Access authentication method and device, computer equipment and storage medium

Abstract

The invention relates to an access authentication method and device, computer equipment and a storage medium. And the ciphertext can be stored through the low-cost safety equipment to cooperate with the terminal to realize secondary verification of the ciphertext, and the method is easy to realize and popularize. When the safety equipment is used, ciphertext matching is carried out, whether authentication succeeds or not is judged according to whether a ciphertext consistent with the target ciphertext exists in the safety equipment or not, after the authentication succeeds and the use is completed, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated; the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is obtained through calculation according to the new encryption algorithm and the new plaintext, the new ciphertext is updated and written into the safety device, the encryption algorithm and the plaintext are randomly selected and randomly generated, only the ciphertext is stored into the safety device, and the encryption algorithm and the plaintext are randomly selected and randomly generated. And the terminal successfully logs in without password verification, and cannot know an encryption algorithm and a plaintext, so that cracking can be thoroughly realized.

Description

Technical Field

[0001] The present application relates to the field of server technology, and in particular to an access authentication method, apparatus, computer equipment and storage medium. Background Art

[0002] In Linux systems, password security is extremely important because it is directly related to the protection of systems and data. Passwords are the main way to verify user identities, ensuring that only authorized users can access systems and resources. In order to improve security, it is required that when setting passwords, regular passwords should not be used. Completely random and frequently changing passwords can be more secure. However, completely random and frequently changing passwords may cause administrators to have password storage management problems, or even forget them. In the case where the password is not completely random and does not change for a long time, expensive supporting equipment is required to collect biometric information to achieve confidentiality. Therefore, how to strengthen the security access of super user privilege accounts without relying on expensive supporting equipment when the password is not completely random and does not change for a long time is easy to implement and popularize on ordinary devices, and this strengthening method will not be easily cracked. Summary of the invention

[0003] Based on this, an access authentication method, apparatus, computer device and storage medium are provided to solve the technical problem that a completely random and frequently changing password is currently required to ensure password security, which may cause the password to be forgotten. In the case where the password is not completely random and does not change for a long time, it is necessary to rely on expensive supporting equipment to collect biometric information to achieve confidentiality, which is difficult to implement and popularize on ordinary equipment.

[0004] In one aspect, an access authentication method is provided, the method comprising:

[0005] Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully;

[0006] In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device;

[0007] In response to the encryption algorithm and the plain text not existing in the storage device, the authentication is successful and access is allowed;

[0008] In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected;

[0009] In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext;

[0010] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0011] In one embodiment, in response to connecting to the security device, performing ciphertext matching, and judging whether the authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device includes:

[0012] Create a secondary encryption service program and set it to run automatically at startup;

[0013] The secondary encryption service program identifies whether there is a file with a specified name in the root directory of the security device, and the file with the specified name is used to store ciphertext;

[0014] In response to the absence of a file with a specified name in the root directory of the security device, authentication fails and access is denied;

[0015] In response to the existence of a file with a specified name in the root directory of the security device, determining whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0016] In response to the ciphertext stored in the specified name file not being consistent with the target ciphertext, authentication fails and access is denied;

[0017] In response to the ciphertext stored in the designated name file being consistent with the target ciphertext, the authentication is successful and access is permitted.

[0018] In one embodiment, the method further comprises:

[0019] In response to the existence of a designated name file in the root directory of the security device, and when the ciphertext stored in the designated name file is inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device are kept unchanged, and the ciphertext stored in the designated name file is kept unchanged.

[0020] In one embodiment, the method further comprises:

[0021] In response to the security device not being connected, starting the secondary encryption service program fails, and an error message is displayed to remind the user to connect the security device;

[0022] In response to connecting to the security device, a secondary encryption service program is started. When it is found that no ciphertext exists in the security device, an encryption algorithm is randomly selected, a plaintext is randomly generated, the ciphertext is calculated and obtained, and then written into the security device, and the encryption algorithm and plaintext are written into the storage device, and the login is logged out and the connection with the security device is disconnected.

[0023] In one embodiment, in response to the password matching being successful, determining whether the encryption algorithm and the plaintext exist in the storage device comprises:

[0024] When the password matches successfully, the file storing the encryption algorithm and plain text in the storage device is read. If the file storing the encryption algorithm and plain text in the storage device does not exist, and / or the file is a blank file, and / or the reading fails due to an error in the file content format, it is determined that the encryption algorithm and plain text do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plain text exist in the storage device.

[0025] In one embodiment, the method further comprises:

[0026] In response to the password not matching successfully, the authentication fails, access is denied, and a password error message is displayed;

[0027] In response to the presence of the encryption algorithm and the plain text in the storage device and the security device not being connected, the authentication fails, access is denied, and a prompt is given that the security device is not inserted;

[0028] In response to a successful password match, before determining whether authentication is successfully completed based on whether there is a ciphertext consistent with the target ciphertext in the security device, it is detected in real time whether the connected security device is unplugged; if the security device is unplugged, authentication fails and access is denied.

[0029] In one embodiment, the randomly selecting a new encryption algorithm, randomly generating a new plaintext, writing the new encryption algorithm and the new plaintext into a storage device, calculating and obtaining a new ciphertext according to the new encryption algorithm and the new plaintext, and updating and writing the new ciphertext into the security device comprises:

[0030] Preset multiple encryption algorithms and set the length threshold of the generated plaintext;

[0031] When randomly selecting a new encryption algorithm, an encryption algorithm different from the encryption algorithm currently in the storage device is selected as the new encryption algorithm, and a new plaintext is randomly generated according to a length threshold of the generated plaintext, and a new ciphertext is obtained by calculation according to the new encryption algorithm and the new plaintext;

[0032] The new encryption algorithm and the new plaintext are written into the storage device, and the new ciphertext is updated and written into the security device.

[0033] In another aspect, an access authentication device is provided, the device comprising:

[0034] A password authentication module is used to detect whether there is an access login request, and in response to receiving the access login request, perform password authentication to determine whether the password matches successfully;

[0035] A secondary enhanced authentication module, for determining whether an encryption algorithm and plain text exist in a storage device in response to a successful password match; for determining whether the encryption algorithm and plain text do not exist in the storage device, the authentication is successful and access is allowed; for determining whether an encryption algorithm and plain text exist in the storage device, the target cipher text is obtained by calculating according to the encryption algorithm and plain text in the storage device, and detecting whether a security device is connected;

[0036] an authentication process module, configured to perform ciphertext matching in response to connecting to the security device, and determine whether the authentication is successful based on whether there is a ciphertext consistent with the target ciphertext in the security device;

[0037] The encryption update module is used to randomly select a new encryption algorithm in response to successful authentication, randomly generate a new plaintext, write the new encryption algorithm and the new plaintext into a storage device, calculate and obtain a new ciphertext based on the new encryption algorithm and the new plaintext, and update the new ciphertext and write it into the security device.

[0038] In another aspect, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are implemented:

[0039] Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully;

[0040] In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device;

[0041] In response to the encryption algorithm and the plain text not existing in the storage device, the authentication is successful and access is allowed;

[0042] In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected;

[0043] In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext;

[0044] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0045] In another aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0046] Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully;

[0047] In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device;

[0048] In response to the encryption algorithm and the plain text not existing in the storage device, the authentication is successful and access is allowed;

[0049] In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected;

[0050] In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext;

[0051] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0052] The access authentication method, device, computer equipment and storage medium mentioned above can store ciphertexts through low-cost security devices and cooperate with terminals to implement secondary verification of ciphertexts, which is easy to implement and popularize. When the security device is not in use, the encryption algorithm and plaintext will not be saved in the storage device of the terminal. As long as the password matches successfully, the authentication is successful and access is allowed. When the security device is used, ciphertext matching is performed, and whether the authentication is successful is determined based on whether there is a ciphertext consistent with the target ciphertext in the security device. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. The new encryption algorithm and the new plaintext are written to the storage device, and a new ciphertext is calculated based on the new encryption algorithm and the new plaintext. The new ciphertext is updated and written to the security device. The encryption algorithm and plaintext are randomly selected and randomly generated. Only the ciphertext is saved in the security device. The terminal cannot log in successfully without password verification, and cannot know the encryption algorithm and plaintext, which can completely achieve unbreakable. Through BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0054] Figure 1 This is an application environment diagram of an access authentication method in one embodiment of the present application;

[0055] Figure 2 A flowchart of an access authentication method in one embodiment of the present application;

[0056] Figure 3 This is a schematic diagram of the operation of the secondary encryption service program in one embodiment of the present application;

[0057] Figure 4 This is a logic diagram of the password authentication process in one embodiment of the present application;

[0058] Figure 5 A schematic diagram of the process of generating and saving ciphertext data in one embodiment of the present application;

[0059] Figure 6 This is a distribution diagram of authentication situations in an embodiment of the present application, taking a USB flash drive as an example of a security device;

[0060] Figure 7 This is a structural block diagram of an access authentication device in one embodiment of the present application;

[0061] Figure 8 This is a diagram of the internal structure of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0063] Common encryption algorithms include: Hash algorithm, a technology that uses mathematical methods to generate a unique identifier of a fixed length for data, which can be used to verify the integrity and consistency of data. Common hash algorithms include MD, SHA, MAC, etc.; symmetric encryption algorithm, an algorithm that uses the same key for encryption and decryption, which can be used to protect the security and confidentiality of data. Common symmetric encryption algorithms include DES, 3DES, AES, etc.; asymmetric encryption algorithm, an algorithm that uses different keys for encryption and decryption, which can be used to achieve secure data transmission and identity authentication. Common asymmetric encryption algorithms include RSA, DSA, ECC, etc.

[0064] In order to further enhance the secure access to Linux machines, in addition to traditional password authentication, the use of biometric technologies such as fingerprint or pupil authentication has become an effective solution. These biometric methods use the user's unique physiological characteristics to make identity authentication more secure and difficult to forge. Fingerprint recognition devices can quickly scan the user's fingerprint to ensure that only legitimate users can access the system. At the same time, pupil recognition technology provides a highly secure authentication method because the uniqueness and difficulty of copying the pupil make this method extremely advantageous in preventing unauthorized access. This combination of multi-factor authentication not only improves security, but also reduces reliance on traditional passwords and reduces the risk of passwords being guessed or leaked. By implementing these advanced authentication methods, Linux systems can more effectively resist potential security threats and protect critical data and resources.

[0065] Although fingerprint recognition and pupil recognition technologies have obvious advantages in security, they also have some disadvantages.

[0066] Among them, the disadvantages of fingerprint recognition include:

[0067] Risk of forgery: Although fingerprints are unique, advanced technology can create fake fingerprints, posing a security risk.

[0068] Environmental influences: Dirt, sweat, or oil may affect the fingerprint sensor's recognition accuracy.

[0069] Injury issues: Injuries to the fingers or skin diseases may result in recognition failure.

[0070] Equipment cost: High-quality fingerprint recognition equipment is relatively expensive, which increases the cost of deployment.

[0071] Privacy issues: Once a user's biometric information is leaked, it cannot be changed, which may cause privacy and security issues.

[0072] Among them, the disadvantages of pupil recognition include:

[0073] High cost: Pupil recognition devices are usually more expensive than fingerprint recognition devices, which limits their popularity.

[0074] Light dependency: The recognition process is sensitive to light conditions, and low-light or strong-light environments may cause recognition difficulties.

[0075] Crowd impact: When performing pupil recognition in a crowded environment, it may be disturbed, reducing accuracy.

[0076] Eye health issues: Certain eye diseases or conditions may affect recognition performance and cause failure.

[0077] Privacy concerns: The use of pupil recognition may raise users’ concerns about biometric monitoring and privacy violations.

[0078] To solve the above problems, the present invention creatively proposes an access authentication method in the embodiment of the present invention, which can strengthen the security access of the super user privilege account when the super user privilege password is not completely random and does not change for a long time, and this strengthening method cannot be easily cracked. Moreover, this strengthening method does not rely on expensive supporting equipment and is easy to implement and popularize.

[0079] The access authentication method provided by this application can be applied to Figure 1 In the application environment shown. Among them, the terminal 101 is rooted as a dedicated device, and can be accessed and logged in through the root password. Among them, the terminal 101 can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices, and can also be implemented with an independent server or a server cluster composed of multiple servers. A storage device is provided in the terminal 101, and the storage device is preferably a hard disk. A file for storing encryption algorithms and plain text is set in the storage device. The terminal 101 can be connected to the security device 102 by plugging and unplugging. The security device 102 is a removable device, such as a USB flash drive. A specified name file is set in the root directory of the security device 102, and the specified name file is used to save the ciphertext. At the first time, the file of the storage device in the terminal 101 is empty, and the encryption algorithm and plain text are not saved. At this time, there is no need to connect to the security device 102, and it can be accessed by the root password. At the second time, if the security device 102 is used to connect the terminal 101, after logging in through the root password access, an encryption algorithm is randomly selected, a plaintext is randomly generated, the encryption algorithm and the plaintext are written into the storage device, the ciphertext is calculated based on the encryption algorithm and the plaintext, and the ciphertext is updated and written into the security device 102. At the third time, if the security device 102 is used to connect the terminal 101 again, after logging in through the root password access, ciphertext matching is performed, the target ciphertext is calculated based on the encryption algorithm and the plaintext in the storage device of the terminal 101, and whether the authentication is successful is determined based on whether there is a ciphertext consistent with the target ciphertext in the security device 102. After the authentication is successful, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, the new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device 102.

[0080] In one embodiment, Figure 2 , Figure 3 , Figure 4 As shown, an access authentication method is provided, which is applied to Figure 1The terminal 101 in the example is used as an example to illustrate, and the following steps are included:

[0081] Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully;

[0082] In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device;

[0083] In response to the encryption algorithm and the plain text not existing in the storage device, the authentication is successful and access is allowed;

[0084] In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected;

[0085] In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext;

[0086] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0087] The access login request is a super user privilege login request, and the super user privilege login is the root login. When performing password authentication and determining whether the password matches successfully, the root password is mainly verified to be correct. When the access is terminated, the security device is unplugged.

[0088] Specifically, by storing ciphertexts in low-cost security devices, the ciphertext secondary verification can be implemented in conjunction with the terminal, which is easy to implement and popularize. When the security device is not in use, the encryption algorithm and plaintext will not be saved in the storage device of the terminal. Only a successful password match will result in successful authentication and access will be allowed. When the security device is in use, ciphertext matching is performed, and whether the authentication is successful is determined based on whether there is a ciphertext consistent with the target ciphertext in the security device. After each successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, and the new encryption algorithm and the new plaintext are written into the storage device. The new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device. The encryption algorithm and plaintext are randomly selected and randomly generated. Only the ciphertext is saved in the security device. The terminal cannot log in successfully without password verification, and cannot know the encryption algorithm and plaintext, which can completely achieve unbreakable.

[0089] In this embodiment, in response to connecting to the security device, performing ciphertext matching, and judging whether authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device includes:

[0090] Create a secondary encryption service program and set it to run automatically at startup;

[0091] The secondary encryption service program identifies whether there is a file with a specified name in the root directory of the security device, and the file with the specified name is used to store ciphertext;

[0092] In response to the absence of a file with a specified name in the root directory of the security device, authentication fails and access is denied;

[0093] In response to the existence of a file with a specified name in the root directory of the security device, determining whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0094] In response to the ciphertext stored in the specified name file not being consistent with the target ciphertext, authentication fails and access is denied;

[0095] In response to the ciphertext stored in the designated name file being consistent with the target ciphertext, the authentication is successful and access is permitted.

[0096] like Figure 3 As shown in the figure, the secondary encryption service program is an eBPF service program. When the service is started, an eBPF program (LSM program type) is loaded and run. The eBPF program will perform enhanced access control again after the root password matches and authenticates successfully. The encryption algorithm and plaintext of enhanced access control are encrypted and stored in the storage device. If the encryption algorithm and plaintext exist in the storage device, they will be read into the memory when the program is loaded and used in the authentication process. If the file storing the encryption algorithm and plaintext in the storage device does not exist, or the file is a blank file, or the file content format is incorrect and causes the reading to fail, the eBPF program will think that the encryption algorithm and plaintext are empty. In this case, the enhanced authentication process will not be performed, which is equivalent to using only the root password for verification.

[0097] eBPF: The full name is "Extended Berkeley Packet Filter". It is a packet filtering technology that provides a mechanism for safely injecting code when kernel events and user program events occur. Later, it was gradually extended to network, kernel, security, tracing, etc., and has been widely used in fault diagnosis, network optimization, security control, performance monitoring and other fields. A core concept of eBPF program is "map", which is a special data structure used to store and share data between eBPF program and user space.

[0098] LSM: Linux Security Modules (LSM) is a lightweight general access control framework that allows user space security modules to extend and enhance the security features of the Linux kernel. The design principle of LSM is to remain transparent to those who do not need it, while allowing those who need it to focus on the development of control policies and security modules. As a flexible interface, LSM enables developers to implement various security policies, including access control, mandatory access control, auditing, etc., thereby helping system administrators better protect system resources, data and user privacy.

[0099] like Figure 4 As shown in the figure, the authentication process is as follows: the ciphertext data is stored in the security device. When the security device is inserted, the probe function is executed to initialize the device. At this time, the ciphertext data is read from the security device and passed to the kernel through the eBPF map. When logging in, after the root password is matched successfully, if there is an algorithm and plaintext in the memory, the ciphertext is obtained by using the algorithm and plaintext in the memory, and matched with the ciphertext in the security device: if the security device (removable device) does not exist, the authentication fails and access is denied; if the specified name file does not exist in the root directory of the security device, the authentication fails and access is denied; if the specified name file exists in the root directory of the security device and the file content is inconsistent with the current ciphertext, the authentication fails and access is denied; if the specified name file exists in the root directory of the security device and the file content is inconsistent with the current ciphertext, the authentication succeeds and access is allowed.

[0100] If necessary, the ciphertext can be saved in multiple security devices, so that multiple "keys" can be implemented, but once a key takes effect, the other keys cannot be used again.

[0101] If there are multiple security devices ("keys") on the device at the same time, there can be multiple logics, for example: the last inserted device is used as the basis, and the previous ciphertext is automatically overwritten; multiple ciphertexts can also be saved in the memory at the same time, and all ciphertexts are matched during the authentication process. As long as one of them matches, it is a successful match.

[0102] Therefore, in this embodiment, the method further includes:

[0103] storing a unique identification code of at least one security device in the storage device, and determining whether the connected security device is a valid key by using the unique identification code stored in the storage device;

[0104] If the unique identification code of the connected security device matches in the storage device, a ciphertext match is performed, otherwise the authentication fails and access is denied, reminding that the connected security device is not a valid key.

[0105] In this embodiment, the method further includes:

[0106] In response to the existence of a designated name file in the root directory of the security device, and when the ciphertext stored in the designated name file is inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device are kept unchanged, and the ciphertext stored in the designated name file is kept unchanged.

[0107] More specifically, Figure 5 As shown, when logging in, after the root password is matched successfully, if the secondary encryption service program is in operation, that is, the ebpf program is running (when the service is started, the algorithm and plaintext of the last ciphertext generation will be read from the specific file of the storage device to the memory; in addition, when the ciphertext data is generated, the randomly selected algorithm and plaintext will be saved in the memory, and will also be saved in the specific file of the storage device for use when the service is started next time), the ciphertext is calculated using the algorithm and plaintext in the memory. If the specified name file does not exist in the root directory of the hardened device, the obtained ciphertext is directly written into the specified name file; if the specified name file exists in the root directory of the hardened device, and the file content is consistent with the current ciphertext, an algorithm is randomly selected, a plaintext is randomly generated, and a new ciphertext is calculated and obtained, and then the new ciphertext is updated and written to the specified name file in the security device (the randomly selected algorithm and plaintext will also be synchronously updated / saved in the specified file of the storage device); if the file content is inconsistent with the current ciphertext, the login fails, and in this case, the algorithm, plaintext, and ciphertext will not be updated (the memory, security device, and storage device will not be updated).

[0108] like Figure 4 , Figure 5 As shown, in this embodiment, the method further includes:

[0109] In response to the security device not being connected, starting the secondary encryption service program fails, and an error message is displayed to remind the user to connect the security device;

[0110] In response to connecting to the security device, a secondary encryption service program is started. When it is found that no ciphertext exists in the security device, an encryption algorithm is randomly selected, a plaintext is randomly generated, the ciphertext is calculated and obtained, and then written into the security device, and the encryption algorithm and plaintext are written into the storage device, and the login is logged out and the connection with the security device is disconnected.

[0111] In this embodiment, in response to the password matching being successful, determining whether the encryption algorithm and plain text exist in the storage device includes:

[0112] When the password matches successfully, the file storing the encryption algorithm and plain text in the storage device is read. If the file storing the encryption algorithm and plain text in the storage device does not exist, and / or the file is a blank file, and / or the reading fails due to an error in the file content format, it is determined that the encryption algorithm and plain text do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plain text exist in the storage device.

[0113] like Figure 4 , Figure 5 As shown, in this embodiment, the method further includes:

[0114] In response to the password not matching successfully, the authentication fails, access is denied, and a password error message is displayed;

[0115] In response to the presence of an encryption algorithm and plain text in the storage device and the security device is not connected, authentication fails, access is denied, and a prompt is given that the security device is not inserted.

[0116] In this case, although the root password verification is passed, the connection to the security device is not detected, so the secondary ciphertext comparison verification cannot be completed.

[0117] In this embodiment, the method further includes:

[0118] In response to a successful password match, before determining whether authentication is successfully completed based on whether there is a ciphertext consistent with the target ciphertext in the security device, detecting in real time whether the connected security device is unplugged;

[0119] In response to the security device being unplugged, authentication fails and access is denied.

[0120] like Figure 6 As shown in the figure, when using it, the security device is a USB flash drive as an example. Assume that there is a USB flash drive as a security device; the ebpf program already exists, and the corresponding service has also been created (but not started).

[0121] In the initial state, the target machine has not been security-enhanced, and you can log in successfully using the root password directly;

[0122] When the USB flash drive is not inserted, the ebpf service fails to start and an error message is displayed saying that the security device cannot be found.

[0123] Insert the USB flash drive, start the ebpf secondary encryption service program, find that the specified file (to save the ciphertext) does not exist in the USB flash drive, randomly select an encryption algorithm, randomly generate a plaintext, calculate and obtain the ciphertext and write it to the specified file in the USB flash drive; and write the encryption algorithm and plaintext to the storage device (fixed path, convenient for subsequent reading and loading), log out and unplug the USB flash drive;

[0124] When no USB flash drive is inserted, login with root and password fails, prompting that the password is wrong or the secondary verification fails;

[0125] Insert the USB flash drive, log in using the root and password, read the encryption algorithm and plain text from the storage device, calculate the ciphertext, and then compare it with the ciphertext in the specified file of the USB flash drive. If they are consistent, the login is successful; if they are inconsistent, the login fails.

[0126] Among them, the ebpf program is used for secondary reinforcement of secure access, which is controlled in the form of services, making it easy to enable and shut down; the encryption algorithm and plaintext are randomly selected and randomly generated, and only the ciphertext is saved in the security device. The target device cannot know the encryption algorithm and plaintext without successfully logging in with the root password, which can achieve complete inability to crack. The secondary reinforcement of secure access can be achieved by using cheap, common, and compact mobile devices such as USB flash drives, which is simple and convenient to implement.

[0127] In the above access authentication method, the ciphertext can be stored in a low-cost security device to cooperate with the terminal to realize the secondary verification of the ciphertext, which is easy to implement and popularize. When the security device is not used, the encryption algorithm and plaintext will not be saved in the storage device of the terminal. Only the password matching is successful, the authentication is successful and access is allowed. When the security device is used, the ciphertext is matched, and the authentication is successful based on whether there is a ciphertext consistent with the target ciphertext in the security device. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. The new encryption algorithm and the new plaintext are written into the storage device, and the new ciphertext is calculated according to the new encryption algorithm and the new plaintext. The new ciphertext is updated and written into the security device. The encryption algorithm and the plaintext are randomly selected and randomly generated. Only the ciphertext is saved in the security device. The terminal cannot log in successfully without password verification, and cannot know the encryption algorithm and plaintext, which can completely achieve unbreakable.

[0128] In one embodiment, Figure 7 As shown, an access authentication device 10 is provided, comprising: a password authentication module 1, a secondary reinforcement authentication module 2, an authentication process module 3 and an encryption update module 4.

[0129] The password authentication module 1 is used to detect whether there is an access login request, and in response to receiving the access login request, perform password authentication to determine whether the password matches successfully.

[0130] The secondary reinforcement authentication module 2 is used to determine whether there is an encryption algorithm and plaintext in the storage device in response to a successful password match; in response to the absence of an encryption algorithm and plaintext in the storage device, the authentication is successful and access is allowed; in response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is obtained according to the encryption algorithm and plaintext in the storage device, and detect whether a security device is connected.

[0131] The authentication process module 3 is used for performing ciphertext matching in response to connecting to the security device, and determining whether the authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device.

[0132] The encryption update module 4 is used to randomly select a new encryption algorithm in response to successful authentication, randomly generate a new plaintext, write the new encryption algorithm and the new plaintext into a storage device, calculate and obtain a new ciphertext based on the new encryption algorithm and the new plaintext, and update the new ciphertext and write it into the security device.

[0133] In this embodiment, in response to connecting to the security device, performing ciphertext matching, and judging whether authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device includes:

[0134] Create a secondary encryption service program and set it to run automatically at startup;

[0135] The secondary encryption service program identifies whether there is a file with a specified name in the root directory of the security device, and the file with the specified name is used to store ciphertext;

[0136] In response to the absence of a file with a specified name in the root directory of the security device, authentication fails and access is denied;

[0137] In response to the existence of a file with a specified name in the root directory of the security device, determining whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0138] In response to the ciphertext stored in the specified name file not being consistent with the target ciphertext, authentication fails and access is denied;

[0139] In response to the ciphertext stored in the designated name file being consistent with the target ciphertext, the authentication is successful and access is permitted.

[0140] In this embodiment, the encryption update module 4 is used to keep the encryption algorithm and plaintext in the storage device unchanged and the ciphertext stored in the specified name file unchanged in response to the presence of a specified name file in the root directory of the security device and the ciphertext stored in the specified name file being inconsistent with the target ciphertext.

[0141] In this embodiment, the password authentication module 1 is used to respond to the failure of authentication, deny access, and prompt that the password is wrong in response to the failure of password matching.

[0142] In this embodiment, in response to the password matching being successful, determining whether the encryption algorithm and plain text exist in the storage device includes:

[0143] When the password matches successfully, the file storing the encryption algorithm and plain text in the storage device is read. If the file storing the encryption algorithm and plain text in the storage device does not exist, and / or the file is a blank file, and / or the reading fails due to an error in the file content format, it is determined that the encryption algorithm and plain text do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plain text exist in the storage device.

[0144] In this embodiment, the authentication process module 3 is used to respond to the existence of encryption algorithm and plain text in the storage device and the security device is not connected, then the authentication fails, access is denied, and a prompt is given that the security device is not inserted.

[0145] like Figure 7 As shown, in this embodiment, the access authentication device 10 further includes: a security device removal detection module 5 .

[0146] The security device unplugging detection module 5 is used to detect in real time whether the connected security device is unplugged in response to a successful password match, before judging whether the authentication is successfully completed based on whether there is a ciphertext consistent with the target ciphertext in the security device; in response to the security device being unplugged, the authentication fails and access is denied.

[0147] In the above-mentioned access authentication device, the ciphertext can be stored in a low-cost security device to cooperate with the terminal to realize the secondary verification of the ciphertext, which is easy to realize and popularize. When the security device is not in use, the encryption algorithm and plaintext will not be saved in the storage device of the terminal. Only the password matching is successful, the authentication is successful and access is allowed. When the security device is used, the ciphertext is matched, and the authentication is successful based on whether there is a ciphertext consistent with the target ciphertext in the security device. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. The new encryption algorithm and the new plaintext are written into the storage device, and the new ciphertext is calculated according to the new encryption algorithm and the new plaintext. The new ciphertext is updated and written into the security device. The encryption algorithm and the plaintext are randomly selected and randomly generated. Only the ciphertext is saved in the security device. The terminal cannot know the encryption algorithm and the plaintext without successfully logging in through the password verification, and can completely achieve the unbreakable.

[0148] For the specific definition of the access authentication device, please refer to the definition of the access authentication method above, which will not be repeated here. Each module in the above-mentioned access authentication device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0149] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0150] Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully;

[0151] In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device;

[0152] In response to the encryption algorithm and the plain text not existing in the storage device, the authentication is successful and access is allowed;

[0153] In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected;

[0154] In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext;

[0155] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0156] In one embodiment, the computer program further implements the following steps when executed by a processor:

[0157] In response to connecting to the security device, performing ciphertext matching, and judging whether the authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device includes:

[0158] Create a secondary encryption service program and set it to run automatically at startup;

[0159] The secondary encryption service program identifies whether there is a file with a specified name in the root directory of the security device, and the file with the specified name is used to store ciphertext;

[0160] In response to the absence of a file with a specified name in the root directory of the security device, authentication fails and access is denied;

[0161] In response to the existence of a file with a specified name in the root directory of the security device, determining whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0162] In response to the ciphertext stored in the specified name file not being consistent with the target ciphertext, authentication fails and access is denied;

[0163] In response to the ciphertext stored in the designated name file being consistent with the target ciphertext, the authentication is successful and access is permitted.

[0164] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0165] In response to the existence of a designated name file in the root directory of the security device, and when the ciphertext stored in the designated name file is inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device are kept unchanged, and the ciphertext stored in the designated name file is kept unchanged.

[0166] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0167] In response to the password not being matched successfully, the authentication fails, access is denied, and a password error is prompted.

[0168] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0169] In response to the password matching being successful, determining whether there is an encryption algorithm and plain text in the storage device includes:

[0170] When the password matches successfully, the file storing the encryption algorithm and plain text in the storage device is read. If the file storing the encryption algorithm and plain text in the storage device does not exist, and / or the file is a blank file, and / or the reading fails due to an error in the file content format, it is determined that the encryption algorithm and plain text do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plain text exist in the storage device.

[0171] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0172] In response to the presence of an encryption algorithm and plain text in the storage device and the absence of the security device, authentication fails, access is denied, and a prompt is given indicating that the security device is not inserted.

[0173] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0174] In response to a successful password match, before determining whether authentication is successfully completed based on whether there is a ciphertext consistent with the target ciphertext in the security device, detecting in real time whether the connected security device is unplugged;

[0175] In response to the security device being unplugged, authentication fails and access is denied.

[0176] For specific limitations on the steps implemented when the computer program is executed by the processor, please refer to the limitations on the access authentication method above, which will not be repeated here.

[0177] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an access authentication method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0178] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0179] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0180] Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully;

[0181] In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device;

[0182] In response to the encryption algorithm and the plain text not existing in the storage device, the authentication is successful and access is allowed;

[0183] In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected;

[0184] In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext;

[0185] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0186] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0187] In response to connecting to the security device, performing ciphertext matching, and judging whether the authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device includes:

[0188] Create a secondary encryption service program and set it to run automatically at startup;

[0189] The secondary encryption service program identifies whether there is a file with a specified name in the root directory of the security device, and the file with the specified name is used to store ciphertext;

[0190] In response to the absence of a file with a specified name in the root directory of the security device, authentication fails and access is denied;

[0191] In response to the existence of a file with a specified name in the root directory of the security device, determining whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0192] In response to the ciphertext stored in the specified name file not being consistent with the target ciphertext, authentication fails and access is denied;

[0193] In response to the ciphertext stored in the designated name file being consistent with the target ciphertext, the authentication is successful and access is permitted.

[0194] In one embodiment, when the processor executes the computer program, the following steps are also implemented:

[0195] In response to the existence of a designated name file in the root directory of the security device, and when the ciphertext stored in the designated name file is inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device are kept unchanged, and the ciphertext stored in the designated name file is kept unchanged.

[0196] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0197] In response to the password not being matched successfully, the authentication fails, access is denied, and a password error is prompted.

[0198] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0199] In response to the password matching being successful, determining whether there is an encryption algorithm and plain text in the storage device includes:

[0200] When the password matches successfully, the file storing the encryption algorithm and plain text in the storage device is read. If the file storing the encryption algorithm and plain text in the storage device does not exist, and / or the file is a blank file, and / or the reading fails due to an error in the file content format, it is determined that the encryption algorithm and plain text do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plain text exist in the storage device.

[0201] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0202] In response to the presence of an encryption algorithm and plain text in the storage device and the absence of the security device, authentication fails, access is denied, and a prompt is given indicating that the security device is not inserted.

[0203] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0204] In response to a successful password match, before determining whether authentication is successfully completed based on whether there is a ciphertext consistent with the target ciphertext in the security device, detecting in real time whether the connected security device is unplugged;

[0205] In response to the security device being unplugged, authentication fails and access is denied.

[0206] For specific limitations on the steps implemented when the processor executes the computer program, please refer to the limitations on the access authentication method above, which will not be repeated here.

[0207] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0208] Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully;

[0209] In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device;

[0210] In response to the encryption algorithm and the plain text not existing in the storage device, the authentication is successful and access is allowed;

[0211] In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected;

[0212] In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext;

[0213] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0214] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0215] In response to connecting to the security device, performing ciphertext matching, and judging whether the authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device includes:

[0216] Create a secondary encryption service program and set it to run automatically at startup;

[0217] The secondary encryption service program identifies whether there is a file with a specified name in the root directory of the security device, and the file with the specified name is used to store ciphertext;

[0218] In response to the absence of a file with a specified name in the root directory of the security device, authentication fails and access is denied;

[0219] In response to the existence of a file with a specified name in the root directory of the security device, determining whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0220] In response to the ciphertext stored in the specified name file not being consistent with the target ciphertext, authentication fails and access is denied;

[0221] In response to the ciphertext stored in the designated name file being consistent with the target ciphertext, the authentication is successful and access is permitted.

[0222] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0223] In response to the existence of a designated name file in the root directory of the security device, and when the ciphertext stored in the designated name file is inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device are kept unchanged, and the ciphertext stored in the designated name file is kept unchanged.

[0224] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0225] In response to the password not being matched successfully, the authentication fails, access is denied, and a password error is prompted.

[0226] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0227] In response to the password matching being successful, determining whether there is an encryption algorithm and plain text in the storage device includes:

[0228] When the password matches successfully, the file storing the encryption algorithm and plain text in the storage device is read. If the file storing the encryption algorithm and plain text in the storage device does not exist, and / or the file is a blank file, and / or the reading fails due to an error in the file content format, it is determined that the encryption algorithm and plain text do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plain text exist in the storage device.

[0229] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0230] In response to the presence of an encryption algorithm and plain text in the storage device and the security device is not connected, authentication fails, access is denied, and a prompt is given that the security device is not inserted.

[0231] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0232] In response to a successful password match, before determining whether authentication is successfully completed based on whether there is a ciphertext consistent with the target ciphertext in the security device, detecting in real time whether the connected security device is unplugged;

[0233] In response to the security device being unplugged, authentication fails and access is denied.

[0234] For specific limitations on the steps implemented when the computer program is executed by the processor, please refer to the limitations on the access authentication method above, which will not be repeated here.

[0235] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0236] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0237] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. An access authentication method, characterized in that: include: Detecting whether there is an access login request, and in response to receiving the access login request, performing password authentication to determine whether the password matches successfully; In response to a successful password match, determining whether an encryption algorithm and plain text exist in the storage device; In response to the encryption algorithm and the plain text not being present in the storage device, the authentication is successful; In response to the existence of the encryption algorithm and the plaintext in the storage device, the target ciphertext is obtained by calculation according to the encryption algorithm and the plaintext in the storage device, and whether a security device is connected; In response to connecting to the security device, performing ciphertext matching to determine whether authentication is successful based on whether there is a ciphertext in the security device that is consistent with the target ciphertext; In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into a storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

2. The access authentication method according to claim 1, characterized in that: In response to connecting to the security device, performing ciphertext matching, and judging whether the authentication is successful according to whether there is a ciphertext consistent with the target ciphertext in the security device includes: Create a secondary encryption service program and set it to run automatically at startup; The secondary encryption service program identifies whether there is a file with a specified name in the root directory of the security device, and the file with the specified name is used to store ciphertext; In response to the absence of a file with a specified name in the root directory of the security device, authentication fails and access is denied; In response to the existence of a file with a specified name in the root directory of the security device, determining whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext; In response to the ciphertext stored in the specified name file not being consistent with the target ciphertext, authentication fails and access is denied; In response to the ciphertext stored in the designated name file being consistent with the target ciphertext, the authentication is successful and access is permitted.

3. The access authentication method according to claim 2, characterized in that: The method further comprises: In response to the existence of a designated name file in the root directory of the security device, and when the ciphertext stored in the designated name file is inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device are kept unchanged, and the ciphertext stored in the designated name file is kept unchanged.

4. The access authentication method according to claim 1, characterized in that: The method further comprises: In response to the security device not being connected, starting the secondary encryption service program fails, and an error message is displayed to remind the user to connect the security device; In response to connecting to the security device, a secondary encryption service program is started. When it is found that no ciphertext exists in the security device, an encryption algorithm is randomly selected, a plaintext is randomly generated, the ciphertext is calculated and obtained, and then written into the security device, and the encryption algorithm and plaintext are written into the storage device, and the login is logged out and the connection with the security device is disconnected.

5. The access authentication method according to claim 1, characterized in that: In response to the password matching being successful, determining whether there is an encryption algorithm and plain text in the storage device includes: When the password matches successfully, the file storing the encryption algorithm and plain text in the storage device is read. If the file storing the encryption algorithm and plain text in the storage device does not exist, and / or the file is a blank file, and / or the reading fails due to an error in the file content format, it is determined that the encryption algorithm and plain text do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plain text exist in the storage device.

6. The access authentication method according to claim 1, characterized in that: The method further comprises: In response to the password not matching successfully, the authentication fails, access is denied, and a password error message is displayed; In response to the presence of the encryption algorithm and the plain text in the storage device and the security device not being connected, the authentication fails, access is denied, and a prompt is given that the security device is not inserted; In response to a successful password match, before determining whether authentication is successfully completed based on whether there is a ciphertext consistent with the target ciphertext in the security device, it is detected in real time whether the connected security device is unplugged. If the security device is unplugged, authentication fails and access is denied.

7. The access authentication method according to claim 1, characterized in that: The randomly selecting a new encryption algorithm, randomly generating a new plaintext, writing the new encryption algorithm and the new plaintext into a storage device, calculating and obtaining a new ciphertext according to the new encryption algorithm and the new plaintext, and updating and writing the new ciphertext into the security device includes: Preset multiple encryption algorithms and set the length threshold of the generated plaintext; When randomly selecting a new encryption algorithm, an encryption algorithm different from the encryption algorithm currently in the storage device is selected as the new encryption algorithm, and a new plaintext is randomly generated according to a length threshold of the generated plaintext, and a new ciphertext is obtained by calculation according to the new encryption algorithm and the new plaintext; The new encryption algorithm and the new plaintext are written into the storage device, and the new ciphertext is updated and written into the security device.

8. An access authentication device, characterized in that: The device comprises: A password authentication module is used to detect whether there is an access login request, and in response to receiving the access login request, perform password authentication to determine whether the password matches successfully; A secondary enhanced authentication module, for determining whether an encryption algorithm and plain text exist in a storage device in response to a successful password match; for determining whether the encryption algorithm and plain text do not exist in the storage device, the authentication is successful and access is allowed; for determining whether an encryption algorithm and plain text exist in the storage device, the target cipher text is obtained by calculating according to the encryption algorithm and plain text in the storage device, and detecting whether a security device is connected; an authentication process module, configured to perform ciphertext matching in response to connecting to the security device, and determine whether the authentication is successful based on whether there is a ciphertext consistent with the target ciphertext in the security device; The encryption update module is used to randomly select a new encryption algorithm in response to successful authentication, randomly generate a new plaintext, write the new encryption algorithm and the new plaintext into a storage device, calculate and obtain a new ciphertext based on the new encryption algorithm and the new plaintext, and update the new ciphertext and write it into the security device.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images