Dynamic certificate updating method and system

Abstract

The invention provides a dynamic certificate updating method and system, which is applied to an authentication server and comprises the following steps: generating a secret seed for a user and encrypting and storing the secret seed; pre-installing a secret seed in the physical token; generating a unique identifier for the user during registration, and associating the unique identifier with the secret seed; when a user requests to issue or update a digital certificate, a one-time password and a VDF result are generated through the physical token according to the current time and the secret seed; receiving the one-time password and the VDF result, verifying the validity of the one-time secret according to the secret seed and the current time, and verifying the VDF result to ensure the synchronism of the time; and if the verification is successful, issuing or updating the digital certificate to the user, and dynamically updating the authority information in the digital certificate based on the fuzzy logic. According to the method, high requirements of current complex and changeable network environments on identity authentication and data encryption are well met by introducing a secret seed, one-time password and VDF result combined authentication and permission updating based on fuzzy logic.

Description

Technical Field

[0001] The present invention relates to the technical field of digital certificate updating, and in particular to a dynamic certificate updating method and system. Background Art

[0002] As an important means of identity authentication and data encryption, digital certificates play a vital role in the field of network security. Digital certificates are not only used to prove the identity of users, but also to ensure the integrity and confidentiality of data. In traditional network applications, digital certificates are usually issued by certification authorities (CA) and contain information such as the user's public key, identity information, and the validity period of the certificate. However, with the increasing complexity and variability of network environments, traditional digital certificate management methods can no longer meet current security needs.

[0003] In traditional digital certificate management systems, users usually need to enter their usernames and passwords to authenticate their identities. Although this method is simple and convenient, it has many security risks. For example, passwords are easy to guess or steal. Once passwords are leaked, the user's identity and data will face serious threats. In order to enhance security, some systems use two-factor authentication or multi-factor authentication methods, such as combining passwords and physical tokens for identity authentication. However, these methods still have certain limitations: 1. Traditional identity authentication methods such as passwords and physical tokens are easy to guess, steal or lose, resulting in threats to the security of user identity and data; 2. Once a traditional digital certificate is issued, its permission information is usually fixed and difficult to dynamically adjust according to the actual needs of the user; 3. Although multi-factor authentication methods improve security, they also increase the complexity of user operations and affect user experience. Summary of the invention

[0004] Based on this, the purpose of the present invention is to propose a dynamic certificate update method and system to solve the above-mentioned problems.

[0005] A dynamic certificate updating method proposed in the present invention is applied to an authentication server, and the method comprises:

[0006] A unique secret seed is generated for each user and stored in encrypted form in a secure database;

[0007] Preinstalling a secret seed in a physical token and distributing each of the physical tokens to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to an authentication server;

[0008] When the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship, a unique identifier is generated for the target user and associated with the secret seed in the security database;

[0009] When the target user requests to issue or renew a digital certificate, a one-time password is generated through the target user's physical token according to the current time and its built-in secret seed, and a VDF result is generated at the same time;

[0010] Receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database according to the unique identifier of the target user, and verify the validity of the one-time secret according to the secret seed and the current time, and verify the VDF result to ensure time synchronization;

[0011] If the one-time password and VDF result verification are successful, a digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

[0012] Furthermore, the physical token of the target user is used to generate a one-time password according to the current time and its built-in secret seed, including:

[0013] For the physical token, get the current timestamp and set it as the first time;

[0014] Extract the built-in secret seed;

[0015] Calculate a time counter according to the first time and the preset time interval, and set it as a first time counter;

[0016] Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value;

[0017] The first hash value is truncated to extract a value of a preset length as a one-time password;

[0018] Send the one-time password to the authentication server for verification.

[0019] Furthermore, verifying the validity of the one-time password includes:

[0020] Set a preset time window;

[0021] Get the current timestamp when receiving the one-time password and set it as the second time;

[0022] Adding or subtracting the preset time window from the second time to obtain a time interval;

[0023] Calculate a set of time counters according to each time point in the time interval and a preset time interval, and set them as second time counters;

[0024] By using a preset encryption algorithm, taking the secret seed and each of the second time counters as input, a set of hash values ​​is generated and set as second hash values;

[0025] Performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords;

[0026] comparing the one-time password with any one of the expected one-time passwords;

[0027] If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

[0028] Furthermore, generating the VDF result includes:

[0029] For the physical token, get the current timestamp and set it as the first time T current ;

[0030] Calculate the first time T current The last synchronization time T sync The time difference ΔT, ΔT = T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server;

[0031] Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ;

[0032] The VDF result R vdf Sent to the authentication server for verification.

[0033] Furthermore, the verification of the VDF results to ensure time synchronization includes:

[0034] Get the received VDF result R vdf The current timestamp is set to the second time T server_current ;

[0035] According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server;

[0036] Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number;

[0037] Determine the VDF result R vdf Whether it is within the expected VDF result range;

[0038] If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is considered successful;

[0039] If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

[0040] Furthermore, before dynamically updating the authority information in the digital certificate based on fuzzy logic, the following steps are included:

[0041] Determine the type of authority and the key factors that influence the extent of authority granted;

[0042] defining fuzzy sets for each of the key factors and permission types;

[0043] Determine a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets;

[0044] Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors;

[0045] All the fuzzy rules are stored in a fuzzy rule base.

[0046] Furthermore, the dynamically updating the authority information in the digital certificate based on fuzzy logic includes:

[0047] Collect real-time data related to the target user's permission grant from the target data source, including the target user's role, behavior pattern, device type, network location, and request time;

[0048] According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user;

[0049] Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

[0050] Furthermore, the method of calculating the degree of authorization of the target user by using a fuzzy inference algorithm based on real-time data and a fuzzy rule base includes:

[0051] The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set;

[0052] According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base;

[0053] According to the matched fuzzy rules, the fuzzy output membership of the target user's authority granting degree is calculated;

[0054] The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

[0055] The present invention also provides a dynamic certificate update system for implementing the above-mentioned dynamic certificate update method, the system comprising:

[0056] Seed generation module: used to generate a unique secret seed for each user and store it in a secure database in encrypted form;

[0057] Seed pre-installation module: used to pre-install secret seeds in physical tokens and distribute each of the physical tokens to corresponding users, wherein the physical tokens are built with a time synchronization module and an encryption algorithm corresponding to the authentication server;

[0058] Registration module: used to generate a unique identifier for the target user and associate it with the secret seed in the security database when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship;

[0059] Generation module: used to generate a one-time password and a VDF result through the target user's physical token according to the current time and its built-in secret seed when the target user requests to issue or update a digital certificate;

[0060] Verification module: used to receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database according to the unique identifier of the target user, and verify the validity of the one-time secret according to the secret seed and the current time, and verify the VDF result to ensure time synchronization;

[0061] Update module: used to issue or update the digital certificate for the target user if the one-time password and VDF result verification are successful, and dynamically update the permission information in the digital certificate based on fuzzy logic, where the new digital certificate contains the target user's unique identifier, validity period, permission information and additional security attributes.

[0062] In summary, in the dynamic certificate update method of the present invention, the secret seed pre-installed in the physical token of the present invention is stored in an encrypted form, which means that even if the token is stolen, the attacker cannot easily extract the secret seed, and the secret seed is associated with the user's unique identifier and stored in a secure database, further enhancing its security.

[0063] Each time an identity is authenticated, the physical token generates a one-time password. This password is generated based on the current time and secret seed and is highly unpredictable. Even if an attacker obtains the physical token, they cannot generate a valid one-time password because they do not know the current secret seed and the exact time. In addition to the one-time password, the physical token also generates a VDF result. While verifying the one-time password, the authentication server also verifies the VDF result to ensure time synchronization. This dual verification together constitutes a powerful security protection mechanism that can effectively prevent replay attacks and man-in-the-middle attacks.

[0064] When issuing or updating a digital certificate, the permission information in the certificate is dynamically updated based on fuzzy logic. This permission update mechanism can dynamically adjust the user's permissions according to the actual situation (such as the user's role, behavior history, and other contextual information) to meet the needs of different users in different scenarios. In other words, even if an attacker successfully forges an identity and obtains a digital certificate, the permission update mechanism based on fuzzy logic can dynamically adjust permissions based on the user's abnormal behavior, thereby effectively limiting the attacker's scope of activities.

[0065] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description or will be learned through embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0067] Figure 1 This is a flow chart of a dynamic certificate updating method according to Embodiment 1 of the present invention;

[0068] Figure 2 This is a system block diagram of a dynamic certificate update system according to Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0069] In order to facilitate the understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Several embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0070] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be a central element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be a central element at the same time. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0071] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0072] Embodiment 1

[0073] See also Figure 1 The present invention proposes a dynamic certificate updating method, which is applied to an authentication server. The method comprises steps S101 to S106:

[0074] S101, a unique secret seed is generated for each user and stored in a secure database in encrypted form.

[0075] It should be noted that a unique secret seed is generated for each user. The uniqueness of the secret seed means that the authentication information of each user is unique, which effectively prevents identity confusion or impersonation between users. The generation process of the secret seed can be random, unpredictable, and complex enough to resist brute force or guessing attacks, which can be achieved by using a strong random number generator.

[0076] The secret seed plays a central role in the subsequent authentication process, where it is preloaded into a physical token and associated with the user’s unique identifier to generate and verify a one-time password.

[0077] The secret seed is stored in a secure database in an encrypted form to protect the secret seed from unauthorized access. Even if the database is illegally accessed, the attacker cannot easily obtain the original value of the secret seed. The encryption process can use a strong encryption algorithm, and the encryption key should be properly kept and only authorized system components or services can access it. A secure database is a database system with strict access control and security measures that can resist various data leakage, tampering or deletion attacks. The database security measures can include access control lists, role-based access control, audit logs, data backup and recovery mechanisms, etc.

[0078] S102, pre-installing a secret seed in a physical token, and distributing each of the physical tokens to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to an authentication server.

[0079] It should be noted that each user’s unique secret seed is pre-loaded into the corresponding physical token to ensure that the user can authenticate using the physical token.

[0080] The physical token has a built-in time synchronization module to ensure that the time between the physical token and the authentication server is synchronized, which is an important factor when generating a one-time password, because the one-time password is usually calculated based on the current time. To ensure time synchronization, of course, it is necessary to consider actual factors that may cause time deviation, such as network delay and clock deviation. Some subsequent specific implementation methods have solved this problem.

[0081] The physical token also needs to have a built-in encryption algorithm that matches the authentication server so that the one-time password and VDF result generated by the physical token can be verified by the authentication server.

[0082] The secret seed should be secure during storage and transmission in the physical token to prevent unauthorized access or extraction, which can be achieved through hardware-level security measures such as using a secure storage chip or module.

[0083] S103, when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship, a unique identifier is generated for the target user and associated with the secret seed in the security database.

[0084] It should be noted that the first registration of a user with an authentication server using a physical token is the beginning of the establishment of a trust relationship between the user and the authentication server, which usually involves the user submitting some authentication information (such as user name, password, biometric information, etc.) and a one-time password or other verification information generated by the physical token. The authentication server verifies the information submitted by the user and the verification information generated by the physical token to confirm the identity of the user and the validity of the physical token.

[0085] Once the user's identity is confirmed, the authentication server will generate a unique identifier for the target user. This unique identifier is the user's unique identity in the system and is used for subsequent identity authentication and certificate management. The generation of the unique identifier should ensure its uniqueness and unpredictability in the system to prevent identity confusion or impersonation.

[0086] The authentication server associates the generated unique identifier with the secret seed in the secure database. The association process should ensure the security and confidentiality of the secret seed to prevent unauthorized access or disclosure. This can be achieved through mechanisms such as database access control, encrypted storage, and audit logs. Associating the unique identifier with the secret seed enables the authentication server to find the corresponding secret seed through the unique identifier in the subsequent identity authentication process, and then verify the one-time password and VDF result submitted by the user. This association also provides a basis for dynamic certificate updates, because the authentication server can verify the identity of the user based on the unique identifier and secret seed, and issue or update the digital certificate accordingly.

[0087] During the initial registration and association process, all communications should be encrypted to prevent information from being intercepted or tampered with. The authentication server should implement a strict access control policy to ensure that only authorized personnel or systems can access the secret seeds in the secure database. The secure database should also be audited and checked regularly to ensure data integrity and confidentiality.

[0088] S104, when the target user requests to issue or update a digital certificate, a one-time password is generated through the target user's physical token according to the current time and its built-in secret seed, and a VDF result is generated at the same time.

[0089] It should be noted that when a user needs to access specific resources or services, he or she may request the authentication server to issue or renew his or her digital certificate. A digital certificate is an electronic proof of the user's identity and authority, and usually contains the user's unique identifier, validity period, authority information, etc.

[0090] The physical token is a key tool for user identity authentication. It has built-in secret seeds, time synchronization modules, and encryption algorithms corresponding to the authentication server.

[0091] When a user requests the issuance or renewal of a digital certificate, the physical token uses an encryption algorithm to generate a one-time password based on the current time and the built-in secret seed. The one-time password is one-time, that is, it is different each time it is generated and expires after a certain period of time, which increases the security and dynamism of identity authentication.

[0092] At the same time, the physical token will also generate a VDF result based on the current time and the secret seed. VDF can verify the delay function, and its output can be verified as being generated by a specific input at a specific time after a certain period of time. This is used to ensure time synchronization and prevent replay attacks. The calculation process of VDF takes a certain amount of time, which increases the difficulty for attackers to forge VDF results.

[0093] After generating the OTP and VDF result, the physical token submits them to the authentication server for verification. The authentication server then obtains the associated secret seed from the secure database based on the target user's unique identifier and uses the secret seed and the current time to verify the validity of the OTP and the correctness of the VDF result.

[0094] S105, receiving the one-time password and VDF result submitted by the physical token, obtaining the associated secret seed from the security database according to the unique identifier of the target user, and verifying the validity of the one-time secret according to the secret seed and the current time, and verifying the VDF result to ensure time synchronization.

[0095] It should be noted that the authentication server receives the OTP and VDF results from the physical token. These data are generated by the physical token based on the current time and the built-in secret seed when the user requests the issuance or renewal of a digital certificate.

[0096] Based on the unique identifier of the target user, the authentication server retrieves the secret seed associated with the unique identifier from the security database. It then uses the retrieved secret seed and the current time to generate an expected one-time password using the same encryption algorithm as the physical token. The authentication server then compares the received one-time password with the expected one-time password to verify their validity. If they match, the user's identity is verified and the one-time password was generated within the correct time.

[0097] In addition to verifying the one-time password, the authentication server also needs to verify the VDF result to ensure that the time between the physical token and the authentication server is synchronized. The VDF result is a verifiable delay function output that proves that at a specific point in time, the physical token used specific inputs (including secret seeds and time) to generate a one-time password. By verifying the VDF result, the authentication server can ensure that the one-time password is generated within the correct time window, thereby preventing time-related security threats such as replay attacks.

[0098] If both the one-time password and the VDF result are successfully verified, the user's identity is confirmed and time synchronization is guaranteed. At this point, the authentication server can continue to process the user's certificate issuance or renewal request. If the one-time password or VDF result verification fails, it means that there is a problem with the user's identity or time synchronization. At this point, the authentication server should reject the user's request and may trigger a security alert to further investigate the potential security threat.

[0099] S106, if the one-time password and VDF result verification are successful, a digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic, wherein the new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

[0100] It should be noted that when both the one-time password and the VDF result are verified by the authentication server, the user's identity is confirmed and time synchronization is guaranteed. At this point, the authentication server will issue or update a digital certificate for the target user, which is an electronic credential for the user to access specific resources or services, proving the user's identity and authority.

[0101] If the user is requesting a certificate for the first time, the authentication server will issue a new digital certificate. If the user is requesting to renew an existing certificate, the authentication server will update the relevant information in the digital certificate based on the user's current permissions and possible changes.

[0102] The new digital certificate will contain a unique identifier for the target user, which is a unique identifier of the user's identity. The certificate will also contain a validity period, indicating the time range in which the certificate is valid. After the expiration date, the certificate will no longer be accepted as a credential for authentication. The permission information in the certificate specifies the resources or services that the user can access, as well as the operations they can perform, which is determined based on the user's role, responsibilities, and access control policies. There are also possible additional security attributes, which can include the certificate's encryption strength, signature algorithm, etc. to enhance the security and credibility of the certificate.

[0103] When updating the digital certificate, the authentication server uses fuzzy logic to dynamically adjust the user's permission information. Fuzzy logic allows for handling uncertainty and ambiguity, which is particularly effective in the permission management of this embodiment because the user's responsibilities and access requirements may change over time. Through dynamic updates based on fuzzy logic, the authentication server can manage the user's permissions more flexibly, ensuring that they can only access the resources and services they currently need. Moreover, even if an attacker successfully forges an identity and obtains a digital certificate, the permission update mechanism based on fuzzy logic can dynamically adjust permissions based on the user's abnormal behavior, thereby effectively limiting the attacker's scope of activities.

[0104] If the one-time password and VDF result verification fail, it means that there is a problem with the user's identity or time synchronization. In this case, the authentication server will reject the user's certificate issuance or renewal request. To enhance security, the authentication server may also trigger a security alert to notify the security team or administrator to investigate potential security threats.

[0105] Based on steps S101 to S106, the secret seed pre-installed in the physical token of the present invention is stored in an encrypted form, which means that even if the token is stolen, the attacker cannot easily extract the secret seed. The secret seed is associated with the user's unique identifier and stored in a secure database, further enhancing its security.

[0106] Each time an identity is authenticated, the physical token generates a one-time password. This password is generated based on the current time and secret seed and is highly unpredictable. Even if an attacker obtains the physical token, they cannot generate a valid one-time password because they do not know the current secret seed and the exact time. In addition to the one-time password, the physical token also generates a VDF result. While verifying the one-time password, the authentication server also verifies the VDF result to ensure time synchronization. This dual verification together constitutes a powerful security protection mechanism that can effectively prevent replay attacks and man-in-the-middle attacks.

[0107] When issuing or updating a digital certificate, the permission information in the certificate is dynamically updated based on fuzzy logic. This permission update mechanism can dynamically adjust the user's permissions according to the actual situation (such as the user's role, behavior history, and other contextual information) to meet the needs of different users in different scenarios. Moreover, even if an attacker successfully forges an identity and obtains a digital certificate, the permission update mechanism based on fuzzy logic can dynamically adjust permissions based on the user's abnormal behavior, thereby effectively limiting the attacker's scope of activities.

[0108] The following is a further detailed introduction to a dynamic certificate update method according to an embodiment of the present invention:

[0109] Further optionally, in step S104, the physical token of the target user is used to generate a one-time password according to the current time and a built-in secret seed, including:

[0110] For the physical token, get the current timestamp and set it as the first time;

[0111] Extract the built-in secret seed;

[0112] Calculate a time counter according to the first time and the preset time interval, and set it as a first time counter;

[0113] Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value;

[0114] The first hash value is truncated to extract a value of a preset length as a one-time password;

[0115] Send the one-time password to the authentication server for verification.

[0116] Understandably, the physical token first obtains the current accurate timestamp, which is accurate to seconds or shorter time units to ensure the timeliness and uniqueness of the one-time password; extracts the built-in secret seed, which is stored in the token in advance and shared with the server; calculates a time counter based on the current timestamp and the preset time interval (such as 30 seconds or 60 seconds), which reflects the time point when the one-time password is generated; uses the secret seed and time counter as input through a preset encryption algorithm (such as HMAC-SHA-1 or a more secure SHA-256 algorithm) to generate a hash value, which ensures the randomness and unpredictability of the one-time password; truncates the hash value, extracts a value of a preset length as the one-time password, and sends it to the authentication server for verification. The one-time password is generated by combining the physical token and the built-in secret seed with the current time. This process ensures the timeliness and uniqueness of the one-time password, providing strong support for identity authentication.

[0117] Further optionally, in step S105, verifying the validity of the one-time password includes:

[0118] Set a preset encryption time window;

[0119] Get the current timestamp when receiving the one-time password and set it as the second time;

[0120] Adding or subtracting the preset time window from the second time to obtain a time interval;

[0121] Calculate a set of time counters according to each time point in the time interval and a preset time interval, and set them as second time counters;

[0122] By using a preset encryption algorithm, taking the secret seed and each of the second time counters as input, a set of hash values ​​is generated and set as second hash values;

[0123] Performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords;

[0124] comparing the one-time password with any one of the expected one-time passwords;

[0125] If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

[0126] Understandably, in order to tolerate the time difference between generating and receiving the one-time password, a preset time window (such as ±1 minute or ±30 seconds) is set. The setting of the time window is crucial to ensure the accuracy of the one-time password verification; obtain the current timestamp when the one-time password is received, and calculate the time interval according to the preset time window. This time interval includes the time range in which the one-time password may be generated; calculate a set of time counters according to each time point in the time interval and the preset time interval, and generate a set of expected one-time passwords through a preset encryption algorithm. This process simulates the generation process of the one-time password so as to compare it with the received one-time password; compare the received one-time password with any expected one-time password; if the two match, the one-time password is valid; otherwise, the one-time password is invalid. By simulating the generation process of the one-time password and comparing it with the received one-time password, the validity of the one-time password is verified. This process ensures that only the OTP generated within the correct time window can be accepted, thereby improving the security of identity authentication.

[0127] Further optionally, in step S104, generating a VDF result includes:

[0128] For the physical token, get the current timestamp and set it as the first time T current ;

[0129] Calculate the first time T current The last synchronization time T sync The time difference ΔT, ΔT = T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server;

[0130] Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ;

[0131] The VDF result R vdf Sent to the authentication server for verification.

[0132] Understandably, the physical token can obtain the current time through its built-in high-precision clock to ensure the accuracy of the timestamp and the precision of the clock, because any time error may lead to errors in subsequent steps; by comparing the current time and the last synchronization time, the time difference ΔT is calculated; the time difference ΔT is processed using the preset VDF function f(ΔT) to obtain the VDF result R vdf , the VDF function generates a VDF result that is difficult to reverse calculate based on the time difference ΔT; the physical token sends the generated VDF result to the authentication server for subsequent verification of time synchronization.

[0133] Further optionally, in step S105, verifying the VDF result to ensure time synchronization includes:

[0134] Get the received VDF result R vdf The current timestamp is set to the second time T server_current ;

[0135] According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server;

[0136] Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number;

[0137] Determine the VDF result R vdf Whether it is within the expected VDF result range;

[0138] If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is considered successful;

[0139] If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

[0140] Understandably, when receiving the VDF result, the authentication server obtains the current time and sets it as the second time as the basis for calculating the expected VDF result and judging the time synchronization; based on the second time and the last synchronization time, the authentication server calculates the expected VDF result; considering factors such as network delay and clock deviation, the authentication server can set a preset tolerance range based on fuzzy logic, and the setting of the tolerance range needs to be cautious to balance security and availability; by comparing the actually received VDF result with the expected interval, it can be judged whether the time synchronization is successful; if the VDF result R vdf If the time synchronization verification is within the expected VDF result range, the time synchronization verification is considered to be successful; otherwise, the verification fails; if the time synchronization verification is successful, the time synchronization information of the authentication server and the physical token is updated.

[0141] Further optionally, setting a preset tolerance range based on fuzzy logic includes:

[0142] Define fuzzy variables and set fuzzy sets for each of the fuzzy variables, wherein the fuzzy variables include network delay, clock deviation, system load, power stability, etc. For example, define a fuzzy variable to represent network delay, and set several fuzzy sets for it, such as "very short", "short", "medium", "long", and "very long". Define a fuzzy variable to represent clock deviation, and also set corresponding fuzzy sets for it, such as "tiny", "small", "medium", "large", and "very large".

[0143] A membership function is determined for each of the fuzzy sets, and the membership function parameters of the fuzzy set are determined based on the historical data of the fuzzy variables, wherein the membership function is used to indicate the degree to which a specific value belongs to the fuzzy set. For example, a "short" fuzzy set of network delay can be represented by a triangular or trapezoidal membership function.

[0144] The historical data of fuzzy variables are analyzed to determine the impact of each fuzzy variable on the tolerance range δ, and a series of fuzzy rules are formulated based on the analysis results. For example: "If the network delay is very short and the clock deviation is small, the tolerance range δ should be set to a smaller value."

[0145] According to the specific input values ​​of the fuzzy variables (such as the specific values ​​of network delay and clock deviation), the fuzzy rules and membership functions are inferred using the fuzzy reasoning mechanism to calculate the fuzzy value of the tolerance range δ.

[0146] Convert the fuzzy values ​​within the tolerance range δ to concrete numerical values. This can be achieved through a defuzzification process, such as using the centroid method, maximum membership method, or weighted average method.

[0147] Understandably, the scheme uses fuzzy logic to set a preset tolerance range δ to cope with the impact of uncertain factors such as network delay, clock deviation, system load and power supply stability on time synchronization verification. By defining fuzzy variables, setting fuzzy sets, determining membership functions, analyzing historical data to formulate fuzzy rules, using fuzzy reasoning mechanisms for reasoning, and converting fuzzy values ​​into specific values, the scheme can dynamically adjust the tolerance range to adapt to different system environments and conditions.

[0148] Further optionally, before step S106, before dynamically updating the authority information in the digital certificate based on fuzzy logic, the following steps are included:

[0149] Determine the type of authority and the key factors that influence the extent of authority granted;

[0150] defining fuzzy sets for each of the key factors and permission types;

[0151] Determine a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets;

[0152] Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors;

[0153] All the fuzzy rules are stored in a fuzzy rule base.

[0154] Understandably, clarify the type of permissions required by the system or application, such as read, write, execute, etc., identify key factors that affect the degree of permission granted, such as user role, behavior history, device type, network environment, etc., these factors will serve as input for fuzzy logic reasoning; define fuzzy sets for each key factor and permission type, such as user role can be "administrator", "ordinary user" and "visitor", etc., behavior pattern can be "frequent operation", "normal operation" and "abnormal operation", etc., and the degree of permission granted can be "high", "medium" and "low" fuzzy sets; determine the membership function of each fuzzy set to quantify the degree of association between key factors and fuzzy sets; formulate a series of fuzzy rules to describe the decision logic of the degree of permission granted under different key factor combinations. The rule form is generally "if...then..." statements, such as "if the user role is administrator and the behavior pattern is normal operation, then the degree of permission granted is high". These rules reflect the system's decision-making strategy for permission granting and are the core of fuzzy logic reasoning; store all fuzzy rules in the fuzzy rule library for use in real-time reasoning.

[0155] Further optionally, in step S106, dynamically updating the authority information in the digital certificate based on fuzzy logic includes:

[0156] Collect real-time data related to the target user's permission grant from the data source, including the target user's role, behavior pattern, device type, network location, and request time;

[0157] According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user;

[0158] Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

[0159] Understandably, real-time data related to the target user's permission granting is collected from the data source in real time, including user roles, behavior patterns, device types, network locations, and request times; based on real-time data and fuzzy rule bases, the fuzzy reasoning algorithm is used to calculate the target user's permission granting degree; based on the target user's permission granting degree, the permission information in the digital certificate is dynamically updated. For example, if the user's permission granting degree changes from "medium" to "high", the permission level in the digital certificate is updated accordingly. This ensures that the permission information in the digital certificate is consistent with the user's actual permission status, improving the security and flexibility of the system.

[0160] The scheme can dynamically adjust the permission information according to the user's real-time behavior and role, thereby improving the flexibility and adaptability of the system. Through the introduction of fuzzy logic and membership functions, the relationship between key factors and the degree of permission granting can be more accurately described and quantified, improving the accuracy of permission management. Dynamically updating the permission information in the digital certificate helps to revoke or adjust the user's permissions in a timely manner, enhancing the security of the system.

[0161] Further optionally, the method of calculating the degree of authorization of the target user by using a fuzzy inference algorithm based on the real-time data and the fuzzy rule base includes:

[0162] The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set;

[0163] According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base;

[0164] According to the matched fuzzy rules, the fuzzy output membership of the target user's authority granting degree is calculated;

[0165] The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

[0166] It can be understood that the authority granting degree of the target user is calculated based on the real-time data and the fuzzy rule base using the fuzzy reasoning algorithm. Specifically, first, the real-time data is fuzzified through the membership function and converted into the membership value of the fuzzy set to convert the precise input data into the representation of fuzzy logic; according to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base; according to the matched fuzzy rules, the fuzzy output membership of the authority granting degree of the target user is calculated; the fuzzy output membership is defuzzified, and defuzzification methods such as the centroid method and the maximum membership method can be used to convert it into a precise authority granting degree value.

[0167] Embodiment 2

[0168] See also Figure 2The present invention proposes a dynamic certificate updating system, the system comprising:

[0169] Seed generation module: used to generate a unique secret seed for each user and store it in a secure database in encrypted form;

[0170] Seed pre-installation module: used to pre-install secret seeds in physical tokens and distribute each of the physical tokens to corresponding users, wherein the physical tokens are built with a time synchronization module and an encryption algorithm corresponding to the authentication server;

[0171] Registration module: used to generate a unique identifier for the target user and associate it with the secret seed in the security database when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship;

[0172] Generation module: used to generate a one-time password and a VDF result through the target user's physical token according to the current time and its built-in secret seed when the target user requests to issue or update a digital certificate;

[0173] Verification module: used to receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database according to the unique identifier of the target user, and verify the validity of the one-time secret according to the secret seed and the current time, and verify the VDF result to ensure time synchronization;

[0174] Update module: used to issue or update the digital certificate for the target user if the one-time password and VDF result verification are successful, and dynamically update the permission information in the digital certificate based on fuzzy logic, where the new digital certificate contains the target user's unique identifier, validity period, permission information and additional security attributes.

[0175] Further optionally, the generating module is further used for:

[0176] For the physical token, get the current timestamp and set it as the first time;

[0177] Extract the built-in secret seed;

[0178] Calculate a time counter according to the first time and the preset time interval, and set it as a first time counter;

[0179] Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value;

[0180] The first hash value is truncated to extract a value of a preset length as a one-time password;

[0181] Send the one-time password to the authentication server for verification.

[0182] Further optionally, the verification module is also used for:

[0183] Set a preset time window;

[0184] Get the current timestamp when receiving the one-time password and set it as the second time;

[0185] Adding or subtracting the preset time window from the second time to obtain a time interval;

[0186] Calculate a set of time counters according to each time point in the time interval and a preset time interval, and set them as second time counters;

[0187] By using a preset encryption algorithm, taking the secret seed and each of the second time counters as input, a set of hash values ​​is generated and set as second hash values;

[0188] Performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords;

[0189] comparing the one-time password with any one of the expected one-time passwords;

[0190] If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

[0191] Further optionally, the generating module is further used for:

[0192] For the physical token, get the current timestamp and set it as the first time T current ;

[0193] Calculate the first time T current The last synchronization time T sync The time difference ΔT, ΔT = T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server;

[0194] Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ;

[0195] The VDF result R vdf Sent to the authentication server for verification.

[0196] Further optionally, the verification module is also used for:

[0197] Get the received VDF result R vdfThe current timestamp is set to the second time T server_current ;

[0198] According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server;

[0199] Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number;

[0200] Determine the VDF result R vdf Whether it is within the expected VDF result range;

[0201] If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is considered successful;

[0202] If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

[0203] Further optionally, the update module is further used for:

[0204] Determine the type of authority and the key factors that influence the extent of authority granted;

[0205] defining fuzzy sets for each of the key factors and permission types;

[0206] Determine a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets;

[0207] Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors;

[0208] All the fuzzy rules are stored in a fuzzy rule base.

[0209] Further optionally, the update module is further used for:

[0210] Collect real-time data related to the target user's permission grant from the target data source, including the target user's role, behavior pattern, device type, network location, and request time;

[0211] According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user;

[0212] Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

[0213] Further optionally, the update module is further used for:

[0214] The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set;

[0215] According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base;

[0216] According to the matched fuzzy rules, the fuzzy output membership of the target user's authority granting degree is calculated;

[0217] The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

[0218] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A dynamic certificate updating method, characterized in that: Applied to an authentication server, the method comprises: A unique secret seed is generated for each user and stored in encrypted form in a secure database; Preinstalling a secret seed in a physical token and distributing each of the physical tokens to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to an authentication server; When the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship, a unique identifier is generated for the target user and associated with the secret seed in the security database; When the target user requests to issue or renew a digital certificate, a one-time password is generated through the target user's physical token according to the current time and its built-in secret seed, and a VDF result is generated at the same time; Receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database according to the unique identifier of the target user, and verify the validity of the one-time secret according to the secret seed and the current time, and verify the VDF result to ensure time synchronization; If the one-time password and VDF result verification are successful, a digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

2. The dynamic certificate updating method according to claim 1, characterized in that: The method generates a one-time password through the target user's physical token according to the current time and its built-in secret seed, including: For the physical token, get the current timestamp and set it as the first time; Extract the built-in secret seed; Calculate a time counter according to the first time and the preset time interval, and set it as a first time counter; Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value; The first hash value is truncated to extract a value of a preset length as a one-time password; Send the one-time password to the authentication server for verification.

3. The dynamic certificate updating method according to claim 2, characterized in that: The verification of the validity of the one-time password includes: Set a preset time window; Get the current timestamp when receiving the one-time password and set it as the second time; Adding or subtracting the preset time window from the second time to obtain a time interval; Calculate a set of time counters according to each time point in the time interval and a preset time interval, and set them as second time counters; By using a preset encryption algorithm, taking the secret seed and each of the second time counters as input, a set of hash values ​​is generated and set as second hash values; Performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords; comparing the one-time password with any one of the expected one-time passwords; If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

4. The dynamic certificate updating method according to claim 1, characterized in that: The generating of the VDF result includes: For the physical token, get the current timestamp and set it as the first time T current ; Calculate the first time T current The last synchronization time T sync The time difference ΔT, ΔT = T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server; Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ; The VDF result R vdf Sent to the authentication server for verification.

5. The dynamic certificate updating method according to claim 4, characterized in that: The verification of the VDF results to ensure time synchronization includes: Get the received VDF result R vdf The current timestamp is set to the second time T server_current ; According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server; Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number; Determine the VDF result R vdf Whether it is within the expected VDF result range; If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is considered successful; If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

6. The dynamic certificate updating method according to claim 1, characterized in that: Before dynamically updating the authority information in the digital certificate based on fuzzy logic, the method includes: Determine the type of authority and the key factors that influence the extent of authority granted; defining fuzzy sets for each of the key factors and permission types; Determine a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets; Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors; All the fuzzy rules are stored in a fuzzy rule base.

7. The dynamic certificate updating method according to claim 6, characterized in that: The method of dynamically updating the authority information in the digital certificate based on fuzzy logic includes: Collect real-time data related to the target user's permission grant from the target data source, including the target user's role, behavior pattern, device type, network location, and request time; According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user; Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

8. The dynamic certificate updating method according to claim 7, characterized in that: The method of calculating the degree of authorization of the target user by using a fuzzy inference algorithm based on real-time data and a fuzzy rule base includes: The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set; According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base; According to the matched fuzzy rules, the fuzzy output membership of the target user's authority granting degree is calculated; The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

9. A dynamic certificate update system, used to implement the dynamic certificate update method according to any one of claims 1 to 8, characterized in that: The system comprises: Seed generation module: used to generate a unique secret seed for each user and store it in a secure database in encrypted form; Seed pre-installation module: used to pre-install secret seeds in physical tokens and distribute each of the physical tokens to corresponding users, wherein the physical tokens are built with a time synchronization module and an encryption algorithm corresponding to the authentication server; Registration module: used to generate a unique identifier for the target user and associate it with the secret seed in the security database when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship; Generation module: used to generate a one-time password and a VDF result through the target user's physical token according to the current time and its built-in secret seed when the target user requests to issue or update a digital certificate; Verification module: used to receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database according to the unique identifier of the target user, and verify the validity of the one-time secret according to the secret seed and the current time, and verify the VDF result to ensure time synchronization; Update module: used to issue or update the digital certificate for the target user if the one-time password and VDF result verification are successful, and dynamically update the permission information in the digital certificate based on fuzzy logic, where the new digital certificate contains the target user's unique identifier, validity period, permission information and additional security attributes.

Images