A lightweight identity authentication method based on a national encryption algorithm SM3

Abstract

The present application relates to the technical field of information security, and provides a lightweight identity authentication method based on a national encryption algorithm SM3, which aims to improve the security and efficiency of identity authentication, and effectively avoids the direct transmission of a key by adopting a random challenge string mechanism and a two-way verification process, thereby reducing the risk of leakage.Meanwhile, the present application combines blockchain technology to ensure the authenticity and integrity of data, and further introduces multi-factor authentication methods such as fingerprint recognition and dynamic tokens to further enhance system security.In general, the present application provides an effective solution to the security challenges in multi-end data transmission, making identity authentication efficient.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a lightweight identity authentication method based on the Chinese national cryptographic algorithm SM3. Background Technology

[0002] With the rapid development of network technology, information security issues are becoming increasingly prominent. Identity authentication, as one of the core technologies of information security, is of great significance for protecting user privacy and system security. However, traditional identity authentication methods suffer from insufficient security and low efficiency. Therefore, developing an efficient and secure identity authentication method is particularly important.

[0003] The SM3 algorithm, a Chinese national cryptographic standard, is a cryptographic hash algorithm used to map a byte string of arbitrary length to a large number of fixed length (256 bits, or 32 bytes). The SM3 algorithm is suitable for digital signature and verification, message authentication code generation and verification, and random number generation in commercial cryptographic applications, meeting the security requirements of various cryptographic applications.

[0004] The SM3 algorithm is an improved version of SHA-256. It adopts a Merkle-Damgard structure similar to SHA-256, with a message block length of 512 bits and a digest value length of 256 bits. Its specific process includes steps such as padding, iterative compression, and output. In terms of security, the SM3 algorithm is designed to be more collision-resistant and is suitable for applications such as digital signatures.

[0005] In identity authentication scenarios, especially in large-scale user scenarios, the SM3 national cryptographic algorithm has high performance requirements. This involves multi-terminal data transmission. During multi-terminal data transmission, although the SM3 algorithm, as a hash function, does not directly involve key generation and management, it needs to be used in combination with other encryption technologies in practical applications. If the key of the SM3 national cryptographic algorithm is leaked, it will lead to a decrease in the security of the SM3 national cryptographic algorithm. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a lightweight identity authentication method based on the Chinese national cryptographic algorithm SM3, which solves the problem that if the key of the Chinese national cryptographic algorithm SM3 is leaked during multi-terminal data transmission, the security of the Chinese national cryptographic algorithm SM3 will be reduced.

[0007] To solve the above-mentioned technical problems, the specific technical solution of the present invention is as follows:

[0008] This invention provides a lightweight authentication method based on the Chinese national cryptographic algorithm SM3, comprising:

[0009] S101, The server obtains a user authentication request. The user authentication request includes user identity information and SM3 national cryptographic algorithm information. The user identity information includes the username and the user password.

[0010] S102, after the server obtains the user authentication request, it verifies the validity of the user authentication request. If the user authentication request is invalid, it generates an authentication failure message. If the user authentication request is valid, the server generates a random string and sends it to the user.

[0011] S103, The server receives the hash result of the random string from the user. The hash result of the random string is obtained by the user using the preset national cryptographic algorithm SM3 to perform a hash operation on the random string.

[0012] S104, the server verifies the validity of the hash result of the random string from the user. If the validity verification fails, a validity verification failure message is generated. If the validity verification passes, the server uses the same national cryptographic algorithm SM3 as the user to perform a hash operation on the random string, generates an expected hash value, and compares the expected hash value with the hash result of the random string. If the expected hash value is the same as the hash result of the random string, the authentication is successful, the user's password is correct, and the hash operation result is correct. If the expected hash value is different from the hash result of the random string, the authentication fails, the user's password is incorrect, and the hash operation result has been tampered with.

[0013] S105. After successful authentication, the server sends an authentication success message to the client and generates a session token.

[0014] Furthermore, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S101, which comprises:

[0015] The server starts a listening mechanism to wait for client authentication request data. The client's authentication request data is transmitted to the server over the network.

[0016] When the server receives data, it parses the received data and extracts the user identity information, which includes the username and password. The username and password are the credentials entered by the client and used to verify the user's identity.

[0017] The results obtained from parsing the received data also include the parameter settings of the SM3 national cryptographic algorithm, the indicator of the encryption key, and the data encryption mode.

[0018] Furthermore, in the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention, step S102 includes:

[0019] After receiving a user authentication request, the server verifies the validity of the user authentication request. The verification of the validity of the user authentication request includes checking the format, signature and timestamp information of the request. If the information contained in the user authentication request does not conform to the predetermined format or the signature verification fails, the user authentication request will be regarded as invalid.

[0020] If the server's user authentication request is invalid, the user authentication process will stop and a user authentication failure message will be generated, which will include an error code.

[0021] If the user authentication request is valid, a random string is generated. The server sends the generated random string to the user's client via a network connection. After receiving the random string, the user's client processes it using a predetermined algorithm and returns the processing result to the server.

[0022] Furthermore, in the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention, step S103 includes:

[0023] The server listens for and receives data packets from the user through the established network connection. The data packets from the user include the result obtained by the user using the preset national cryptographic algorithm SM3 to perform a hash operation on the random string previously sent by the server.

[0024] The data packets from the user end are parsed to extract the hash operation results. The parsing process includes decrypting the data packets, verifying the integrity of the data packets, and extracting the hash operation results from the data packets.

[0025] Furthermore, in the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention, step S104 includes:

[0026] The server verifies the validity of the hash result of the random string sent by the client. The validity verification of the hash result includes checking whether the hash value meets the expected format and length and whether it meets the output characteristics of the national cryptographic algorithm SM3. If the hash result is abnormal, the server determines that the validity verification has failed.

[0027] If the hash operation result passes the validity verification, the server will use the same national cryptographic algorithm SM3 as the client to perform a hash operation on the random string sent to the client, generate the expected hash value, and then compare the expected hash value with the hash operation result sent by the client.

[0028] Furthermore, in the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention, step S104 includes:

[0029] If the expected hash value is the same as the hash result sent by the user, then the user authentication is successful, the password entered by the user is correct, and the result of the hash calculation has not been tampered with.

[0030] If the expected hash value is different from the hash result sent by the user, then the password entered by the user is incorrect, or the result of the hash operation has been tampered with during transmission.

[0031] Furthermore, in the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention, step S104 includes:

[0032] Random strings generated during the server's data collection process and the results of random string hash operations;

[0033] The collected random strings and the results of random string hash operations are matched with the data generated by the server and the data generated by the user to obtain a key data set;

[0034] The data in the key data set is stored in the blockchain in real time, and the hash value corresponding to the key data in the key data set is generated.

[0035] The search tags for the key data set are obtained by establishing search labels between the hash values ​​corresponding to the key data in the key data set and the key data in the key data set.

[0036] Furthermore, in the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention, step S104 includes:

[0037] Set the hash value update time for the key data set, and update the hash value of the key data in the key data set according to the set hash value update time to obtain the updated hash value data of the key data set.

[0038] Record the hash value of the key data set after each update to obtain the key data hash value update record;

[0039] The key data hash value is updated and stored in the blockchain to obtain the hash value corresponding to the key data hash value.

[0040] Furthermore, in the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention, step S104 includes:

[0041] The server is configured with a fingerprint recognition mechanism, a dynamic token recognition mechanism, or a biometric recognition mechanism;

[0042] The server receives and processes dynamic login requests from users using verification codes generated by fingerprint recognition or dynamic tokens.

[0043] Match the corresponding hash value during the data flow process based on the dynamic login request;

[0044] The hash value corresponding to the data flow process is compared with the login information currently submitted by the user. If the comparison results match, the user is allowed to log in; if the comparison results do not match, the user is denied login.

[0045] Furthermore, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S101, which comprises:

[0046] Establish a relationship between the user's random string and the key data hash value update record;

[0047] When comparing the corresponding hash value with the login information currently submitted by the user during the data flow process, the key data hash value update record that matches the corresponding hash value during the data flow process is retrieved.

[0048] If the corresponding hash value in the data flow process exists in the key data hash value update record, then obtain the time information of the corresponding hash value in the data flow process.

[0049] If the time information of the corresponding hash value during the data flow is consistent with the data time information in the key data hash value update record, then the corresponding hash value has not been tampered with during the data flow.

[0050] The beneficial effects of this invention are mainly reflected in the following aspects:

[0051] First, by introducing a random challenge string mechanism, this invention effectively avoids the risk of fixed keys being leaked during transmission, significantly improving the security of identity authentication. Simultaneously, a two-way verification mechanism is employed, which not only verifies the hash value returned by the user but also calculates and compares the expected hash value, thereby enhancing the integrity and accuracy of data during transmission.

[0052] Secondly, the method of this invention avoids the direct use of a fixed key during the identity authentication process, reducing the possibility of key leakage. Furthermore, by periodically updating the hash value of the key data set and recording it on the blockchain, any tampering with the key data can be detected in a timely manner, effectively preventing key leakage and further enhancing the security of data transmission.

[0053] Furthermore, by storing critical data on a blockchain, leveraging its decentralized and distributed characteristics, this invention improves data reliability and availability. Even in the event of partial system failures, data integrity and consistency are guaranteed, thereby enhancing system reliability and fault tolerance.

[0054] Finally, this invention supports configuring mechanisms such as fingerprint recognition, dynamic token recognition, or biometrics to achieve multi-factor authentication, further enhancing the security of the system.

[0055] In summary, by comprehensively utilizing various technical means, such as random challenge strings, two-way verification mechanisms, blockchain storage, and multi-factor authentication, this invention significantly improves the security of identity authentication and prevents key leakage. It also enhances the security of data transmission and improves the reliability and fault tolerance of the system. Attached Figure Description

[0056] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0057] Figure 1 This is a schematic diagram of the method flow provided in an embodiment of the present invention. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. The technical solutions provided by various embodiments of this invention will be described in detail below with reference to the accompanying drawings.

[0059] To better understand the purpose of this invention, the invention will now be described in further detail.

[0060] Please see Figure 1 This invention provides a lightweight identity authentication method based on the Chinese national cryptographic algorithm SM3, comprising:

[0061] S101, The server obtains a user authentication request. The user authentication request includes user identity information and SM3 national cryptographic algorithm information. The user identity information includes the username and the user password.

[0062] First, the user sends an authentication request to the server. The authentication request contains the user's identity information and information related to the national cryptographic algorithm SM3. The identity information is data used to confirm the user's identity, while the national cryptographic algorithm SM3 information involves encryption and verification technologies.

[0063] Specifically, user identity information includes username and password. The username is the user's unique identifier and helps the server identify the specific user attempting to authenticate.

[0064] When the server receives this authentication request, it first checks whether the username exists and is valid. Then, it uses the password provided by the user and other possible verification methods (such as the SM3 national cryptographic algorithm) to confirm the user's identity.

[0065] In this process, the Chinese national cryptographic algorithm SM3 plays a crucial role. SM3 is an encryption algorithm used to protect the confidentiality and integrity of data. During identity authentication, SM3 is used to encrypt user passwords or generate hash values ​​for verification. This ensures that even if the password is intercepted during transmission, attackers cannot directly obtain the plaintext password, thus increasing system security.

[0066] S102, after the server obtains the user authentication request, it verifies the validity of the user authentication request. If the user authentication request is invalid, it generates an authentication failure message. If the user authentication request is valid, the server generates a random string and sends it to the user.

[0067] First, the server verifies the validity of the user authentication request. This verification process includes checking whether the user's identity information is complete, whether the format is correct, and whether the password meets the requirements. For example, the server will confirm whether the username and password match the information stored in the system, or check whether the SM3 national cryptographic algorithm information in the request meets expectations.

[0068] If a user authentication request is invalid, such as a non-existent username, an incorrect password, or an incorrect request format, the server immediately generates an authentication failure message and returns it to the user, informing them that the authentication failed. The server will also provide relevant error messages or suggestions so that the user can make the necessary adjustments.

[0069] However, if the user authentication request is valid, the server proceeds to the next step by generating a random string. This string is unique in each authentication process, increasing security. The server then sends this random string to the user's client, where it will be used in subsequent authentication processes, such as hash comparisons with the user's data.

[0070] S103, The server receives the hash result of the random string from the user. The hash result of the random string is obtained by the user using the preset national cryptographic algorithm SM3 to perform a hash operation on the random string.

[0071] In step S103, the server receives the hash result of a random string from the user. The hash result of the random string from the user is obtained by the user using the preset national cryptographic algorithm SM3 to perform a hash operation on the random string previously sent by the server.

[0072] In detail, when the client receives a random string from the server, it hashes the string using the locally pre-installed SM3 national cryptographic algorithm. Hash operations are a method of converting data of arbitrary length into data of fixed length. They are irreversible, meaning the original data cannot be deduced from the hash value. This characteristic makes hash operations widely used in data integrity verification and password storage.

[0073] In this step, the SM3 national cryptographic algorithm, as a secure hash algorithm, ensures that the hash result has a high degree of security and uniqueness. After the user completes the hash calculation, it sends the result back to the server.

[0074] After receiving the hash calculation result, the server will perform subsequent verification processes, such as comparing it with its own calculated hash value, to confirm the user's identity and data integrity. If the two match, it means the user is legitimate and the data has not been tampered with during transmission.

[0075] S104, the server verifies the validity of the hash result of the random string from the user. If the validity verification fails, a validity verification failure message is generated. If the validity verification passes, the server uses the same national cryptographic algorithm SM3 as the user to perform a hash operation on the random string, generates an expected hash value, and compares the expected hash value with the hash result of the random string. If the expected hash value is the same as the hash result of the random string, the authentication is successful, the user's password is correct, and the hash operation result is correct. If the expected hash value is different from the hash result of the random string, the authentication fails, the user's password is incorrect, and the hash operation result has been tampered with.

[0076] The server checks whether the received hash result conforms to the expected format and length, and whether it was received within a reasonable timeframe; this is the initial validity verification. If this verification fails, such as due to an incorrect data format or a timeout, the server will generate a validity verification failure message and may terminate the authentication process.

[0077] If the initial verification passes, the server performs a deeper verification. It uses the same SM3 cryptographic algorithm as the user client to hash the random string previously sent to the user client, generating an expected hash value. This expected hash value, calculated by the server based on the random string and the SM3 algorithm, is used to compare with the hash result sent by the user client.

[0078] Next, the server compares the expected hash value with the hash result of the random string sent by the user. If they match, it means the password used by the user is correct, and the hash result is also correct, indicating successful authentication. The server then allows the user to access protected resources or services.

[0079] However, authentication will fail if the expected hash value does not match the hash result sent by the user. This means the user entered an incorrect password, or the hash result was tampered with during transmission. In this case, the server will reject the user's access request and may generate an error message to notify the user.

[0080] S105. After successful authentication, the server sends an authentication success message to the client and generates a session token.

[0081] Once authentication is successful—that is, the server verifies that the hash value sent by the user matches the expected hash value calculated by the server—the server immediately sends an authentication success message to the client. This message is typically a simple notification informing the user that their identity has been successfully verified and they can now access protected services or resources. The server then generates a session token. A session token is a unique string used to identify and verify a user's session. It allows the server to track and identify authenticated users and ensure that only these users can access restricted resources. Session tokens are usually generated after a user is authenticated and remain valid throughout the user's session.

[0082] Session tokens can contain information about a user's session, such as the user's identity, the session's start time, and expiration time. Servers use a secure method to generate and store these tokens to ensure they cannot be forged or tampered with.

[0083] Once a session token is generated, it is sent to the client and attached to subsequent requests by the client to prove their identity and the validity of their session. This allows the server to identify and authorize user requests without needing to perform a full authentication process every time.

[0084] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S101, which comprises:

[0085] The server starts a listening mechanism to wait for client authentication request data. The client's authentication request data is transmitted to the server over the network.

[0086] When the server receives data, it parses the received data and extracts the user identity information, which includes the username and password. The username and password are the credentials entered by the client and used to verify the user's identity.

[0087] The results obtained from parsing the received data also include the parameter settings of the SM3 national cryptographic algorithm, the indicator of the encryption key, and the data encryption mode.

[0088] First, the server will start a listening mechanism to wait for authentication request data from the client. This is to ensure that the server can respond to the client's authentication needs in a timely manner.

[0089] Secondly, when a client sends authentication request data, this data is transmitted over the network to the server. Upon receiving the data, the server parses it to extract crucial user identity information, including the username and password. This information serves as credentials entered by the client to verify the user's identity.

[0090] Furthermore, during data parsing, the server also processes parameter settings related to the SM3 national cryptographic algorithm, including encryption key indicators and data encryption modes. These parameters are crucial for the subsequent authentication process, ensuring the security and accuracy of authentication.

[0091] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S102, which comprises:

[0092] After receiving a user authentication request, the server verifies the validity of the user authentication request. The verification of the validity of the user authentication request includes checking the format, signature and timestamp information of the request. If the information contained in the user authentication request does not conform to the predetermined format or the signature verification fails, the user authentication request will be regarded as invalid.

[0093] If the server's user authentication request is invalid, the user authentication process will stop and a user authentication failure message will be generated, which will include an error code.

[0094] If the user authentication request is valid, a random string is generated. The server sends the generated random string to the user's client via a network connection. After receiving the random string, the user's client processes it using a predetermined algorithm and returns the processing result to the server.

[0095] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes the following aspects in step S102: the processing flow of the server after receiving the user identity authentication request includes the following:

[0096] Verification of the validity of user authentication requests:

[0097] The server first verifies the validity of the authentication request sent by the user.

[0098] The verification process includes checking whether the request format is correct, whether the signature is valid, and whether the timestamp information is compliant.

[0099] If any information in the request does not meet the predefined requirements (e.g., incorrect formatting, signature verification failure, etc.), the request is considered invalid.

[0100] Handling invalid requests:

[0101] If a user authentication request is invalid, the server will stop processing the request.

[0102] At the same time, the server will generate a user authentication failure message, which usually contains an error code so that users or administrators can identify the reason for the failure.

[0103] Handling of valid requests:

[0104] If the user's authentication request passes the verification, the server will generate a random string, which will be sent to the user's client via a network connection for subsequent verification processes.

[0105] After receiving the random string, the client will process it using a predetermined algorithm (i.e., the national cryptographic algorithm SM3) and return the processing result (i.e., the hash operation result) to the server.

[0106] This process ensures that only valid authentication requests are processed, enhancing the security and accuracy of the authentication process. Simultaneously, by generating a random string and requesting the user to return its hash value, the server can verify whether the user actually possesses the correct key (or password), thus confirming the user's identity.

[0107] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S103, which comprises:

[0108] The server listens for and receives data packets from the user through the established network connection. The data packets from the user include the result obtained by the user using the preset national cryptographic algorithm SM3 to perform a hash operation on the random string previously sent by the server.

[0109] The data packets from the user end are parsed to extract the hash operation results. The parsing process includes decrypting the data packets, verifying the integrity of the data packets, and extracting the hash operation results from the data packets.

[0110] Specifically, in the lightweight authentication method based on the national cryptographic algorithm SM3 described in this invention, step S103 details how the server receives and processes data packets from the user terminal. This process includes the following key steps:

[0111] Listening for and receiving data packets: The server continuously listens for data transmission from the user's end through the established network connection. When a data packet is detected to be arriving, the server receives the data packet.

[0112] Data packet content: The data packet sent by the user contains the result of a hash operation on the random string previously sent by the server. This hash operation is performed using the pre-set national cryptographic algorithm SM3.

[0113] Parsing data packets: After receiving a data packet, the server first parses it. The parsing process involves the following key sub-steps:

[0114] Decryption: If the data packet is encrypted during transmission, the server needs to decrypt it first.

[0115] Integrity verification: The server verifies the integrity of data packets to ensure that they have not been tampered with during transmission.

[0116] Extracting hash calculation results: After confirming the integrity and authenticity of the data packet, the server extracts the hash calculation results calculated by the user from the data packet.

[0117] Through these steps, the server can securely and accurately obtain the results of the user's hash operation on the random string, providing necessary data support for the subsequent authentication process.

[0118] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S104, which comprises:

[0119] The server verifies the validity of the hash result of the random string sent by the client. The validity verification of the hash result includes checking whether the hash value meets the expected format and length and whether it meets the output characteristics of the national cryptographic algorithm SM3. If the hash result is abnormal, the server determines that the validity verification has failed.

[0120] If the hash operation result passes the validity verification, the server will use the same national cryptographic algorithm SM3 as the client to perform a hash operation on the random string sent to the client, generate the expected hash value, and then compare the expected hash value with the hash operation result sent by the client.

[0121] In step S104, the server performs a rigorous validity verification on the hash result of the random string sent by the user. This verification process includes checking whether the hash value conforms to the expected format and length, and whether it meets the output characteristics of the Chinese national cryptographic algorithm SM3. This is to ensure that the received hash value is legitimate and has not been tampered with.

[0122] If any anomalies are found in the hash operation result, such as incorrect format, length mismatch, or non-compliance with the SM3 algorithm output specification, the server will immediately determine that the validity verification of the hash operation result has failed. This is a security mechanism to prevent illegal or tampered hash values ​​from being accepted.

[0123] However, if the hash result passes the initial validity verification, the server will proceed to the next step. It will use the same national cryptographic algorithm SM3 as the client to perform a hash operation on the random string previously sent to the client, in order to generate an expected hash value. This expected hash value is calculated by the server based on the random string and the national cryptographic algorithm SM3, and is used to compare it with the hash result sent by the client.

[0124] The server then compares the generated expected hash value with the hash result sent by the user. If they match, it means the user's password is correct and the hash result has not been tampered with, and authentication is successful. Conversely, if they do not match, it means the user's password is incorrect or the hash result has been tampered with during transmission, and authentication will fail.

[0125] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S104, which comprises:

[0126] If the expected hash value is the same as the hash result sent by the user, then the user authentication is successful, the password entered by the user is correct, and the result of the hash calculation has not been tampered with.

[0127] If the expected hash value is different from the hash result sent by the user, then the password entered by the user is incorrect, or the result of the hash operation has been tampered with during transmission.

[0128] In step S104, the server verifies the hash result sent by the user. If the expected hash value matches the hash result sent by the user, it means that the user authentication is successful, the password entered by the user is correct, and the hash result has not been tampered with during transmission.

[0129] However, if the expected hash value does not match the hash result sent by the user, it means that the user entered an incorrect password, or that the hash result was tampered with during data transmission. In this case, authentication will fail.

[0130] In summary, step S104 is a crucial step in the identity authentication process. It verifies the user's identity and password by comparing the expected hash value generated by the server with the hash calculation result sent by the user, thereby ensuring the security and accuracy of the entire authentication process.

[0131] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S104, which comprises:

[0132] Random strings generated during the server's data collection process and the results of random string hash operations;

[0133] The collected random strings and the results of random string hash operations are matched with the data generated by the server and the data generated by the user to obtain a key data set;

[0134] The data in the key data set is stored in the blockchain in real time, and the hash value corresponding to the key data in the key data set is generated.

[0135] The search tags for the key data set are obtained by establishing search labels between the hash values ​​corresponding to the key data in the key data set and the key data in the key data set.

[0136] First, the server collects random strings generated throughout the data flow and the hash results of these random strings. This data is key information in the identity authentication process and is crucial for verifying the user's identity.

[0137] Next, the server matches the collected random string, hash calculation result, server-generated data, and user-generated data to form a complete key data set. This set includes not only user input but also server-generated data, thus forming a comprehensive authentication record.

[0138] To further enhance data security, the server stores this key data set on the blockchain in real time. The decentralized and immutable characteristics of blockchain technology ensure the security and trustworthiness of this critical data, making any data tampering immediately detectable.

[0139] On the blockchain, the server also generates a corresponding hash value for each key data within each key data set. The uniqueness of the hash value ensures that any minor change to the data will be immediately reflected in the hash value, thus providing an effective data integrity verification mechanism.

[0140] Finally, in order to facilitate the quick and accurate retrieval of relevant key data and its hash value when needed, the server will create a retrieval tag for each key data and its corresponding hash value in the key data set, forming a key data set retrieval tag.

[0141] These steps together constitute a secure and reliable identity authentication process. In particular, the introduction of blockchain technology not only ensures data security but also greatly improves data credibility, making the entire identity authentication process more robust and reliable.

[0142] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S104, which comprises:

[0143] Set the hash value update time for the key data set, and update the hash value of the key data in the key data set according to the set hash value update time to obtain the updated hash value data of the key data set.

[0144] Record the hash value of the key data set after each update to obtain the key data hash value update record;

[0145] The key data hash value is updated and stored in the blockchain to obtain the hash value corresponding to the key data hash value.

[0146] First, the system sets a fixed time period to periodically update the hash values ​​of all key data in the key data set. The purpose of this is to continuously enhance the security of the system and prevent security risks that may arise from using the same hash value for a long time.

[0147] At each set update time, the system will traverse all key data in the key data set and recalculate their hash values ​​using the national cryptographic algorithm SM3 to ensure that the hash values ​​of the key data are always up-to-date.

[0148] Each time the hash value is updated, the new key data set hash value is recorded in detail, forming a key data hash value update record. These records are crucial for subsequent verification and security auditing of the system.

[0149] To ensure the security and immutability of these hash value records, this invention cleverly stores the key data hash value update records on the blockchain. The distributed ledger nature of blockchain technology means that any attempt to tamper with the records will be detected by the system immediately, thereby ensuring the absolute integrity and high credibility of the data.

[0150] Finally, it is worth mentioning that what is stored on the blockchain is not only the update record of hash values, but also the original data identifiers corresponding to these hash values. In this way, when necessary, the system can quickly retrieve the key data related to a specific hash value, improving the efficiency and accuracy of data retrieval.

[0151] This mechanism significantly enhances the security and data protection capabilities of the identity authentication system, ensuring comprehensive protection of key data during both transmission and storage.

[0152] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S104, which comprises:

[0153] The server is configured with a fingerprint recognition mechanism, a dynamic token recognition mechanism, or a biometric recognition mechanism;

[0154] The server receives and processes dynamic login requests from users using verification codes generated by fingerprint recognition or dynamic tokens.

[0155] Match the corresponding hash value during the data flow process based on the dynamic login request;

[0156] The hash value corresponding to the data flow process is compared with the login information currently submitted by the user. If the comparison results match, the user is allowed to log in; if the comparison results do not match, the user is denied login.

[0157] First, the server is configured with these additional security mechanisms, such as fingerprint recognition, dynamic token recognition, or biometrics, to provide users with multi-layered authentication methods.

[0158] When a user attempts to log in, the server receives and processes the verification code they generate using methods such as fingerprint recognition or dynamic tokens. These verification codes are dynamically generated, increasing the security of the login process.

[0159] Next, the server matches the corresponding hash value generated in the previous data flow process with the dynamic login request submitted by the user. This step ensures that the login information submitted by the user is consistent with the information generated in the previous identity authentication process.

[0160] Then, the server compares the hash value corresponding to the data flow with the login information currently submitted by the user. The submitted login information includes not only the username and password but also a dynamic verification code.

[0161] Finally, if the comparison results match, it means the user's identity has been effectively verified, and the server allows the user to log in to the system. Conversely, if the comparison results do not match, it means the user's identity has failed verification, and the server will reject the user's login request.

[0162] This multi-factor authentication mechanism enhances the security of identity verification. Even if the hash value is intercepted or tampered with during transmission, attackers cannot bypass other security verification steps using only the hash value. Therefore, this comprehensive authentication method effectively protects the overall security of the system.

[0163] Specifically, the lightweight identity authentication method based on the national cryptographic algorithm SM3 described in this invention includes step S101, which comprises:

[0164] Establish a relationship between the user's random string and the key data hash value update record;

[0165] When comparing the corresponding hash value with the login information currently submitted by the user during the data flow process, the key data hash value update record that matches the corresponding hash value during the data flow process is retrieved.

[0166] If the corresponding hash value in the data flow process exists in the key data hash value update record, then obtain the time information of the corresponding hash value in the data flow process.

[0167] If the time information of the corresponding hash value during the data flow is consistent with the data time information in the key data hash value update record, then the corresponding hash value has not been tampered with during the data flow.

[0168] First, the system establishes a correlation between the random string sent by the user and the updated hash value of the key data. This is to ensure that every random string has a corresponding record available for subsequent querying and verification when its hash value is updated.

[0169] Next, during the data flow process, when it is necessary to compare the hash value with the login information currently submitted by the user, the system will retrieve the key data hash value update record that matches the corresponding hash value in the data flow. This is an important step in realizing hash value verification and time consistency check.

[0170] Then, the system checks whether the corresponding hash value in the data flow exists in the key data hash value update record. If it exists, the system further obtains the time information of the hash value to ensure that the hash value for subsequent verification is known and recorded by the system.

[0171] Finally, the system verifies whether the time information of the corresponding hash value in the data flow matches the corresponding data time information in the key data hash value update record. If they match, the system determines that the corresponding hash value in the data flow has not been tampered with. This is a crucial step in verifying the integrity and security of the hash value.

[0172] To address the security issues that may arise from the leakage of the SM3 national cryptographic algorithm key during multi-terminal data transmission, this invention proposes a lightweight identity authentication method based on the SM3 algorithm, which effectively improves the security and reliability of the identity authentication process.

[0173] First, this invention introduces a random challenge string mechanism. During each authentication, the server generates a temporary random string and sends it to the user. The user uses this random string and the pre-set national cryptographic algorithm SM3 to perform a hash operation, and then returns the result to the server. This avoids directly using a fixed key for data transmission, thereby reducing the risk of key leakage.

[0174] Secondly, the present invention adopts a two-way verification mechanism. The server not only receives the hash value returned by the user, but also performs a hash operation on the same random string to generate the expected hash value. By comparing the two hash values, the server can verify whether the calculation result of the user is correct and detect whether the data has been tampered with during transmission.

[0175] Furthermore, this invention enhances security by incorporating dynamic factors. Each authentication process is based on different inputs, making each authentication session unique and difficult to predict or replicate.

[0176] Meanwhile, this invention incorporates blockchain technology to ensure the authenticity and integrity of the data. The server stores the data generated during the authentication process on the blockchain in real time, using the immutability of the blockchain to prevent the data from being modified.

[0177] Finally, the present invention also incorporates mechanisms such as configuration fingerprint recognition, dynamic token recognition, or biometrics as additional authentication steps to further enhance security.

[0178] Through the above comprehensive measures, this invention effectively solves the security problems that may be caused by the leakage of the SM3 national cryptographic algorithm key, and provides users with a more secure and reliable identity authentication method during multi-terminal data transmission.

[0179] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations. The above-described embodiments of this invention do not constitute a limitation on the scope of protection of this invention.

Claims

1. A lightweight authentication method based on the Chinese national cryptographic algorithm SM3, characterized in that, include: S101, The server obtains a user authentication request. The user authentication request includes user identity information and SM3 national cryptographic algorithm information. The user identity information includes the username and the user password. S102, after the server obtains the user authentication request, it verifies the validity of the user authentication request. If the user authentication request is invalid, it generates an authentication failure message. If the user authentication request is valid, the server generates a random string and sends it to the user. S103, The server receives the hash result of the random string from the user. The hash result of the random string is obtained by the user using the preset national cryptographic algorithm SM3 to perform a hash operation on the random string. S104, the server verifies the validity of the hash result of the random string from the user. If the validity verification fails, a validity verification failure message is generated. If the validity verification passes, the server uses the same national cryptographic algorithm SM3 as the user to perform a hash operation on the random string, generates an expected hash value, and compares the expected hash value with the hash result of the random string. If the expected hash value is the same as the hash result of the random string, the authentication is successful, the user's password is correct, and the hash operation result is correct. If the expected hash value is different from the hash result of the random string, the authentication fails, the user's password is incorrect, and the hash operation result has been tampered with. S105, After successful authentication, the server sends an authentication success message to the client and generates a session token; Step S104 includes: Random strings generated during the server's data collection process and the results of random string hash operations; The collected random strings and the results of random string hash operations are matched with the data generated by the server and the data generated by the user to obtain a key data set; The data in the key data set is stored in the blockchain in real time, and the hash value corresponding to the key data in the key data set is generated. The search tags for the key data set are obtained by establishing search labels between the hash values ​​corresponding to the key data in the key data set and the key data in the key data set. Step S104 includes: Set the hash value update time for the key data set, and update the hash value of the key data in the key data set according to the set hash value update time to obtain the updated hash value data of the key data set. Record the hash value of the key data set after each update to obtain the key data hash value update record; The hash value of the key data is updated and recorded in the blockchain for storage, thus obtaining the hash value corresponding to the hash value of the key data. Step S101 includes: Establish a relationship between the user's random string and the key data hash value update record; When comparing the corresponding hash value with the login information currently submitted by the user during the data flow process, the key data hash value update record that matches the corresponding hash value during the data flow process is retrieved. If the corresponding hash value in the data flow process exists in the key data hash value update record, then obtain the time information of the corresponding hash value in the data flow process. If the time information of the corresponding hash value during the data flow is consistent with the data time information in the key data hash value update record, then the corresponding hash value has not been tampered with during the data flow.

2. The lightweight identity authentication method based on the national cryptographic algorithm SM3 as described in claim 1, characterized in that, Step S101 includes: The server starts a listening mechanism to wait for client authentication request data. The client's authentication request data is transmitted to the server over the network. When the server receives data, it parses the received data and extracts the user identity information, which includes the username and password. The username and password are the credentials entered by the client and used to verify the user's identity. The results obtained from parsing the received data also include the parameter settings of the SM3 national cryptographic algorithm, the indicator of the encryption key, and the data encryption mode.

3. The lightweight identity authentication method based on the national cryptographic algorithm SM3 as described in claim 1, characterized in that, Step S102 includes: After receiving a user authentication request, the server verifies the validity of the user authentication request. The verification of the validity of the user authentication request includes checking the format, signature and timestamp information of the request. If the information contained in the user authentication request does not conform to the predetermined format or the signature verification fails, the user authentication request will be regarded as invalid. If the server's user authentication request is invalid, the user authentication process will stop and a user authentication failure message will be generated, which will include an error code. If the user authentication request is valid, a random string is generated. The server sends the generated random string to the user's client via a network connection. After receiving the random string, the user's client processes it using a predetermined algorithm and returns the processing result to the server.

4. The lightweight identity authentication method based on the national cryptographic algorithm SM3 as described in claim 1, characterized in that, Step S103 includes: The server listens for and receives data packets from the user through the established network connection. The data packets from the user include the result obtained by the user using the preset national cryptographic algorithm SM3 to perform a hash operation on the random string previously sent by the server. The data packets from the user end are parsed to extract the hash operation results. The parsing process includes decrypting the data packets, verifying the integrity of the data packets, and extracting the hash operation results from the data packets.

5. The lightweight identity authentication method based on the national cryptographic algorithm SM3 as described in claim 1, characterized in that, Step S104 includes: The server verifies the validity of the hash result of the random string sent by the client. The validity verification of the hash result includes checking whether the hash value meets the expected format and length and whether it meets the output characteristics of the national cryptographic algorithm SM3. If the hash result is abnormal, the server determines that the validity verification has failed. If the hash operation result passes the validity verification, the server will use the same national cryptographic algorithm SM3 as the client to perform a hash operation on the random string sent to the client, generate the expected hash value, and then compare the expected hash value with the hash operation result sent by the client.

6. The lightweight identity authentication method based on the national cryptographic algorithm SM3 as described in claim 5, characterized in that, Step S104 includes: If the expected hash value is the same as the hash result sent by the user, then the user authentication is successful, the password entered by the user is correct, and the result of the hash calculation has not been tampered with. If the expected hash value is different from the hash result sent by the user, then the password entered by the user is incorrect, or the result of the hash operation has been tampered with during transmission.

7. The lightweight identity authentication method based on the national cryptographic algorithm SM3 as described in claim 1, characterized in that, Step S104 includes: The server is configured with a fingerprint recognition mechanism, a dynamic token recognition mechanism, or a biometric recognition mechanism; The server receives and processes dynamic login requests from users using verification codes generated by fingerprint recognition or dynamic tokens. Match the corresponding hash value during the data flow process based on the dynamic login request; The hash value corresponding to the data flow process is compared with the login information currently submitted by the user. If the comparison results match, the user is allowed to log in; if the comparison results do not match, the user is denied login.

Images