Access authentication methods, devices, computer equipment and storage media

Abstract

This application relates to an access authentication method, apparatus, computer device, and storage medium. By storing ciphertext in a low-cost security device, two-factor authentication can be achieved with the terminal, making it easy to implement and widely adopted. When using the security device, ciphertext matching is performed. Authentication success is determined by whether a matching ciphertext exists in the security device. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. The new encryption algorithm and the new plaintext are written to the storage device. A new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and this new ciphertext is updated and written to the security device. Since both the encryption algorithm and the plaintext are randomly selected and generated, simply storing the ciphertext in the security device ensures that the terminal cannot access the encryption algorithm or plaintext without password verification, thus achieving complete uncrackability.

Description

Technical Field

[0001] This application relates to the field of server technology, and in particular to an access authentication method, apparatus, computer equipment, and storage medium. Background Technology

[0002] In Linux systems, password security is paramount, as it directly impacts system and data protection. Passwords are the primary means of user authentication, ensuring that only authorized users can access the system and resources. To enhance security, passwords should be completely random and frequently changed, avoiding predictable patterns. However, completely random and frequently changed passwords can lead to problems with password storage and management, and may even result in forgotten passwords. When passwords are not completely random and remain unchanged for extended periods, expensive biometric data collection is required for confidentiality. Therefore, a solution is needed that, without relying on expensive equipment, strengthens the secure access of superuser accounts using non-random, unchanging passwords, is easily implemented and widely adopted on ordinary devices, and that this strengthening method is not easily cracked. Summary of the Invention

[0003] Based on this, an access authentication method, apparatus, computer device, and storage medium are provided to solve the technical problems that currently, to ensure password security, completely random and frequently changing passwords are required, which may lead to passwords being forgotten. In the case of passwords that are not completely random and are not changed for a long time, expensive supporting equipment is needed to collect biometric information to achieve confidentiality, which is difficult to implement and popularize on ordinary devices.

[0004] On the one hand, an access authentication method is provided, the method comprising:

[0005] Detect whether there is an access login request, and in response to receiving an access login request, perform password authentication and determine whether the password matches successfully;

[0006] In response to a successful password match, the system checks whether the storage device contains the encryption algorithm and the plaintext.

[0007] If no encryption algorithm and plaintext are found in the storage device, authentication is successful and access is granted.

[0008] In response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is calculated and obtained based on the encryption algorithm and plaintext in the storage device, and the connection to a security device is detected.

[0009] In response to connecting to the security device, ciphertext matching is performed, and the authentication is determined to be successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0010] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0011] In one embodiment, the step of performing ciphertext matching in response to connecting to the security device, and determining whether authentication is successful based on whether there is ciphertext in the security device that matches the target ciphertext, includes:

[0012] Create a secondary encryption service program and set it to run automatically on startup;

[0013] The secondary encryption service program identifies whether a file with a specified name exists in the root directory of the security device. The file with the specified name is used to store the ciphertext.

[0014] If the file with the specified name does not exist in the root directory of the security device, authentication fails and access is denied.

[0015] In response to the existence of a file with a specified name in the root directory of the security device, it is determined whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0016] If the ciphertext stored in the specified name file does not match the target ciphertext, authentication fails and access is denied.

[0017] If the ciphertext stored in the specified name file matches the target ciphertext, authentication is successful and access is granted.

[0018] In one embodiment, the method further includes:

[0019] In response to the existence of a file with a specified name in the root directory of the security device, and the ciphertext stored in the file with the specified name being inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device remain unchanged, and the ciphertext stored in the file with the specified name remains unchanged.

[0020] In one embodiment, the method further includes:

[0021] If the security device is not connected, the secondary encryption service program fails to start and an error message is displayed prompting the user to connect to the security device.

[0022] In response to connecting to the security device, a secondary encryption service program is initiated. If no ciphertext is found in the security device, an encryption algorithm is randomly selected, a piece of plaintext is randomly generated, the ciphertext is calculated and obtained, and then written into the security device. The encryption algorithm and plaintext are written into the storage device, the login is exited, and the connection with the security device is disconnected.

[0023] In one embodiment, the step of determining whether an encryption algorithm and plaintext exist in the storage device in response to a successful password match includes:

[0024] When the password is successfully matched, the file storing the encryption algorithm and plaintext in the storage device is read. If the file storing the encryption algorithm and plaintext in the storage device does not exist, and / or the file is blank, and / or the file content format is incorrect, causing the reading to fail, it is determined that the encryption algorithm and plaintext do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plaintext exist in the storage device.

[0025] In one embodiment, the method further includes:

[0026] If the password does not match, authentication fails, access is denied, and an incorrect password message is displayed.

[0027] If the storage device contains both encryption algorithm and plaintext, and the security device is not connected, authentication fails, access is denied, and a message is displayed indicating that no security device is inserted.

[0028] In response to a successful password match, before determining whether authentication is successful based on whether there is a ciphertext matching the target ciphertext in the security device, the system continuously checks whether the connected security device has been disconnected; if the security device is disconnected, authentication fails and access is denied.

[0029] In one embodiment, the steps of randomly selecting a new encryption algorithm, randomly generating a new plaintext, writing the new encryption algorithm and the new plaintext into a storage device, calculating and obtaining a new ciphertext based on the new encryption algorithm and the new plaintext, and updating and writing the new ciphertext into the security device include:

[0030] Multiple encryption algorithms are preset, and the length threshold of the generated plaintext can be set;

[0031] When randomly selecting a new encryption algorithm, an encryption algorithm different from the encryption algorithm in the current storage device is selected as the new encryption algorithm, and a new plaintext is randomly generated according to the length threshold of the generated plaintext. The new ciphertext is then calculated and obtained based on the new encryption algorithm and the new plaintext.

[0032] The new encryption algorithm and the new plaintext are written into the storage device, and the new ciphertext is updated and written into the security device.

[0033] On the other hand, an access authentication device is provided, the device comprising:

[0034] The password authentication module is used to detect whether there is an access login request. In response to receiving an access login request, it performs password authentication and determines whether the password matches successfully.

[0035] The secondary authentication module is used to determine whether an encryption algorithm and plaintext exist in the storage device in response to a successful password match; if no encryption algorithm and plaintext exist in the storage device, authentication is successful and access is allowed; if an encryption algorithm and plaintext exist in the storage device, the target ciphertext is calculated based on the encryption algorithm and plaintext in the storage device, and the connection to the security device is checked.

[0036] The authentication process module is used to perform ciphertext matching in response to connecting to the security device, and to determine whether the authentication is successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0037] The encryption update module is used to, in response to successful authentication, randomly select a new encryption algorithm, randomly generate a new plaintext, write the new encryption algorithm and the new plaintext into a storage device, calculate and obtain a new ciphertext based on the new encryption algorithm and the new plaintext, and update and write the new ciphertext into the security device.

[0038] In another aspect, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0039] Detect whether there is an access login request, and in response to receiving an access login request, perform password authentication and determine whether the password matches successfully;

[0040] In response to a successful password match, the system checks whether the storage device contains the encryption algorithm and the plaintext.

[0041] If no encryption algorithm and plaintext are found in the storage device, authentication is successful and access is granted.

[0042] In response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is calculated and obtained based on the encryption algorithm and plaintext in the storage device, and the connection to a security device is detected.

[0043] In response to connecting to the security device, ciphertext matching is performed, and the authentication is determined to be successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0044] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0045] In another aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0046] Detect whether there is an access login request, and in response to receiving an access login request, perform password authentication and determine whether the password matches successfully;

[0047] In response to a successful password match, the system checks whether the storage device contains the encryption algorithm and the plaintext.

[0048] If no encryption algorithm and plaintext are found in the storage device, authentication is successful and access is granted.

[0049] In response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is calculated and obtained based on the encryption algorithm and plaintext in the storage device, and the connection to a security device is detected.

[0050] In response to connecting to the security device, ciphertext matching is performed, and the authentication is determined to be successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0051] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0052] The aforementioned access authentication method, device, computer equipment, and storage medium can achieve two-factor authentication using a low-cost security device storing ciphertext, making it easy to implement and widely adopted. When the security device is not used, neither the encryption algorithm nor the plaintext is stored on the terminal's storage device; successful password matching grants authentication and access. When the security device is used, ciphertext matching is performed. Authentication is determined by whether a matching ciphertext exists in the security device. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. The new encryption algorithm and the new plaintext are written to the storage device. A new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and then updated and written to the security device. Since both the encryption algorithm and the plaintext are randomly selected and generated, only the ciphertext is stored in the security device. Without password verification, the terminal cannot know the encryption algorithm or the plaintext, thus achieving complete uncrackability. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a diagram illustrating the application environment of an access authentication method in one embodiment of this application.

[0055] Figure 2 This is a flowchart illustrating an access authentication method in one embodiment of this application;

[0056] Figure 3 This is a schematic diagram illustrating the operation of a secondary encryption service program in one embodiment of this application;

[0057] Figure 4 This is a logic diagram of the cryptographic authentication process in one embodiment of this application;

[0058] Figure 5 This is a schematic diagram illustrating the process of generating and saving encrypted data in one embodiment of this application;

[0059] Figure 6 This is a distribution diagram of authentication status in one embodiment of this application, using a USB flash drive as an example of a security device;

[0060] Figure 7 This is a structural block diagram of an access authentication device in one embodiment of this application;

[0061] Figure 8 This is an internal structural diagram of a computer device in one embodiment of this application. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0063] Common encryption algorithms include: hash algorithms, which are techniques that use mathematical methods to generate a fixed-length unique identifier for data, and can be used to verify the integrity and consistency of data. Common hash algorithms include MD, SHA, and MAC; symmetric encryption algorithms, which use the same key for encryption and decryption, and can be used to protect the security and confidentiality of data. Common symmetric encryption algorithms include DES, 3DES, and AES; and asymmetric encryption algorithms, which use different keys for encryption and decryption, and can be used to achieve secure data transmission and authentication. Common asymmetric encryption algorithms include RSA, DSA, and ECC.

[0064] To further enhance secure access to Linux machines, biometric technologies such as fingerprint or iris recognition have become an effective solution in addition to traditional password authentication. These biometric methods leverage a user's unique physiological characteristics, making authentication more secure and difficult to forge. Fingerprint recognition devices can quickly scan a user's fingerprint, ensuring that only authorized users can access the system. Meanwhile, iris recognition technology provides a highly secure authentication method because the uniqueness and difficulty in replicating the pupil make this method extremely advantageous in preventing unauthorized access. This combination of multi-factor authentication not only improves security but also reduces reliance on traditional passwords, lowering the risk of password guessing or leakage. By implementing these advanced authentication methods, Linux systems can more effectively defend against potential security threats and protect critical data and resources.

[0065] While fingerprint and iris recognition technologies offer significant advantages in security, they also have some drawbacks.

[0066] The disadvantages of fingerprint recognition include:

[0067] Counterfeiting risk: Although fingerprints are unique, advanced technology can create fake fingerprints, leading to security risks.

[0068] Environmental impact: Dirt, sweat, or grease may affect the recognition accuracy of the fingerprint sensor.

[0069] Injury issues: Recognition may fail in response to finger injuries or skin conditions.

[0070] Equipment cost: High-quality fingerprint recognition equipment is relatively expensive, which increases deployment costs.

[0071] Privacy issues: Once a user's biometric information is leaked, it cannot be changed, which may lead to privacy and security problems.

[0072] The disadvantages of pupil recognition include:

[0073] High cost: Illumination recognition devices are typically more expensive than fingerprint recognition devices, which limits their widespread adoption.

[0074] Light dependence: The recognition process is sensitive to light conditions; low light or strong light environments may lead to recognition difficulties.

[0075] Crowd-related factors: Pupil recognition in crowded environments may be subject to interference, reducing accuracy.

[0076] Eye health issues: Certain eye diseases or conditions may affect recognition performance and lead to failure.

[0077] Privacy concerns: The use of iris recognition may raise concerns among users about biometric surveillance and privacy violations.

[0078] To address the aforementioned issues, this invention creatively proposes an access authentication method that enhances the security of superuser accounts even when the superuser password is not completely random and remains unchanged over a long period. Furthermore, this enhancement method is not easily cracked. Moreover, it does not rely on expensive supporting equipment, making it easy to implement and widely adopted.

[0079] The access authentication method provided in this application can be applied to, for example... Figure 1 The application environment shown is as follows. Terminal 101 is a dedicated device that can be rooted and accessed via a root password. Terminal 101 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. It can also be implemented using a standalone server or a server cluster consisting of multiple servers. Terminal 101 has a storage device, preferably a hard drive, which contains files for storing encryption algorithms and plaintext. A security device 102, a removable device such as a USB flash drive, can be plugged into Terminal 101. A file with a specified name is set in the root directory of the security device 102 to store the encrypted text. Initially, the files on the storage device in Terminal 101 are empty, containing neither encryption algorithms nor plaintext. At this time, there is no need to connect to the security device 102; access is possible only with the root password. In the second instance, if security device 102 connects to terminal 101, after logging in with the root password, a random encryption algorithm is selected, a piece of plaintext is randomly generated, and the encryption algorithm and the plaintext are written to the storage device. Ciphertext is then calculated based on the encryption algorithm and the plaintext, and the ciphertext is updated and written to security device 102. In the third instance, if security device 102 connects to terminal 101 again, after logging in with the root password, ciphertext matching is performed. The target ciphertext is calculated based on the encryption algorithm and plaintext in terminal 101's storage device. The existence of a matching ciphertext in security device 102 determines whether authentication is successful. If authentication is successful, a new encryption algorithm is randomly selected, a new piece of plaintext is randomly generated, and the new encryption algorithm and the new plaintext are written to the storage device. A new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written to security device 102.

[0080] In one embodiment, such as Figure 2 , Figure 3 , Figure 4 As shown, an access authentication method is provided, which is applied to... Figure 1Taking terminal 101 as an example, the explanation includes the following steps:

[0081] Detect whether there is an access login request, and in response to receiving an access login request, perform password authentication and determine whether the password matches successfully;

[0082] In response to a successful password match, the system checks whether the storage device contains the encryption algorithm and the plaintext.

[0083] If no encryption algorithm and plaintext are found in the storage device, authentication is successful and access is granted.

[0084] In response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is calculated and obtained based on the encryption algorithm and plaintext in the storage device, and the connection to a security device is detected.

[0085] In response to connecting to the security device, ciphertext matching is performed, and the authentication is determined to be successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0086] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0087] The login request is a superuser privilege login request, which is root login. Password authentication is performed, primarily verifying the root password when checking for a successful password match. Upon termination of access, the security device is removed.

[0088] Specifically, storing ciphertext in a low-cost security device allows for two-factor authentication with the terminal, making it easy to implement and widely adopted. When the security device is not in use, neither the encryption algorithm nor the plaintext is stored on the terminal's storage; successful password matching grants authentication and access. When the security device is in use, ciphertext matching is performed. Authentication is determined by whether a matching ciphertext exists in the security device. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. Both the new encryption algorithm and the new plaintext are written to the storage device. A new ciphertext is then calculated based on the new encryption algorithm and the new plaintext, and updated and written to the security device. Since both the encryption algorithm and the plaintext are randomly selected and generated, only the ciphertext is stored in the security device. Without password verification, the terminal cannot know the encryption algorithm or the plaintext, thus achieving complete uncrackability.

[0089] In this embodiment, the step of performing ciphertext matching in response to connecting to the security device, and determining whether authentication is successful based on whether there is ciphertext in the security device that matches the target ciphertext, includes:

[0090] Create a secondary encryption service program and set it to run automatically on startup;

[0091] The secondary encryption service program identifies whether a file with a specified name exists in the root directory of the security device. The file with the specified name is used to store the ciphertext.

[0092] If the file with the specified name does not exist in the root directory of the security device, authentication fails and access is denied.

[0093] In response to the existence of a file with a specified name in the root directory of the security device, it is determined whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0094] If the ciphertext stored in the specified name file does not match the target ciphertext, authentication fails and access is denied.

[0095] If the ciphertext stored in the specified name file matches the target ciphertext, authentication is successful and access is granted.

[0096] like Figure 3 As shown, the secondary encryption service program is an eBPF service program. When the service starts, it loads and runs an eBPF program (LSM program type). This eBPF program performs a second round of enhanced access control after successful root password authentication. The encryption algorithm and plaintext for enhanced access control are encrypted and stored in the storage device. If the encryption algorithm and plaintext exist in the storage device, they will be read into memory during program loading and used in the authentication process. If the file storing the encryption algorithm and plaintext does not exist in the storage device, or the file is blank, or the file content format is incorrect, causing the read to fail, the eBPF program will consider the encryption algorithm and plaintext to be empty. In this case, the enhanced authentication process will not be performed, which is equivalent to only using the root password for verification.

[0097] eBPF, short for Extended Berkeley Packet Filter, is a packet filtering technology that provides a mechanism for secure code injection during kernel and user program events. It has since been extended to networking, kernel, security, and tracing, finding widespread application in fault diagnosis, network optimization, security control, and performance monitoring. A core concept in eBPF is the "map," a special data structure used to store and share data between the eBPF program and user space.

[0098] Linux Security Modules (LSM) is a lightweight, general-purpose access control framework that allows user-space security modules to extend and enhance the security features of the Linux kernel. The design principle of LSM is to remain transparent to those who do not need it, while allowing those who do need it to focus on developing control policies and security modules. As a flexible interface, LSM enables developers to implement various security policies, including access control, mandatory access control, and auditing, thereby helping system administrators better protect system resources, data, and user privacy.

[0099] like Figure 4 As shown, the authentication process is as follows: Ciphertext data is stored in the security device. When the security device is inserted, the probe function is executed to initialize the device. At this time, the ciphertext data is read from the security device and passed to the kernel via the eBPF map. During login, after the root password is successfully matched, if the algorithm and plaintext exist in memory, the ciphertext is calculated using the algorithm and plaintext in memory and matched against the ciphertext in the security device: If the security device (removable device) does not exist, authentication fails and access is denied; if the file with the specified name does not exist in the root directory of the security device, authentication fails and access is denied; if the file with the specified name exists in the root directory of the security device, and the file content does not match the current ciphertext, authentication fails and access is denied; if the file with the specified name exists in the root directory of the security device, and the file content matches the current ciphertext, authentication succeeds and access is allowed.

[0100] If needed, encrypted data can be saved to multiple security devices, thus enabling multiple "keys." However, once one key is activated, the others cannot be used again.

[0101] If there are multiple security devices ("keys") on the device at the same time, there are various logics, such as: using the last inserted device as the reference and automatically overwriting the previous ciphertext; or storing multiple ciphertexts in memory at the same time and matching them with all the ciphertexts during the authentication process, and a successful match is achieved as long as one of them matches.

[0102] Therefore, in this embodiment, the method further includes:

[0103] The storage device stores at least one unique identification code of a security device, and uses the unique identification code stored in the storage device to determine whether the connected security device is a valid key;

[0104] If the unique identifier of the connected security device matches in the storage device, then a ciphertext match is performed; otherwise, authentication fails, access is denied, and the connected security device is not a valid key.

[0105] In this embodiment, the method further includes:

[0106] In response to the existence of a file with a specified name in the root directory of the security device, and the ciphertext stored in the file with the specified name being inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device remain unchanged, and the ciphertext stored in the file with the specified name remains unchanged.

[0107] More specifically, such as Figure 5 As shown, during login, after the root password is successfully matched, if the secondary encryption service program is running (i.e., the EBPF program is running; when the service starts, it reads the algorithm and plaintext from a specific file on the storage device from the last ciphertext generation and stores them in memory; additionally, when generating ciphertext data, it also saves the randomly selected algorithm and plaintext in memory, and also saves them to a specific file on the storage device for use the next time the service starts), it uses the algorithm and plaintext in memory to calculate and obtain the ciphertext. If the file with the specified name does not exist in the root directory of the enhanced device, the obtained ciphertext is directly written to the file with the specified name; if the file with the specified name exists in the root directory of the enhanced device, and the file content is consistent with the current ciphertext, a random algorithm is selected, a random plaintext is generated, and a new ciphertext is calculated and obtained, and then the new ciphertext is updated and written to the file with the specified name in the security device (the randomly selected algorithm and plaintext are also synchronously updated / saved to the specified file on the storage device); if the file content is inconsistent with the current ciphertext, the login fails, and in this case, the algorithm, plaintext, and ciphertext will not be updated (the memory, security device, and storage device will not be updated).

[0108] like Figure 4 , Figure 5 As shown, in this embodiment, the method further includes:

[0109] If the security device is not connected, the secondary encryption service program fails to start and an error message is displayed prompting the user to connect to the security device.

[0110] In response to connecting to the security device, a secondary encryption service program is initiated. If no ciphertext is found in the security device, an encryption algorithm is randomly selected, a piece of plaintext is randomly generated, the ciphertext is calculated and obtained, and then written into the security device. The encryption algorithm and plaintext are written into the storage device, the login is exited, and the connection with the security device is disconnected.

[0111] In this embodiment, the step of determining whether an encryption algorithm and plaintext exist in the storage device in response to a successful password match includes:

[0112] When the password is successfully matched, the file storing the encryption algorithm and plaintext in the storage device is read. If the file storing the encryption algorithm and plaintext in the storage device does not exist, and / or the file is blank, and / or the file content format is incorrect, causing the reading to fail, it is determined that the encryption algorithm and plaintext do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plaintext exist in the storage device.

[0113] like Figure 4 , Figure 5 As shown, in this embodiment, the method further includes:

[0114] If the password does not match, authentication fails, access is denied, and an incorrect password message is displayed.

[0115] If the storage device contains both encryption algorithm and plaintext, and the security device is not connected, authentication fails, access is denied, and a message is displayed indicating that no security device is inserted.

[0116] This situation occurs when the root password verification passes, but the connection to the security device is not detected, thus preventing the completion of the secondary ciphertext comparison verification.

[0117] In this embodiment, the method further includes:

[0118] In response to a successful password match, before determining whether authentication is successful based on whether there is a ciphertext in the security device that matches the target ciphertext, the system continuously detects whether the connected security device has been disconnected.

[0119] If the security device is unplugged, authentication fails and access is denied.

[0120] like Figure 6 As shown, the following explanation uses a USB flash drive as the security device. Assume there is a USB flash drive as the security device; the ebpf program already exists, and the corresponding service has been created (but not started).

[0121] Initially, the target machine has not undergone any security enhancements, and users can log in successfully using the root password.

[0122] When the USB drive is not inserted, the ebpf service fails to start, reporting an error that a security device cannot be found.

[0123] Insert the USB drive, start the ebpf secondary encryption service program, find that the specified file (to save the ciphertext) does not exist on the USB drive, randomly select an encryption algorithm, randomly generate a piece of plaintext, calculate and obtain the ciphertext and write it to the specified file on the USB drive; and write the encryption algorithm and plaintext to the storage device (fixed path, for easy reading and loading later), log out and unplug the USB drive;

[0124] When no USB drive is inserted, logging in with root and password fails, prompting an incorrect password or two-factor authentication failure.

[0125] Insert the USB drive, log in using root and password, read the encryption algorithm and plaintext from the storage device, calculate the ciphertext, and then compare it with the ciphertext in the specified file on the USB drive. If they match, the login is successful; otherwise, the login fails.

[0126] The secondary security enhancement employs the EBPF program, controlled as a service for easy activation and deactivation. Both the encryption algorithm and plaintext are randomly selected and generated; only the ciphertext is saved to the secure device. Without root access, the target device cannot know the encryption algorithm or plaintext, making it completely uncrackable. This secondary security enhancement can be implemented using inexpensive, common, and compact mobile devices such as USB flash drives, making it simple and convenient to implement.

[0127] In the above access authentication method, ciphertext can be stored in a low-cost security device to achieve two-factor authentication with the terminal, making it easy to implement and widely adopted. When the security device is not used, neither the encryption algorithm nor the plaintext is stored on the terminal's storage device; successful password matching results in successful authentication and access is granted. When the security device is used, ciphertext matching is performed. The existence of a matching ciphertext in the security device determines successful authentication. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. The new encryption algorithm and the new plaintext are written to the storage device. A new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and this new ciphertext is updated and written to the security device. Since both the encryption algorithm and the plaintext are randomly selected and generated, only the ciphertext is stored in the security device. Without password verification, the terminal cannot know the encryption algorithm or the plaintext, thus achieving complete uncrackability.

[0128] In one embodiment, such as Figure 7 As shown, an access authentication device 10 is provided, including: a password authentication module 1, a secondary enhanced authentication module 2, an authentication process module 3, and an encryption update module 4.

[0129] The password authentication module 1 is used to detect whether there is an access login request. In response to receiving an access login request, it performs password authentication and determines whether the password matches successfully.

[0130] The secondary enhanced authentication module 2 is used to determine whether an encryption algorithm and plaintext exist in the storage device in response to a successful password match; if no encryption algorithm and plaintext exist in the storage device, authentication is successful and access is allowed; if an encryption algorithm and plaintext exist in the storage device, the target ciphertext is calculated based on the encryption algorithm and plaintext in the storage device, and the connection to the security device is checked.

[0131] The authentication process module 3 is used to perform ciphertext matching in response to connecting to the security device, and to determine whether the authentication is successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0132] The encryption update module 4 is used to respond to successful authentication by randomly selecting a new encryption algorithm, randomly generating a new plaintext, writing the new encryption algorithm and the new plaintext into the storage device, calculating and obtaining a new ciphertext based on the new encryption algorithm and the new plaintext, and updating and writing the new ciphertext into the security device.

[0133] In this embodiment, the step of performing ciphertext matching in response to connecting to the security device, and determining whether authentication is successful based on whether there is ciphertext in the security device that matches the target ciphertext, includes:

[0134] Create a secondary encryption service program and set it to run automatically on startup;

[0135] The secondary encryption service program identifies whether a file with a specified name exists in the root directory of the security device. The file with the specified name is used to store the ciphertext.

[0136] If the file with the specified name does not exist in the root directory of the security device, authentication fails and access is denied.

[0137] In response to the existence of a file with a specified name in the root directory of the security device, it is determined whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0138] If the ciphertext stored in the specified name file does not match the target ciphertext, authentication fails and access is denied.

[0139] If the ciphertext stored in the specified name file matches the target ciphertext, authentication is successful and access is granted.

[0140] In this embodiment, the encryption update module 4 is used to respond to the existence of a file with a specified name in the root directory of the security device, and the ciphertext stored in the file with the specified name is inconsistent with the target ciphertext, by keeping the encryption algorithm and plaintext in the storage device unchanged, and keeping the ciphertext stored in the file with the specified name unchanged.

[0141] In this embodiment, the password authentication module 1 is used to respond to a password failure, such as authentication failure, access denial, and password error message.

[0142] In this embodiment, the step of determining whether an encryption algorithm and plaintext exist in the storage device in response to a successful password match includes:

[0143] When the password is successfully matched, the file storing the encryption algorithm and plaintext in the storage device is read. If the file storing the encryption algorithm and plaintext in the storage device does not exist, and / or the file is blank, and / or the file content format is incorrect, causing the reading to fail, it is determined that the encryption algorithm and plaintext do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plaintext exist in the storage device.

[0144] In this embodiment, the authentication process module 3 is used to respond to the presence of encryption algorithm and plaintext in the storage device and the fact that the security device is not connected, in which case authentication fails, access is denied, and a message is displayed indicating that the security device is not inserted.

[0145] like Figure 7 As shown, in this embodiment, the access authentication device 10 further includes a security device removal detection module 5.

[0146] The security device unplug detection module 5 is used to detect in real time whether the connected security device is unplugged after a successful password match, before determining whether the authentication is successful based on whether there is a ciphertext in the security device that matches the target ciphertext; if the security device is unplugged, the authentication fails and access is denied.

[0147] In the aforementioned access authentication device, ciphertext storage via a low-cost security device is sufficient for secondary ciphertext verification with the terminal, making it easy to implement and widely adopted. When the security device is not in use, neither the encryption algorithm nor the plaintext is stored on the terminal's storage device; successful password matching grants authentication and access. When the security device is in use, ciphertext matching is performed. The presence of a matching ciphertext in the security device determines successful authentication. After each successful authentication, a new encryption algorithm is randomly selected, and a new plaintext is randomly generated. Both the new encryption algorithm and the new plaintext are written to the storage device. A new ciphertext is then calculated based on the new encryption algorithm and the new plaintext, and updated and written to the security device. Since both the encryption algorithm and the plaintext are randomly selected and generated, and only the ciphertext is stored in the security device, the terminal cannot know the encryption algorithm or plaintext without successful password verification, thus achieving complete uncrackability.

[0148] For specific limitations regarding the access authentication device, please refer to the limitations on the access authentication method above, which will not be repeated here. Each module in the aforementioned access authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the operations corresponding to each module.

[0149] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0150] Detect whether there is an access login request, and in response to receiving an access login request, perform password authentication and determine whether the password matches successfully;

[0151] In response to a successful password match, the system checks whether the storage device contains the encryption algorithm and the plaintext.

[0152] If no encryption algorithm and plaintext are found in the storage device, authentication is successful and access is granted.

[0153] In response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is calculated and obtained based on the encryption algorithm and plaintext in the storage device, and the connection to a security device is detected.

[0154] In response to connecting to the security device, ciphertext matching is performed, and the authentication is determined to be successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0155] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0156] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0157] In response to connecting to the security device, ciphertext matching is performed, and the determination of whether authentication is successful is based on whether there is ciphertext in the security device that matches the target ciphertext.

[0158] Create a secondary encryption service program and set it to run automatically on startup;

[0159] The secondary encryption service program identifies whether a file with a specified name exists in the root directory of the security device. The file with the specified name is used to store the ciphertext.

[0160] If the file with the specified name does not exist in the root directory of the security device, authentication fails and access is denied.

[0161] In response to the existence of a file with a specified name in the root directory of the security device, it is determined whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0162] If the ciphertext stored in the specified name file does not match the target ciphertext, authentication fails and access is denied.

[0163] If the ciphertext stored in the specified name file matches the target ciphertext, authentication is successful and access is granted.

[0164] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0165] In response to the existence of a file with a specified name in the root directory of the security device, and the ciphertext stored in the file with the specified name being inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device remain unchanged, and the ciphertext stored in the file with the specified name remains unchanged.

[0166] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0167] If the password does not match, authentication fails, access is denied, and an incorrect password message is displayed.

[0168] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0169] The response to a successful password match includes determining whether an encryption algorithm and plaintext exist in the storage device:

[0170] When the password is successfully matched, the file storing the encryption algorithm and plaintext in the storage device is read. If the file storing the encryption algorithm and plaintext in the storage device does not exist, and / or the file is blank, and / or the file content format is incorrect, causing the reading to fail, it is determined that the encryption algorithm and plaintext do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plaintext exist in the storage device.

[0171] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0172] If the storage device contains both encryption algorithm and plaintext, and the security device is not connected, authentication fails, access is denied, and a message is displayed indicating that no security device is inserted.

[0173] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0174] In response to a successful password match, before determining whether authentication is successful based on whether there is a ciphertext in the security device that matches the target ciphertext, the system continuously detects whether the connected security device has been disconnected.

[0175] If the security device is unplugged, authentication fails and access is denied.

[0176] For specific limitations on the steps implemented when a computer program is executed by a processor, please refer to the limitations on access authentication methods mentioned above, which will not be repeated here.

[0177] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an access authentication method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0178] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0179] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0180] Detect whether there is an access login request, and in response to receiving an access login request, perform password authentication and determine whether the password matches successfully;

[0181] In response to a successful password match, the system checks whether the storage device contains the encryption algorithm and the plaintext.

[0182] If no encryption algorithm and plaintext are found in the storage device, authentication is successful and access is granted.

[0183] In response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is calculated and obtained based on the encryption algorithm and plaintext in the storage device, and the connection to a security device is detected.

[0184] In response to connecting to the security device, ciphertext matching is performed, and the authentication is determined to be successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0185] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0186] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0187] In response to connecting to the security device, ciphertext matching is performed, and the determination of whether authentication is successful is based on whether there is ciphertext in the security device that matches the target ciphertext.

[0188] Create a secondary encryption service program and set it to run automatically on startup;

[0189] The secondary encryption service program identifies whether a file with a specified name exists in the root directory of the security device. The file with the specified name is used to store the ciphertext.

[0190] If the file with the specified name does not exist in the root directory of the security device, authentication fails and access is denied.

[0191] In response to the existence of a file with a specified name in the root directory of the security device, it is determined whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0192] If the ciphertext stored in the specified name file does not match the target ciphertext, authentication fails and access is denied.

[0193] If the ciphertext stored in the specified name file matches the target ciphertext, authentication is successful and access is granted.

[0194] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0195] In response to the existence of a file with a specified name in the root directory of the security device, and the ciphertext stored in the file with the specified name being inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device remain unchanged, and the ciphertext stored in the file with the specified name remains unchanged.

[0196] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0197] If the password does not match, authentication fails, access is denied, and an incorrect password message is displayed.

[0198] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0199] The response to a successful password match includes determining whether an encryption algorithm and plaintext exist in the storage device:

[0200] When the password is successfully matched, the file storing the encryption algorithm and plaintext in the storage device is read. If the file storing the encryption algorithm and plaintext in the storage device does not exist, and / or the file is blank, and / or the file content format is incorrect, causing the reading to fail, it is determined that the encryption algorithm and plaintext do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plaintext exist in the storage device.

[0201] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0202] If the storage device contains both encryption algorithm and plaintext, and the security device is not connected, authentication fails, access is denied, and a message is displayed indicating that no security device is inserted.

[0203] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0204] In response to a successful password match, before determining whether authentication is successful based on whether there is a ciphertext in the security device that matches the target ciphertext, the system continuously detects whether the connected security device has been disconnected.

[0205] If the security device is unplugged, authentication fails and access is denied.

[0206] For specific limitations on the steps a processor takes when executing a computer program, please refer to the limitations on access authentication methods mentioned above, which will not be repeated here.

[0207] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0208] Detect whether there is an access login request, and in response to receiving an access login request, perform password authentication and determine whether the password matches successfully;

[0209] In response to a successful password match, the system checks whether the storage device contains the encryption algorithm and the plaintext.

[0210] If no encryption algorithm and plaintext are found in the storage device, authentication is successful and access is granted.

[0211] In response to the presence of an encryption algorithm and plaintext in the storage device, the target ciphertext is calculated and obtained based on the encryption algorithm and plaintext in the storage device, and the connection to a security device is detected.

[0212] In response to connecting to the security device, ciphertext matching is performed, and the authentication is determined to be successful based on whether there is a ciphertext in the security device that matches the target ciphertext.

[0213] In response to successful authentication, a new encryption algorithm is randomly selected, a new plaintext is randomly generated, the new encryption algorithm and the new plaintext are written into the storage device, a new ciphertext is calculated based on the new encryption algorithm and the new plaintext, and the new ciphertext is updated and written into the security device.

[0214] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0215] In response to connecting to the security device, ciphertext matching is performed, and the determination of whether authentication is successful is based on whether there is ciphertext in the security device that matches the target ciphertext.

[0216] Create a secondary encryption service program and set it to run automatically on startup;

[0217] The secondary encryption service program identifies whether a file with a specified name exists in the root directory of the security device. The file with the specified name is used to store the ciphertext.

[0218] If the file with the specified name does not exist in the root directory of the security device, authentication fails and access is denied.

[0219] In response to the existence of a file with a specified name in the root directory of the security device, it is determined whether the ciphertext stored in the file with the specified name is consistent with the target ciphertext;

[0220] If the ciphertext stored in the specified name file does not match the target ciphertext, authentication fails and access is denied.

[0221] If the ciphertext stored in the specified name file matches the target ciphertext, authentication is successful and access is granted.

[0222] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0223] In response to the existence of a file with a specified name in the root directory of the security device, and the ciphertext stored in the file with the specified name being inconsistent with the target ciphertext, the encryption algorithm and plaintext in the storage device remain unchanged, and the ciphertext stored in the file with the specified name remains unchanged.

[0224] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0225] If the password does not match, authentication fails, access is denied, and an incorrect password message is displayed.

[0226] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0227] The response to a successful password match includes determining whether an encryption algorithm and plaintext exist in the storage device:

[0228] When the password is successfully matched, the file storing the encryption algorithm and plaintext in the storage device is read. If the file storing the encryption algorithm and plaintext in the storage device does not exist, and / or the file is blank, and / or the file content format is incorrect, causing the reading to fail, it is determined that the encryption algorithm and plaintext do not exist in the storage device; otherwise, it is determined that the encryption algorithm and plaintext exist in the storage device.

[0229] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0230] If the storage device contains both encryption algorithm and plaintext, and the security device is not connected, authentication fails, access is denied, and a message is displayed indicating that no security device is inserted.

[0231] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0232] In response to a successful password match, before determining whether authentication is successful based on whether there is a ciphertext in the security device that matches the target ciphertext, the system continuously detects whether the connected security device has been disconnected.

[0233] If the security device is unplugged, authentication fails and access is denied.

[0234] For specific limitations on the steps implemented when a computer program is executed by a processor, please refer to the limitations on access authentication methods mentioned above, which will not be repeated here.

[0235] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0236] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0237] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An access authentication method characterized by, The method comprises: detecting whether there is an access login request, in response to receiving an access login request, performing password authentication, and determining whether the password matches successfully; in response to the password matching successfully, determining whether the encryption algorithm and the plaintext exist in the storage device; in response to the storage device not containing the encryption algorithm and the plaintext, the authentication is successful; in response to the storage device containing the encryption algorithm and the plaintext, calculating the target ciphertext according to the encryption algorithm and the plaintext in the storage device, and detecting whether the security device is connected; in response to connecting the security device, performing ciphertext matching, and determining whether the authentication is successful according to whether the ciphertext consistent with the target ciphertext exists in the security device; in response to the authentication being successful, randomly selecting a new encryption algorithm, randomly generating a new plaintext, writing the new encryption algorithm and the new plaintext into the storage device, calculating a new ciphertext according to the new encryption algorithm and the new plaintext, and updating and writing the new ciphertext into the security device.

2. The access authentication method according to claim 1, characterized in that, The response to connecting the security device includes: creating a secondary encryption service program and setting it to an automatic startup mode; the secondary encryption service program identifies whether a specified name file exists in the root directory of the security device, and the specified name file is used to save the ciphertext; in response to the specified name file not existing in the root directory of the security device, the authentication fails and access is denied; in response to the specified name file existing in the root directory of the security device, determining whether the ciphertext saved in the specified name file is consistent with the target ciphertext; in response to the ciphertext saved in the specified name file being inconsistent with the target ciphertext, the authentication fails and access is denied; in response to the ciphertext saved in the specified name file being consistent with the target ciphertext, the authentication is successful and access is allowed.

3. The access authentication method according to claim 2, wherein The method further comprises: in response to the specified name file existing in the root directory of the security device and the ciphertext saved in the specified name file being inconsistent with the target ciphertext, keeping the encryption algorithm and the plaintext in the storage device unchanged, and keeping the ciphertext saved in the specified name file unchanged.

4. The access authentication method of claim 1, wherein, The method further comprises: in response to not connecting the security device, starting the secondary encryption service program fails, and an error prompt is given to connect the security device; in response to connecting the security device, starting the secondary encryption service program, randomly selecting an encryption algorithm when the ciphertext is found not to exist in the security device, randomly generating a plaintext, writing the ciphertext into the security device after calculating, writing the encryption algorithm and the plaintext into the storage device, exiting the login and disconnecting the connection with the security device.

5. The access authentication method of claim 1, wherein, The response to the password matching successfully includes: When the password matches successfully, a file storing the encryption algorithm and the plaintext in the storage device is read. If the file storing the encryption algorithm and the plaintext in the storage device does not exist, and / or the file is a blank file, and / or the file content is in a wrong format, the reading fails, it is determined that the encryption algorithm and the plaintext do not exist in the storage device, otherwise it is determined that the encryption algorithm and the plaintext exist in the storage device.

6. The access authentication method of claim 1, wherein, The method further comprises: In response to the password not matching successfully, the authentication fails, access is denied, and a password error is prompted; In response to the encryption algorithm and the plaintext existing in the storage device and the security device not being connected, the authentication fails, access is denied, and a security device not being inserted is prompted; In response to the password matching successfully, before determining whether the authentication is successfully completed according to whether the ciphertext consistent with the target ciphertext exists in the security device, it is detected in real time whether the connected security device is pulled out. If the security device is pulled out, the authentication fails, and access is denied.

7. The access authentication method of claim 1, wherein, The random selection of a new encryption algorithm, the random generation of a new plaintext, the writing of the new encryption algorithm and the new plaintext into the storage device, the calculation of a new ciphertext according to the new encryption algorithm and the new plaintext, and the updating and writing of the new ciphertext into the security device comprise: A plurality of encryption algorithms are preset, and a length threshold of the generated plaintext is set; In the random selection of a new encryption algorithm, an encryption algorithm different from the encryption algorithm in the current storage device is selected as the new encryption algorithm, a new plaintext is randomly generated according to the length threshold of the generated plaintext, and a new ciphertext is calculated according to the new encryption algorithm and the new plaintext; The new encryption algorithm and the new plaintext are written into the storage device, and the new ciphertext is updated and written into the security device.

8. An access authentication apparatus characterized by comprising: The device comprises: A password authentication module configured to detect whether an access login request exists, and in response to receiving the access login request, perform password authentication and determine whether the password matches successfully; A secondary reinforcement authentication module configured to, in response to the password matching successfully, determine whether an encryption algorithm and a plaintext exist in a storage device, in response to the encryption algorithm and the plaintext not existing in the storage device, determine that the authentication is successful and access is allowed, and in response to the encryption algorithm and the plaintext existing in the storage device, calculate a target ciphertext according to the encryption algorithm and the plaintext in the storage device and detect whether a security device is connected; An authentication process module configured to, in response to the security device being connected, perform ciphertext matching and determine whether the authentication is successful according to whether a ciphertext consistent with the target ciphertext exists in the security device; An encryption updating module configured to, in response to the authentication being successful, randomly select a new encryption algorithm, randomly generate a new plaintext, write the new encryption algorithm and the new plaintext into the storage device, calculate a new ciphertext according to the new encryption algorithm and the new plaintext, and update and write the new ciphertext into the security device.

9. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the method of any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the steps of the method of any one of claims 1 to 7 when executed by the processor.

Images