Security authentication method based on PKI certificate

Abstract

The invention discloses a security authentication method based on a PKI certificate, and the method comprises the following steps: A, enabling a user and a certificate authority to generate an asymmetric secret key together, and enabling the certificate authority to carry out the behavior feature analysis of the user in the secret key generation process; b, the user sends a certificate registration request to a certificate issuing mechanism, and the certificate issuing mechanism carries out identity authentication on the user according to user behavior characteristics and certificate characteristics sent by the user; after the identity authentication is passed, the certificate issuing mechanism signs a public key and personal information of the user by using a private key of the certificate issuing mechanism, generates a digital certificate and sends the digital certificate to the user; and C, when the users communicate with each other, verifying the identity legality of the opposite side through the digital certificate, encrypting the information by the information sender by using the public key of the information receiver after the verification is passed, and decrypting the encrypted information by the information receiver by using the private key of the information receiver. Through adoption of the technical scheme, the security of the certificate issuing mechanism for identity verification of the user is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security authentication, and in particular to a security authentication method based on a PKI certificate. Background Art

[0002] PKI (Public Key Infrastructure) certificate authentication is a security mechanism that verifies identity in electronic communications through the use of digital certificates. Digital certificates are issued by certificate authorities, which need to authenticate users before issuing digital certificates. The existing verification process has many loopholes, making it easy for illegal users to obtain electronic certificates from certificate authorities. Summary of the invention

[0003] The purpose of the present invention is to provide a security authentication method based on PKI certificate to solve the problems raised in the above background technology.

[0004] A security authentication method based on a PKI certificate comprises the following steps:

[0005] A. The user and the certificate authority jointly generate an asymmetric key. During the key generation process, the certificate authority analyzes the user's behavioral characteristics.

[0006] B. The user sends a certificate registration request to the certificate authority, which authenticates the user based on the user's behavior characteristics and the credentials sent by the user. After the identity authentication is passed, the certificate authority uses its own private key to sign the user's public key and personal information, generates a digital certificate and sends it to the user;

[0007] C. When users communicate with each other, digital certificates are used to verify the legitimacy of the other party's identity. After the verification is passed, the sender of the information uses the public key of the receiver of the information to encrypt the information, and the receiver of the information uses his or her own private key to decrypt the encrypted information.

[0008] Preferably, the user and the certificate authority respectively send a random first data to each other, the certificate authority divides the received first data into blocks, encrypts each data block separately, generates a corresponding public key component, and then sends the public key component back to the user. The user uses the received first data to re-encrypt the public key component to obtain a public key. The user sends the public key to the certificate authority, and the user uses the public key to generate a corresponding private key.

[0009] Preferably, the certificate authority parses the encryption process of the public key and private key, selects the largest number of encryption threads in public key component encryption, public key secondary encryption and private key encryption as the basic parsing dimension, adds the time dimension to generate a parsing space, fills the encryption object data and encryption process data in all encryption threads into the parsing space, extracts features from the data in the parsing space, and obtains user behavior features.

[0010] Preferably, in the analytical space, the encrypted object data and the encrypted process data are organized into data packets according to their correlation and sorted in time series, and a correlation function is established between the encrypted object data and the encrypted process data in the same data packet; the projection data of each data packet on each analytical dimension except the time dimension is calculated, the projection data that is nonlinearly related to the corresponding correlation function is deleted, the remaining projection data are organized into a feature matrix, and the eigenvectors of the feature matrix are calculated as user behavior features.

[0011] Preferably, the credential features sent by the user are discretized and then mapped to the analytical space, and the vector product of the discretized credential feature data and the feature vector is calculated to obtain an authentication vector set. The user is authenticated based on the linear correlation index of the authentication vector set. When the linear correlation index of the authentication vector set is greater than a minimum threshold, the user passes the authentication.

[0012] Preferably, the authentication vectors of the authentication vector set are dimensionally reduced until all authentication vectors are linearly correlated, and the dimension after dimension reduction is divided by the original dimension of the authentication vector set to obtain a linear correlation index.

[0013] Preferably, the dimension reduction process of the authentication vector is to calculate the mapping function between the data of the dimension to be reduced and other dimensions, map the data of the dimension to be reduced to other dimensions according to the corresponding mapping function, and then use the original data of other dimensions and the mapped new data for weighted merging.

[0014] Preferably, in step C, the certificate issuing authority periodically verifies the issued digital certificates and their corresponding users.

[0015] By adopting the above technical solution, the security of the certificate issuing authority in authenticating users is improved.

[0016] Compared with the prior art, the beneficial effects of the present invention are: analyzing the user's behavioral characteristics during the key generation process, authenticating the user through the user's behavioral characteristics and the credential characteristics sent by the user, and effectively improving the security of the certificate authority's identity authentication of the user. DETAILED DESCRIPTION

[0017] Whether it is a personal / organization PKI certificate or a code signing PKI certificate, both involve user authentication. However, due to the timeliness of PKI authentication, most of the existing user authentication processes use simple credential authentication, which has poor security.

[0018] In order not to affect the timeliness of PKI authentication, the present invention collects user behavior features in the process of generating asymmetric keys, and then combines the user behavior features with the credential features sent by the user for authentication during the user authentication process, thereby improving the accuracy of user authentication without affecting the entire PKI authentication. The specific process is as follows:

[0019] A. The user and the certificate authority send a random first data to each other. The certificate authority divides the received first data into blocks, encrypts each data block separately, generates the corresponding public key component, and then sends the public key component back to the user. The user uses the received first data to encrypt the public key component twice to obtain the public key. The user sends the public key to the certificate authority, and the user uses the public key to generate the corresponding private key. Through the above two-way encryption process, the user's behavioral characteristics can be fully demonstrated.

[0020] The certificate authority parses the encryption process of the public key and private key, selects the largest number of encryption threads in public key component encryption, public key secondary encryption and private key encryption as the basic parsing dimension, and adds the time dimension to generate a parsing space. The encryption object data and encryption process data in all encryption threads are filled into the parsing space, and features are extracted from the data in the parsing space to obtain user behavior features.

[0021] The feature extraction of data in the analytical space includes the following steps: in the analytical space, the encrypted object data and the encrypted process data are combined into data packets according to their correlation, and are sorted in time sequence, and the correlation function between the encrypted object data and the encrypted process data in the same data packet is established; the projection data of each data packet on each analytical dimension except the time dimension is calculated, the projection data nonlinearly related to the corresponding correlation function is deleted, the remaining projection data are combined into a feature matrix, and the eigenvector of the feature matrix is ​​calculated as the user behavior feature. By projecting the data packet in the multidimensional analytical space, the user behavior feature can be multi-dimensionally decoupled, which is convenient for subsequent authentication.

[0022] B. The user sends a certificate registration request to the certificate authority, and the certificate authority authenticates the user based on the user's behavior characteristics and the credential characteristics sent by the user: the credential characteristics sent by the user are discretized and then mapped to the analytical space, and the vector product of the discretized credential characteristics data and the feature vector is calculated to obtain the authentication vector set. The user is authenticated based on the linear correlation index of the authentication vector set. When the linear correlation index of the authentication vector set is greater than the minimum threshold, the user passes the authentication.

[0023] The linear correlation index of the authentication vector set is calculated by reducing the dimension of the authentication vectors of the authentication vector set until all the authentication vectors are linearly correlated, and dividing the dimension after the dimension reduction by the original dimension of the authentication vector set to obtain the linear correlation index;

[0024] The dimensionality reduction process of the authentication vector is to calculate the mapping function between the data of the dimension to be reduced and other dimensions, map the data of the dimension to be reduced to other dimensions according to the corresponding mapping function, and then use the original data of other dimensions and the mapped new data for weighted merging.

[0025] After identity authentication is passed, the certificate authority uses its own private key to sign the user's public key and personal information, generates a digital certificate and sends it to the user.

[0026] By using the linear correlation index to authenticate the user, the authentication error caused by the deviation of some individual authentication vectors when the authentication vector set is directly used can be avoided.

[0027] C. When users communicate with each other, they use digital certificates to verify the legitimacy of each other's identities. After verification, the sender uses the public key of the receiver to encrypt the information, and the receiver uses his or her private key to decrypt the encrypted information. The certificate authority periodically verifies the issued digital certificates and their corresponding users.

Claims

1. A security authentication method based on PKI certificate, characterized in that The following steps are involved: A. The user and the certificate authority jointly generate an asymmetric key. During the key generation process, the certificate authority analyzes the user's behavioral characteristics. B. The user sends a certificate registration request to the certificate authority, and the certificate authority authenticates the user based on the user's behavior characteristics and the credentials sent by the user; After identity authentication is passed, the certificate authority uses its own private key to sign the user's public key and personal information, generates a digital certificate and sends it to the user; C. When users communicate with each other, digital certificates are used to verify the legitimacy of the other party's identity. After the verification is passed, the sender of the information uses the public key of the receiver of the information to encrypt the information, and the receiver of the information uses his or her own private key to decrypt the encrypted information.

2. The security authentication method based on PKI certificate according to claim 1, characterized in that: In step A, generating an asymmetric key includes the following steps: The user and the certificate authority each send a random first data to each other. The certificate authority divides the received first data into blocks, encrypts each data block separately, generates the corresponding public key component, and then sends the public key component back to the user. The user uses the received first data to re-encrypt the public key component to obtain the public key. The user sends the public key to the certificate authority, and the user uses the public key to generate the corresponding private key.

3. The security authentication method based on PKI certificate according to claim 2, characterized in that: In step A, the user's behavior characteristics are analyzed The following steps are included: The certificate authority parses the encryption process of the public key and private key, selects the largest number of encryption threads in public key component encryption, public key secondary encryption and private key encryption as the basic parsing dimension, and adds the time dimension to generate a parsing space. The encryption object data and encryption process data in all encryption threads are filled into the parsing space, and features are extracted from the data in the parsing space to obtain user behavior features.

4. The security authentication method based on PKI certificate according to claim 3 is characterized in that: Feature extraction of data in the analytical space includes the following steps: In the analytical space, the encrypted object data and the encrypted process data are organized into data packets according to their correlation and sorted in time sequence, and a correlation function is established between the encrypted object data and the encrypted process data in the same data packet. The projection data of each data packet on each analytical dimension except the time dimension is calculated, and the projection data that is nonlinearly related to the corresponding correlation function is deleted. The remaining projection data are organized into a feature matrix, and the eigenvectors of the feature matrix are calculated as user behavior features.

5. The security authentication method based on PKI certificate according to claim 4, characterized in that: In step B, the user identity authentication based on the user behavior characteristics and the credential characteristics sent by the user includes the following steps: The credential features sent by the user are discretized and then mapped to the analytical space. The vector product of the discretized credential feature data and the feature vector is calculated to obtain the authentication vector set. The user is authenticated according to the linear correlation index of the authentication vector set. When the linear correlation index of the authentication vector set is greater than the minimum threshold, the user passes the authentication.

6. The security authentication method based on PKI certificate according to claim 5, characterized in that: The linear correlation index of the authentication vector set is calculated as follows: The authentication vectors of the authentication vector set are dimensionally reduced until all the authentication vectors are linearly correlated, and the dimension after dimension reduction is divided by the original dimension of the authentication vector set to obtain a linear correlation index.

7. The security authentication method based on PKI certificate according to claim 6, characterized in that: The dimension reduction process of the authentication vector is: Calculate the mapping function between the data of the dimension to be reduced and other dimensions, map the data of the dimension to be reduced to other dimensions according to the corresponding mapping function, and then use the original data of other dimensions and the mapped new data for weighted merger.

8. The security authentication method based on PKI certificate according to claim 1, characterized in that: In step C, the certificate authority periodically verifies the issued digital certificates and their corresponding users.