Lightweight identity authentication method based on cryptographic algorithm SM3

Abstract

The invention relates to the technical field of information security, provides a lightweight identity authentication method based on a national cryptographic algorithm SM3, aims to improve the security and efficiency of identity authentication, and effectively avoids direct transmission of a key by adopting a random challenge string mechanism and a bidirectional verification process, thereby reducing the risk of leakage. Meanwhile, the block chain technology is combined, the authenticity and integrity of the data are ensured, in order to further enhance the system security, multi-factor authentication modes such as fingerprint recognition and dynamic token are introduced, in general, an effective solution is provided for security challenges in multi-terminal data transmission, and identity authentication is efficient.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a lightweight identity authentication method based on the national secret algorithm SM3. Background Art

[0002] With the rapid development of network technology, information security issues are becoming increasingly prominent. Identity authentication, as one of the core technologies of information security, is of great significance for protecting user privacy and system security. However, traditional identity authentication methods have problems such as insufficient security and low efficiency. Therefore, it is particularly important to develop an efficient and secure identity authentication method.

[0003] The SM3 algorithm is a cryptographic hash algorithm used to map a "byte string" of any length into a large number of fixed length (256 bits, or 32 bytes). The SM3 algorithm is suitable for digital signatures and verification, message authentication code generation and verification, and random number generation in commercial cryptographic applications, and can meet the security requirements of a variety of cryptographic applications.

[0004] The SM3 algorithm is an improved algorithm based on SHA-256. It adopts a Merkle-Damgard structure similar to SHA-256. The message group length is 512 bits and the digest value length is 256 bits. The specific process includes padding, iterative compression, output and other steps. In terms of security, the design of the SM3 algorithm is more resistant to collision and is suitable for applications such as digital signatures.

[0005] When the national encryption algorithm SM3 is used in identity authentication scenarios, especially in large-scale user scenarios, high performance requirements are placed on the algorithm, which involves multi-terminal data transmission. During multi-terminal data transmission, the SM3 algorithm, as a hash function, does not directly involve key generation and management. However, when it needs to be used in combination with other encryption technologies in actual applications, if the key of the national encryption algorithm SM3 is leaked, the security of the national encryption algorithm SM3 will be reduced. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a lightweight identity authentication method based on the national secret algorithm SM3, which solves the problem that if the key of the national secret algorithm SM3 is leaked during multi-terminal data transmission, the security of the national secret algorithm SM3 will be reduced.

[0007] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows:

[0008] The present invention provides a lightweight identity authentication method based on the national secret algorithm SM3, comprising:

[0009] S101, the server obtains a user identity authentication request, the user identity authentication request includes user identity information and national encryption algorithm SM3 information, the user identity information includes user name and user password;

[0010] S102, after obtaining the user identity authentication request, the server verifies the validity of the user identity authentication request. If the user identity authentication request is invalid, a message indicating authentication failure is generated. If the user identity authentication request is valid, the server generates a random string and sends it to the user end;

[0011] S103, the server receives a hash operation result of a random string from the user, where the hash operation result of the random string is obtained by the user performing a hash operation on the random string using a preset national encryption algorithm SM3;

[0012] S104, the server verifies the validity of the hash operation result of the random string of the user end. If the validity verification fails, a validity verification failure message is generated. If the validity verification passes, the server uses the same national secret algorithm SM3 as the user end to perform a hash operation on the random string to generate an expected hash value, and compares the expected hash value with the hash operation result of the random string. If the expected hash value is the same as the hash operation result of the random string, the identity authentication is successful, the password entered by the user is correct and the hash operation result is correct. If the expected hash value is different from the hash operation result of the random string, the identity authentication fails, the password entered by the user is incorrect and the hash operation result is tampered with.

[0013] S105, after the identity authentication is successful, the server sends an authentication success message to the client and generates a session token.

[0014] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S101, includes:

[0015] The server starts the monitoring mechanism and waits for the client's identity authentication request data, which is then transmitted over the network to the server.

[0016] When the server receives the data, it parses the received data and extracts the user identity information, which includes the user name and user password. The user name and user password are the credentials entered on the client and used to verify the user's identity;

[0017] The received data is parsed and the results obtained also include the parameter settings of the national encryption algorithm SM3 algorithm, the indicator of the encryption key and the data encryption mode.

[0018] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S102, includes:

[0019] After receiving the user authentication request, the server verifies the validity of the user authentication request. The verification of the validity of the user authentication request includes checking the format, signature and timestamp information of the request. If the information contained in the user authentication request does not conform to the predetermined format or the signature verification fails, the user authentication request will be deemed invalid;

[0020] If the server user authentication request is invalid, the server stops processing the user authentication and generates user authentication failure information, which includes an error code;

[0021] If the user authentication request is valid, a random string is generated, and the server sends the generated random string to the user end through the network connection. After receiving the random string, the user end processes it using a predetermined algorithm and returns the processing result to the server.

[0022] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S103, includes:

[0023] The server monitors and receives data packets from the client through the established network connection. The data packets from the client include the result obtained by the client using the preset national encryption algorithm SM3 to perform a hash operation on the random string previously sent by the server;

[0024] The data packet at the user end is parsed to extract the hash operation result. The parsing process includes decrypting the data packet, verifying the integrity of the data packet, and extracting the hash operation result from the data packet.

[0025] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0026] The server verifies the validity of the hash operation result of the random string sent by the client. The validity verification of the random string hash operation result includes checking whether the hash value conforms to the expected format and length and whether it meets the output characteristics of the national encryption algorithm SM3. If there is an abnormality in the hash operation result, the server determines that the validity verification has failed;

[0027] If the hash operation result passes the validity verification, the server will use the same national encryption algorithm SM3 as the user to perform a hash operation on the random string sent to the user to generate the expected hash value. The server will compare the expected hash value with the hash operation result sent by the user.

[0028] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0029] If the expected hash value is the same as the hash operation result sent by the user, the user identity authentication is successful, the password entered by the user is correct, and the hash operation result has not been tampered with;

[0030] If the expected hash value is different from the hash operation result sent by the user, the password entered by the user is incorrect, or the hash operation result has been tampered with during transmission.

[0031] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0032] The random string generated during the server data collection process and the hash operation result of the random string;

[0033] Establish a matching relationship between the collected random character string and the random character string hash operation result and the data generated by the server and the data generated by the user end to obtain a key data set;

[0034] The data of the key data set is stored in the blockchain in real time, and the hash value corresponding to the key data in the key data set is generated;

[0035] A retrieval tag is established by combining the hash value corresponding to the key data in the key data set with the key data in the key data set to obtain the key data set retrieval tag.

[0036] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0037] Setting a key data set hash value update time, updating the key data in the key data set with a hash value according to the set key data set hash value update time, and obtaining updated key data set hash value data;

[0038] Record the hash value of the key data set after each update to obtain a key data hash value update record;

[0039] The key data hash value is updated and recorded in the blockchain for storage, and the hash value corresponding to the key data hash value is obtained.

[0040] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0041] The server is configured with a fingerprint recognition mechanism, a dynamic token recognition mechanism or a biometric recognition mechanism;

[0042] The server receives and processes the user's dynamic login request through fingerprint recognition or verification code generated by a dynamic token;

[0043] Match the corresponding hash value in the data flow process according to the dynamic login request;

[0044] The corresponding hash value in the data flow process is compared with the login information currently submitted by the user. If the comparison results are consistent, the user is allowed to log in. If the comparison results are inconsistent, the user is denied login.

[0045] Furthermore, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S101, includes:

[0046] Establish an association between the random character string on the user side and the key data hash value update record;

[0047] When the corresponding hash value in the data flow process is compared with the login information currently submitted by the user, the key data hash value update record matching the corresponding hash value in the data flow process is retrieved;

[0048] If the corresponding hash value in the data flow process exists in the key data hash value update record, then the time information of the corresponding hash value in the data flow process;

[0049] If the time information of the corresponding hash value during the data flow process is consistent with the corresponding data time information in the key data hash value update record, the corresponding hash value during the data flow process has not been tampered with.

[0050] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0051] First, by introducing a random challenge string mechanism, the present invention effectively avoids the risk of fixed keys being leaked during transmission, significantly improving the security of identity authentication. At the same time, a two-way verification mechanism is adopted, which not only verifies the hash value returned by the user end, but also calculates the expected hash value for comparison, thereby improving the integrity and accuracy of the data during transmission.

[0052] Secondly, the method of the present invention avoids the direct use of fixed keys in the identity authentication process, reducing the possibility of key leakage. Moreover, by regularly updating the hash value of the key data set and recording it on the blockchain, any tampering with the key data can be detected in a timely manner, effectively preventing key leakage and further enhancing the security of data transmission.

[0053] In addition, by storing key data on the blockchain and utilizing the decentralized and distributed characteristics of the blockchain, the present invention improves the reliability and availability of data. Even when part of the system fails, the integrity and consistency of the data can be guaranteed, thereby improving the reliability and fault tolerance of the system.

[0054] Finally, the present invention supports configuration of mechanisms such as fingerprint recognition, dynamic token recognition or biometric recognition to achieve multi-factor authentication, further enhancing the security of the system.

[0055] In summary, the present invention significantly improves the security of identity authentication and prevents key leakage by comprehensively using a variety of technical means, such as random challenge strings, two-way verification mechanism, blockchain storage and multi-factor authentication. It also enhances the security of data transmission and improves the reliability and fault tolerance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0057] Figure 1 A schematic diagram of a method flow chart provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The technical solutions provided by the embodiments of the present invention are described in detail below in conjunction with the drawings.

[0059] In order to better understand the purpose of the present invention, the present invention is described in further detail below.

[0060] See also Figure 1 The present invention provides a lightweight identity authentication method based on the national secret algorithm SM3, comprising:

[0061] S101, the server obtains a user identity authentication request, the user identity authentication request includes user identity information and national encryption algorithm SM3 information, the user identity information includes user name and user password;

[0062] First, the user sends an identity authentication request to the server. The identity authentication request contains the user's identity information and related information of the national encryption algorithm SM3. The identity information is data used to confirm the user's identity, and the national encryption algorithm SM3 information involves encryption and verification technology.

[0063] Specifically, user identity information includes a user name and a user password. The user name is a unique identifier of the user, and the user name helps the server identify the specific user who is trying to authenticate.

[0064] When the server receives this authentication request, first, the server checks whether the user name exists and is valid, and then uses the password provided by the user and other possible verification methods (such as the national encryption algorithm SM3) to confirm the user's identity.

[0065] In this process, the National Encryption Algorithm SM3 plays an important role. The National Encryption Algorithm SM3 is an encryption algorithm used to protect the confidentiality and integrity of data. In the identity authentication process, the National Encryption Algorithm SM3 is used to encrypt user passwords or generate hash values ​​for verification. In this way, even if the password is intercepted during transmission, the attacker cannot directly obtain the plaintext password, thereby increasing the security of the system.

[0066] S102, after obtaining the user identity authentication request, the server verifies the validity of the user identity authentication request. If the user identity authentication request is invalid, a message indicating authentication failure is generated. If the user identity authentication request is valid, the server generates a random string and sends it to the user end;

[0067] First, the server verifies the validity of the user authentication request, which includes checking whether the user identity information is complete, the format is correct, and whether the password meets the requirements. For example, the server will confirm whether the user name and password match the information stored in the system, or check whether the national encryption algorithm SM3 information in the request meets expectations.

[0068] If the user authentication request is invalid, for example, the user name does not exist, the password is incorrect, or the request format is incorrect, the server immediately generates an authentication failure message and returns it to the user, informing the user that the authentication has not passed. It also provides relevant error prompts or suggestions so that the user can make corresponding adjustments.

[0069] However, if the user authentication request is valid, the server proceeds to the next step and generates a random string, which is unique in each authentication process, increasing the security of the authentication. The server then sends this random string to the user, which will be used in subsequent authentication processes, such as hash calculation comparison with the user.

[0070] S103, the server receives a hash operation result of a random string from the user, where the hash operation result of the random string is obtained by the user performing a hash operation on the random string using a preset national encryption algorithm SM3;

[0071] In step S103, the server receives a hash operation result of the random string from the user end. The hash operation result of the random string of the user end is obtained by the user end using a preset national encryption algorithm SM3 to perform a hash operation on the random string previously sent by the server.

[0072] In detail, when the client receives the random string sent by the server, it will use the locally preset national encryption algorithm SM3 to hash the string. Hash operation is a method of converting data of any length into fixed-length data. It is irreversible, that is, the original data cannot be deduced from the hash value. This feature makes hash operation widely used in data integrity verification and password storage.

[0073] In this step, the national encryption algorithm SM3, as a secure hash algorithm, can ensure that the result of the hash operation is highly secure and unique. After the client completes the hash operation, it will send the result back to the server.

[0074] After receiving the hash calculation result, the server will conduct a subsequent verification process, such as comparing it with the hash value calculated by itself, to confirm the identity of the user and the integrity of the data. If the two are consistent, it means that the user is legitimate and the data has not been tampered with during transmission.

[0075] S104, the server verifies the validity of the hash operation result of the random string of the user end. If the validity verification fails, a validity verification failure message is generated. If the validity verification passes, the server uses the same national secret algorithm SM3 as the user end to perform a hash operation on the random string to generate an expected hash value, and compares the expected hash value with the hash operation result of the random string. If the expected hash value is the same as the hash operation result of the random string, the identity authentication is successful, the password entered by the user is correct and the hash operation result is correct. If the expected hash value is different from the hash operation result of the random string, the identity authentication fails, the password entered by the user is incorrect and the hash operation result is tampered with.

[0076] The server checks whether the received hash result conforms to the expected format and length, and whether it is received within a reasonable time. This is a preliminary validity verification. If this step of verification fails, such as the received data format is incorrect or timeout, the server will generate a validity verification failure message and may terminate the authentication process.

[0077] If the initial verification is successful, the server will conduct a deeper level of verification. It will use the same national encryption algorithm SM3 as the client to perform a hash operation on the random string previously sent to the client to generate an expected hash value. This expected hash value is calculated by the server based on the random string and the national encryption algorithm SM3, and is used to compare with the hash operation result sent by the client.

[0078] Next, the server compares the expected hash value with the hash result of the random string sent by the client. If the two are the same, it means that the password used by the client is correct and the hash result is also correct, which means that the authentication is successful. The server allows the user to access the protected resources or services.

[0079] However, if the expected hash value is different from the hash result sent by the user, the authentication fails. This means that the password entered by the user is incorrect, or the hash result has been tampered with during transmission. In this case, the server will deny the user's access request and may generate a corresponding error message to notify the user.

[0080] S105, after the identity authentication is successful, the server sends an authentication success message to the client and generates a session token.

[0081] When authentication is successful, that is, the server verifies that the hash value sent by the client matches the expected hash value calculated by the server, the server immediately sends an authentication success message to the client. This message is usually a simple notification that the user's identity has been successfully verified and can now access protected services or resources. The server then generates a session token. A session token is a unique string used to identify and verify a user session. It allows the server to track and identify authenticated users and ensure that only these users can access restricted resources. Session tokens are usually generated after a user is authenticated and remain valid throughout the user's session.

[0082] Session tokens can contain information about a user's session, such as the user's identity, the start time of the session, and the expiration time. The server generates and stores these tokens in a secure way to ensure that they cannot be forged or tampered with.

[0083] When a session token is generated, it is sent to the client and included in subsequent requests by the client to prove its identity and the validity of the session. This allows the server to identify and authorize the user's requests without having to go through the full authentication process every time.

[0084] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S101, includes:

[0085] The server starts the monitoring mechanism and waits for the client's identity authentication request data, which is then transmitted over the network to the server.

[0086] When the server receives the data, it parses the received data and extracts the user identity information, which includes the user name and user password. The user name and user password are the credentials entered on the client and used to verify the user's identity;

[0087] The received data is parsed and the results obtained also include the parameter settings of the national encryption algorithm SM3 algorithm, the indicator of the encryption key and the data encryption mode.

[0088] First, the server will start the monitoring mechanism and wait for the identity authentication request data from the client. This is to ensure that the server can respond to the client's identity authentication requirements in a timely manner.

[0089] Secondly, when the client sends authentication request data, the data is transmitted over the network to the server. After receiving the data, the server will parse it to extract key user identity information, including user name and user password. This information is the credentials entered by the client and used to verify the user's identity.

[0090] In addition, during the data parsing process, the server also processes the parameter settings related to the national encryption algorithm SM3, including the indicator of the encryption key and the data encryption mode, etc. These parameters are crucial for the subsequent identity authentication process, and they ensure the security and accuracy of the identity authentication.

[0091] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S102, includes:

[0092] After receiving the user authentication request, the server verifies the validity of the user authentication request. The verification of the validity of the user authentication request includes checking the format, signature and timestamp information of the request. If the information contained in the user authentication request does not conform to the predetermined format or the signature verification fails, the user authentication request will be deemed invalid;

[0093] If the server user authentication request is invalid, the server stops processing the user authentication and generates user authentication failure information, which includes an error code;

[0094] If the user authentication request is valid, a random string is generated, and the server sends the generated random string to the user end through the network connection. After receiving the random string, the user end processes it using a predetermined algorithm and returns the processing result to the server.

[0095] Specifically, in the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, in step S102, the processing flow after the server receives the user identity authentication request includes the following aspects:

[0096] Verification of the validity of the user authentication request:

[0097] The server first verifies the validity of the identity authentication request sent by the user.

[0098] The verification process includes checking whether the request is formatted correctly, the signature is valid, and the timestamp information is compliant.

[0099] If any information in the request does not meet the predetermined requirements (e.g. format error, signature verification failure, etc.), the request is deemed invalid.

[0100] Invalid request handling:

[0101] If the user authentication request is invalid, the server will stop processing the request further.

[0102] At the same time, the server generates user authentication failure information, which usually includes an error code so that the user or administrator can identify the cause of the failure.

[0103] Processing of valid requests:

[0104] If the user authentication request passes the verification, the server will generate a random string, which will be sent to the user through the network connection for subsequent verification process.

[0105] After receiving the random string, the client will process it using a predetermined algorithm (i.e., the national encryption algorithm SM3) and return the processing result (i.e., the hash operation result) to the server.

[0106] Through this process, the server can ensure that only valid authentication requests will be further processed, thereby enhancing the security and accuracy of the authentication process. At the same time, by generating a random string and requiring the client to return its hash value, the server can verify whether the client actually holds the correct key (or password), thereby confirming the user's identity.

[0107] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S103, includes:

[0108] The server monitors and receives data packets from the client through the established network connection. The data packets from the client include the result obtained by the client using the preset national encryption algorithm SM3 to perform a hash operation on the random string previously sent by the server;

[0109] The data packet at the user end is parsed to extract the hash operation result. The parsing process includes decrypting the data packet, verifying the integrity of the data packet, and extracting the hash operation result from the data packet.

[0110] Specifically, in the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S103 describes in detail how the server receives and processes data packets from the user end. This process includes the following key steps:

[0111] Listening and receiving data packets: The server continuously listens to data transmission from the user through the established network connection. When a data packet arrives, the server receives it.

[0112] Data packet content: The data packet sent by the client contains the result of a hash operation on the random string previously sent by the server. This hash operation is performed using the preset national encryption algorithm SM3.

[0113] Parsing data packets: After receiving the data packets, the server first parses them. The parsing process involves the following key sub-steps:

[0114] Decryption: If the data packet is encrypted during transmission, the server needs to decrypt it first.

[0115] Verify integrity: The server verifies the integrity of the data packet to ensure that it has not been tampered with during transmission.

[0116] Extracting hash operation results: After confirming the integrity and authenticity of the data packet, the server extracts the hash operation results calculated by the user end from the data packet.

[0117] Through these steps, the server can safely and accurately obtain the result of the hash operation on the random string by the user, providing necessary data support for the subsequent authentication process.

[0118] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0119] The server verifies the validity of the hash operation result of the random string sent by the client. The validity verification of the random string hash operation result includes checking whether the hash value conforms to the expected format and length and whether it meets the output characteristics of the national encryption algorithm SM3. If there is an abnormality in the hash operation result, the server determines that the validity verification has failed;

[0120] If the hash operation result passes the validity verification, the server will use the same national encryption algorithm SM3 as the user to perform a hash operation on the random string sent to the user to generate the expected hash value. The server will compare the expected hash value with the hash operation result sent by the user.

[0121] In step S104, the server will conduct strict validity verification on the hash operation result of the random string sent by the client. This verification process includes checking whether the hash value conforms to the expected format and length, and whether it meets the output characteristics of the national encryption algorithm SM3. This is to ensure that the received hash value is legal and has not been tampered with.

[0122] If there is any anomaly in the hash operation result, such as format error, length mismatch or non-compliance with the output specification of the SM3 algorithm, the server will immediately determine that the validity verification of the hash operation result has failed. This is a security mechanism to prevent illegal or tampered hash values ​​from being accepted.

[0123] However, if the hash operation result passes the preliminary validity verification, the server will proceed to the next step. It will use the same national encryption algorithm SM3 as the client to perform a hash operation on the random string previously sent to the client to generate an expected hash value. This expected hash value is calculated by the server based on the random string and the national encryption algorithm SM3, and is used to compare with the hash operation result sent by the client.

[0124] The server then compares the generated expected hash value with the hash result sent by the client. If the two are the same, it means that the password entered by the user is correct and the hash result has not been tampered with, and the authentication is successful. On the contrary, if the two are different, it means that the password entered by the user is incorrect or the hash result has been tampered with during transmission, and the authentication will fail.

[0125] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0126] If the expected hash value is the same as the hash operation result sent by the user, the user identity authentication is successful, the password entered by the user is correct, and the hash operation result has not been tampered with;

[0127] If the expected hash value is different from the hash operation result sent by the user, the password entered by the user is incorrect, or the hash operation result has been tampered with during transmission.

[0128] In step S104, the server verifies the hash operation result sent by the user. If the expected hash value matches the hash operation result sent by the user, it means that the user identity authentication is successful, the password entered by the user is correct, and the hash operation result has not been tampered with during transmission.

[0129] However, if the expected hash value is inconsistent with the hash operation result sent by the user, it means that the password entered by the user is incorrect, or the hash operation result has been tampered with during data transmission. In this case, the authentication will fail.

[0130] In general, step S104 is a key link in the identity authentication process. It confirms the correctness of the user's identity and password by comparing the expected hash value generated by the server and the hash operation result sent by the user, thereby ensuring the security and accuracy of the entire authentication process.

[0131] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0132] The random string generated during the server data collection process and the hash operation result of the random string;

[0133] Establish a matching relationship between the collected random character string and the random character string hash operation result and the data generated by the server and the data generated by the user end to obtain a key data set;

[0134] The data of the key data set is stored in the blockchain in real time, and the hash value corresponding to the key data in the key data set is generated;

[0135] A retrieval tag is established by combining the hash value corresponding to the key data in the key data set with the key data in the key data set to obtain the key data set retrieval tag.

[0136] First, the server will collect the random strings generated during the entire data flow and the hash operation results of these random strings. This data is key information in the identity authentication process and is crucial for verifying the user's identity.

[0137] Next, the server matches the collected random string, the hash operation result, the data generated by the server, and the data generated by the user to form a complete key data set. This set not only includes the information entered by the user, but also the data generated by the server, thus forming a comprehensive identity authentication record.

[0138] In order to further enhance the security of data, the server stores this key data set in real time on the blockchain. The decentralized and tamper-proof characteristics of blockchain technology ensure the security and credibility of these key data, so that any tampering with the data can be detected immediately.

[0139] On the blockchain, the server also generates a corresponding hash value for each key data set. The uniqueness of the hash value means that any minor changes to the data will be immediately reflected in the change of the hash value, thus providing an effective data integrity verification mechanism.

[0140] Finally, in order to facilitate the rapid and accurate retrieval of relevant key data and its hash value when needed, the server will create a retrieval tag for each key data and its corresponding hash value in the key data set to form a key data set retrieval tag.

[0141] These steps together constitute a secure and reliable identity authentication process. In particular, the introduction of blockchain technology not only ensures the security of data, but also greatly improves the credibility of data, making the entire identity authentication process more robust and reliable.

[0142] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0143] Setting a key data set hash value update time, updating the key data in the key data set with a hash value according to the set key data set hash value update time, and obtaining updated key data set hash value data;

[0144] Record the hash value of the key data set after each update to obtain a key data hash value update record;

[0145] The key data hash value is updated and recorded in the blockchain for storage, and the hash value corresponding to the key data hash value is obtained.

[0146] First, the system will set a fixed time period to regularly update the hash values ​​of all key data in the key data set. The purpose of this is to continuously enhance the security of the system and prevent security risks that may be caused by using the same hash value for a long time.

[0147] At the set update time, the system will traverse all the key data in the key data set and recalculate the hash value for them using the national secret algorithm SM3 to ensure that the hash value of the key data is always kept up to date.

[0148] After each hash value update, the new key data set hash value will be recorded in detail to form a key data hash value update record. These records are crucial for the subsequent verification and security audit of the system.

[0149] In order to ensure the security and non-tamperability of these hash value records, the present invention cleverly stores the key data hash value update records on the blockchain. The distributed ledger characteristics of blockchain technology mean that any attempt to tamper with the records will be immediately detected by the system, thereby ensuring the absolute integrity and high credibility of the data.

[0150] Finally, it is worth mentioning that what is stored on the blockchain is not only the update records of hash values, but also the original data identifiers corresponding to these hash values. In this way, when necessary, the system can quickly retrieve the key data related to a specific hash value, improving the efficiency and accuracy of data retrieval.

[0151] Through this mechanism, the security and data protection capabilities of the identity authentication system have been significantly improved, ensuring that key data is fully protected both during transmission and storage.

[0152] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S104, includes:

[0153] The server is configured with a fingerprint recognition mechanism, a dynamic token recognition mechanism or a biometric recognition mechanism;

[0154] The server receives and processes the user's dynamic login request through fingerprint recognition or verification code generated by a dynamic token;

[0155] Match the corresponding hash value in the data flow process according to the dynamic login request;

[0156] The corresponding hash value in the data flow process is compared with the login information currently submitted by the user. If the comparison results are consistent, the user is allowed to log in. If the comparison results are inconsistent, the user is denied login.

[0157] First, the server configures these additional security mechanisms, such as fingerprint recognition, dynamic token recognition, or biometrics, to provide users with multi-level authentication methods.

[0158] When a user attempts to log in, the server receives and processes the verification code they generate through fingerprint recognition, dynamic tokens, etc. These verification codes are dynamically generated, increasing the security of the login process.

[0159] Next, the server will match the corresponding hash value generated in the previous data flow process according to the dynamic login request submitted by the user. This step ensures that the login information submitted by the user is consistent with the information generated in the previous identity authentication process.

[0160] Then, the server will compare the corresponding hash value in the data flow process with the login information currently submitted by the user. In addition to the user name and password, the login information submitted here also includes a dynamic verification code.

[0161] Finally, if the comparison results are consistent, it means that the user's identity has been effectively verified, and the server allows the user to log in to the system. On the contrary, if the comparison results are inconsistent, it means that the user's identity has not been verified, and the server will reject the user's login request.

[0162] This multi-factor authentication mechanism enhances the security of identity authentication. Even if the hash value is intercepted or tampered with during transmission, the attacker cannot bypass other security verification links only through the hash value. Therefore, this comprehensive identity authentication method effectively protects the overall security of the system.

[0163] Specifically, the lightweight identity authentication method based on the national secret algorithm SM3 described in the present invention, step S101, includes:

[0164] Establish an association between the random character string on the user side and the key data hash value update record;

[0165] When the corresponding hash value in the data flow process is compared with the login information currently submitted by the user, the key data hash value update record matching the corresponding hash value in the data flow process is retrieved;

[0166] If the corresponding hash value in the data flow process exists in the key data hash value update record, then the time information of the corresponding hash value in the data flow process;

[0167] If the time information of the corresponding hash value during the data flow process is consistent with the corresponding data time information in the key data hash value update record, the corresponding hash value during the data flow process has not been tampered with.

[0168] First, the system associates the random string on the client side with the key data hash value update record. This is done to ensure that each random string has a corresponding record for subsequent query and verification when its hash value is updated.

[0169] Then, during the data flow, when it is necessary to compare the hash value with the login information currently submitted by the user, the system will retrieve the key data hash value update record that matches the corresponding hash value in the data flow. This is an important step to implement hash value verification and time consistency check.

[0170] Then, the system checks whether the corresponding hash value in the data flow exists in the key data hash value update record. If so, the system further obtains the time information of the hash value to ensure that the hash value subsequently verified is known and recorded by the system.

[0171] Finally, the system verifies whether the time information of the corresponding hash value in the data flow is consistent with the corresponding data time information in the key data hash value update record. If they are consistent, the system determines that the corresponding hash value in the data flow has not been tampered with. This is a key step in verifying the integrity and security of the hash value.

[0172] In order to solve the security problem that may be caused by the leakage of the national secret algorithm SM3 key during multi-terminal data transmission, the present invention proposes a lightweight identity authentication method based on the national secret algorithm SM3, which effectively improves the security and reliability of the identity authentication process.

[0173] First, the present invention introduces a random challenge string mechanism. During each identity authentication, the server generates a temporary random string and sends it to the client. The client uses this random string and the preset national encryption algorithm SM3 to perform a hash operation, and then returns the result to the server, avoiding the direct use of a fixed key for data transmission, thereby reducing the risk of key leakage.

[0174] Secondly, the present invention adopts a two-way verification mechanism. The server not only receives the hash value returned by the user, but also performs hash operation on the same random string to generate the expected hash value. By comparing these two hash values, the server can verify whether the calculation result of the user is correct and detect whether the data has been tampered with during transmission.

[0175] In addition, the present invention also improves security by adding dynamic factors. Each authentication process is based on different inputs, making each authentication session unique and difficult to predict or copy.

[0176] At the same time, the present invention combines blockchain technology to ensure the authenticity and integrity of the data. The server stores the data generated during the authentication process on the blockchain in real time, and uses the immutability of the blockchain to prevent the data from being modified.

[0177] Finally, the present invention also combines configuration of fingerprint recognition, dynamic token recognition or biometric recognition mechanisms as additional identity authentication steps to further improve security.

[0178] Through the above-mentioned comprehensive measures, the present invention effectively solves the security problems that may be caused by the leakage of the key of the national encryption algorithm SM3, and provides users with a more secure and reliable identity authentication method during multi-terminal data transmission.

[0179] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations, and the above-described embodiments of the present invention do not constitute a limitation on the scope of protection of the present invention.

Claims

1. A lightweight identity authentication method based on the national secret algorithm SM3, characterized in that: include: S101, the server obtains a user identity authentication request, the user identity authentication request includes user identity information and national encryption algorithm SM3 information, the user identity information includes user name and user password; S102, after obtaining the user identity authentication request, the server verifies the validity of the user identity authentication request. If the user identity authentication request is invalid, a message indicating authentication failure is generated. If the user identity authentication request is valid, the server generates a random string and sends it to the user end; S103, the server receives a hash operation result of a random string from the user, where the hash operation result of the random string is obtained by the user performing a hash operation on the random string using a preset national encryption algorithm SM3; S104, the server verifies the validity of the hash operation result of the random string of the user end. If the validity verification fails, a validity verification failure message is generated. If the validity verification passes, the server uses the same national secret algorithm SM3 as the user end to perform a hash operation on the random string to generate an expected hash value, and compares the expected hash value with the hash operation result of the random string. If the expected hash value is the same as the hash operation result of the random string, the identity authentication is successful, the password entered by the user is correct and the hash operation result is correct. If the expected hash value is different from the hash operation result of the random string, the identity authentication fails, the password entered by the user is incorrect and the hash operation result is tampered with. S105, after the identity authentication is successful, the server sends an authentication success message to the client and generates a session token.

2. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 1, characterized in that: Step S101 includes: The server starts the monitoring mechanism and waits for the client's identity authentication request data, which is then transmitted over the network to the server. When the server receives the data, it parses the received data and extracts the user identity information, which includes the user name and user password. The user name and user password are the credentials entered on the client and used to verify the user's identity; The received data is parsed and the results obtained also include the parameter settings of the national encryption algorithm SM3 algorithm, the indicator of the encryption key and the data encryption mode.

3. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 1, characterized in that: Step S102 includes: After receiving the user authentication request, the server verifies the validity of the user authentication request. The verification of the validity of the user authentication request includes checking the format, signature and timestamp information of the request. If the information contained in the user authentication request does not conform to the predetermined format or the signature verification fails, the user authentication request will be deemed invalid; If the server user authentication request is invalid, the server stops processing the user authentication and generates user authentication failure information, which includes an error code; If the user authentication request is valid, a random string is generated, and the server sends the generated random string to the user end through the network connection. After receiving the random string, the user end processes it using a predetermined algorithm and returns the processing result to the server.

4. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 1, characterized in that: Step S103 includes: The server monitors and receives data packets from the client through the established network connection. The data packets from the client include the result obtained by the client using the preset national encryption algorithm SM3 to perform a hash operation on the random string previously sent by the server; The data packet at the user end is parsed to extract the hash operation result. The parsing process includes decrypting the data packet, verifying the integrity of the data packet, and extracting the hash operation result from the data packet.

5. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 1, characterized in that: Step S104 includes: The server verifies the validity of the hash operation result of the random string sent by the client. The validity verification of the random string hash operation result includes checking whether the hash value conforms to the expected format and length and whether it meets the output characteristics of the national encryption algorithm SM3. If there is an abnormality in the hash operation result, the server determines that the validity verification has failed; If the hash operation result passes the validity verification, the server will use the same national encryption algorithm SM3 as the user to perform a hash operation on the random string sent to the user to generate the expected hash value. The server will compare the expected hash value with the hash operation result sent by the user.

6. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 5, characterized in that: Step S104 includes: If the expected hash value is the same as the hash operation result sent by the user, the user identity authentication is successful, the password entered by the user is correct, and the hash operation result has not been tampered with; If the expected hash value is different from the hash operation result sent by the user, the password entered by the user is incorrect, or the hash operation result has been tampered with during transmission.

7. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 6, characterized in that: Step S104 includes: The random string generated during the server data collection process and the hash operation result of the random string; Establish a matching relationship between the collected random character string and the random character string hash operation result and the data generated by the server and the data generated by the user end to obtain a key data set; The data of the key data set is stored in the blockchain in real time, and the hash value corresponding to the key data in the key data set is generated; A retrieval tag is established by combining the hash value corresponding to the key data in the key data set with the key data in the key data set to obtain the key data set retrieval tag.

8. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 7, characterized in that: Step S104 includes: Setting a key data set hash value update time, updating the key data in the key data set with a hash value according to the set key data set hash value update time, and obtaining updated key data set hash value data; Record the hash value of the key data set after each update to obtain a key data hash value update record; The key data hash value is updated and recorded in the blockchain for storage, and the hash value corresponding to the key data hash value is obtained.

9. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 8, characterized in that: Step S104 includes: The server is configured with a fingerprint recognition mechanism, a dynamic token recognition mechanism or a biometric recognition mechanism; The server receives and processes the user's dynamic login request through fingerprint recognition or verification code generated by a dynamic token; Match the corresponding hash value in the data flow process according to the dynamic login request; The corresponding hash value in the data flow process is compared with the login information currently submitted by the user. If the comparison results are consistent, the user is allowed to log in. If the comparison results are inconsistent, the user is denied login.

10. The lightweight identity authentication method based on the national secret algorithm SM3 as claimed in claim 1, characterized in that: Step S101 includes: Establish an association between the random character string on the user side and the key data hash value update record; When the corresponding hash value in the data flow process is compared with the login information currently submitted by the user, the key data hash value update record matching the corresponding hash value in the data flow process is retrieved; If the corresponding hash value in the data flow process exists in the key data hash value update record, then the time information of the corresponding hash value in the data flow process; If the time information of the corresponding hash value during the data flow process is consistent with the corresponding data time information in the key data hash value update record, the corresponding hash value during the data flow process has not been tampered with.

Images