Mobile user access authentication method and device for resisting multi-system cross attack

Abstract

The invention provides a mobile user access authentication method and device for resisting multi-system cross attack, and is suitable for the technical field of Internet of Things, and the method comprises the steps: obtaining user name information, user password information, to-be-authenticated user name information, to-be-authenticated password information, and user login failure times; generating a terminal authentication random number, a cloud server side authentication random number and a user password replacement random number; and according to the user name information, the user password information, the terminal authentication random number, the cloud server side authentication random number, the user password replacement random number and the number of user login failures, performing authentication variable calculation so as to authenticate the to-be-authenticated user name information and the to-be-authenticated password information. According to the method, the randomly generated user password is stored in the cloud server instead of the random number for authenticating the access behavior of the user, so that the problem that the user password is extremely easy to leak when the cloud server is attacked due to the fact that the user password cloud is directly stored in the cloud server in the prior art is solved.

Description

Technical Field

[0001] The present application belongs to the technical field of Internet of Things, and in particular, relates to a mobile user access authentication method and device that is resistant to multi-system cross-attacks. Background Art

[0002] The development of mobile communication technology has made it easier for users to use mobile devices to enjoy a variety of mobile application services anytime and anywhere. These applications involve almost every field of people's lives, such as shopping, banking, transportation, education, entertainment, travel, social interaction and health. While enjoying mobile services, users are also facing various threats. Mobile users communicate with remote cloud servers through open channels, which enables attackers to intercept, tamper with, and replay messages transmitted in the open channels, thereby being able to perform a variety of attacks. In addition, threats may also come from attacks on mobile devices. After stealing a mobile device, an attacker can extract the information stored in the mobile device, analyze the user's password and other secret parameters, or impersonate a legitimate mobile user to interact fraudulently with the server. Furthermore, threats may also come from attacks on cloud servers. Cloud servers usually store user registration information. Once a cloud server is compromised, the user's registration information will be leaked, especially the user's password and biometric information will be obtained by the attacker. What is more worrying is that the attacker may have powerful attack capabilities. He uses various means to obtain the registration information of mobile users in different systems to perform multi-system cross-attacks. Therefore, in order to protect the communication security between mobile users and cloud servers, it is necessary to design secure access control methods that can resist these attacks.

[0003] At present, many solutions have been proposed to ensure the security of communication between mobile users and cloud servers, mainly including mobile device authentication methods and password-based access control methods. In the authentication of mobile devices, multi-factor methods are usually used to prevent illegal use of mobile devices. In password-based access control, the cloud server stores information related to user names and passwords. In order to prevent the cloud server from being compromised and directly leaking user passwords, the existing technology is that the cloud server does not store user passwords in plain text, but stores other forms of passwords, such as hash passwords, salted hash passwords, slow hash passwords, negative passwords, and honeypot passwords.

[0004] Although these methods have a certain effect in protecting password security, they still cannot prevent offline password guessing attacks, especially multi-system cross-attacks. That is, after obtaining the password stored in the cloud server, criminals can substitute the guessed password into the calculation of the hash algorithm, match the hash calculation result with the stored password, and thus match the user's actual password. In addition, the existing "mobile user-cloud server" remote access control method does not fully consider the attacker's capabilities. When the attacker's capabilities change, such as when the mobile device is stolen or multi-system registration information is leaked, these access control systems become unsafe. Summary of the invention

[0005] In view of this, an embodiment of the present application provides a method and device for mobile user access authentication that is resistant to multi-system cross-attacks. The present application replaces random numbers with randomly generated user passwords and stores them in a cloud server for authenticating user access behavior. This can solve the problem in the prior art that user passwords are directly stored in the cloud server, which makes it very easy to leak user passwords when the cloud server is attacked.

[0006] A first aspect of an embodiment of the present application provides a mobile user access authentication method that is resistant to multi-system cross-attacks, comprising:

[0007] Obtain user name information, user password information, user name information to be authenticated, password information to be authenticated, and the number of failed login attempts;

[0008] Generate random numbers for terminal authentication, cloud server authentication, and user password replacement;

[0009] Authentication variable calculation is performed based on the user name information, user password information, terminal authentication random number, cloud server authentication random number, user password replacement random number and the number of user login failures to authenticate the user name information to be authenticated and the password information to be authenticated.

[0010] A second aspect of an embodiment of the present application provides a mobile user access authentication device resistant to multi-system cross-attacks, comprising:

[0011] An information acquisition module is used to obtain user name information, user password information, user name information to be authenticated, password information to be authenticated, and the number of failed login attempts of a user;

[0012] Random number generation module, used to generate random numbers for terminal authentication, cloud server authentication, and user password replacement random numbers;

[0013] The authentication variable calculation module is used to calculate the authentication variables according to the user name information, user password information, terminal authentication random number, cloud server authentication random number, user password replacement random number and the number of user login failures, so as to authenticate the user name information to be authenticated and the password information to be authenticated.

[0014] A third aspect of an embodiment of the present application provides a terminal device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the computer program, the steps of the mobile user access authentication method that is resistant to multi-system cross-attacks as described in any one of the first aspects above are implemented.

[0015] The fourth aspect of an embodiment of the present application provides a computer-readable storage medium, comprising: storing a computer program, characterized in that when the computer program is executed by a processor, the steps of the mobile user access authentication method that is resistant to multi-system cross-attacks as described in any one of the above-mentioned first aspects are implemented.

[0016] Compared with the prior art, the embodiments of the present application have the following beneficial effects: the present application replaces the user password with a randomly generated random value to store it in the cloud server and authenticate the access behavior. When the cloud server is attacked, even if the attacker obtains the random value stored in the cloud server, he cannot crack the user password. The user's access behavior is authenticated by the terminal authentication random number, the cloud server authentication random number and the number of user login failures, which effectively avoids the occurrence of malicious access behavior and improves the security and reliability of the Internet of Things system during operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0018] Figure 1 It is a schematic diagram of the implementation flow of the mobile user access authentication method against multi-system cross-attacks provided in an embodiment of the present application;

[0019] Figure 2 It is a schematic diagram of the implementation flow of the mobile user access authentication method against multi-system cross-attacks provided in an embodiment of the present application;

[0020] Figure 3 It is a schematic diagram of the implementation flow of the mobile user access authentication method against multi-system cross-attacks provided in an embodiment of the present application;

[0021] Figure 4 It is a schematic diagram of the implementation flow of the mobile user access authentication method against multi-system cross-attacks provided in an embodiment of the present application;

[0022] Figure 5 It is a schematic diagram of the implementation flow of the mobile user access authentication method against multi-system cross-attacks provided in an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of the implementation flow of the mobile user access authentication method against multi-system cross-attacks provided in an embodiment of the present application;

[0024] Figure 7 It is a structural diagram of a mobile user access authentication device that resists multi-system cross-attacks provided in an embodiment of the present application;

[0025] Figure 8 It is a schematic diagram of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0027] In order to illustrate the technical solution described in this application, a specific embodiment is provided below for illustration.

[0028] Figure 1 The following is a flowchart of the implementation of the mobile user access authentication method against multi-system cross-attack provided in the first embodiment of the present application, which is described in detail as follows:

[0029] Step S101, obtaining user name information, user password information, user name information to be authenticated, password information to be authenticated, and the number of user login failures.

[0030] In this embodiment, the user name information refers to the account name used by the user when registering an Internet account, which is an identification code based on a specific website. The user password information refers to a string of characters generated by the user when registering an Internet of Things account, which is used to verify the identity of the user when the user logs in to the Internet of Things. Among them, the user name information and the user password information are stored in the user's terminal device for verifying the identity of the user. The user name information to be authenticated refers to the identification code entered by the user when logging in to the Internet of Things for access operations, which is used to match the user name information generated during registration to verify the identity of the user. The password information to be authenticated refers to a string of characters entered by the user when logging in to the Internet of Things for access operations, which is used to match the user password information generated during registration to verify the identity of the user. The number of user login failures refers to the number of times the user is deemed to have failed to log in because the user name information or user password information cannot be successfully authenticated when logging in through the terminal. The system will automatically record the number of login failures.

[0031] Step S102, generating a terminal authentication random number, a cloud server authentication random number, and a user password replacement random number.

[0032] In this embodiment, the terminal authentication random number, the cloud server authentication random number and the user password replacement random number are all randomly generated random numbers. Among them, the terminal authentication random number is stored in the user terminal device, generated by the user's terminal device, and used to verify the identity of the user. The cloud server authentication random number is stored in the cloud server, generated by the server, and used to verify the authenticity of the cloud server. The user password replacement random number is generated by the user terminal and stored in the cloud server, and is used to replace the user password in the cloud server for access message verification. It can be understood that in the prior art, the user password information is sent from the user terminal to the cloud server, and the cloud server stores the user password information. When the cloud server is attacked, the user password information is very easy to leak. In this application, the user password information will be replaced by a random number, which is sent from the user terminal to the cloud server for storage. The random number is the user password replacement random number. When the cloud server is attacked, even if the user password replacement random number is leaked, the attacker cannot restore the user password information from the user password replacement random number, thereby realizing secure access control between mobile users and cloud servers.

[0033] Step S103, based on the user name information, user password information, terminal authentication random number, cloud server authentication random number, user password replacement random number and the number of user login failures, authentication variable calculation is performed to authenticate the user name information to be authenticated and the password information to be authenticated.

[0034] In this embodiment, when the number of failed login attempts by a user exceeds a certain threshold, it can be determined that the login operation is an attempt by an attacker to access with different user names and user passwords, thereby threatening the user's online security, and the access of the user input behavior is denied. The authentication variable calculation can be performed by encrypting the user name information and the user password information through the terminal authentication random number, the cloud server authentication random number, the hash algorithm and the XOR algorithm, or by encrypting the user password replacement random number through the terminal authentication random number, the cloud server authentication random number, the hash algorithm and the XOR algorithm, which is used for subsequent encryption and verification of the user's identity authenticity and the authenticity of the cloud server to ensure the security of the user's access behavior.

[0035] The embodiment of the present application provides a mobile user access authentication method that is resistant to multi-system cross-attacks. The present application replaces the user password with a randomly generated random value to store it in a cloud server and authenticate the access behavior. When the cloud server is attacked, even if the attacker obtains the random value stored in the cloud server, the user password cannot be cracked. The user's access behavior is authenticated through the terminal authentication random number, the cloud server authentication random number, and the number of user login failures, thereby achieving resistance to multi-system cross-attacks, effectively avoiding the occurrence of malicious access behavior, and improving the security and reliability of the Internet of Things system during operation.

[0036] Figure 2 The flowchart of the implementation of the mobile user access authentication method against multi-system cross attack provided in the second embodiment of the present application is shown. The difference between the second embodiment and the first embodiment is that the step S103 specifically includes:

[0037] Step S201, calculate the user login message variable according to the user name information, user password information, terminal authentication random number, cloud server authentication random number and user password replacement random number.

[0038] In this embodiment, the user uses a smart phone to generate a random number R1 and a registration request message req i , and {R1, req i The cloud server generates a random number R2, passes {R2, R1} to the user, and prompts the user to create a username and password. The user then enters the username ID i and user password PW i , the smartphone generates two random numbers r i , R3. R1 and R3 are generated by the terminal as random numbers for terminal authentication; R2 is generated by the cloud server as random number for cloud server authentication. Calculate AM i =h(ID i ||r i )⊕R2,BM i=h(ID i ||PW i ||r i )⊕R2⊕R3, and {AM i , B.M. i} is transmitted to the cloud server. Wherein, i represents the serial number of the user. For example, if the user is the 100th user to register on the website, then i=100.

[0039] The cloud server generates a random number SDPW i As the shadow of the user password, that is, the user password replaces the random number, calculate h(ID i ||r i )=AM i ⊕R2,h(ID i ||PW i ||r i )⊕R3=BM i ⊕R2, calculate the shadow of the user name as SDID i =h(ID i ||r i )⊕k=AM i ⊕R2⊕k, as the user name instead of the random number, where k is the long-term key of the cloud server, and the shadow information of the user {SDID i ,SDPW i}. Finally, the cloud server deletes the random number R2 and calculates CM i =h(SDPW i ||k)⊕h(ID i ||PW i ||r i )⊕R3, {CM i} passed to the user.

[0040] The user terminal receives {CM i}After that, the smartphone calculates h(SDPW i ||k)=CM i ⊕h(ID i ||PW i ||r i )⊕R3, the first user login message variable DMi=r i ⊕h(ID i ||PW i ), the second user login message variable EMi = h(SDPW i ||k)⊕h(PW i ||r i ), the third user login message variable FM i =h(ID i ||PW i||r i ||h(SDPW i ||k)), substitute the third user login message variable as the user login message variable into subsequent calculations to verify the authenticity of the user's identity. Finally, the smartphone deletes the random numbers R1, R3, r i , and stores {DM i , EM i , FM i , NUM}, where NUM represents the number of login failures, its initial value is set to 0, and the maximum value is n. Herein, the smartphone is the user terminal. ⊕ represents the exclusive OR operation, || represents the union operation, and h() represents the hash operation.

[0041] Step S202, determine whether the number of user login failures is less than a preset login failure threshold. If so, proceed to step S203; if not, the access authentication fails.

[0042] In this embodiment, when the number of user login failures exceeds a certain threshold, it can be determined that the login operation is an attacker attempting to access with different usernames and passwords, threatening the user's online security, and rejecting the access to the user's input behavior. When the number of user login failures is less than a certain threshold, it indicates that the login failure is most likely caused by the user's improper operation rather than an attacker attempting to maliciously log in with different user identifiers, and then proceed to the next access authentication operation.

[0043] Step S203, calculate the login message variable to be authenticated according to the terminal authentication random number, the username information to be authenticated, and the password information to be authenticated.

[0044] In this embodiment, the user inputs the username information ID to be authenticated i * and the password information PW to be authenticated i * in the smartphone. When it is determined that the number of user login failures NUM < n holds, the smartphone calculates the first login message variable to be authenticated r i * = DM i ⊕h(ID i * ||PW i * ), and then calculates the second login message variable to be authenticated h(SDPW i ||k) = EM i ⊕h(PW i * ||r i * ), and then calculates the third login message variable to be authenticated FMi * =h(ID i * ||PW i * ||r i * ||h(SDPW i ||k)), the third login to be authenticated message variable is used as the login to be authenticated message variable for subsequent authentication of the authenticity of the cloud server.

[0045] Step S204, determining whether the login to-be-authenticated message variable is equal to the user login message variable, if so, proceeding to step S205; if not, the access authentication fails.

[0046] In this embodiment, when the third user logs in to the message variable FM i =h(ID i ||PW i ||r i ||h(SDPW i ||k)) is equal to the third login authentication message variable FM i * =h(ID i * ||PW i * ||r i * ||h(SDPWi||k)), indicating that the user's identity authentication has passed and the user can successfully log in to the smartphone.

[0047] Step S205: Generate first access authentication time information and first waiting authentication time information.

[0048] In this embodiment, after the user successfully logs in to the access terminal, the terminal device will generate a current timestamp TIME1 as the first access authentication time information. When the user's login message arrives at the cloud server, the cloud server will generate a timestamp TIME1* as the first time information to be authenticated. The difference between the timestamps is used to perform access authentication in the future to identify whether the current access information is maliciously accessed by an attacker through a replay attack.

[0049] Step S206: Calculate the user access message variable according to the first access authentication time information, user name information, user password information and terminal authentication random number.

[0050] In this embodiment, the first access authentication variable V1=n1·Q, the second access authentication variable V2=n1·K pub , user authentication variable UID i =h(IDi ||r i )⊕h(V2), the first user accesses the message intermediate variable M1=h(ID i ||PW i ||r i )⊕h((SDPWi||k)||V1||V2), access message variable M2=h(h(ID i ||r i )||h(ID i ||PW i ||r i )||V1||V2||TIME1), and transmit the set MM1={V1, UIDi, M1, M2, TIME1} generated by accessing the message variables to the cloud server. pub Refers to the public key of the cloud server, which is generated and stored by the cloud server. n1 is a random number generated by the smartphone.

[0051] Step S207, determining whether the difference between the first access authentication time information and the first to-be-authenticated time information is not greater than a preset time difference threshold, if so, proceeding to step S208; if not, the access authentication fails.

[0052] In this embodiment, when the cloud server receives the access message variable MM1, the cloud server checks whether it meets |TIME1*-TIME1|≤△T to verify the freshness of the message MM1, which is used to identify whether the authentication message is an authentication message sent by an attacker through a replay attack to confuse the cloud server, where TIME1* is the timestamp of receiving the message MM1, and △T represents a preset time difference threshold, which can be set manually. When |TIME1*-TIME1|≤△T is established, it means that the communication time from the generation of the access message variable to the arrival of the cloud server is within a reasonable range, and it is determined that the access message variable is not generated by the attacker through a replay attack or a desynchronization attack, so the next step of the access authentication operation is entered; when it is identified that |TIME1*-TIME1|>△T, it means that the communication time from the generation of the access message variable to the arrival of the cloud server is not within a reasonable range, and it is determined that the access message variable has a great probability of being generated by the attacker through a replay attack or a desynchronization attack, so it is not authenticated, and the cloud server terminates the access control process, and the cloud server discards the access message variable.

[0053] Step S208, calculating the user access to-be-authenticated message variable according to the first access authentication time information, the terminal authentication random number, the cloud server authentication random number, the to-be-authenticated user name information, and the to-be-authenticated password information.

[0054] In this embodiment, the cloud server calculates the first access to be authenticated variable V1*=a·V1, the second access to be authenticated variable h(ID i ||r i )=UID i ⊕h(V1*), SDID i =h(ID i ||r i )⊕k, and extract SDID i Corresponding SDPW i , further calculate the third access to be authenticated variable h(ID i ||PW i ||r i )=M1⊕h((SDPW i ||k)||V1||V1*), then calculate the user access to authenticated message variable M2*=h(h(ID i ||r i )||h(ID i ||PW i ||r i )||V1||V2*||TIME1).

[0055] Step S209, determining whether the user access message variable to be authenticated is equal to the user access message variable, if so, proceeding to step S210; if not, the access authentication fails.

[0056] In this embodiment, it is determined that the user accesses the message to be authenticated. Variable M2*=h(h(ID i ||r i )||h(ID i ||PW i ||r i )||V1||V2*||TIME1) is equal to the access message variable M2=h(h(ID i ||r i )||h(ID i ||PW i ||r i )||V1||V2||TIME1), when M2*=M2, it indicates that the current user identity is authentic and can be used for the next access verification operation; when M2*=M2, it indicates that the current user identity is suspicious and may not be the user identity information authenticated during registration, or it may be forged by an attacker. The cloud server will then identify this user access behavior as an unauthentic user identity and terminate the session.

[0057] Step S210: Generate second access authentication time information and second to-be-authenticated time information.

[0058] In this embodiment, the cloud server generates a random number n2 and a current timestamp TIME2, and uses the current timestamp TIME2 as the second access authentication time information.

[0059] Step S211, calculating a cloud server access message variable according to the first access authentication time information, the second access authentication time information, the user name information, the user password information, the terminal authentication random number and the cloud server authentication random number.

[0060] In this embodiment, the third access authentication variable V3=n2·Q, the fourth access authentication variable V4=n2·V1, and the access authentication intermediate variable SK=h(h(ID i ||PW i ||r i )||UID i ||V4||V2||h(ID i ||r i )||TIME1||TIME2), cloud server access message variable M3=h(UID i ||SK||V4||TIME2), and then transmit the set MM2={V3, M3, TIME2} generated by the cloud server access message variables to the user.

[0061] Step S212, determining whether the difference between the second access authentication time information and the second to-be-authenticated time information is not greater than a preset time difference threshold, if so, proceeding to step S213; if not, the access authentication fails.

[0062] In this embodiment, the user uses the timestamp TIME2* received from MM2 as the second time information to be authenticated to verify the freshness of MM2, that is, to determine whether |TIME2*-TIME2|≤△T is established. The difference between the timestamps is used to perform access authentication to identify whether the current access information is maliciously accessed by an attacker through a replay attack.

[0063] Step S213, calculating the cloud server access to the to-be-authenticated message variable according to the terminal authentication random number, the cloud server authentication random number, the to-be-authenticated user name information, and the to-be-authenticated password information.

[0064] In this embodiment, if MM2 is fresh, it means that the current receiving behavior of MM2 is formed by the normal access operation of the user, not by a replay attack. The user calculates the fourth access to be authenticated variable V4*=n1·V3, and the access to be authenticated intermediate variable SK*=h(h(ID i ||PW i ||r i )||UID i ||V4*||V2||h(IDi ||r i )||TIME1||TIME2), the cloud server accesses the message variable to be authenticated M3*=h(UID i ||SK*||V4||TIME2).

[0065] Step S214, determining whether the cloud server access to-be-authenticated message variable is equal to the cloud server access message variable, if so, the access authentication is successful; if not, the access authentication fails.

[0066] In this embodiment, it is checked whether M3*=M3 is satisfied. If the condition is not satisfied, the user terminates the session. Otherwise, the user believes that the cloud server is authentic, and both parties authenticate each other as authentic.

[0067] The mobile user access authentication method that is resistant to multi-system cross-attacks provided in the embodiment of the present application realizes multiple authentications of user access behaviors through the calculation and size relationship judgment of time information, access message variables, and access message variables to be authenticated. When an attacker has multiple attack capabilities at the same time, the attack behaviors can be identified and filtered through multiple authentication operations, thereby achieving the purpose of resisting multi-system cross-attacks, effectively preventing the occurrence of attack behaviors, and effectively protecting the security of user access behaviors and user privacy information.

[0068] Figure 3 The flowchart of the implementation of the mobile user access authentication method against multi-system cross attack provided in the third embodiment of the present application is shown. The difference between the third embodiment and the second embodiment is that the step S201 specifically includes:

[0069] Step S301, obtain the long-term key of the cloud server.

[0070] In this embodiment, the cloud server long-term key is generated when the cloud server enters the Internet of Things, and is stored in the cloud server for a long time, and is used by users to authenticate and access the cloud server.

[0071] Step S302, performing hash operation and XOR calculation according to the cloud server long-term key, the user password replacement random number, the user name information, the user password information and the first login authentication random number to obtain a first login message variable.

[0072] In this embodiment, the first login authentication random number is generated by the smartphone used by the user and can be represented by R1. The first login message variable AM i =h(ID i ||r i )⊕R2, which is used to further authenticate the authenticity of the user's identity information in the future.

[0073] Step S303, performing hash operation and XOR calculation according to the first login authentication random number, user name information and user password information to obtain a second login message variable.

[0074] In this embodiment, the second login message variable BM i =h(ID i ||PW i ||r i )⊕R2⊕R3, which is used to subsequently calculate the user login message variables, thereby further verifying the authenticity of the user's identity information.

[0075] Step S304, performing hash operation and XOR calculation according to the first message variable, the second login authentication random number, the user name information, the user password information and the first login authentication random number to obtain a third login message variable.

[0076] In this embodiment, the third login message variable CM i =h(SDPW i ||k)⊕h(ID i ||PW i ||r i )⊕R3, which is used to subsequently calculate the user login message variables, thereby further verifying the authenticity of the user's identity information.

[0077] Step S305, calculating a username replacement random number based on the cloud server long-term secret key, the username information and the first login authentication random number.

[0078] In this embodiment, the shadow of the user name, that is, the user name replaces the random number SDID i =h(ID i ||r i )⊕k=AM i ⊕R2⊕k, and then the user's identity is verified by replacing the random number with the username, thereby avoiding the user's identity being directly exposed in the authentication of the user terminal and causing leakage.

[0079] Step S306, performing hash operation and XOR calculation according to the first message variable, the second login authentication random number, the user name information, the user password information, the first login authentication random number and the user name replacement random number to obtain the user login message variable.

[0080] In this embodiment, the user login message variable FM i =h(ID i ||PW i ||r i ||h(SDPW i ||k)), used to verify the authenticity of the user's identity.

[0081] The mobile user access authentication method against multi-system cross attacks provided by the embodiments of the present application calculates the user login message variable through hash operation and exclusive OR calculation. The calculated user login message variable is used to verify the authenticity of the user identity in the subsequent process, avoiding malicious access to the website caused by attackers disguising the user identity and the leakage of the user's real information, thereby ensuring the security and reliability of the user during the online access process.

[0082] Figure 4 The implementation flowchart of the mobile user access authentication method against multi-system cross attacks provided by the fourth embodiment of the present application is shown. The difference from the third embodiment above is that the step S203 specifically includes:

[0083] Step S401: Perform hash operation and exclusive OR calculation according to the second login message variable, the user name information to be authenticated, and the password information to be authenticated, to obtain the first login variable to be authenticated.

[0084] In this embodiment, when it is determined that the number of user login failure times NUM < n holds, the smart phone calculates the first login message variable to be authenticated r i * = DM i ⊕ h(ID i *||PW i *), which is used to calculate the login message variable to be authenticated in the subsequent process to verify the authenticity of the cloud server.

[0085] Step S402: Perform hash operation and exclusive OR calculation according to the third login message variable, the first login variable to be authenticated, and the password information to be authenticated, to obtain the second login variable to be authenticated.

[0086] In this embodiment, the second login variable to be authenticated h(SDPW i ||k) = EM i ⊕ h(PW i * ||r i * ), which is used to verify the authenticity of the cloud server by calculating the login message variable to be authenticated in the subsequent process, avoiding the leakage of privacy information due to the user accessing the cloud server address forged by the attacker.

[0087] Step S403: Perform hash operation and exclusive OR calculation according to the first login variable to be authenticated, the second login variable to be authenticated, the user name information to be authenticated, and the password information to be authenticated, to obtain the login message variable to be authenticated.

[0088] In this embodiment, the login message variable to be authenticated FM i *=h(ID i * ||PW i * ||r i * ||h(SDPW i ||k)), through the calculation of variables, is used to authenticate the authenticity of the cloud server and ensure the accuracy and reliability of the authentication process.

[0089] The mobile user access authentication method that is resistant to multi-system cross-attacks provided in the embodiment of the present application, through the derivation and calculation of the login variables to be authenticated, encrypts the user information while increasing the difficulty for attackers to break through the authentication level, and ensures the rigor and accuracy of the authentication process, thereby effectively avoiding the leakage of the user's identity while verifying the authenticity of the user's identity, and ensuring the security of the user when performing online access operations.

[0090] Figure 5 The flowchart of the implementation of the mobile user access authentication method against multi-system cross attack provided by the fifth embodiment of the present application is shown. The difference between the fifth embodiment and the second embodiment is that the step S206 specifically includes:

[0091] Step S501, obtain the cloud server public key.

[0092] In this embodiment, the cloud server public key is generated by the cloud server factory and stored in the cloud server for a long time, and is used by users to authenticate and access the cloud server, thereby ensuring the authenticity and reliability of the cloud server.

[0093] Step S502: Calculate a first access message variable according to the first access authentication random number and a preset security access control parameter.

[0094] In this embodiment, the preset security access control parameters can be represented by a global variable GPP={E, p, q, G, Q, h}, where E is a finite field F p A non-singular elliptic curve on E, p and q are two large prime numbers, G is a point on the elliptic curve E and an elliptic curve group of order q at infinity, Q is the generator of G, and h is a one-way hash function. The cloud server selects a random number a as its private key and calculates the public key K pub =a·Q. The server keeps the private key a secret and public key K pub . Calculate the first access message variable V1 = n1·Q. This is used to subsequently calculate the user access message variable, thereby verifying the authenticity of the cloud server.

[0095] Step S503: Calculate a second access message variable according to the second access authentication random number and the cloud server public key.

[0096] In this embodiment, the second access message variable V2 = n1·K pub , which is used to subsequently calculate the user access message variables to verify the authenticity of the user's identity.

[0097] Step S504, performing hash operation and XOR calculation according to the user name information, user password information, third access authentication random number, first access message variable, second access message variable and first access authentication time information to obtain user access message variable.

[0098] In this embodiment, the user access message variable M2 = h(h(ID i ||r i )||h(ID i ||PW i ||r i )||V1||V2||TIME1), used to verify the authenticity of the user's identity.

[0099] The mobile user access authentication method that is resistant to multi-system cross-attacks provided in the embodiment of the present application further authenticates whether the user information stored on the cloud server is correct by calculating the user access message variables, thereby authenticating whether the user who currently initiates the access request is the same user as when registering, so as to prevent other attackers from stealing user information to initiate malicious access to the Internet of Things, thereby effectively protecting the security of the website.

[0100] Figure 6 The flowchart of the implementation of the mobile user access authentication method against multi-system cross attack provided by the sixth embodiment of the present application is shown. The difference between the sixth embodiment and the fifth embodiment is that the step S103 specifically includes:

[0101] Step S601, calculating a first access variable to be authenticated according to the cloud server authentication random number and the first access message variable.

[0102] In this embodiment, the first access to be authenticated variable V1*=a·V1 is used to subsequently calculate the user access to be authenticated message variable to verify the authenticity of the cloud server.

[0103] Step S602: performing a hash operation and an XOR operation according to the user name information, the third access authentication random number and the second access message variable to obtain a second access variable to be authenticated.

[0104] In this embodiment, the second access to the to-be-authenticated variable h(ID i ||r i )=UID i⊕h(V1*) is used to verify the authenticity of the cloud server in the future to prevent users from accidentally visiting websites imitated by attackers and leaking their own information.

[0105] Step S603: performing hash calculation and XOR calculation according to the first access variable to be authenticated and the second access variable to be authenticated to obtain a third access variable to be authenticated.

[0106] In this embodiment, the third access to the to-be-authenticated variable h(ID i ||PW i ||r i )=M1⊕h((SDPW i ||k)||V1||V1*), which is used to calculate the variables of the message to be authenticated by the user in the future, so as to verify the authenticity of the cloud server and prevent the user from being deceived by the maliciously forged website of the attacker and causing the exposure of privacy information.

[0107] Step S604, calculating a fourth access variable to be authenticated according to the user name information to be authenticated, the password information to be authenticated, the first access message variable, the second access message variable and the cloud server-side authentication random number.

[0108] In this embodiment, SDID i =h(ID i ||r i )⊕ SDID in k i As the fourth access to be authenticated variable, used to extract the corresponding SDPW from the fourth access to be authenticated variable i , so as to verify the authenticity of the cloud server later.

[0109] Step S605 , performing hash operation and XOR calculation according to the fourth access to be authenticated variable, the first access message variable, the second access to be authenticated variable and the first access authentication time information to obtain the user access to be authenticated message variable.

[0110] In this embodiment, the user accesses the message variable to be authenticated M2*=h(h(ID i ||r i )||h(ID i ||PW i ||r i )||V1||V2*||TIME1) is used to perform equality check with the access message variable, thereby verifying the authenticity and reliability of the cloud server.

[0111] The mobile user access authentication method that is resistant to multi-system cross-attacks provided in the embodiment of the present application calculates the variables of the user access message to be authenticated, and while verifying the identification information of the user and the cloud server, further encrypts the user information, thereby increasing the difficulty of cracking the user information. The authenticity of the cloud server is verified, effectively preventing the attacker from maliciously imitating a fake server to lure users to log in and causing the user's privacy information to be stolen, thereby ensuring the security and reliability of users' online access.

[0112] Another mobile user access authentication method against multi-system cross-attack provided in the embodiment of the present application is different from the above-mentioned embodiment 1 in that: the step S1031 specifically includes:

[0113] Step S1031, generating a temporary session key for the terminal to access the cloud server.

[0114] In this embodiment, it can be understood that when the cloud server and the user terminal mutually authenticate each other as being authentic, a temporary session key is negotiated for the mobile user to securely access the cloud server on a public channel to obtain various online services provided by the cloud server.

[0115] The mobile user access authentication method that is resistant to multi-system cross-attacks provided in the embodiment of the present application, when the user's access behavior is authenticated and it is confirmed that the user and the cloud server can communicate, a session key is temporarily generated to facilitate the user and the cloud server to communicate on a public channel, which is used to avoid attacks and information interception on the public channel during the communication between the user and the cloud server, thereby ensuring the security and reliability of the user in the process of enjoying online services.

[0116] Corresponding to the method of the above embodiment, Figure 7 A structural block diagram of a mobile user access authentication device that is resistant to multi-system cross-attacks provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown. Figure 7 The exemplary mobile user access authentication device capable of resisting multi-system cross-attacks may be an execution subject of the mobile user access authentication method capable of resisting multi-system cross-attacks provided in the aforementioned first embodiment.

[0117] Reference Figure 7 The mobile user access authentication device against multi-system cross-attacks comprises:

[0118] The information acquisition module 710 is used to acquire user name information, user password information, user name information to be authenticated, password information to be authenticated, and the number of failed logins of the user;

[0119] A random number generation module 720 is used to generate a random number for terminal authentication, a random number for cloud server authentication, and a random number for user password replacement;

[0120] The authentication variable calculation module 730 is used to calculate authentication variables based on the user name information, user password information, terminal authentication random number, cloud server authentication random number, user password replacement random number and the number of user login failures, so as to authenticate the user name information to be authenticated and the password information to be authenticated.

[0121] The process of each module realizing its own function in the mobile user access authentication device against multi-system cross attack provided by the embodiment of the present application can be specifically referred to the aforementioned Figure 1 The description of the first embodiment is not repeated here.

[0122] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0123] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0124] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0125] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0126] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish descriptions, and cannot be understood as indicating or suggesting relative importance. It should also be understood that although the terms "first", "second", etc. are used to describe various elements in some embodiments of the present application in the text, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, the first table can be named as the second table, and similarly, the second table can be named as the first table without departing from the scope of the various described embodiments. The first table and the second table are both tables, but they are not the same table.

[0127] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0128] The mobile user access authentication method for resisting multi-system cross-attacks provided in the embodiments of the present application can be applied to terminal devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), etc. The embodiments of the present application do not impose any restrictions on the specific types of terminal devices.

[0129] For example, the terminal device can be a station (STAION, ST) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a vehicle networking terminal, a computer, a laptop computer, a handheld communication device, a handheld computing device, a satellite wireless device, a wireless modem card, a TV set-top box (settop box, STB), customer premises equipment (customer premises equipment, CPE) and / or other devices for communicating on a wireless system and a next-generation communication system, such as a mobile terminal in a 5G network or a mobile terminal in a future evolved Public Land Mobile Network (PLMN) network, etc.

[0130] As an example but not limitation, when the terminal device is a wearable device, the wearable device can also be a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not just hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include those that are fully functional, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.

[0131] Figure 8 Schematic diagram of the structure of a terminal device provided by an embodiment of the present application. Figure 8 As shown, the terminal device 80 of this embodiment includes: at least one processor 800 ( Figure 8 Only one is shown in the figure), a memory 810, wherein the memory 810 stores a computer program 820 that can be run on the processor 800. When the processor 800 executes the computer program 820, the steps in the above-mentioned embodiments of the mobile user access authentication method for resisting multi-system cross attack are implemented, such as Figure 1 Alternatively, when the processor 800 executes the computer program 820, the functions of each module / unit in the above-mentioned device embodiments are implemented, for example Figure 7 Functions of modules 710 to 730 are shown.

[0132] The terminal device 8 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The terminal device may include, but is not limited to, a processor 800 and a memory 810. Those skilled in the art will appreciate that Figure 8 It is only an example of the terminal device 8 and does not constitute a limitation of the terminal device 8. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the terminal device may also include an input sending device, a network access device, a bus, etc.

[0133] The processor 800 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0134] In some embodiments, the memory 810 may be an internal storage unit of the terminal device 8, such as a hard disk or memory of the terminal device 8. The memory 810 may also be an external storage device of the terminal device 8, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device 8. Further, the memory 810 may also include both an internal storage unit of the terminal device 8 and an external storage device. The memory 810 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 810 may also be used to temporarily store data that has been sent or is to be sent.

[0135] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0136] An embodiment of the present application also provides a terminal device, which includes at least one memory, at least one processor, and a computer program stored in the at least one memory and executable on the at least one processor, wherein when the processor executes the computer program, the terminal device implements the steps in any of the above-mentioned method embodiments.

[0137] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0138] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A mobile user access authentication method resistant to multi-system cross-attacks, characterized in that: include: Obtain user name information, user password information, user name information to be authenticated, password information to be authenticated, and the number of failed login attempts; Generate random numbers for terminal authentication, cloud server authentication, and user password replacement; Authentication variable calculation is performed based on the user name information, user password information, terminal authentication random number, cloud server authentication random number, user password replacement random number and the number of user login failures to authenticate the user name information to be authenticated and the password information to be authenticated.

2. The mobile user access authentication method against multi-system cross-attack as claimed in claim 1, characterized in that: The step of calculating authentication variables according to the user name information, user password information, terminal authentication random number, cloud server authentication random number, user password replacement random number and number of user login failures to authenticate the user name information to be authenticated and the password information to be authenticated specifically includes: Calculate the user login message variable according to the user name information, user password information, terminal authentication random number, cloud server authentication random number and user password replacement random number; When the number of failed login attempts of the user is less than a preset threshold of failed login attempts, a login authentication message variable is calculated according to the terminal authentication random number, the user name information to be authenticated, and the password information to be authenticated; When the login to-be-authenticated message variable is equal to the user login message variable, generating first access authentication time information and first to-be-authenticated time information; Calculate the user access message variable according to the first access authentication time information, user name information, user password information and terminal authentication random number; When the difference between the first access authentication time information and the first to-be-authenticated time information is not greater than a preset time difference threshold, calculating a user access to-be-authenticated message variable according to the first access authentication time information, the terminal authentication random number, the cloud server authentication random number, the to-be-authenticated user name information, and the to-be-authenticated password information; When the user access message variable to be authenticated is equal to the user access message variable, generating second access authentication time information and second authentication time information; Calculate a cloud server access message variable according to the first access authentication time information, the second access authentication time information, the user name information, the user password information, the terminal authentication random number, and the cloud server authentication random number; When the difference between the second access authentication time information and the second to-be-authenticated time information is not greater than a preset time difference threshold, calculating a cloud server access to-be-authenticated message variable according to the terminal authentication random number, the cloud server authentication random number, the to-be-authenticated user name information, and the to-be-authenticated password information; When the cloud server access message variable to be authenticated is equal to the cloud server access message variable, the access authentication is successful.

3. The mobile user access authentication method against multi-system cross-attack as claimed in claim 2, characterized in that: The terminal authentication random number includes a first login authentication random number and a second login authentication random number; The cloud server authentication random number includes a first cloud server authentication random number, a second cloud server authentication random number, and a third cloud server authentication random number: The step of calculating the user login message variable according to the user name information, the user password information, the terminal authentication random number, the cloud server authentication random number and the user password replacement random number specifically includes: Get the long-term key of the cloud server; Perform hash operation and XOR calculation according to the cloud server long-term secret key, the user password replacement random number, the user name information, the user password information and the first login authentication random number to obtain a first login message variable; Perform hash operation and XOR calculation according to the first login authentication random number, user name information and user password information to obtain a second login message variable; Perform hash operation and XOR calculation according to the first message variable, the second login authentication random number, the user name information, the user password information and the first login authentication random number to obtain a third login message variable; Calculate a username replacement random number based on the cloud server long-term secret key, the username information, and the first login authentication random number; A hash operation and an XOR calculation are performed according to the first message variable, the second login authentication random number, the user name information, the user password information, the first login authentication random number and the user name replacement random number to obtain a user login message variable.

4. The mobile user access authentication method against multi-system cross-attack as claimed in claim 3, characterized in that: The step of calculating the login message variable to be authenticated according to the terminal authentication random number, the user name information to be authenticated and the password information to be authenticated specifically includes: Performing a hash operation and an XOR operation according to the second login message variable, the user name information to be authenticated, and the password information to be authenticated to obtain a first login variable to be authenticated; Performing a hash operation and an XOR operation according to the third login message variable, the first login variable to be authenticated, and the password information to be authenticated to obtain a second login variable to be authenticated; A hash operation and an XOR calculation are performed according to the first login variable to be authenticated, the second login variable to be authenticated, the username information to be authenticated and the password information to be authenticated to obtain a login message variable to be authenticated.

5. The mobile user access authentication method against multi-system cross-attack as claimed in claim 2, characterized in that: The terminal authentication random number includes a first access authentication random number, a second access authentication random number and a third access authentication random number; The step of calculating the user access message variable according to the first access authentication time information, the user name information, the user password information and the terminal authentication random number specifically includes: Get the cloud server public key; Calculate a first access message variable according to the first access authentication random number and a preset security access control parameter; Calculate a second access message variable according to the second access authentication random number and the cloud server public key; A hash operation and an XOR calculation are performed according to the user name information, the user password information, the third access authentication random number, the first access message variable, the second access message variable and the first access authentication time information to obtain a user access message variable.

6. The mobile user access authentication method against multi-system cross-attack as claimed in claim 5, characterized in that: The step of calculating the user access message variable to be authenticated according to the first access authentication time information, the terminal authentication random number, the cloud server authentication random number, the user name information to be authenticated, and the password information to be authenticated specifically includes: Calculate a first access variable to be authenticated according to the cloud server authentication random number and the first access message variable; Perform hash operation and XOR calculation according to the user name information, the third access authentication random number and the second access message variable to obtain a second access variable to be authenticated; Performing hash calculation and XOR calculation according to the first access variable to be authenticated and the second access variable to be authenticated to obtain a third access variable to be authenticated; Calculate a fourth access variable to be authenticated according to the user name information to be authenticated, the password information to be authenticated, the first access message variable, the second access message variable and the cloud server-side authentication random number; A hash operation and an XOR calculation are performed according to the fourth access variable to be authenticated, the first access message variable, the second access variable to be authenticated and the first access authentication time information to obtain a user access message variable to be authenticated.

7. The mobile user access authentication method against multi-system cross-attack as claimed in claim 2, characterized in that: After the step of access authentication being successful when the cloud server access message variable to be authenticated is equal to the cloud server access message variable, the step further includes: Generate a temporary session key for the terminal to access the cloud server.

8. A mobile user access authentication device resistant to multi-system cross-attack, characterized in that: include: An information acquisition module is used to obtain user name information, user password information, user name information to be authenticated, password information to be authenticated, and the number of failed login attempts of a user; Random number generation module, used to generate random numbers for terminal authentication, cloud server authentication, and user password replacement random numbers; The authentication variable calculation module is used to calculate the authentication variables according to the user name information, user password information, terminal authentication random number, cloud server authentication random number, user password replacement random number and the number of user login failures, so as to authenticate the user name information to be authenticated and the password information to be authenticated.

9. A terminal device, characterized in that: The terminal device includes a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images