Multi-dimensional observation chain for enhancing token authentication security

Abstract

The invention provides a multi-dimensional observation chain for enhancing token authentication security. The multi-dimensional observation chain comprises the following steps: S1, a user; s2, an identity authentication component; s3, a token signing component; s4, a service provider; the invention provides a multi-dimensional observation chain for enhancing the security of token authentication, and through the provided multi-dimensional observation chain for enhancing the security of token authentication, an observation point collects and uploads metadata related to a token at each role of token authentication and verifies the validity of the metadata according to a data dependency relationship among the metadata. The multi-dimensional observation chain judges the validity of the uploaded metadata according to a data dependency relationship set among the uploaded metadata, and judges whether the identity token is valid or not based on verification results and authentication process integrity of each node and the observation chain on the validity of the metadata; therefore, the token authentication model is prevented from being threatened by credential forgery attack.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security, and in particular to a multi-dimensional observation chain that enhances the security of token authentication. Background Art

[0002] Due to the deployment and popularization of new computing models and network architectures such as cloud computing, cloud native, and the Internet of Things, access authentication mechanisms that use tokens as credentials are widely used in high-frequency cross-domain access scenarios. For example, in high-frequency cross-domain access scenarios such as cross-domain federated identity authentication, cloud resources and edge devices, microservices, and distributed cluster nodes. However, this type of access authentication mechanism that uses tokens as credentials faces the threat of forged credential attacks. At present, there is no relevant technical solution that can strengthen the security of the token authentication mechanism and protect it from the threat of forged credential attacks.

[0003] Currently, no technology exists to detect and respond to access tokens forged through credential forgery attacks.

[0004] Reason: When a user uses an access token to request services / resources from a service provider, the service provider uses the public key corresponding to the signing key of the token signer to verify the legitimacy of the access token. In a forged credential attack, the attacker steals the signing key of the token signer through unknown technical means, and uses this signing key to sign a forged access token. Since the signing key is legal, when the service provider uses the public key to verify the forged access token, it will consider the forged token to be legal. That is, the existing public key-based access token verification mechanism cannot verify the legitimacy of forged access tokens issued by stolen signing keys. The existing access token verification mechanism cannot detect the legitimacy of access tokens forged by forged credential attacks.

[0005] Therefore, it is necessary to provide a multi-dimensional observation chain that enhances the security of token authentication to solve the above technical problems. Summary of the invention

[0006] The present invention provides a multi-dimensional observation chain for strengthening the security of token authentication, solving the problem that the existing access token verification mechanism cannot detect the legitimacy of the access token forged by forged credential attacks.

[0007] In order to solve the above technical problems, the present invention provides a multi-dimensional observation chain for enhancing the security of token authentication, comprising the following steps:

[0008] S1: User, acting as a token applicant and token user, submits a token application request to the token signing component, provides credentials to the identity authentication component to prove that it is a legitimate user, and uses the identity token to verify the identity of the service provider and request related services;

[0009] S2: Identity authentication component, which verifies the legitimacy of the user's identity according to the security policy it implements (for example, a multi-factor authentication policy), and notifies the token signing component to sign the corresponding identity token for this user;

[0010] S3: Token signing component. After the identity authentication component confirms the user's legal identity, the token signing component uses the signature key to sign and generate an identity token based on the user's identity, requested service scope, user permissions, token application time and other metadata;

[0011] S4: Service provider, acting as a token verifier, is responsible for redirecting the user to the identity authentication component to implement the token application. At the same time, the service provider uses the public key of the signing key to verify the legitimacy of the token provided by the user.

[0012] Preferably, the user attempts to access the required service on the client; the service provider redirects the user to the identity authentication component, and observation point 1 observes and records metadata information such as the client ID, request service address, request service ID, redirection address, service request time, etc. At the same time, observation point 1 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0013] Preferably, the user provides credentials to the identity authentication component to perform identity authentication according to the security policy, and observation point 2 observes and records metadata information such as user name, user identity, user authority, user credentials, user authentication time, etc. At the same time, observation point 2 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0014] Preferably, after the identity authentication component passes, the token signing component uses a signature key to sign the identity token based on metadata such as the service requested by the user and user identity. Observation point 3 observes and records metadata information such as user identity, token ID, token permissions, token scope, token signing time, etc. At the same time, observation point 3 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0015] Preferably, the token signing component returns the identity token to the user.

[0016] Preferably, the user uses this access token to access the service provider, and the service provider uses the public key corresponding to the signature key to verify the validity of the access token. Observation point 4 observes and records metadata information such as client ID, user identity, token ID, request service ID, token verification time, etc. At the same time, observation point 4 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0017] Preferably, the multidimensional observation chain verifies the validity of the metadata and the integrity of the token authentication process based on the data dependency relationship between the metadata. If the verification result of the multidimensional observation chain or any observation point is abnormal, an alarm is issued and the authentication process is interrupted.

[0018] Preferably, the multidimensional observation chain consists of a number of observation points, and the number of observation points is less than or equal to the number of different roles in the token authentication model. For example, when the number of roles in the token authentication model is n, the corresponding number of observation points in the multidimensional observation chain is m, and m≦n.

[0019] Preferably, the validity verification of the metadata is related to the data dependency relationship between the metadata, and the data dependency relationship varies according to the token authentication model used. For example, the four metadata items in the example, client ID (observation point 1), user name (observation point 2), user identity (observation point 3), and client ID (observation point 4) are associated, and the client ID and the user name bound to it are in a one-to-one correspondence, the user name and the user identity are also in a one-to-one correspondence, the client ID recorded in observation point 1 and the client ID recorded in observation point 4 should be the same. Only when the relationship between these four matches can the verification of the multi-dimensional observation chain be passed.

[0020] Preferably, the four metadata in the example, service request time (observation point 1), user authentication time (observation point 2), token signing time (observation point 3), and token verification time (observation point 4) are related, and whether there is an anomaly at each time point of the token authentication process can be evaluated by specifying an appropriate security confidence function y = f(x1, x2, x3, x4, ...), that is, y = f(service request time, user authentication time, token signing time, token authentication time), and the result y should be within the specified confidence interval.

[0021] Compared with the related art, the multi-dimensional observation chain for enhancing the security of token authentication provided by the present invention has the following beneficial effects:

[0022] The present invention provides a multi-dimensional observation chain that enhances the security of token authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1A schematic diagram of the structure of a multi-dimensional observation chain for enhancing the security of token authentication provided by the present invention;

[0024] Figure 2 for Figure 1 The diagram shows how to extract metadata related to the identity token from an observation point. DETAILED DESCRIPTION

[0025] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.

[0026] Please refer to Figure 1 and Figure 2 ,in, Figure 1 A schematic diagram of the structure of a multi-dimensional observation chain for enhancing the security of token authentication provided by the present invention; Figure 2 for Figure 1 The schematic diagram of extracting metadata related to identity tokens from observation points shown. A multi-dimensional observation chain that strengthens the security of token authentication includes: S1: a user, acting as a token applicant and a token user, submits a token application request to a token signing component, provides credentials to the identity authentication component to prove that it is a legitimate user, and uses the identity token to verify the identity of the service provider and request related services;

[0027] S2: Identity authentication component, which verifies the legitimacy of the user's identity according to the security policy it implements (for example, a multi-factor authentication policy), and notifies the token signing component to sign the corresponding identity token for this user;

[0028] S3: Token signing component. After the identity authentication component confirms the user's legal identity, the token signing component uses the signature key to sign and generate an identity token based on the user's identity, requested service scope, user permissions, token application time and other metadata;

[0029] S4: Service provider, acting as a token verifier, is responsible for redirecting the user to the identity authentication component to implement the token application. At the same time, the service provider uses the public key of the signing key to verify the legitimacy of the token provided by the user.

[0030] The user attempts to access the required service on the client; the service provider redirects the user to the identity authentication component, and observation point 1 observes and records metadata information such as client ID, request service address, request service ID, redirection address, service request time, etc. At the same time, observation point 1 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0031] The user provides credentials to the identity authentication component according to the security policy to perform identity authentication. Observation point 2 observes and records metadata information such as user name, user identity, user authority, user credentials, user authentication time, etc. At the same time, observation point 2 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0032] After the identity authentication component passes, the token signing component uses the signature key to sign the identity token based on the service requested by the user, user identity and other metadata. Observation point 3 observes and records metadata information such as user identity, token ID, token permissions, token scope, token signing time, etc. At the same time, observation point 3 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0033] The token signing component returns the identity token to the user.

[0034] The user uses this access token to access the service provider, and the service provider uses the public key corresponding to the signature key to verify the validity of the access token. Observation point 4 observes and records metadata information such as client ID, user identity, token ID, request service ID, token verification time, etc. At the same time, observation point 4 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

[0035] The multidimensional observation chain verifies the validity of the metadata and the integrity of the token authentication process according to the data dependency relationship between the metadata. If the verification result of the multidimensional observation chain or any observation point is abnormal, an alarm is issued and the authentication process is interrupted.

[0036] The multidimensional observation chain consists of a number of observation points, and the number of observation points is less than or equal to the number of different roles in the token authentication model. For example, when the number of roles in the token authentication model is n, the corresponding number of observation points in the multidimensional observation chain is m, and m≦n.

[0037] The validity verification of the metadata is related to the data dependency between the metadata. The data dependency varies according to the token authentication model used. For example, the four metadata in the example, client ID (observation point 1), user name (observation point 2), user identity (observation point 3), and client ID (observation point 4) are associated. The client ID and the user name bound to it are in a one-to-one correspondence, the user name and the user identity are also in a one-to-one correspondence, the client ID recorded in observation point 1 and the client ID recorded in observation point 4 should be the same. Only when the relationship between these four matches can the verification of the multi-dimensional observation chain be passed.

[0038] The four metadata in the example, service request time (observation point 1), user authentication time (observation point 2), token signing time (observation point 3), and token verification time (observation point 4) are related. The appropriate security confidence function y=f(x1, x2, x3, x4, ...) can be specified to evaluate whether there are anomalies at each time point in the token authentication process, that is, y=f(service request time, user authentication time, token signing time, token authentication time), and the result y should be within the specified confidence interval.

[0039] The present invention conducts multi-dimensional and multi-faceted observations on relevant metadata in multiple links of the token authentication model, such as various roles, token application, signing, transmission, and verification, and judges the legitimacy of the identity token based on the data dependency relationship between the metadata and the integrity of the token authentication process, thus filling the gap in strengthening the token authentication model to defend against forged credential attacks.

[0040] An example of the metadata types collected by the four observation points of the multi-dimensional observation chain. The metadata types collected by the observation points can be adjusted according to the token authentication model and the characteristics of the applied business scenarios, including but not limited to Figure 2 Example of metadata shown.

[0041] The observation points on the multidimensional observation chain are used to observe and collect metadata related to identity tokens in related links such as identity token application, signing, transmission, and verification. The multidimensional observation chain transmits the observed metadata between different observation points or associates the observed metadata at each observation point, and verifies the validity of each metadata and the integrity of the token authentication process based on the data dependency relationship between different metadata.

[0042] The functions of the multidimensional observation chain include but are not limited to:

[0043] Transfer metadata collected by different roles between different observation points;

[0044] Associate the metadata collected at each observation point and verify the validity of the metadata based on the data dependency between different metadata;

[0045] Receive the verification results of metadata validity from each observation point, and determine whether the identity authentication process is secure based on the verification results returned by each observation point;

[0046] Verify the integrity of the authentication process for the token authentication model.

[0047] The functions of observation points include but are not limited to:

[0048] Observe and collect metadata related to identity tokens generated, received, processed, and transmitted by its corresponding role in the token authentication model;

[0049] Receive metadata collected from other observation points in the multidimensional observation chain;

[0050] The validity of metadata is verified according to the data dependency relationship between different metadata, and the verification results are returned to the multidimensional observation chain.

[0051] The working principle of a multi-dimensional observation chain for enhancing token authentication security provided by the present invention is as follows:

[0052] When working, first the user tries to access the required service on the client side;

[0053] The service provider redirects the user to the identity authentication component, and observation point 1 observes and records metadata information such as client ID, request service address, request service ID, redirect address, service request time, etc. At the same time, observation point 1 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies;

[0054] The user provides credentials to the identity authentication component according to the security policy to perform identity authentication. Observation point 2 observes and records metadata information such as user name, user identity, user authority, user credentials, and user authentication time. At the same time, observation point 2 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies;

[0055] After the identity authentication is passed, the token signing component uses the signature key to sign the identity token according to the metadata such as the service requested by the user and the user identity. Observation point 3 observes and records metadata information such as user identity, token ID, token authority, token scope, token signing time, etc. At the same time, observation point 3 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata according to the data dependency relationship;

[0056] The token signing component returns the identity token to the user;

[0057] The user uses this access token to access the service provider. The service provider uses the public key corresponding to the signature key to verify the validity of the access token. Observation point 4 observes and records metadata information such as client ID, user identity, token ID, request service ID, token verification time, etc. At the same time, observation point 4 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies;

[0058] The multidimensional observation chain verifies the validity of metadata and the integrity of the token authentication process based on the data dependency between metadata. If the verification result of the multidimensional observation chain or any observation point is abnormal, an alarm will be issued and the authentication process will be interrupted.

[0059] Compared with the related art, the multi-dimensional observation chain for enhancing the security of token authentication provided by the present invention has the following beneficial effects:

[0060] The present invention provides a multi-dimensional observation chain for strengthening the security of token authentication. Through the proposed multi-dimensional observation chain for strengthening the security of token authentication, observation points collect and upload metadata related to the token at various roles of token authentication and verify the validity of the metadata according to the data dependency relationship between the metadata. The multi-dimensional observation chain determines the validity of the metadata according to the data dependency relationship set between the uploaded metadata. The multi-dimensional observation chain determines whether the identity token is valid based on the verification results of the metadata validity of each node and the observation chain itself and the integrity of the authentication process, thereby preventing the token authentication model from the threat of credential forgery attacks. The present invention performs multi-dimensional and multi-directional observations on relevant metadata in multiple links such as various roles, token application, signing, transmission, and verification of the token authentication model, determines the legitimacy of the identity token according to the data dependency relationship between the metadata and the integrity of the token authentication process, and fills the gap in strengthening the token authentication model to defend against forged credential attacks.

[0061] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A multi-dimensional observation chain for enhancing the security of token authentication, characterized in that: The following steps are involved: S1: User, acting as a token applicant and token user, submits a token application request to the token signing component, provides credentials to the identity authentication component to prove that it is a legitimate user, and uses the identity token to verify the identity of the service provider and request related services; S2: Identity authentication component, which verifies the legitimacy of the user's identity according to the security policy it implements (for example, a multi-factor authentication policy), and notifies the token signing component to sign the corresponding identity token for this user; S3: Token signing component. After the identity authentication component confirms the user's legal identity, the token signing component uses the signature key to sign and generate an identity token based on the user's identity, requested service scope, user permissions, token application time and other metadata; S4: Service provider, acting as a token verifier, is responsible for redirecting the user to the identity authentication component to implement the token application. At the same time, the service provider uses the public key of the signing key to verify the legitimacy of the token provided by the user.

2. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 1, characterized in that: The user attempts to access the required service on the client; the service provider redirects the user to the identity authentication component, and observation point 1 observes and records metadata information such as client ID, request service address, request service ID, redirection address, service request time, etc. At the same time, observation point 1 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

3. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 1, characterized in that: The user provides credentials to the identity authentication component according to the security policy to perform identity authentication. Observation point 2 observes and records metadata information such as user name, user identity, user authority, user credentials, user authentication time, etc. At the same time, observation point 2 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

4. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 1, characterized in that: After the identity authentication component passes, the token signing component uses the signature key to sign the identity token based on the service requested by the user, user identity and other metadata. Observation point 3 observes and records metadata information such as user identity, token ID, token permissions, token scope, token signing time, etc. At the same time, observation point 3 uploads the metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of the metadata based on data dependencies.

5. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 1, characterized in that: The token signing component returns the identity token to the user.

6. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 1, characterized in that: The user uses this access token to access the service provider, and the service provider uses the public key corresponding to the signature key to verify the validity of the access token. Observation point 4 observes and records metadata information such as client ID, user identity, token ID, request service ID, token verification time, etc. At the same time, observation point 4 uploads metadata information to the multidimensional observation chain, receives other metadata from the multidimensional observation chain, and verifies the validity of metadata based on data dependencies.

7. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 2, characterized in that: The multidimensional observation chain verifies the validity of the metadata and the integrity of the token authentication process according to the data dependency relationship between the metadata. If the verification result of the multidimensional observation chain or any observation point is abnormal, an alarm is issued and the authentication process is interrupted.

8. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 2, characterized in that: The multidimensional observation chain consists of a number of observation points, and the number of observation points is less than or equal to the number of different roles in the token authentication model. For example, when the number of roles in the token authentication model is n, the corresponding number of observation points in the multidimensional observation chain is m, and m≦n.

9. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 6, characterized in that: The validity verification of the metadata is related to the data dependency between the metadata. The data dependency varies according to the token authentication model used. For example, the four metadata in the example, client ID (observation point 1), user name (observation point 2), user identity (observation point 3), and client ID (observation point 4) are associated. The client ID and the user name bound to it are in a one-to-one correspondence, the user name and the user identity are also in a one-to-one correspondence, the client ID recorded in observation point 1 and the client ID recorded in observation point 4 should be the same. Only when the relationship between these four matches can the verification of the multi-dimensional observation chain be passed.

10. A multi-dimensional observation chain for enhancing the security of token authentication according to claim 9, characterized in that: The four metadata in the example, service request time (observation point 1), user authentication time (observation point 2), token signing time (observation point 3), and token verification time (observation point 4) are related. The appropriate security confidence function y=f(x1, x2, x3, x4, ...) can be specified to evaluate whether there are anomalies at each time point in the token authentication process, that is, y=f(service request time, user authentication time, token signing time, token authentication time), and the result y should be within the specified confidence interval.

Images