Method for realizing user login security authentication based on cloud platform

Abstract

The invention provides a method for realizing user login security authentication based on a cloud platform, which belongs to the technical field of security authentication and comprises management forms of password identity authentication, two-factor authentication, biological recognition authentication, certificate-based authentication and the like based on a cloud platform user. Security of transmission protocol encryption, password encryption, storage encryption and the like is also included, and data leakage is prevented; meanwhile, access control limitation of the user, user login security auditing and monitoring and the like are also included, and it is ensured that abnormal login or abnormal operation of the user can be found and processed in time. In the cloud platform system, whether multiple authentication modes, authentication timeliness and the like are configured for the user role, so that the user login process can be simplified in the complex cloud platform system.

Description

Technical Field

[0001] The present invention relates to the technical field of security authentication, and in particular to a method for implementing security authentication based on user login on a cloud platform. Background Art

[0002] With the rapid development of multi-cloud technology, cloud platforms have become an important way for enterprises, individuals and other users to store data and run applications. In a multi-cloud architecture environment, the security issues of cloud platforms have also received widespread attention, especially in terms of user login security authentication.

[0003] The core purpose of user login security authentication is to verify user identity, ensure that only legitimate users can access system resources, and prevent unauthorized access and potential security threats. User login security authentication is the first line of defense to ensure the security of the cloud platform system. It is responsible for verifying user identity, preventing illegal users from accessing cloud platform resources, and protecting the privacy and integrity of cloud platform data.

[0004] User login security authentication technology is a key mechanism to ensure that only authorized users can access systems and resources. With the increase in cyber attacks and data leaks, these technologies are becoming more and more important. In the past, single-factor authentication that only used account and password to log in had security risks. Therefore, a new, efficient and secure login authentication method is needed to solve the system login problem. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a method for implementing cloud platform user login security authentication, which directly affects the security and reliability of the cloud platform system, and also improves the security of cloud platform user login, implements fine-grained access control, strengthens the security of data transmission, implements intelligent security auditing and monitoring, provides flexible and diverse authentication methods, and reduces the cost and complexity of security authentication. The realization of these goals can provide users with a more secure, reliable and convenient cloud platform service experience.

[0006] The technical solution of the present invention is:

[0007] A method for implementing cloud platform user login security authentication, comprising:

[0008] User single-factor authentication: the user first enters the user name and password through the cloud platform system login interface to verify the first authentication factor;

[0009] User two-factor authentication: if the first authentication factor is verified, and the cloud platform system configures the current user role to require secondary verification, then the user is required to perform two-factor verification;

[0010] The server-side authentication center controls user access, performs user login security audits and monitoring, etc., to ensure that abnormal logins or abnormal operations by users are discovered and handled in a timely manner.

[0011] Furthermore,

[0012] User single-factor authentication, including

[0013] (1) Password storage:

[0014] Hash storage: The server converts the password into a hash value through a hash algorithm and then stores it;

[0015] Salt: During the hashing process, a randomly generated salt value is used in combination with the password to increase the complexity of the hash and prevent rainbow table attacks;

[0016] Hash iteration: The password is hashed several times to increase the difficulty of cracking;

[0017] (2) Password verification:

[0018] Hash comparison: After receiving the password entered by the user, the server compares it with the stored hash value instead of directly comparing the password itself;

[0019] (3) Limit the number of attempts: limit the number of times a user attempts to log in within a set time. If the number of attempts is exceeded, the account will be temporarily locked or the user will be required to provide additional authentication information;

[0020] (4) Password complexity requirements:

[0021] Minimum length: Set the minimum length requirement for the password;

[0022] Character type: Requires the password to contain different types of characters;

[0023] Regular update: force users to change passwords regularly;

[0024] (5) Graphic verification code measures:

[0025] Graphic verification code: Use graphic verification code during the login process to verify whether the login request is from a human, preventing script automation attacks;

[0026] (6) Use HTTPS encryption: With SSL / TLS encryption, users can access websites and applications securely; HTTPS protocol is used to encrypt communications between the client and the server;

[0027] (7) IP address restriction: Limit login attempts to specific IP addresses to prevent attacks from unknown sources;

[0028] (8) Login log: records all login attempts for security auditing and monitoring;

[0029] (9) Regular updates and maintenance: Regularly update cryptographic hash functions and hash iteration times to keep security up to date, and regularly check and update security vulnerabilities.

[0030] in,

[0031] It is forbidden to transmit user login information and identity credentials in plain text. SSL encryption tunnel is used to ensure the transmission security of user passwords. It is forbidden to store user passwords in plain text in the database or file system. It is forbidden to save user passwords in COOKIE. One-way hash value is used to store user passwords in the database.

[0032] If you encounter an IP address that frequently attacks, add it to the blacklist to prevent it from accessing the cloud platform system.

[0033] Furthermore,

[0034] Two-factor authentication for users, including:

[0035] 1) SMS verification code verification:

[0036] When the user enters their mobile phone number for the second login and clicks Send Verification Code, the server generates a one-time password, sets an expiration date, and sends it to the user's mobile phone via SMS. The user enters the received one-time password. If the input is incorrect, the verification fails and the one-time password becomes invalid. If the input is incorrect repeatedly, the account will be temporarily locked or the user will be required to provide additional authentication information.

[0037] 2) Email Verification:

[0038] When the user enters their email address during the second login, the server generates a one-time password, sets an expiration date, and sends it to the user's registered email address via email service; the user enters the received one-time password. If the input is incorrect, the verification fails and the one-time password becomes invalid. If the input is incorrect continuously, the account will be temporarily locked or the user will be required to provide additional authentication information;

[0039] 3) Mobile application verification:

[0040] The user's mobile phone needs to install the authentication application and bind the user information to the authentication application. The user can obtain a one-time password through the authentication application. The user enters the one-time password generated by the authentication application server for login verification during the second login;

[0041] 4) Hardware token verification:

[0042] The hardware device server generates a one-time password and sends it to the hardware device held by the user through the hardware token. The user checks the one-time password during authentication and enters the one-time password for login verification during the second login.

[0043] 5) Biometric Verification:

[0044] When the user logs in for the second time, the user's biometric information is compared. During the comparison process, the user's biometric information is guaranteed to be dynamic to prevent static images from interfering with the recognition system;

[0045] 6) Certificate-based authentication

[0046] When the user logs in for the second time, he needs to provide a digital certificate. The system will verify the validity of the certificate. If the verification is successful, the user is allowed to log in.

[0047] 7) Blockchain-based authentication

[0048] When logging in for the second time, the user needs to provide a digital identity on the blockchain. The system will verify the validity of the digital identity. If the verification is successful, the user is allowed to log in.

[0049] 8) Risk-based certification:

[0050] The server assesses login risk based on the user's historical behavior and login environment factors.

[0051] If the risk is lower than the set value, the server only requires the user to enter the password for one verification; if the risk is higher than the set value, the server will require the user to provide additional secondary authentication information.

[0052] Furthermore,

[0053] Server authentication center, including

[0054] 1) User identity verification:

[0055] The user enters a username and password and submits a login request. The server verifies whether the username and password entered by the user match the credentials stored in the database; if the credentials match, the user's authentication is successful, otherwise the user must log in again;

[0056] 2) Session Management:

[0057] Use session ID as identification. Session ID is a randomly generated string used to identify the user in subsequent requests. Session data is stored in the session storage on the server side. The session is bound to the IP address.

[0058] 3) Access Control:

[0059] When the server receives the request, it checks the validity of the session ID. If the session ID is invalid or expired, the server rejects the request. If the session ID is valid, the server checks the session data to determine the user's permissions and access restrictions.

[0060] 4) Session timeout:

[0061] Set the session timeout to prevent long-inactive sessions from being exploited by attackers; when a user is inactive for a long time, the server will automatically log out of the session;

[0062] 5) Login restrictions:

[0063] Set a limit on the number of login attempts to prevent brute force attacks. When the limit is reached, the server will temporarily lock the account or require the user to provide additional authentication information.

[0064] 6) Abnormal login detection:

[0065] The server monitors the user's login behavior. If abnormal behavior is detected, the server rejects the login request and notifies the user or administrator.

[0066] 7) Security Audit:

[0067] Log all login attempts for security auditing and monitoring; analyze login logs to detect potential security threats.

[0068] The beneficial effects of the present invention are

[0069] The usual implementation method of user login security authentication can achieve the following effects:

[0070] 1) Improve system security: By introducing a multi-factor authentication (MFA) mechanism, the security of cloud platform user login has been significantly improved. These measures have greatly increased the difficulty of illegal access, requiring attackers to obtain multiple authentication factors at the same time to successfully log in, effectively preventing the risk of data leakage and illegal intrusion into the system.

[0071] 2) Protect user data: Encrypted transmission and data protection technology ensure the security of user data during transmission. By using technologies such as TLS / SSL protocol and AES symmetric encryption algorithm, user identity information and sensitive data are encrypted for transmission, preventing data from being stolen or tampered with during transmission. This protection mechanism provides a solid guarantee for the security of user data.

[0072] 3) Improve user experience: Although security authentication measures have been added, this method makes the security authentication process more efficient and convenient by optimizing algorithm design and simplifying operation procedures, thereby lowering the user's usage threshold and cost, improving user experience, and increasing user trust.

[0073] 4) Strong adaptability: This method provides a variety of flexible authentication methods for users to choose from, such as username and password, mobile phone verification code, email verification, facial recognition, hardware tokens, certificates, etc. These authentication methods can be combined and configured according to the actual situation of the user, meeting the needs and scenarios of different users, and have strong adaptability.

[0074] 5) Prevent fraud and account abuse: More reliable authentication technology reduces fraud and account abuse, protecting the legitimate rights and interests of users and cloud service providers. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 It is a schematic diagram of the architecture design of the present invention;

[0076] Figure 2 This is a login authentication flow chart. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0078] The present invention provides a method for implementing user login security authentication based on a cloud platform, including the reasonable combination of multi-factor authentication (password, mobile phone verification code, password token), human biometric authentication (face recognition, iris recognition), data information encryption transmission technology (TLS / SSL protocol, AES symmetric encryption algorithm, password hash storage), digital certificate (certificate issued by public key infrastructure (PKI) to verify the identity of the user) and other technologies to ensure user security login.

[0079] The details are as follows:

[0080] Single-factor authentication for users

[0081] The user first enters the username and password through the cloud platform system login interface to verify the first authentication factor.

[0082] 1) Password storage:

[0083] Hash storage: The server does not store the user's plain text password, but converts the password into a hash value through a hash algorithm (such as SHA-256) and then stores it.

[0084] Salt: During the hashing process, a randomly generated salt value is used in combination with the password to increase the complexity of the hash and prevent rainbow table attacks.

[0085] Hash iteration: The password is hashed multiple times to increase the difficulty of cracking.

[0086] It is forbidden to transmit user login information and identity credentials in plain text. SSL encryption tunnel should be used to ensure the security of user password transmission. It is forbidden to store user passwords in plain text in the database or file system. It is forbidden to save user passwords in COOKIE. One-way hash values ​​should be used to store user passwords in the database.

[0087] 2) Password verification:

[0088] Hash comparison: After the server receives the password entered by the user, it compares it with the stored hash value instead of directly comparing the password itself.

[0089] 3) Limit the number of attempts: To prevent brute force cracking, the system will limit the number of times a user attempts to log in within a certain period of time. If the number of attempts is exceeded, the account will be temporarily locked or the user will be required to provide additional authentication information.

[0090] 4) Password complexity requirements:

[0091] Minimum length: Set the minimum length requirement for the password to increase the complexity of the password.

[0092] Character types: Require passwords to contain different types of characters, such as uppercase and lowercase letters, numbers, and special characters to increase the strength of your passwords.

[0093] Regular updates: Force users to change their passwords regularly to reduce the risk of password leaks.

[0094] 5) Graphic verification code measures:

[0095] Graphic verification code: Use a graphic verification code during the login process to verify whether the login request comes from a human, preventing script automation attacks.

[0096] 6) Use HTTPS encryption: With SSL / TLS encryption, users can access websites and applications securely, protecting personal information and transaction data from being stolen or tampered with. Use HTTPS protocol to encrypt communications between the client and the server to prevent man-in-the-middle attacks and data leaks.

[0097] 7) IP address restriction: Limit login attempts to specific IP addresses to prevent attacks from unknown sources. If you encounter an IP that frequently accesses attacks, you can add it to the blacklist to prevent it from accessing the cloud platform system.

[0098] 8) Login log: records all login attempts, both successful and failed, for security auditing and monitoring purposes.

[0099] 9) Regular updates and maintenance: Regularly update the password hash function and hash iteration times to keep security up to date. And regularly check and update security vulnerabilities to ensure the security and stability of the system.

[0100] Two-factor authentication for users

[0101] If the first authentication factor is verified successfully, and the cloud platform system has configured the current user role to require secondary verification, then the user will be required to perform two-factor verification.

[0102] 1) SMS verification code verification:

[0103] When logging in for the second time, the user enters their mobile phone number and clicks to send a verification code (sent once every 60 seconds). The server generates a one-time password (OTP) with an expiration time of 3 minutes and sends it to the user's mobile phone via SMS. The user enters the received OTP. If the input is incorrect, the verification fails and the OTP becomes invalid. If the input is incorrect continuously, the account will be temporarily locked or the user will be required to provide additional authentication information.

[0104] 2) Email Verification:

[0105] When the user enters the email address during the second login, the server generates an OTP, sets the expiration time to 3 minutes, and sends it to the user's registered email address via email service. The user enters the received OTP. If the input is incorrect, the verification fails and the OTP becomes invalid. If the input is incorrect continuously, the account will be temporarily locked or the user will be required to provide additional authentication information.

[0106] 3) Mobile application verification:

[0107] The user's mobile phone needs to install an authentication application (Google Authenticator, Authy, etc.) and bind the user information to the authentication application. In this way, the user can obtain an OTP through the authentication application. The user enters the OTP generated by the authentication application server for login verification during the second login.

[0108] 4) Hardware token verification:

[0109] The hardware device server generates an OTP and sends it to the hardware device held by the user through the hardware token. The user views the OTP during authentication and enters the OTP for login verification during the second login.

[0110] 5) Biometric Verification:

[0111] When the user logs in for the second time, the user's biometric information (facial recognition, iris recognition) is compared. During the comparison process, the user's biometric information is guaranteed to be dynamic to prevent static images from interfering with the recognition system.

[0112] 6) Certificate-based authentication

[0113] When users log in for the second time, they need to provide a digital certificate. Certificate authentication is a method of authentication based on public key infrastructure (PKI). The system will verify the validity of the certificate. If the verification is successful, the user is allowed to log in.

[0114] 7) Blockchain-based authentication

[0115] When the user logs in for the second time, blockchain technology is a decentralized distributed database technology that can achieve secure storage and transmission of data. Blockchain-based authentication is a new type of authentication method. When logging in, the user needs to provide a digital identity on the blockchain. The system will verify the validity of the digital identity. If the verification is successful, the user is allowed to log in. Blockchain-based authentication has high security and transparency.

[0116] 8) Risk-based certification:

[0117] The server assesses the login risk based on factors such as the user's historical behavior and login environment. If the risk is low, the server may only require the user to enter the password for one verification; if the risk is high, the server will require the user to provide additional secondary authentication information. In the frequently used cloud platform system login environment, users must enter their username and password, as well as two-factor authentication such as mobile phone verification code, email, hardware token, or facial recognition every time to successfully log in, which undoubtedly brings great inconvenience to user login. Through server risk authentication, the user login process can be simplified and the user login security can also be guaranteed.

[0118] Server-side authentication center

[0119] 1) User identity verification:

[0120] The user enters a username and password and submits a login request. The server verifies whether the username and password entered by the user match the credentials stored in the database. If the credentials match, the user authentication succeeds, otherwise the user logs in again.

[0121] 2) Session Management:

[0122] The server creates a session for the authenticated user, usually using a session ID as an identifier. The session ID is a randomly generated string used to identify the user in subsequent requests. Session data (such as user permissions, login status, etc.) is stored in the server-side session storage. The session should be bound to the IP address to reduce the risk of session theft.

[0123] 3) Access Control:

[0124] When the server receives the request, it checks the validity of the session ID. If the session ID is invalid or expired, the server rejects the request. If the session ID is valid, the server checks the session data to determine the user's permissions and access restrictions.

[0125] 4) Session timeout:

[0126] Set the session timeout to prevent long-term inactive sessions from being exploited by attackers. When the user is inactive for a long time, the server will automatically log out the session.

[0127] 5) Login restrictions:

[0128] Set a limit on the number of login attempts to prevent brute force attacks. When the limit is reached, the server may temporarily lock the account or require the user to provide additional authentication information.

[0129] 6) Abnormal login detection:

[0130] The server monitors the user's login behavior, such as login time, location, device, etc. If abnormal behavior is detected, the server may reject the login request and notify the user or administrator.

[0131] 7) Security Audit:

[0132] Log all login attempts, including successful and failed attempts, for security auditing and monitoring purposes. Analyze login logs to detect potential security threats.

[0133] 8) Multi-factor Authentication (MFA):

[0134] After the username and password are successfully verified, the user is required to provide a second authentication factor, such as a mobile phone SMS verification code, email, biometric verification, certificate verification, hardware token, etc., to ensure the security of the user's login to the system.

[0135] Login authentication through these services can provide a certain degree of security, but there are still security risks. Therefore, many service providers now use multi-factor authentication (MFA) technology to provide a higher level of security.

[0136] The present invention ensures the security of cloud platform user login and prevents illegal access and data leakage by using a multi-level identity authentication mechanism for users in the cloud platform.

[0137] The core of cloud platform user login security authentication lies in identity authentication, which ensures the authenticity and legitimacy of user identity through technical means such as encryption algorithms, digital signatures and verification codes.

[0138] The present invention is used to improve the security of cloud servers to optimize business processes and improve user experience. Physical access control and joint authentication are used to further ensure the security of cloud platforms. When users access resources and application operations, a multi-factor authentication mechanism is introduced to provide a higher level of protection.

[0139] The above description is only a preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, and is not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A method for implementing cloud platform user login security authentication, characterized in that: include User single-factor authentication: the user first enters the user name and password through the cloud platform system login interface to verify the first authentication factor; User two-factor authentication: if the first authentication factor is verified, and the cloud platform system configures the current user role to require secondary verification, the user is required to perform two-factor verification; The server-side authentication center controls and restricts user access, performs security audits and monitoring of user logins, and ensures that abnormal logins or abnormal operations by users are discovered and handled in a timely manner.

2. The method according to claim 1, characterized in that User single-factor authentication, including (1) Password storage: Hash storage: The server converts the password into a hash value through a hash algorithm and then stores it; Salt: During the hashing process, a randomly generated salt value is used in combination with the password to increase the complexity of the hash and prevent rainbow table attacks; Hash iteration: The password is hashed several times to increase the difficulty of cracking; (2) Password verification: Hash comparison: After receiving the password entered by the user, the server compares it with the stored hash value instead of directly comparing the password itself; (3) Limit the number of attempts: limit the number of times a user attempts to log in within a set time. If the number of attempts is exceeded, the account will be temporarily locked or the user will be required to provide additional authentication information; (4) Password complexity requirements: Minimum length: Set the minimum length requirement for the password; Character type: Requires the password to contain different types of characters; Regular updates: force users to change their passwords regularly; (5) Graphic verification code measures: Graphic verification code: Use graphic verification code during the login process to verify whether the login request is from a human, preventing script automation attacks; (6) Use HTTPS encryption: With SSL / TLS encryption, users can access websites and applications securely; HTTPS protocol is used to encrypt communication between the client and the server; (7) IP address restriction: Limit login attempts to specific IP addresses to prevent attacks from unknown sources; (8) Login log: records all login attempts for security auditing and monitoring; (9) Regular updates and maintenance: Regularly update cryptographic hash functions and hash iteration times to keep security up to date, and regularly check and update security vulnerabilities.

3. The method according to claim 2, characterized in that It is prohibited to transmit user login information and identity credentials in plain text. SSL encryption tunnel is used to ensure the transmission security of user passwords. It is prohibited to store user passwords in plain text in the database or file system. Prohibit saving user passwords in COOKIE.

4. The method according to claim 3, characterized in that Use one-way hash values ​​to store user passwords in the database.

5. The method according to claim 2, characterized in that: If you encounter an IP address that frequently attacks, add it to the blacklist to prevent it from accessing the cloud platform system.

6. The method according to claim 1, characterized in that User two-factor authentication, including: 1) SMS verification code verification: When the user enters their mobile phone number for the second login and clicks Send Verification Code, the server generates a one-time password, sets an expiration date, and sends it to the user's mobile phone via SMS. The user enters the received one-time password. If the input is incorrect, the verification fails and the one-time password becomes invalid. If the input is incorrect repeatedly, the account will be temporarily locked or the user will be required to provide additional authentication information. 2) Email Verification: When the user enters their email address during the second login, the server generates a one-time password, sets an expiration date, and sends it to the user's registered email address via email service; the user enters the received one-time password. If the input is incorrect, the verification fails and the one-time password becomes invalid. If the input is incorrect continuously, the account will be temporarily locked or the user will be required to provide additional authentication information; 3) Mobile application verification: The user's mobile phone needs to install the authentication application and bind the user information to the authentication application. The user can obtain a one-time password through the authentication application. The user enters the one-time password generated by the authentication application server for login verification during the second login; 4) Hardware token verification: The hardware device server generates a one-time password and sends it to the hardware device held by the user through the hardware token. The user checks the one-time password during authentication and enters the one-time password for login verification during the second login. 5) Biometric Verification: When the user logs in for the second time, the user's biometric information is compared. During the comparison process, the user's biometric information is guaranteed to be dynamic to prevent static images from interfering with the recognition system; 6) Certificate-based authentication When the user logs in for the second time, he needs to provide a digital certificate. The system verifies the validity of the certificate. If the verification is successful, the user is allowed to log in. 7) Blockchain-based authentication When logging in for the second time, the user needs to provide the digital identity on the blockchain. The system verifies the validity of the digital identity. If the verification is successful, the user is allowed to log in. 8) Risk-based certification: The server assesses login risk based on the user's historical behavior and login environment factors.

7. The method according to claim 6, characterized in that If the risk is lower than the set value, the server only requires the user to enter the password for one verification; if the risk is higher than the set value, the server will require the user to provide additional secondary authentication information.

8. The method according to claim 1, characterized in that Server authentication center, including 1) User identity verification: The user enters a username and password and submits a login request; the server verifies whether the username and password entered by the user match the credentials stored in the database; if the credentials match, the user's identity authentication succeeds, otherwise the user logs in again; 2) Session Management: Use session ID as identification. Session ID is a randomly generated string used to identify the user in subsequent requests. Session data is stored in the session storage on the server side. The session is bound to the IP address. 3) Access Control: When the server receives the request, it checks the validity of the session ID. If the session ID is invalid or expired, the server rejects the request. If the session ID is valid, the server checks the session data to determine the user's permissions and access restrictions. 4) Session timeout: Set the session timeout to prevent long-inactive sessions from being exploited by attackers; when a user is inactive for a long time, the server will automatically log out of the session; 5) Login restrictions: Set a limit on the number of login attempts to prevent brute force attacks. When the limit is reached, the server will temporarily lock the account or require the user to provide additional authentication information. 6) Abnormal login detection: The server monitors the user's login behavior. If abnormal behavior is detected, the server rejects the login request and notifies the user or administrator. 7) Security Audit: Log all login attempts for security auditing and monitoring purposes; Analyze login logs to detect potential security threats.

Images