System login method and system for preventing Sybil attack

Abstract

The invention provides a system login method and system for preventing Sybil attack, and the method comprises the steps: the system is divided into a mobile terminal system and a server terminal system to be logged in, and the mobile terminal system and the server terminal system are respectively installed on a mobile phone and a server of the mobile terminal system. The mobile terminal system manages own public key / private key; the functions of signature, signature verification, encryption / decryption, and two-dimensional code information scanning and reading are provided. The server side comprises an initialization module capable of being directly accessed and a login module for a visitor to enter a target system. The initialization module calculates a public key / private key for a visitor, sends the public key / private key to a mobile phone wallet of the visitor, and automatically stores the public key; the login module provides functions of accessing and logging in, generating a random number, encrypting the random number by using a public key of a visitor and displaying the random number as a two-dimensional code by using a specific algorithm; a function of comparing and verifying decryption feedback of the visitor is provided; and making a decision on whether login is allowed or not. The technical problems of difficulty in preventing counterfeit from entering, high computing power or time cost and low defense success rate are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of software design, and in particular to a system login method and system for preventing Sybil attacks. Background Art

[0002] Sybil attack is also called identity or reputation attack, commonly known as witch attack, which refers to the attacker impersonating others to enter the target system or network to obtain relevant benefits. When invading traditional Web systems, the attacker gains benefits by obtaining the operating permissions assigned by the system. When invading peer-to-peer networks, the attacker generally uses multiple fake identities to gain benefits in the voting mechanism of the distributed system.

[0003] Obviously, the first priority of a Sybil attack is that the fake identity cannot be discovered, otherwise it is impossible to enter the system or network, let alone gain benefits. In other words, the first step to defend against a Sybil attack is to prevent the fake identity from entering the system or network.

[0004] Currently, the methods for defending against Sybil attacks can be roughly summarized into the following five categories:

[0005] 1. Identity verification: Verify participants entering the network or system through a centralized organization or third-party agent.

[0006] 2. Social trust graph: Analyze the connection data contained in the social graph to identify whether it is a Sybil attacker.

[0007] 3. Economic cost: Use economic costs to create barriers to entry into the system or network, that is, by controlling economic costs, making Sybil attacks expensive and not worth the cost.

[0008] 4. Protocol defense: Create a distributed protocol that is not vulnerable to Sybil attacks.

[0009] 5. Establish a hierarchical system: People who have been in the network for a long time should have more power than newcomers. In this way, even if a new Sybil node wants to launch a large-scale attack, it will be powerless.

[0010] The above method has the following characteristics:

[0011] 1. Defend within the system or network and adopt a strategy of letting the attacker in;

[0012] 2. Use relevant technical means, such as identity authentication, protocol defense, and establishing a hierarchical system;

[0013] 3. Use common sense to identify, for example, social trust graph method and economic cost method.

[0014] In short, the existing methods are of the nature of closing the fold after the horse has bolted, requiring high recognition costs (time costs, computing power costs), and cannot guarantee 100% success.

[0015] The existing invention patent application document "A method and system for defending Sybil attack against UAV self-organizing network" with publication number CN108989020A, the UAV self-organizing network system in the existing method includes several UAVs, a control center, and several local servers, including the following steps: (Registration: the control center generates a large number of original master keys, the UAV sends a registration request to the control center through the local server, and feedback obtains a communication ID, a local certificate, and a session key encrypted with the original master key; Independent verification: When the UAV enters the network, it has a communication demand with the local server, first verifies its own identity, and determines that there is no impersonation; Mutual inspection: The communicating parties use their own calculations and the help of the local server to perform identity mutual inspection; Judgment: According to the previous verification result information, it is judged whether there is a Sybil attack. However, the system architecture adopted by the above-mentioned prior art sets a third-party organization "control center", and several local servers act as agents, which belongs to the first of the above five situations. Once the control center or the local server is attacked and controlled, the entire network is in an unsafe state and cannot achieve defense against Sybil attacks.

[0016] The existing invention patent application document "An open data replication proof method, system and device for resisting Sybil attacks" with publication number CN117650916A, the existing method includes: the storage provider discloses its identity and storage strategy, and initializes the public parameter pool; the storage provider preprocesses the open data, generates Class I parameters, and updates the public parameter pool; each member in group K receives Class I parameters, calculates Class II parameters, and then the storage provider updates the public parameter pool; group K consists of q members, represented by C1,...,Cq; the storage provider regularly obtains challenges and generates proofs, and updates the public parameter pool; the verifier regularly obtains proofs from the public parameter pool and verifies. However, it belongs to the fourth of the above five situations. A "protocol defense method" is established between the storage provider and the q verifiers in group K. The protocol here is manifested as a multiple encryption and decryption algorithm. It has the defects of high computational cost and unreliability in the era of quantum computing.

[0017] The existing public document "Research on Security Mechanism for Information Security Issues in Internet of Vehicles" prevents collusion attacks launched by malicious RSU and witch attackers. Secondly, under the premise of ensuring the security of RSU, an anti-sybil attack strategy based on a single-point time-limited credential is proposed. TLC is an information time-limited credential authorized by RSU. While effectively solving the problem of witch attacks launched by external attackers, it effectively resists the witch attacks launched by internal attackers that cannot be solved in the ordinary anti-sybil attack mechanism. In addition, the single-point location strategy designed by the scheme can effectively prevent the leakage of user driving paths. Finally, through experimental calculation and analysis, this scheme can effectively reduce witch attacks and effectively improve the message delivery rate in the case of witch attacks in the Internet of Vehicles. However, the aforementioned prior art adopts an anti-sybil attack strategy of a single-point time-limited credential. The single-point time-limited credential TLC is authorized by a secure RSU to be issued. The verifier must pass the verification within a limited time limit, otherwise it will be regarded as a witch attacker. It belongs to the third of the above five situations. The economic cost here is expressed as time cost. The existing scheme has the possibility of accidental injury and is not accurate.

[0018] In summary, existing technologies are difficult to prevent counterfeiters from entering systems and networks, and have high computing power and time costs, as well as the defect of inaccurate accidental injuries. Summary of the invention

[0019] The technical problem to be solved by the present invention is: how to solve the technical problems in the prior art that it is difficult to prevent counterfeiters from entering the system and network, the computing power and time costs are high, and the defense success rate is low.

[0020] The present invention adopts the following technical solution to solve the above technical problem: a system login method for preventing Sybil attacks includes:

[0021] S1. Obtain the public key input by the visitor, calculate the public key and private key based on the identity identification technology IBC and the SM9 encryption algorithm, and obtain the public key calculation results and the private key calculation results;

[0022] S2. Send the public key calculation result and the private key calculation result to the mobile terminal application logged in by the applicant;

[0023] S3. Save the public key calculation result for the applicant and destroy the private key calculation result;

[0024] S4, allowing the visitor to select the public key file in the target specified by the server through the open icon on the page, reading and displaying the public key file in the preset public key column, and allowing the visitor to click the submit button, so that the public key in the public key file is sent to the preset system backend;

[0025] S5. Generate a random number in the intended login system as the encrypted original text, perform symmetrical encryption using the public key to obtain and display the encryption result in a preset encryption message bar, convert the encryption result into a QR code, and display the QR code on a preset display device;

[0026] S6. The visitor uses a mobile terminal application to scan the QR code to obtain the encrypted message, and uses the mobile terminal application to perform a symmetric decryption operation on the private key, obtains and sends the symmetric decryption result to the decryption original text column for display, and the visitor clicks the submit button to send the symmetric decryption result to the preset system background, and the preset system background compares the symmetric decryption result with the random number to verify the symmetric decryption result and obtain a verification result;

[0027] S7. According to the verification result, identify and block Sybil impersonators from visitors.

[0028] The SM9 cryptographic algorithm adopted in the present invention belongs to the Identity Based Cryptograph (IBC) system, which uses the user's identity to replace the public key, does not require a public key certificate authority (CA), and reduces the difficulty of key resource management and deployment.

[0029] The present invention adopts a strategy of keeping the enemy out of the door. Through the SM9 algorithm and related interactive processing procedures, effective verification is performed when logging into the system, and counterfeiters are blocked outside the system or network, making it impossible for them to enter the system or network, which can well achieve the goal of resisting Sybil attacks.

[0030] In a more specific technical solution, in S1, the original text is received, and the public key and private key are used to perform symmetric encryption operations on the original text. The public key encryption option and the private key encryption option are selected and the submit button is clicked. Symmetric encryption is performed according to the SM9 encryption algorithm to obtain the ciphertext, and the ciphertext is sent to the target node.

[0031] In a more specific technical solution, in S1, assuming that m is plain text, c is the encrypted ciphertext of m, SK is the private key, and PK is the public key, the following logic is used to perform symmetric encryption and symmetric decryption operations:

[0032] PK(m)=c;SK(c)=m.

[0033] In order to prevent counterfeiters from using other people's public information to apply for public keys / private keys, the present invention uses email verification and activation processing, which effectively ensures the security of the method of the present invention; the interaction process between the visitor and the system of the present invention is very simple, does not involve large computing power and large storage, and has low cost.

[0034] In a more specific technical solution, in S6, the ciphertext is received, and the ciphertext is symmetrically decrypted using the public key and private key. The ciphertext is received, the public key decryption option and the private key decryption option are selected and the submit button is clicked. The symmetric decryption operation is performed according to the SM9 decryption algorithm to obtain the plaintext, and the plaintext is sent to the target node.

[0035] The method of preventing Sybil attacks adopted by the present invention uses one's own public key and private key, mobile phone wallet, and encrypts and decrypts random numbers to prove one's identity, thereby logging into the system or network. It is simple, low-cost and has a high success rate.

[0036] In a more specific technical solution, in S6, a public key and a private key management module is used to perform mobile terminal management and maintenance operations on public keys and private keys.

[0037] In a more specific technical solution, in S6, a signature verification module is used to perform mobile terminal signature operations and mobile terminal signature verification operations on the visitor.

[0038] In a more specific technical solution, in S6, an encryption and decryption module is used to perform encryption operations and decryption operations of the mobile terminal.

[0039] In a more specific technical solution, in S6, the code scanning module of the mobile terminal is used to scan and read the encrypted information in the QR code according to a preset algorithm.

[0040] The algorithm and processing process adopted by the present invention are mainly based on asymmetric encryption, QR code scanning and other methods, and have a good protection effect against Sybil counterfeiters. Simple and low-cost, the algorithm and processing process are simple, without high computing power and high time cost.

[0041] In a more specific technical solution, in S7, the original text of the random number method and the symmetric decryption result corresponding to the visitor are compared. When the verification results are inconsistent, the Sybil impersonator is not allowed to enter the preset system.

[0042] The present invention uses a specific algorithm and processing process to perform effective checks when logging into the system, blocking Sybil impersonators from the system or network, making it impossible for Sybil impersonators to enter the system or network.

[0043] In a more specific technical solution, a system login system for preventing Sybil attacks includes: a system end system and a mobile end system; the system end system includes: an initialization module and a login module, and the login module is connected to the initialization module; the mobile end system includes: a public key and private key management module, a signature verification module, an encryption and decryption module, and a code scanning module, wherein the encryption and decryption module is connected to the public key and private key management module and the signature verification module; the code scanning module is connected to the encryption and decryption module;

[0044] The initialization module also includes:

[0045] The public key and private key calculation component is used to obtain the public key input by the visitor, calculate the public key and private key based on the identity identification technology IBC and the SM9 encryption algorithm, and obtain the public key calculation results and private key calculation results;

[0046] The calculation result sending component is used to send the public key calculation result and the private key calculation result to the mobile terminal application logged in by the applicant on the mobile terminal system. The calculation result sending component is connected to the public key and private key calculation component;

[0047] The public key component is retained to save the public key calculation result and destroy the private key calculation result for the applicant, and the retained public key component is connected to the public key and private key calculation component;

[0048] The login module also includes:

[0049] The public key input component enables the visitor to select the public key file in the specified target on the server through the open icon on the page, read and display the public key file in the preset public key column, and enable the visitor to click the submit button to send the public key in the public key file to the preset system background;

[0050] A QR code conversion and display component is used to generate a random number in the intended login system as the encryption original text, use the public key to perform symmetrical encryption, obtain and display the encryption result in a preset encryption message bar, convert the encryption result into a QR code, and display the QR code on a preset display device. The QR code conversion and display component is connected to its own public key input component;

[0051] The symmetric decryption and login verification component is used to enable visitors to use mobile terminal applications to scan the QR code to obtain encrypted messages, use the mobile terminal application to perform symmetric decryption operations on the private key, obtain and send the symmetric decryption result to the decryption original text column for display, and the visitor clicks the submit button to send the symmetric decryption result to the preset system background. In the preset system background, the symmetric decryption result is compared with the random number to verify the symmetric decryption result and obtain the system login permission judgment result. The symmetric decryption and login verification component is connected to the QR code conversion and display component.

[0052] Compared with the prior art, the present invention has the following advantages:

[0053] The SM9 cryptographic algorithm adopted in the present invention belongs to the Identity Based Cryptograph (IBC) system, which uses the user's identity to replace the public key, does not require a public key certificate authority (CA), and reduces the difficulty of key resource management and deployment.

[0054] The present invention adopts a strategy of keeping the enemy out of the door. Through the SM9 algorithm and related interactive processing procedures, effective verification is performed when logging into the system, and counterfeiters are blocked outside the system or network, making it impossible for them to enter the system or network, which can well achieve the goal of resisting Sybil attacks.

[0055] In order to prevent counterfeiters from using other people's public information to apply for public keys / private keys, the present invention uses email verification and activation processing, which effectively ensures the security of the method of the present invention; the interaction process between the visitor and the system of the present invention is very simple, does not involve large computing power and large storage, and has low cost.

[0056] The method of preventing Sybil attacks adopted by the present invention uses one's own public key and private key, mobile phone wallet, and encrypts and decrypts random numbers to prove one's identity, thereby logging into the system or network. It is simple, low-cost and has a high success rate.

[0057] The algorithm and processing process adopted by the present invention are mainly based on asymmetric encryption, QR code scanning and other methods, and have a good protection effect against Sybil counterfeiters. Simple and low-cost, the algorithm and processing process are simple, without high computing power and high time cost.

[0058] The present invention uses a specific algorithm and processing process to perform effective checks when logging into the system, blocking Sybil impersonators from the system or network, making it impossible for Sybil impersonators to enter the system or network.

[0059] The present invention solves the technical problems existing in the prior art that it is difficult to prevent counterfeiters from entering the system and network, the computing power and time costs are high, and the defense success rate is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a schematic diagram of basic steps of a system login method for preventing Sybil attacks according to Embodiment 1 of the present invention;

[0061] Figure 2 This is a diagram of the selection initialization / login page of Embodiment 1 of the present invention;

[0062] Figure 3 The public key / private key calculation page diagram of embodiment 1 of the present invention;

[0063] Figure 4 The sending public key / private key and the retention page diagram of embodiment 1 of the present invention;

[0064] Figure 5 This is a diagram of a personal wallet function page according to Embodiment 1 of the present invention;

[0065] Figure 6 This is a diagram of a key management page according to Embodiment 1 of the present invention;

[0066] Figure 7 This is a private key signature / public key signature verification page diagram of Example 1 of the present invention;

[0067] Figure 8 The encryption / decryption page diagram of embodiment 1 of the present invention;

[0068] Fig. 9 The public key / private key encryption page diagram of embodiment 1 of the present invention;

[0069] Fig.10 This is a public key / private key decryption page diagram of embodiment 1 of the present invention;

[0070] Fig.11 This is a QR code scanning page diagram of Example 1 of the present invention;

[0071] Fig.12 This is a diagram of a page for submitting a public key according to Embodiment 1 of the present invention;

[0072] Fig.13 This is a page diagram of scanning a ciphertext QR code and symmetrically decrypting the code in Embodiment 1 of the present invention;

[0073] Fig.14 This is a schematic diagram of system login module connection for preventing Sybil attacks according to Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0074] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0075] Example 1

[0076] like Figure 1 As shown, the present invention provides a system login method for preventing Sybil attacks, including the following basic steps:

[0077] S1. Enter the public key.

[0078] S2. The system generates a random number and encrypts the random number using the received public key using the SM9 encryption algorithm;

[0079] In this embodiment, an initialization module and a login module are installed on the server side; the initialization module is used to calculate the public key and private key for the visitor, and the calculation result is sent to the visitor's mobile wallet; the initialization module is used to save the visitor's public key, but not the applicant's private key; the login module is used to perform access login operations; and random number generation operations are performed;

[0080] S3, displaying the encryption result on the screen and showing its QR code;

[0081] In this embodiment, the random number is encrypted using the visitor's public key, and a QR code is generated and displayed using a specific algorithm;

[0082] S4. The visitor uses the code scanning function in the mobile wallet to read the ciphertext information and decrypts it using his own private key and SM9 decryption algorithm;

[0083] In this embodiment, the mobile terminal system is installed and deployed on the mobile device, and the server is installed and deployed on the server; the mobile terminal system is used to manage its own public key and private key; signature and signature verification operations are performed; encryption and decryption operations are performed; and QR code information is scanned and read;

[0084] S5. Input the decryption result and submit it to the system;

[0085] S6. The system compares the random number with the visitor's decryption result;

[0086] S7, judging whether the random number is consistent with the visitor's decryption result;

[0087] S8, if yes, the visitor enters the system and operates according to the assigned permissions;

[0088] S9. If no, log out.

[0089] In this embodiment, the visitor's decrypted feedback is compared and verified; a decision is made as to whether to allow login.

[0090] In this embodiment, an independent initialization module without identity requirements and permission requirements and a login module for visitors to enter the target system are installed.

[0091] like Figure 2 and Figure 3 As shown, in this embodiment, when accessing the URL of the target system, a preparation page is first entered. If the visitor clicks the initialization button, the public key and private key calculation page is entered.

[0092] In this embodiment, if the visitor clicks the login button, the system login page is entered. Fig.12 ; If the visitor clicks the exit button, the visit process will be exited. Fig.12 .

[0093] See also Figure 3In this embodiment, it is a page that provides visitors with public key / private key calculation services. Visitors use the drop-down selection button in the "Type" column to select a type of personal information that can uniquely represent and be disclosed as a public key, including but not limited to: ID number, mobile phone number, email address, QQ number, WeChat account, home address and social security card number, and enter the value of the corresponding type in the value column, enter the verification email address in the verification email column, click the private key calculation button, and the system will first send an activation email to the verification email. After successful activation, the SM9 national secret algorithm is used to calculate the private key. After the calculation is completed, a prompt for calculation completion will be displayed. If the visitor clicks the Send to Mobile Wallet option, the public key / private key sending and retention page will be entered, see Figure 4 ; If the visitor clicks the exit button, the system will be exited without saving the above input and calculation results.

[0094] like Figure 4 As shown, it is a page for sending the visitor's public key / private key to the visitor's mobile wallet. In this embodiment, the visitor enters his or her mobile phone number, clicks the Send and Save Public Key button, and the system automatically sends his or her public key / private key to the mobile wallet, and displays a prompt that the sending is completed; the visitor clicks the Exit button to exit the system.

[0095] like Figure 5 As shown, in the main page of the personal wallet of this embodiment, function buttons are displayed, including but not limited to: key management button, signature verification button, encryption / decryption button, and code scanning button. If the key management button is clicked, the key management page is entered. Figure 6 ; If you click the Signature Verification button, you will enter the private key signature / public key verification page, see Figure 7 ; If you click the encryption and decryption button, you will enter the encryption and decryption page, see Figure 8 ; If you click Scan, you will enter the QR code scanning page, see Fig. 9 ; If you click Return, you will return to the previous page; if you click Exit, you will exit your personal wallet.

[0096] like Figure 6 As shown, in the personal key management page of this embodiment, each pair of public keys and private keys belonging to the mobile wallet received by the wallet is displayed; specifically, the private key can be displayed in a shielded manner, for example, and the complete private key can be displayed by clicking the View Private Key option; clicking the Return option enters the main page of the personal wallet, see Figure 6 ; Click the exit option to exit the personal wallet.

[0097] like Figure 7As shown, in the page for private key signature or public key signature verification in this embodiment, if private key signature is selected and the Submit button is clicked, the specified message is digitally signed based on SM9 using the personal private key, and the result is sent to the target node; if public key signature verification is selected and the Submit button is clicked, the signature verification based on SM9 is performed using the designated person's "key", and whether the verification is successful is displayed; click the Return option to enter the main page of the personal wallet, see Figure 5 ; Click the exit option to exit the personal wallet.

[0098] like Figure 8 As shown, the embodiment of the symmetric encryption and decryption page using the public key and private key, if you select the encryption option and click the submit button, you will enter the public key / private key encryption page, see Fig. 9 ; If you select the decryption option and click the Submit button, you will enter the public key / private key decryption page, see Fig.10 ; Click the return button to enter the main page of your personal wallet, see Figure 5 ; Click the Exit button to exit your personal wallet.

[0099] like Fig. 9 As shown, in the page of this embodiment, the original text is symmetrically encrypted using the public key and private key. The original text is received, public key encryption and private key encryption are selected and the submit button is clicked. The system performs symmetrical encryption according to the pre-selected SM9 algorithm. The result can be displayed or sent directly to the target node. Click the return button to enter the main page of the personal wallet. Figure 5 ; Click the Exit button to exit your personal wallet.

[0100] like Fig.10 As shown in the figure, it is a page for symmetric decryption of ciphertext using public key and private key. Receive the ciphertext, select public key decryption, private key decryption and click the submit button. The system performs symmetric decryption based on the pre-selected SM9 algorithm. The result can be displayed or sent directly to the target node. Click the return button to enter the main page of the personal wallet. Figure 5 ; Click the exit button to exit the personal wallet. In this embodiment, if the ciphertext is encrypted by the public key, it can only be decrypted by the private key, and vice versa.

[0101] In this embodiment, the user login process is implemented by calculating the user's public key / private key and performing encryption / decryption operations based on the SM9 algorithm. Specifically, SM9 is a national secret algorithm that replaces the escp256k1 asymmetric encryption algorithm. It is mainly used for digital signatures and signature verification, but it can also perform public key encryption and private key decryption operations, that is, using public keys and private keys according to the symmetric encryption idea. Its formal representation is as follows:

[0102] Assume that m is plain text, c is the encrypted ciphertext of m, SK is the private key and PK is the public key, then

[0103] PK(m)=c;SK(c)=m.

[0104] At present, the SM9 algorithm has been proven to be safe and has sufficient encryption strength. In order to prevent counterfeiters from using other people's public information to apply for public / private keys, the present invention uses email verification and activation processing, which effectively ensures the security of the method of the present invention; the interaction process between the visitor and the system of the present invention is very simple, does not involve large computing power and large storage, and has low cost.

[0105] like Fig.11 As shown, in the page of scanning the QR code to obtain information in this embodiment, aiming the mobile phone camera at the QR code will automatically scan and parse its information. If the submit button is clicked, the parsed result will be displayed or sent to the target node.

[0106] like Fig.12 As shown, on the system login page of this embodiment, the visitor clicks the open icon on the right to open the public key file in the specified directory. The system reads the content of the public key file and displays it in the public key column. The visitor clicks the submit button to send the public key to the system background; clicks the exit button to exit the login process.

[0107] like Fig.13 As shown, in the page where the system of this embodiment interacts with the visitor, the system generates a random number as the encrypted original text, and uses the received public key to perform symmetrical encryption. The encryption result is displayed in the encrypted message column, and the encryption result is automatically converted into a QR code and displayed on the screen; the visitor uses the scan function in the mobile wallet to obtain the encrypted message, and uses the corresponding private key decryption function of the mobile wallet to perform symmetrical decryption. The decryption result is sent to the decrypted original text column for display, and the submit button is clicked. The decryption result is sent to the system background, and the system background compares it with the random number to verify the decryption result, and gives a conclusion on whether to allow login to the system based on this; click the exit button to exit the login process.

[0108] Example 2

[0109] In this embodiment, taking a legitimate visitor who intends to log in to the system as an example, the public key / private key calculation service provided by the initialization module of the system obtains his own public key / private key and stores it in his mobile wallet. Among them, the public key is retained in the form of a text file in a specific directory of the system to be logged in.

[0110] Assume that the visitor is Alicest, holding:

[0111] Public key: alicest006@hotmail.com

[0112] Private Key:

[0113] 03AEE6D5A5C103D3855994394573F979E15E74A3694618A09DE583E928314DE6 8411B3995F938D72B93B2C0AF93B5957317DC830FDD44402D39D6DDD793A94911 E03B9D21AD70CD917AC600ADDF2E855A743A9568CEECCCE7DE632884E6BEB75F825B91F08CF675A805CAA03D42ECF7B5EC464A5F4FD06F61FD21EECFD4D6A51CB

[0114] The public key file is stored in F:\PublicKeyDir\AlicestPublicKeyFile.txt of the system to be logged in;

[0115] Assume that the URL of the target system to be accessed is: https: / / www.examplesystem.com /

[0116] Alicest accesses https: / / www.examplesystem.com / through a browser, and the screen displays Figure 2 , click the "Login" button to enter the "System Login Page", see Fig.12 ;

[0117] Click the open icon on the right to open the AlicestPublicKeyFile.txt file in the F:\PublicKeyDir\ directory. The system reads the public key file content and displays it in the public key column. When the visitor clicks the submit button, the public key is sent to the system backend.

[0118] The system to be accessed generates a random number (276323edac8e09f8) as the original text for encryption, and uses Alicest's public key for symmetric encryption. The result of the encryption is:

[0119] E791EC7AB2CB09A7B8485487AE23141D030D2004D6E6EC5729DB82FDEE4FD1EA

[0120] The encrypted message is displayed in the encrypted message column, and the encrypted result is automatically converted into a QR code and displayed on the screen; the visitor uses the "Scan" function in the mobile wallet to obtain the encrypted message, and uses the corresponding private key decryption function of the mobile wallet to perform symmetrical decryption. The decryption result is sent to the decrypted original text column for display. Click the Submit button, and the decryption result is sent to the system backend;

[0121] The system compares the original random number and the result of Aliest's decryption. Because they are consistent, Aliest is allowed to enter the target system and perform system operations according to the assigned permissions.

[0122] Example 3

[0123] In this embodiment, a Sybil impersonator intends to log into the system as an example, wherein the Sybil impersonator is a person who attempts to log into the system using someone else's identity (public key), that is, a person who has mastered someone else's public key but does not have the corresponding private key.

[0124] In this embodiment, it is assumed that the Sybil impersonator is Boblast, who has the public key of Alicest but does not have the private key of Alicest.

[0125] Boblast accesses https: / / www.examplesystem.com / through a browser, and the screen displays Figure 2 , click the login button to enter the system login page, see Fig.12 ;

[0126] Click the open icon on the right to open the AlicestPublicKeyFile.txt file in the F:\PublicKeyDir\ directory (using Alicest's identity). The system reads the public key file content and displays it in the public key column. The visitor clicks the submit button to send the public key to the system backend.

[0127] The system to be accessed generates a random number: 4537ae236c3af809 as the original text for encryption, and uses the received public key for symmetric encryption. The encryption result is:

[0128] A091641CD2B21D10C5D471117A23BF25030D2004D6E6EC5729DB82FDEE4FD1EA

[0129] The encrypted message is displayed in the encrypted message column, and the encrypted result is automatically converted into a QR code and displayed on the screen. Boblast uses the scan function in the mobile wallet to obtain its encrypted message, but because it does not have the private key corresponding to Alices public key, it cannot perform the private key decryption function. Boblast can only try to enter the guessed decryption result in the decryption original text column, click the submit button, and the decryption result is sent to the system background.

[0130] In this embodiment, the system compares the random number original text and the result of Boblast decryption, and because they are inconsistent, Boblast is not allowed to enter the target system.

[0131] Example 4

[0132] like Fig.14 As shown, in this embodiment, a system login system for preventing Sybil attacks includes: a system end system 1 and a mobile end system 2, and the system end system 1 is coupled to the mobile end system 2.

[0133] In this embodiment, the system end system 1 includes but is not limited to: an initialization module 11 and a login module 12 , and the login module 12 is connected to the initialization module 11 .

[0134] In this embodiment, the specific components of the initialization module 11 include but are not limited to:

[0135] The public key and private key calculation component 111 is used to provide applicants with public key and private key calculation based on IBC (Identity-Based Cryptograph) and SM9 algorithm;

[0136] The calculation result sending component 112 is used to send the calculated public key and private key to the applicant's mobile wallet. The calculation result sending component 112 is connected to the public key and private key calculation component 111;

[0137] The retained public key component 113 is used to save the public key and destroy the private key for the applicant. The retained public key component 113 is connected to the public key and private key calculation component 111.

[0138] In this embodiment, the specific components of the login module 12 include but are not limited to:

[0139] The own public key input component 121 allows the visitor to select his own public key file under the specified target on the server through the open icon on the page. The system reads the public key and displays it in the public key column. The visitor clicks the submit button to send the public key to the system background;

[0140] The QR code conversion and display component 122 is used to generate a random number as the encrypted original text in the system to be logged in, and perform symmetrical encryption with the received public key. The encryption result is displayed in the encryption message bar, and the encryption result is automatically converted into a QR code and displayed on the screen. The QR code conversion and display component 122 is connected to its own public key input component 121;

[0141] The symmetric decryption and login verification component 123 is used for visitors to obtain encrypted messages using the code scanning function in the mobile wallet, and use the corresponding private key decryption function of the mobile wallet to perform symmetric decryption. The decryption result is sent to the decrypted original text column for display. Click the submit button, and the decryption result is sent to the system background. The system background compares the decryption result with the random number to verify the decryption result, and gives a conclusion on whether to allow login to the system based on this. The symmetric decryption and login verification component 123 is connected to the QR code conversion and display component 122.

[0142] In this embodiment, the aforementioned mobile terminal system 2 includes but is not limited to:

[0143] Public key and private key management module 21, used to manage and maintain one's own public key and private key;

[0144] Signature verification module 22, used for signing and verifying signatures;

[0145] The encryption and decryption module 23 is used to perform encryption and decryption operations. The encryption and decryption module 23 is connected to the public key and private key management module 21 and the signature verification module 22;

[0146] The code scanning module 24 is used to scan and read the two-dimensional code information. The code scanning module 24 is connected to the encryption and decryption module 23 .

[0147] In summary, the SM9 cryptographic algorithm adopted in the present invention belongs to the Identity Based Cryptograph (IBC) system, which uses the user's identity to replace the public key, does not require a public key certificate authority (CA), and reduces the difficulty of key resource management and deployment.

[0148] The present invention adopts a strategy of keeping the enemy out of the door. Through the SM9 algorithm and related interactive processing procedures, effective verification is performed when logging into the system, and counterfeiters are blocked outside the system or network, making it impossible for them to enter the system or network, which can well achieve the goal of resisting Sybil attacks.

[0149] In order to prevent counterfeiters from using other people's public information to apply for public keys / private keys, the present invention uses email verification and activation processing, which effectively ensures the security of the method of the present invention; the interaction process between the visitor and the system of the present invention is very simple, does not involve large computing power and large storage, and has low cost.

[0150] The method of preventing Sybil attacks adopted by the present invention uses one's own public key and private key, mobile phone wallet, and encrypts and decrypts random numbers to prove one's identity, thereby logging into the system or network. It is simple, low-cost and has a high success rate.

[0151] The algorithm and processing process adopted by the present invention are mainly based on asymmetric encryption, QR code scanning and other methods, and have a good protection effect against Sybil counterfeiters. Simple and low-cost, the algorithm and processing process are simple, without high computing power and high time cost.

[0152] The present invention uses a specific algorithm and processing process to perform effective checks when logging into the system, blocking Sybil impersonators from the system or network, making it impossible for Sybil impersonators to enter the system or network.

[0153] The present invention solves the technical problems existing in the prior art that it is difficult to prevent counterfeiters from entering the system and network, the computing power and time costs are high, and the defense success rate is low.

[0154] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A system login method for preventing Sybil attacks, characterized in that: The method comprises: S1. Obtain the public key input by the visitor, calculate the public key and private key based on the identity identification technology IBC and the SM9 encryption algorithm, and obtain the public key calculation result and the private key calculation result; S2. Send the public key calculation result and the private key calculation result to the mobile terminal application logged in by the applicant; S3. Save the public key calculation result for the applicant and destroy the private key calculation result; S4, enabling the visitor to select a public key file in the target specified by the server through the open icon on the page, reading and displaying the public key file in the preset public key column, enabling the visitor to click a submit button, and then sending the public key in the public key file to the preset system backend; S5. Generate a random number in the intended login system as the encrypted original text, use the public key to perform symmetrical encryption to obtain and display the encryption result in a preset encryption message bar, convert the encryption result into a QR code, and display the QR code on a preset display device; S6, the visitor uses the mobile terminal application to scan the QR code to obtain the encrypted message, uses the mobile terminal application to perform a symmetric decryption operation on the private key, obtains and sends the symmetric decryption result to the decrypted original text column for display, the visitor clicks the submit button to send the symmetric decryption result to the preset system background, and the preset system background compares the symmetric decryption result with the random number to verify the symmetric decryption result and obtain a verification result; S7. According to the verification result, identify and intercept Sybil impersonators from the visitors.

2. According to claim 1, a system login method for preventing Sybil attacks is characterized in that: In S1, the original text is received, and the public key and the private key are used to perform symmetric encryption on the original text. The public key encryption option and the private key encryption option are selected and the submit button is clicked. Symmetric encryption is performed according to the SM9 encryption algorithm to obtain the ciphertext, and the ciphertext is sent to the target node.

3. According to claim 1, a system login method for preventing Sybil attacks is characterized in that: In S1, assuming that m is the plaintext, c is the ciphertext encrypted from m, SK is the private key, and PK is the public key, the following logic is used to perform symmetric encryption and decryption operations: PK(m)=c; SK(c)=m.

4. According to claim 1, a system login method for preventing Sybil attacks is characterized in that: In S6, the ciphertext is received, and the ciphertext is symmetrically decrypted using the public key and the private key. The ciphertext is received, the public key decryption option and the private key decryption option are selected and the submit button is clicked. The symmetric decryption operation is performed according to the SM9 decryption algorithm to obtain plaintext, and the plaintext is sent to the target node.

5. According to claim 1, a system login method for preventing Sybil attacks is characterized in that: In S6, the public key and the private key are managed and maintained using a public key and a private key management module.

6. According to claim 1, a system login method for preventing Sybil attacks is characterized in that: In S6, a signature verification module is used to perform a signature operation and a signature verification operation on the visitor.

7. The system login method for preventing Sybil attacks according to claim 1, characterized in that: In S6, the encryption and decryption modules are used to perform encryption and decryption operations on the mobile terminal.

8. The system login method for preventing Sybil attacks according to claim 1, characterized in that: In S6, the encrypted information in the two-dimensional code is scanned and read using a preset algorithm using a code scanning module of the mobile terminal.

9. The system login method for preventing Sybil attacks according to claim 1, characterized in that: In S7, the random number method original text and the symmetric decryption result corresponding to the visitor are compared, and when the verification results are inconsistent, the Sybil imposter is not allowed to enter the preset system.

10. A system login system for preventing Sybil attacks, characterized in that: The system comprises: a system end system and a mobile end system; the system end system comprises: an initialization module and a login module, wherein the login module is connected to the initialization module; the mobile end system comprises: a public key and private key management module, a signature verification module, an encryption and decryption module and a code scanning module, wherein the encryption and decryption module is connected to the public key and private key management module and the signature verification module; the code scanning module is connected to the encryption and decryption module; The initialization module also includes: The public key and private key calculation component is used to obtain the public key input by the visitor, calculate the public key and private key based on the identity identification technology IBC and the SM9 encryption algorithm, and obtain the public key calculation result and the private key calculation result; A calculation result sending component, used for sending the public key calculation result and the private key calculation result to the mobile terminal application logged in by the applicant in the mobile terminal system, and the calculation result sending component is connected to the public key and private key calculation component; A retained public key component is used to save the public key calculation result and destroy the private key calculation result for the applicant, and the retained public key component is connected to the public key and private key calculation component; The login module also includes: The public key input component is used to enable the visitor to select a public key file in the target specified by the server through the open icon on the page, read and display the public key file in the preset public key column, and enable the visitor to click the submit button, so that the public key in the public key file is sent to the preset system backend; A QR code conversion and display component is used to generate a random number in the intended login system as the encryption original text, use the public key to perform symmetrical encryption to obtain and display the encryption result in a preset encryption message bar, convert the encryption result into a QR code, and display the QR code on a preset display device. The QR code conversion and display component is connected to the own public key input component; The symmetric decryption and login verification component is used to enable the visitor to use the mobile terminal application to scan the QR code to obtain the encrypted message, use the mobile terminal application to perform a symmetric decryption operation on the private key, obtain and send the symmetric decryption result to the decryption original text column for display, and the visitor clicks the submit button to send the symmetric decryption result to the preset system background. In the preset system background, the symmetric decryption result is compared with the random number to verify the symmetric decryption result and obtain the system login permission judgment result. The symmetric decryption and login verification component is connected to the QR code conversion and display component.

Images