and the security of the system.
Smart Images
Figure CN119276589A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security and identity authentication, and in particular to a security authentication method and system for preventing authentication credentials from being stolen. Background Art
[0002] With the widespread popularity of the Internet and the acceleration of digital transformation, user authentication credentials (such as usernames, passwords, authentication tokens, biometric information, etc.) have become the cornerstone of confirming user identities and ensuring data security and privacy in the online world. However, the storage, transmission and use of these authentication credentials are facing increasingly severe security threats.
[0003] First, the traditional authentication method based on static passwords has significant security risks. Static passwords are often easy to guess, dictionary attack or brute force cracking, and users often use the same or similar passwords on multiple platforms. Once the password of one platform is leaked, other platforms may also face the risk of being hacked.
[0004] Secondly, after the traditional authentication method is passed, a static authentication identifier (such as a token, session ID, etc.) is generated, which is saved in the browser and sent to the server along with the access request. If intercepted by an attacker, it will be easy to obtain the authentication credentials and reuse them, posing a huge threat to user privacy and data security. At the same time, there is also the risk of being exploited by attackers and sending a huge number of requests in a short period of time to occupy the server network and other resources, or even worse, causing the server to crash. Summary of the invention
[0005] The purpose of the present invention is to provide a security authentication method and system for preventing authentication credentials from being stolen, so as to solve the problems raised in the above-mentioned background technology.
[0006] To achieve the above object, the present invention provides the following technical solution: a security authentication method for preventing authentication credentials from being stolen, the method comprising the following steps:
[0007] Before the user submits the sensitive authentication information, the client uses an asymmetric encryption algorithm to preliminarily encrypt the sensitive authentication information;
[0008] The user sends the public key to the server through a secure channel to ensure that the server uses the corresponding private key for decryption;
[0009] After receiving the encrypted information, the server uses the private key to decrypt it and verify the decrypted information;
[0010] After verification, the server uses a symmetric encryption algorithm to re-encrypt and store the information.
[0011] Preferably, the method further comprises the following steps:
[0012] After decryption and verification, the server generates a unique random data as an important component of the authentication identifier;
[0013] Bind the random data to a valid time within a specified range and store it persistently together with the user information;
[0014] The server sets a scheduled task to monitor and clear expired random data.
[0015] Preferably, the method further comprises the following steps:
[0016] After receiving the random data sent by the server, the client will encrypt the random number together with the current timestamp, user name and other encryption elements using an asymmetric encryption algorithm when sending subsequent requests;
[0017] Send the encrypted authentication token to the server as part of the request.
[0018] Preferably, after receiving the request from the client, the server further includes the following steps:
[0019] Use an asymmetric encryption algorithm to decrypt the authentication identifier carried in the request to obtain random data and timestamp related information;
[0020] A series of strict verification operations are performed on the decrypted information, including verifying whether the timestamp exceeds the set error threshold and effective time range, and comparing the decrypted random data with the persistently stored data to confirm the validity of the user's identity.
[0021] Preferably, the method further comprises the following steps:
[0022] If the verification fails, the server will not process the request further and return a failure message to the client, inviting the user to re-authenticate.
[0023] If the verification passes, the server executes the corresponding business logic according to the request content, and determines whether the random data has expired during the business processing before returning the processing result;
[0024] If the random data has expired, the server regenerates the random data, validity period, etc., and sends them to the client synchronously.
[0025] A security authentication system for preventing authentication credentials from being stolen, applied to a security authentication method for preventing authentication credentials from being stolen, the system comprising:
[0026] The client module is used to use an asymmetric encryption algorithm to preliminarily encrypt the sensitive authentication information before the user submits it, and send the public key to the server through a secure channel;
[0027] The server module is used to receive the encrypted sensitive authentication information, decrypt it using the corresponding private key, and verify the decrypted information; if the verification passes, the information is re-encrypted and stored using a symmetric encryption algorithm.
[0028] Preferably, the server module further includes:
[0029] The secondary encryption and key management unit is used to re-encrypt the decrypted sensitive authentication information and implement strict key management policies to ensure that only authorized users can access and decrypt the encrypted data;
[0030] The random authentication identifier generation unit is used to generate a unique random data as an important component of the authentication identifier after the user authentication credentials are verified, and store it persistently after binding with the user information; at the same time, set a scheduled task to monitor and clear expired random data.
[0031] Preferably, the client module also includes: an encrypted transmission authentication identification unit, which is used to encrypt the random number together with the current timestamp and username encryption elements using an asymmetric encryption algorithm after receiving the random data sent by the server when sending a subsequent request, and send the encrypted authentication identification to the server as part of the request.
[0032] Preferably, the server module also includes: a decryption and verification unit, which is used to receive the request sent by the client, use an asymmetric encryption algorithm to decrypt the authentication identifier carried in the request, obtain random data, timestamp and other related information, and perform a series of strict verification operations, including verifying whether the timestamp exceeds the set error threshold and valid time range, and comparing the decrypted random data with the persistently stored data to confirm the validity of the user's identity.
[0033] Preferably, the server module also includes: a verification result processing unit, which is used to return failure information to the client based on the results of the decryption and verification unit, if the verification fails, and invite the user to re-perform security authentication; if the verification passes, the corresponding business logic is executed according to the request content, and before returning the processing result, it is determined whether the random data has expired during the business processing period; if it has expired, the random data and validity time are regenerated and sent to the client synchronously.
[0034] Compared with the prior art, the present invention has the following beneficial effects:
[0035] The security authentication method and system for preventing the theft of authentication credentials proposed by the present invention use an asymmetric encryption algorithm (such as RSA) to perform preliminary encryption on sensitive authentication information, ensuring that even if the information is intercepted during transmission, it is difficult for unauthorized parties to decrypt it, thereby greatly enhancing the security of data transmission; on the server side or in a secure storage medium, a high-strength symmetric encryption algorithm (such as AES) is used to perform secondary encryption on the information, thereby improving the security of data storage. At the same time, the server securely manages the encryption key to ensure that only authorized users can decrypt the data; by generating unique random data as part of the authentication identifier, and combining it with encryption elements such as the current timestamp and user name, a dynamic authentication identifier is formed. This mechanism effectively prevents the static storage and reuse of the authentication identifier, reducing the risk of theft; the effective time of the authentication identifier is set to a random number within a specified range, which not only ensures the timeliness of the authentication identifier, but also increases the difficulty for attackers to predict and use the authentication identifier, thereby improving the flexibility of the authentication process; a scheduled task is set to clean up expired random data to keep the system data clean and secure. At the same time, during the authentication identifier verification process, strict timestamp and random data verification is used to ensure that only legitimate requests can be processed, thereby enhancing the security and robustness of the system. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION
[0037] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0038] For example, see Figure 1 The present invention provides a technical solution: a security authentication method for preventing authentication credentials from being stolen, the method comprising the following steps:
[0039] (1) Client security encryption
[0040] Before the user submits sensitive authentication information (including but not limited to passwords, biometric information, etc.) to the server, the client uses an asymmetric encryption algorithm (such as RSA) for preliminary encryption. The user sends the public key to the server through a secure channel to ensure that only the server can use the corresponding private key for decryption. This step fundamentally prevents the risk of information being easily decrypted after being intercepted during transmission, ensuring the confidentiality of information transmission.
[0041] (2) Server-side secondary encryption and key management
[0042] After receiving the encrypted information, the server uses the private key to decrypt it and conducts strict verification on the decrypted information. Once the verification is passed, the server will use a high-intensity symmetric encryption algorithm (such as AES) to re-encrypt the information and store it on the server or in a secure storage medium. At the same time, the server implements a strict key management policy to ensure that only authorized users can access and decrypt the encrypted data, further enhancing the security of the data.
[0043] (3) The server generates a random authentication token
[0044] After the user authentication credentials are verified, the server generates a unique random data (such as UUID) as an important part of the authentication identifier. The random data is given a validity period within a specified range (such as a random number within 1-2 hours) and is persistently stored (such as in a database) after being bound to the user information. In addition, the server also sets a scheduled task to monitor and clear expired random data to ensure the cleanliness and security of the system.
[0045] (4) Client encrypted transmission authentication identifier
[0046] After the client receives the random data sent by the server, it will encrypt the random number together with encryption elements such as the current timestamp and user name using an asymmetric encryption algorithm when sending subsequent requests, and send the encrypted authentication identifier to the server as part of the request.
[0047] (5) Server-side decryption and verification
[0048] After receiving the request from the client, the server first uses an asymmetric encryption algorithm to decrypt the authentication identifier carried in the request to obtain random data, timestamp and other related information. Subsequently, the server will perform a series of strict verification operations. First, it verifies whether the timestamp exceeds the error threshold and valid time range set by the server; secondly, it compares the decrypted random data with the persistently stored data to confirm the validity of the user's identity.
[0049] (6) Verification result processing
[0050] If the verification fails, the server will no longer process the request further and immediately return the failure information to the client, inviting the user to re-authenticate. If the verification passes, the server will execute the corresponding business logic according to the request content and return the processing result to the client. Before returning, it will determine whether the random data has expired during the business processing. If it has expired, it will regenerate the random data, validity period, etc. according to step 2 and send them to the client synchronously.
[0051] Embodiment 2, based on embodiment 1, proposes a security authentication system for preventing authentication credentials from being stolen, which is applied to a security authentication method for preventing authentication credentials from being stolen. The system includes:
[0052] The client module is used to use an asymmetric encryption algorithm to preliminarily encrypt the sensitive authentication information before the user submits the sensitive authentication information, and send the public key to the server through a secure channel; the client module also includes: an encrypted transmission authentication identification unit, which is used to encrypt the random number together with the current timestamp and the user name encryption element using an asymmetric encryption algorithm when sending a subsequent request after receiving the random data sent by the server, and send the encrypted authentication identification as part of the request to the server.
[0053] The server module is used to receive the encrypted sensitive authentication information, decrypt it using the corresponding private key, and verify the decrypted information; if the verification passes, the information is re-encrypted and stored using a symmetric encryption algorithm.
[0054] The server module also includes: a secondary encryption and key management unit, which is used to perform secondary encryption on the decrypted sensitive authentication information and implement a strict key management strategy to ensure that only authorized users can access and decrypt the encrypted data; a random authentication identifier generation unit, which is used to generate a unique random data as an important component of the authentication identifier after the user authentication credentials are verified, and store it persistently after binding with the user information; at the same time, set a scheduled task to monitor and clear expired random data; a decryption and verification unit, which is used to receive the request sent by the client, use an asymmetric encryption algorithm to decrypt the authentication identifier carried in the request, and obtain the random data, Timestamp and other related information, and perform a series of strict verification operations, including verifying whether the timestamp exceeds the set error threshold and effective time range, and comparing the decrypted random data with the persistently stored data to confirm the validity of the user's identity; the verification result processing unit is used to return failure information to the client based on the results of the decryption and verification units, if the verification fails, and invite the user to re-perform security authentication; if the verification passes, execute the corresponding business logic according to the request content, and determine whether the random data has expired during the business processing before returning the processing result; if it has expired, regenerate the random data and effective time, and send them to the client synchronously.
[0055] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.
Claims
1. A secure authentication method for preventing authentication credentials from being stolen, characterized in that: The method comprises the following steps: Before the user submits the sensitive authentication information, the client uses an asymmetric encryption algorithm to preliminarily encrypt the sensitive authentication information; The user sends the public key to the server through a secure channel to ensure that the server uses the corresponding private key for decryption; After receiving the encrypted information, the server uses the private key to decrypt it and verify the decrypted information; After verification, the server uses a symmetric encryption algorithm to re-encrypt and store the information.
2. A security authentication method for preventing authentication credentials from being stolen according to claim 1, characterized in that: The following steps are also included: After decryption and verification, the server generates a unique random data as an important component of the authentication identifier; Bind the random data to a valid time within a specified range and store it persistently together with the user information; The server sets a scheduled task to monitor and clear expired random data.
3. A security authentication method for preventing authentication credentials from being stolen according to claim 1, characterized in that: The following steps are also included: After receiving the random data sent by the server, the client will encrypt the random number together with the current timestamp, user name and other encryption elements using an asymmetric encryption algorithm when sending subsequent requests; Send the encrypted authentication token to the server as part of the request.
4. A security authentication method for preventing authentication credentials from being stolen according to claim 3, characterized in that: After the server receives the client's request, it also includes the following steps: Use an asymmetric encryption algorithm to decrypt the authentication identifier carried in the request to obtain random data and timestamp related information; A series of strict verification operations are performed on the decrypted information, including verifying whether the timestamp exceeds the set error threshold and effective time range, and comparing the decrypted random data with the persistently stored data to confirm the validity of the user's identity.
5. A security authentication method for preventing authentication credentials from being stolen according to claim 1, characterized in that: The following steps are also included: If the verification fails, the server will not process the request further and return a failure message to the client, inviting the user to re-authenticate. If the verification passes, the server executes the corresponding business logic according to the request content, and determines whether the random data has expired during the business processing before returning the processing result; If the random data has expired, the server regenerates the random data, validity period, etc., and sends them to the client synchronously.
6. A security authentication system for preventing authentication credentials from being stolen, applied to the security authentication method for preventing authentication credentials from being stolen as claimed in any one of claims 1 to 5, characterized in that: The system comprises: The client module is used to use an asymmetric encryption algorithm to preliminarily encrypt the sensitive authentication information before the user submits it, and send the public key to the server through a secure channel; The server module is used to receive the encrypted sensitive authentication information, decrypt it using the corresponding private key, and verify the decrypted information; if the verification passes, the information is re-encrypted and stored using a symmetric encryption algorithm.
7. A security authentication system for preventing authentication credentials from being stolen according to claim 6, characterized in that: The server module also includes: The secondary encryption and key management unit is used to re-encrypt the decrypted sensitive authentication information and implement strict key management policies to ensure that only authorized users can access and decrypt the encrypted data; The random authentication identifier generation unit is used to generate a unique random data as an important component of the authentication identifier after the user authentication credentials are verified, and store it persistently after binding with the user information; at the same time, set a scheduled task to monitor and clear expired random data.
8. A security authentication system for preventing authentication credentials from being stolen according to claim 7, characterized in that: The client module also includes: an encrypted transmission authentication identification unit, which is used to encrypt the random number together with the current timestamp and username encryption elements using an asymmetric encryption algorithm after receiving the random data sent by the server when sending a subsequent request, and send the encrypted authentication identification as part of the request to the server.
9. A security authentication system for preventing authentication credentials from being stolen according to claim 8, characterized in that: The server module also includes: a decryption and verification unit, which is used to receive the request sent by the client, use an asymmetric encryption algorithm to decrypt the authentication identifier carried in the request, obtain random data, timestamp and other related information, and perform a series of strict verification operations, including verifying whether the timestamp exceeds the set error threshold and valid time range, and comparing the decrypted random data with the persistently stored data to confirm the validity of the user's identity.
10. A security authentication system for preventing authentication credentials from being stolen according to claim 9, characterized in that: The server module also includes: a verification result processing unit, which is used to return failure information to the client based on the results of the decryption and verification unit, if the verification fails, and invite the user to re-perform security authentication; if the verification passes, the corresponding business logic is executed according to the request content, and before returning the processing result, it is determined whether the random data has expired during the business processing period; if it has expired, the random data and validity period are regenerated and sent to the client synchronously.