Dynamic certificate updating method and system

Abstract

The present invention proposes a dynamic certificate update method and system, applied to an authentication server, comprising: generating a secret seed for the user and encrypting and storing it; pre-installing the secret seed in a physical token; generating a unique identifier for the user during registration and associating it with the secret seed; when the user requests the issuance or renewal of a digital certificate, generating a one-time password and a VDF result based on the current time and the secret seed using the physical token; receiving the one-time password and VDF result, and verifying the validity of the one-time secret based on the secret seed and the current time, while also verifying the VDF result to ensure time synchronization; if the verification is successful, issuing or updating the digital certificate for the user, and dynamically updating the permission information in the digital certificate based on fuzzy logic. By introducing a secret seed, combining the one-time password with the VDF result for verification, and updating permissions based on fuzzy logic, the present invention effectively meets the high requirements for identity authentication and data encryption in today's complex and ever-changing network environments.

Description

Technical Field

[0001] The present invention relates to the technical field of digital certificate updating, and in particular to a dynamic certificate updating method and system. Background Art

[0002] Digital certificates, as an essential means of identity authentication and data encryption, play a crucial role in network security. They not only verify user identity but also ensure data integrity and confidentiality. In traditional network applications, digital certificates are typically issued by a certification authority (CA) and contain information such as the user's public key, identity information, and the certificate's validity period. However, with the increasing complexity and variability of network environments, traditional digital certificate management methods are no longer able to meet current security requirements.

[0003] In traditional digital certificate management systems, users typically need to enter their username and password to authenticate their identity. While this method is simple and convenient, it poses numerous security risks. For example, passwords are easily guessed or stolen. Once a password is leaked, the user's identity and data are seriously threatened. To enhance security, some systems employ two-factor or multi-factor authentication, such as combining passwords with physical tokens for authentication. However, these methods still have certain limitations: 1. Traditional authentication methods such as passwords and physical tokens are easily guessed, stolen, or lost, threatening the security of user identity and data; 2. Once issued, traditional digital certificates typically retain their permissions, making them difficult to dynamically adjust based on the user's actual needs; 3. While multi-factor authentication improves security, it also increases operational complexity for users, impacting the user experience. Summary of the Invention

[0004] Based on this, the purpose of the present invention is to propose a dynamic certificate update method and system to solve the above-mentioned problems.

[0005] A dynamic certificate update method proposed in the present invention is applied to an authentication server, and the method includes:

[0006] A unique secret seed is generated for each user and stored in encrypted form in a secure database;

[0007] Pre-installing a secret seed in a physical token and distributing each of the physical tokens to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to the authentication server;

[0008] When the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship, a unique identifier is generated for the target user and associated with the secret seed in the security database;

[0009] When the target user requests to issue or renew a digital certificate, a one-time password is generated through the target user's physical token based on the current time and its built-in secret seed, and a VDF result is generated at the same time;

[0010] Receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database based on the unique identifier of the target user, and verify the validity of the one-time password based on the secret seed and the current time, while verifying the VDF result to ensure time synchronization;

[0011] If the one-time password and VDF result are successfully verified, a digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

[0012] Furthermore, the physical token of the target user is used to generate a one-time password based on the current time and its built-in secret seed, including:

[0013] For the physical token, get the current timestamp and set it as the first time;

[0014] Extract the built-in secret seed;

[0015] Calculate a time counter according to the first time and a preset time interval, and set it as a first time counter;

[0016] Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value;

[0017] truncating the first hash value to extract a value of a preset length as a one-time password;

[0018] Send the one-time password to the authentication server for verification.

[0019] Furthermore, verifying the validity of the one-time password includes:

[0020] Set a preset time window;

[0021] Get the current timestamp when receiving the one-time password and set it as the second time;

[0022] Adding or subtracting the preset time window from the second time to obtain a time interval;

[0023] Calculating a set of time counters according to each time point in the time interval and a preset time interval, and setting them as second time counters;

[0024] Using a preset encryption algorithm, the secret seed and each of the second time counters are used as input to generate a set of hash values, which are set as second hash values;

[0025] performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords;

[0026] comparing the one-time password with any of the expected one-time passwords;

[0027] If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

[0028] Furthermore, generating a VDF result includes:

[0029] For the physical token, get the current timestamp and set it as the first time T current ;

[0030] Calculate the first time T current Time T of the last synchronization sync The time difference ΔT, ΔT=T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server;

[0031] Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ;

[0032] The VDF result R vdf Sent to the authentication server for verification.

[0033] Furthermore, the verification of the VDF results to ensure time synchronization includes:

[0034] Get the received VDF result R vdf The current timestamp is set to the second time T server_current ;

[0035] According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server;

[0036] Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number;

[0037] Determine the VDF result R vdf Whether it is within the expected VDF result range;

[0038] If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is determined to be successful;

[0039] If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

[0040] Furthermore, before dynamically updating the authority information in the digital certificate based on fuzzy logic, the following steps are included:

[0041] Determine the type of authority and the key factors that influence the degree of authority granted;

[0042] defining a fuzzy set for each of the key factors and permission types;

[0043] Determining a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets;

[0044] Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors;

[0045] All the fuzzy rules are stored in a fuzzy rule base.

[0046] Furthermore, the dynamic updating of the permission information in the digital certificate based on fuzzy logic includes:

[0047] Collect real-time data related to target user permission granting from the target data source, including the target user's role, behavior pattern, device type, network location, and request time;

[0048] According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user;

[0049] Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

[0050] Furthermore, the method of calculating the degree of authorization granted to the target user using a fuzzy inference algorithm based on real-time data and a fuzzy rule base includes:

[0051] The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set;

[0052] According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base;

[0053] According to the matched fuzzy rules, the fuzzy output membership of the target user's permission granting degree is calculated;

[0054] The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

[0055] The present invention also provides a dynamic certificate update system for implementing the above-mentioned dynamic certificate update method, the system comprising:

[0056] Seed generation module: used to generate a unique secret seed for each user and store it in a secure database in encrypted form;

[0057] A seed pre-installation module is used to pre-install a secret seed in a physical token and distribute each physical token to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to the authentication server;

[0058] Registration module: used for generating a unique identifier for the target user and associating it with the secret seed in the security database when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship;

[0059] Generation module: When a target user requests to issue or renew a digital certificate, it generates a one-time password and a VDF result based on the current time and its built-in secret seed using the target user's physical token.

[0060] Verification module: used to receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database based on the unique identifier of the target user, and verify the validity of the one-time password based on the secret seed and the current time, while verifying the VDF result to ensure time synchronization;

[0061] Update module: If the one-time password and VDF result verification are successful, the digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

[0062] In summary, in the dynamic certificate update method of the present invention, the secret seed pre-installed in the physical token of the present invention is stored in encrypted form, which means that even if the token is stolen, the attacker cannot easily extract the secret seed, and the secret seed is associated with the user's unique identifier and stored in a secure database, further enhancing its security.

[0063] During each authentication, the physical token generates a one-time password. This password is based on the current time and a secret seed, making it highly unpredictable. Even if an attacker obtains the physical token, they cannot generate a valid one-time password because they do not know the current secret seed and the exact time. In addition to the one-time password, the physical token also generates a VDF result. The authentication server verifies both the one-time password and the VDF result to ensure time synchronization. This dual verification provides a strong security mechanism that effectively prevents replay attacks and man-in-the-middle attacks.

[0064] When issuing or renewing a digital certificate, the permissions information in the certificate is dynamically updated based on fuzzy logic. This permission update mechanism can dynamically adjust user permissions based on actual circumstances (such as the user's role, behavior history, and other contextual information) to meet the needs of different users in different scenarios. In other words, even if an attacker successfully forges an identity and obtains a digital certificate, the fuzzy logic-based permission update mechanism can dynamically adjust permissions based on the user's abnormal behavior, effectively limiting the attacker's scope of activity.

[0065] Additional aspects and advantages of the present invention will be set forth in part in the following description and, in part, will be obvious from the following description, or may be learned through embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments with reference to the accompanying drawings, in which:

[0067] Figure 1 This is a flow chart of a dynamic certificate updating method according to embodiment 1 of the present invention;

[0068] Figure 2 This is a system block diagram of a dynamic certificate update system according to the second embodiment of the present invention. DETAILED DESCRIPTION

[0069] To facilitate understanding of the present invention, the present invention will be described more fully below with reference to the accompanying drawings. The drawings illustrate several embodiments of the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and comprehensive understanding of the present invention.

[0070] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be an intermediate element. When an element is referred to as being "connected to" another element, it may be directly connected to the other element or there may be an intermediate element. The terms "vertical," "horizontal," "left," "right," and similar expressions used herein are for illustrative purposes only.

[0071] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one skilled in the art to which this invention pertains. The terms used in this specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0072] Example 1: Please refer to Figure 1 The present invention proposes a dynamic certificate update method, which is applied to an authentication server. The method includes steps S101 to S106:

[0073] S101, a unique secret seed is generated for each user and stored in a secure database in encrypted form.

[0074] It should be noted that a unique secret seed is generated for each user. The uniqueness of the secret seed means that each user's authentication information is unique, which effectively prevents identity confusion or impersonation between users. The secret seed generation process can be random, unpredictable, and sufficiently complex to resist brute force or guessing attacks. This can be achieved by using a strong random number generator.

[0075] The secret seed plays a central role in the subsequent authentication process, where it is pre-loaded into the physical token and associated with the user’s unique identifier for generating and verifying one-time passwords.

[0076] The secret seed is stored in an encrypted form in a secure database to protect it from unauthorized access. Even if the database is illegally accessed, the attacker cannot easily obtain the original value of the secret seed. The encryption process can use a strong encryption algorithm, and the encryption key should be properly stored and accessible only to authorized system components or services. A secure database is a database system with strict access control and security measures that can resist various data leakage, tampering, or deletion attacks. Database security measures can include access control lists, role-based access control, audit logs, and data backup and recovery mechanisms.

[0077] S102 , pre-installing a secret seed in a physical token, and distributing each of the physical tokens to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to the authentication server.

[0078] It should be noted that each user’s unique secret seed is pre-loaded into the corresponding physical token to ensure that the user can authenticate using the physical token.

[0079] The physical token has a built-in time synchronization module to ensure that the time between the physical token and the authentication server remains synchronized. This is a crucial factor when generating one-time passwords, as they are typically calculated based on the current time. Ensuring time synchronization requires considering factors such as network latency and clock skew that can cause time deviations. This issue is addressed in future implementations.

[0080] The physical token also needs to have a built-in encryption algorithm that matches the authentication server so that the one-time password generated by the physical token and the VDF result authentication server can verify.

[0081] The secret seed should be secure during storage and transmission in the physical token to prevent unauthorized access or extraction. This can be achieved through hardware-level security measures, such as using a secure storage chip or module.

[0082] S103, when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship, a unique identifier is generated for the target user and associated with the secret seed in the security database.

[0083] It's important to note that the initial registration of a user with a physical token with an authentication server marks the beginning of a trust relationship between the user and the authentication server. This typically involves the user submitting authentication information (such as username, password, and biometric information) along with a one-time password or other verification information generated by the physical token. The authentication server then verifies the user's submitted information and the verification information generated by the physical token to confirm the user's identity and the validity of the physical token.

[0084] Once the user's identity is confirmed, the authentication server generates a unique identifier for the target user. This unique identifier uniquely identifies the user within the system and is used for subsequent authentication and certificate management. The unique identifier must be unique and unpredictable within the system to prevent identity confusion or impersonation.

[0085] The authentication server associates the generated unique identifier with the secret seed in the secure database. This association process should ensure the security and confidentiality of the secret seed to prevent unauthorized access or disclosure. This can be achieved through mechanisms such as database access control, encrypted storage, and audit logs. Associating the unique identifier with the secret seed enables the authentication server to find the corresponding secret seed through the unique identifier during subsequent identity verification, thereby verifying the one-time password and VDF result submitted by the user. This association also provides the basis for dynamic certificate renewal, as the authentication server can verify the user's identity based on the unique identifier and secret seed and issue or renew digital certificates accordingly.

[0086] During the initial registration and association process, all communications should be encrypted to prevent information from being intercepted or tampered with. The authentication server should implement a strict access control policy to ensure that only authorized personnel or systems can access the secret seeds in the secure database. The secure database should also be audited and inspected regularly to ensure data integrity and confidentiality.

[0087] S104, when the target user requests to issue or update a digital certificate, a one-time password is generated through the target user's physical token according to the current time and its built-in secret seed, and a VDF result is generated at the same time.

[0088] It should be noted that when a user needs to access specific resources or services, they may request the authentication server to issue or renew their digital certificate. A digital certificate is an electronic proof of a user's identity and permissions, typically containing a unique identifier, validity period, and permission information.

[0089] The physical token is a key tool for user authentication. It has built-in secret seeds, time synchronization modules, and encryption algorithms corresponding to the authentication server.

[0090] When a user requests the issuance or renewal of a digital certificate, the physical token uses an encryption algorithm to generate a one-time password based on the current time and the built-in secret seed. The one-time password is one-time, that is, it is different each time it is generated and expires after a certain period of time, which increases the security and dynamism of identity authentication.

[0091] At the same time, the physical token also generates a VDF result based on the current time and the secret seed. VDF is a verifiable delay function whose output can be verified after a certain period of time as being generated by a specific input at a specific time. This is used to ensure time synchronization and prevent replay attacks. The VDF calculation process takes a certain amount of time, which increases the difficulty for attackers to forge VDF results.

[0092] After generating the OTP and VDF result, the physical token submits them to the authentication server for verification. The authentication server then retrieves the associated secret seed from the secure database based on the target user's unique identifier and uses the secret seed and the current time to verify the validity of the OTP and the correctness of the VDF result.

[0093] S105, receiving the one-time password and VDF result submitted by the physical token, obtaining the associated secret seed from the security database according to the unique identifier of the target user, and verifying the validity of the one-time password according to the secret seed and the current time, while verifying the VDF result to ensure time synchronization.

[0094] It should be noted that the authentication server receives the OTP and VDF results from the physical token. These data are generated by the physical token based on the current time and the built-in secret seed when the user requests the issuance or renewal of a digital certificate.

[0095] Based on the target user's unique identifier, the authentication server retrieves the secret seed associated with that unique identifier from a secure database. Using the retrieved secret seed and the current time, the server generates a desired one-time password using the same encryption algorithm as the physical token. The authentication server then compares the received one-time password with the expected one-time password to verify their validity. If they match, the user's identity is verified and the one-time password was generated within the correct time.

[0096] In addition to verifying the one-time password, the authentication server also needs to verify the VDF result to ensure that the time between the physical token and the authentication server is synchronized. The VDF result is a verifiable delay function output that proves that at a specific point in time, the physical token used specific inputs (including the secret seed and time) to generate the one-time password. By verifying the VDF result, the authentication server can ensure that the one-time password was generated within the correct time window, thereby preventing time-related security threats such as replay attacks.

[0097] If both the one-time password and the VDF result are successfully verified, the user's identity is confirmed and time synchronization is guaranteed. The authentication server can then proceed with processing the user's certificate issuance or renewal request. If either the one-time password or the VDF result fails to verify, this indicates an issue with the user's identity or time synchronization. The authentication server should reject the user's request and may trigger a security alert for further investigation into the potential security threat.

[0098] S106: If the one-time password and the VDF result are successfully verified, a digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

[0099] It should be noted that when both the one-time password and the VDF result are verified by the authentication server, the user's identity is confirmed and time synchronization is guaranteed. At this point, the authentication server will issue or renew a digital certificate for the target user. This is the user's electronic credential for accessing specific resources or services, proving the user's identity and authority.

[0100] If the user is requesting a certificate for the first time, the authentication server will issue a new digital certificate. If the user is requesting to renew an existing certificate, the authentication server will update the relevant information in the digital certificate based on the user's current permissions and any changes.

[0101] The new digital certificate will contain a unique identifier for the target user, which uniquely identifies the user. The certificate will also contain a validity period, indicating the timeframe in which the certificate is valid; after expiration, the certificate will no longer be accepted as authentication credentials. The permissions in the certificate specify the resources or services the user can access and the operations they can perform, based on the user's role, responsibilities, and access control policies. Additional security attributes may also be included, including the certificate's encryption strength and signature algorithm, to enhance the security and credibility of the certificate.

[0102] When updating digital certificates, the authentication server uses fuzzy logic to dynamically adjust the user's permissions. Fuzzy logic allows for handling uncertainty and ambiguity, which is particularly effective in the permissions management of this embodiment, as users' responsibilities and access requirements may change over time. Through dynamic updates based on fuzzy logic, the authentication server can more flexibly manage user permissions, ensuring that they can only access the resources and services they currently need. Furthermore, even if an attacker successfully forges an identity and obtains a digital certificate, the fuzzy logic-based permissions update mechanism can dynamically adjust permissions based on the user's abnormal behavior, effectively limiting the attacker's scope of activity.

[0103] If the one-time password and VDF verification result fail, it indicates a problem with the user's identity or time synchronization. In this case, the authentication server will reject the user's certificate issuance or renewal request. To enhance security, the authentication server may also trigger a security alert to notify the security team or administrator to investigate the potential security threat.

[0104] Based on steps S101 to S106, the secret seed pre-installed in the physical token of the present invention is stored in an encrypted form, which means that even if the token is stolen, the attacker cannot easily extract the secret seed. The secret seed is associated with the user's unique identifier and stored in a secure database, further enhancing its security.

[0105] During each authentication, the physical token generates a one-time password. This password is based on the current time and a secret seed, making it highly unpredictable. Even if an attacker obtains the physical token, they cannot generate a valid one-time password because they do not know the current secret seed and the exact time. In addition to the one-time password, the physical token also generates a VDF result. The authentication server verifies both the one-time password and the VDF result to ensure time synchronization. This dual verification provides a strong security mechanism that effectively prevents replay attacks and man-in-the-middle attacks.

[0106] When issuing or renewing a digital certificate, the permissions information in the certificate is dynamically updated based on fuzzy logic. This permission update mechanism can dynamically adjust user permissions based on actual circumstances (such as the user's role, behavior history, and other contextual information) to meet the needs of different users in different scenarios. Furthermore, even if an attacker successfully forges an identity and obtains a digital certificate, the fuzzy logic-based permission update mechanism can dynamically adjust permissions based on the user's abnormal behavior, effectively limiting the attacker's scope of activity.

[0107] The following is a further detailed description of a dynamic certificate update method according to an embodiment of the present invention:

[0108] Further optionally, in step S104, the physical token of the target user is used to generate a one-time password according to the current time and its built-in secret seed, including:

[0109] For the physical token, get the current timestamp and set it as the first time;

[0110] Extract the built-in secret seed;

[0111] Calculate a time counter according to the first time and a preset time interval, and set it as a first time counter;

[0112] Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value;

[0113] truncating the first hash value to extract a value of a preset length as a one-time password;

[0114] Send the one-time password to the authentication server for verification.

[0115] As you can understand, the physical token first obtains the current accurate timestamp, accurate to seconds or shorter time units, to ensure the timeliness and uniqueness of the one-time password. It then extracts the built-in secret seed, which is pre-stored in the token and shared with the server. Based on the current timestamp and a preset time interval (such as 30 seconds or 60 seconds), it calculates a time counter that reflects the time when the one-time password was generated. A hash value is generated using a preset encryption algorithm (such as HMAC-SHA-1 or the more secure SHA-256 algorithm) using the secret seed and time counter as input. This process ensures the randomness and unpredictability of the one-time password. The hash value is truncated to extract a value of a preset length as the one-time password, which is then sent to the authentication server for verification. This process generates a one-time password using the physical token and the built-in secret seed, combined with the current time. This process ensures the timeliness and uniqueness of the one-time password, providing strong support for identity authentication.

[0116] Further optionally, in step S105, verifying the validity of the one-time password includes:

[0117] Set a preset encryption time window;

[0118] Get the current timestamp when receiving the one-time password and set it as the second time;

[0119] Adding or subtracting the preset time window from the second time to obtain a time interval;

[0120] Calculating a set of time counters according to each time point in the time interval and a preset time interval, and setting them as second time counters;

[0121] Using a preset encryption algorithm, the secret seed and each of the second time counters are used as input to generate a set of hash values, which are set as second hash values;

[0122] performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords;

[0123] comparing the one-time password with any of the expected one-time passwords;

[0124] If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

[0125] Understandably, to tolerate the time difference between generating and receiving the one-time password, a preset time window (such as ±1 minute or ±30 seconds) is set. Setting this time window is crucial to ensuring the accuracy of one-time password verification. The current timestamp when the one-time password is received is obtained, and a time interval is calculated based on the preset time window. This time interval covers the time range when the one-time password may be generated. Based on each time point in the time interval and the preset time interval, a set of time counters is calculated, and a set of expected one-time passwords is generated using a preset encryption algorithm. This process simulates the one-time password generation process so that it can be compared with the received one-time password. The received one-time password is compared with any expected one-time password. If the two match, the one-time password is valid; otherwise, the one-time password is invalid. By simulating the one-time password generation process and comparing it with the received one-time password, the validity of the one-time password is verified. This process ensures that only OTPs generated within the correct time window are accepted, thereby improving the security of authentication.

[0126] Further optionally, in step S104, generating a VDF result includes:

[0127] For the physical token, get the current timestamp and set it as the first time T current ;

[0128] Calculate the first time T current Time T of the last synchronization sync The time difference ΔT, ΔT=T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server;

[0129] Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ;

[0130] The VDF result R vdf Sent to the authentication server for verification.

[0131] It is understandable that the physical token can obtain the current time through its built-in high-precision clock to ensure the accuracy of the timestamp and the precision of the clock, because any time error may cause errors in subsequent steps; by comparing the current time and the last synchronization time, the time difference ΔT is calculated; the time difference ΔT is processed using the preset VDF function f(ΔT) to obtain the VDF result R vdf , the VDF function generates a VDF result that is difficult to reverse calculate based on the time difference ΔT; the physical token sends the generated VDF result to the authentication server for subsequent verification of time synchronization.

[0132] Further optionally, in step S105, verifying the VDF result to ensure time synchronization includes:

[0133] Get the received VDF result R vdf The current timestamp is set to the second time T server_current ;

[0134] According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server;

[0135] Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number;

[0136] Determine the VDF result R vdf Whether it is within the expected VDF result range;

[0137] If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is determined to be successful;

[0138] If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

[0139] It is understandable that when receiving the VDF result, the authentication server obtains the current time and sets it as the second time as the basis for calculating the expected VDF result and judging time synchronization; based on the second time and the last synchronization time, the authentication server calculates the expected VDF result; considering factors such as network delay and clock deviation, the authentication server can set a preset tolerance range based on fuzzy logic. The setting of the tolerance range needs to be cautious to balance security and availability; by comparing the actually received VDF result with the expected interval, it can be judged whether the time synchronization is successful; if the VDF result R vdf If the time synchronization verification is within the expected VDF result range, the time synchronization verification is determined to be successful; otherwise, the verification fails; if the time synchronization verification is successful, the time synchronization information of the authentication server and the physical token is updated.

[0140] Further optionally, setting a preset tolerance range based on fuzzy logic includes:

[0141] Define fuzzy variables and assign fuzzy sets to each variable. These fuzzy variables include network delay, clock skew, system load, and power supply stability. For example, define a fuzzy variable to represent network delay and assign several fuzzy sets to it, such as "very short," "short," "medium," "long," and "very long." Define a fuzzy variable to represent clock skew and assign corresponding fuzzy sets to it, such as "slightly," "small," "medium," "large," and "very large."

[0142] A membership function is determined for each fuzzy set, and the membership function parameters of the fuzzy set are determined based on the historical data of the fuzzy variables. The membership function is used to represent the degree to which a specific value belongs to the fuzzy set. For example, a "short" fuzzy set for network delay can be represented using a triangular or trapezoidal membership function.

[0143] The historical data of fuzzy variables is analyzed to determine the impact of each fuzzy variable on the tolerance range δ. Based on the analysis results, a series of fuzzy rules are formulated. For example, "If the network delay is short and the clock deviation is small, the tolerance range δ should be set to a small value."

[0144] According to the specific input values ​​of the fuzzy variables (such as the specific values ​​of network delay and clock deviation), the fuzzy rules and membership functions are inferred using the fuzzy reasoning mechanism to calculate the fuzzy value of the tolerance range δ.

[0145] Convert the fuzzy values ​​within the tolerance range δ into concrete numerical values. This can be achieved through a defuzzification process, such as using the centroid method, maximum membership method, or weighted average method.

[0146] As can be understood, this solution uses fuzzy logic to set a preset tolerance range δ to account for the impact of uncertainties such as network latency, clock skew, system load, and power supply stability on time synchronization verification. By defining fuzzy variables, setting fuzzy sets, determining membership functions, analyzing historical data to formulate fuzzy rules, using fuzzy inference mechanisms for reasoning, and converting fuzzy values ​​into concrete numerical values, the solution can dynamically adjust the tolerance range to adapt to different system environments and conditions.

[0147] Further optionally, before step S106, before dynamically updating the authority information in the digital certificate based on fuzzy logic, the following steps are included:

[0148] Determine the type of authority and the key factors that influence the degree of authority granted;

[0149] defining a fuzzy set for each of the key factors and permission types;

[0150] Determining a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets;

[0151] Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors;

[0152] All the fuzzy rules are stored in a fuzzy rule base.

[0153] Understandably, clearly define the types of permissions required by the system or application, such as read, write, execute, etc., identify key factors that affect the degree of permission granted, such as user role, behavior history, device type, network environment, etc., which will serve as input for fuzzy logic reasoning; define fuzzy sets for each key factor and permission type, such as user roles can be "administrator", "ordinary user" and "guest", behavior patterns can be "frequent operation", "normal operation" and "abnormal operation", and the degree of permission granted can be fuzzy sets such as "high", "medium" and "low"; determine the membership function of each fuzzy set to quantify the degree of association between the key factors and the fuzzy set; formulate a series of fuzzy rules to describe the decision logic of the degree of permission granted under different combinations of key factors. The rule form is generally "if...then..." statements, such as "If the user role is administrator and the behavior pattern is normal operation, then the degree of permission granted is high". These rules reflect the system's decision-making strategy for permission granting and are the core of fuzzy logic reasoning; store all fuzzy rules in a fuzzy rule library for use in real-time reasoning.

[0154] Further optionally, in step S106, dynamically updating the authority information in the digital certificate based on fuzzy logic includes:

[0155] Collect real-time data related to the target user's permission grant from the data source, including the target user's role, behavior pattern, device type, network location, and request time;

[0156] According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user;

[0157] Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

[0158] Understandably, real-time data related to the target user's permission grant is collected from the data source in real time, including user role, behavior pattern, device type, network location, and request time. Based on this real-time data and a fuzzy rule base, a fuzzy inference algorithm is used to calculate the target user's permission grant level. Based on the target user's permission grant level, the permission information in the digital certificate is dynamically updated. For example, if the user's permission grant level changes from "medium" to "high," the permission level in the digital certificate is updated accordingly. This ensures that the permission information in the digital certificate is consistent with the user's actual permission status, improving the security and flexibility of the system.

[0159] This solution dynamically adjusts permissions based on real-time user behavior and roles, improving system flexibility and adaptability. By introducing fuzzy logic and membership functions, it more accurately describes and quantifies the relationship between key factors and the degree of permission granted, enhancing the accuracy of permission management. Dynamically updating permission information in digital certificates facilitates the timely revocation or adjustment of user permissions, enhancing system security.

[0160] Further optionally, the step of calculating the degree of authorization granted to the target user using a fuzzy inference algorithm based on the real-time data and the fuzzy rule base includes:

[0161] The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set;

[0162] According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base;

[0163] According to the matched fuzzy rules, the fuzzy output membership of the target user's permission granting degree is calculated;

[0164] The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

[0165] It can be understood that the degree of authority granted to the target user is calculated based on the real-time data and the fuzzy rule base using a fuzzy reasoning algorithm. Specifically, first, the real-time data is fuzzified through a membership function and converted into a membership value of a fuzzy set, so as to convert the precise input data into a representation of fuzzy logic; according to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base; according to the matched fuzzy rules, the fuzzy output membership of the degree of authority granted to the target user is calculated; the fuzzy output membership is defuzzified, and defuzzification methods such as the centroid method and the maximum membership method can be used to convert it into a precise value of the degree of authority granted.

[0166] Example 2: Please refer to Figure 2 The present invention proposes a dynamic certificate update system, which includes:

[0167] Seed generation module: used to generate a unique secret seed for each user and store it in a secure database in encrypted form;

[0168] A seed pre-installation module is used to pre-install a secret seed in a physical token and distribute each physical token to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to the authentication server;

[0169] Registration module: used for generating a unique identifier for the target user and associating it with the secret seed in the security database when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship;

[0170] Generation module: When a target user requests to issue or renew a digital certificate, it generates a one-time password and a VDF result based on the current time and its built-in secret seed using the target user's physical token.

[0171] Verification module: used to receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database based on the unique identifier of the target user, and verify the validity of the one-time password based on the secret seed and the current time, while verifying the VDF result to ensure time synchronization;

[0172] Update module: If the one-time password and VDF result verification are successful, the digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

[0173] Further optionally, the generating module is further configured to:

[0174] For the physical token, get the current timestamp and set it as the first time;

[0175] Extract the built-in secret seed;

[0176] Calculate a time counter according to the first time and a preset time interval, and set it as a first time counter;

[0177] Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value;

[0178] truncating the first hash value to extract a value of a preset length as a one-time password;

[0179] Send the one-time password to the authentication server for verification.

[0180] Further optionally, the verification module is further configured to:

[0181] Set a preset time window;

[0182] Get the current timestamp when receiving the one-time password and set it as the second time;

[0183] Adding or subtracting the preset time window from the second time to obtain a time interval;

[0184] Calculating a set of time counters according to each time point in the time interval and a preset time interval, and setting them as second time counters;

[0185] Using a preset encryption algorithm, the secret seed and each of the second time counters are used as input to generate a set of hash values, which are set as second hash values;

[0186] performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords;

[0187] comparing the one-time password with any of the expected one-time passwords;

[0188] If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

[0189] Further optionally, the generating module is further configured to:

[0190] For the physical token, get the current timestamp and set it as the first time T current ;

[0191] Calculate the first time T current Time T of the last synchronization sync The time difference ΔT, ΔT=T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server;

[0192] Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ;

[0193] The VDF result R vdf Sent to the authentication server for verification.

[0194] Further optionally, the verification module is further configured to:

[0195] Get the received VDF result R vdf The current timestamp is set to the second time T server_current ;

[0196] According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server;

[0197] Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number;

[0198] Determine the VDF result R vdf Whether it is within the expected VDF result range;

[0199] If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is determined to be successful;

[0200] If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

[0201] Further optionally, the update module is further configured to:

[0202] Determine the type of authority and the key factors that influence the degree of authority granted;

[0203] defining a fuzzy set for each of the key factors and permission types;

[0204] Determining a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets;

[0205] Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors;

[0206] All the fuzzy rules are stored in a fuzzy rule base.

[0207] Further optionally, the update module is further configured to:

[0208] Collect real-time data related to target user permission granting from the target data source, including the target user's role, behavior pattern, device type, network location, and request time;

[0209] According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user;

[0210] Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

[0211] Further optionally, the update module is further configured to:

[0212] The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set;

[0213] According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base;

[0214] According to the matched fuzzy rules, the fuzzy output membership of the target user's permission granting degree is calculated;

[0215] The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

[0216] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A dynamic certificate update method, characterized in that: Applied to an authentication server, the method includes: A unique secret seed is generated for each user and stored in encrypted form in a secure database; Pre-installing a secret seed in a physical token and distributing each of the physical tokens to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to the authentication server; When the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship, a unique identifier is generated for the target user and associated with the secret seed in the security database; When the target user requests to issue or renew a digital certificate, a one-time password is generated through the target user's physical token based on the current time and its built-in secret seed, and a VDF result is generated at the same time; Receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database based on the unique identifier of the target user, and verify the validity of the one-time password based on the secret seed and the current time, while verifying the VDF result to ensure time synchronization; If the one-time password and VDF result are successfully verified, a digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

2. The dynamic certificate update method according to claim 1, characterized in that: The target user's physical token is used to generate a one-time password based on the current time and its built-in secret seed, including: For the physical token, get the current timestamp and set it as the first time; Extract the built-in secret seed; Calculate a time counter according to the first time and a preset time interval, and set it as a first time counter; Using a preset encryption algorithm, the secret seed and the first time counter are used as input to generate a hash value, which is set as a first hash value; truncating the first hash value to extract a value of a preset length as a one-time password; Send the one-time password to the authentication server for verification.

3. The dynamic certificate update method according to claim 2, characterized in that: Verifying the validity of the one-time password includes: Set a preset time window; Get the current timestamp when receiving the one-time password and set it as the second time; Adding or subtracting the preset time window from the second time to obtain a time interval; Calculating a set of time counters according to each time point in the time interval and a preset time interval, and setting them as second time counters; Using a preset encryption algorithm, the secret seed and each of the second time counters are used as input to generate a set of hash values, which are set as second hash values; performing truncation processing on each of the second hash values ​​to extract a value of a preset length to obtain a set of expected one-time passwords; comparing the one-time password with any of the expected one-time passwords; If the two match, the one-time password is valid; otherwise, the one-time password is invalid.

4. The dynamic certificate update method according to claim 1, wherein: Generating a VDF result includes: For the physical token, get the current timestamp and set it as the first time T current ; Calculate the first time T current Time T of the last synchronization sync The time difference ΔT, ΔT=T current -T sync , where T sync The time stored in the physical token when it was last synchronized with the authentication server; Use the preset VDF function f(ΔT) to process the time difference ΔT and obtain the VDF result R vdf ; The VDF result R vdf Sent to the authentication server for verification.

5. The dynamic certificate update method according to claim 4, characterized in that: Verifying the VDF results to ensure time synchronization includes: Get the received VDF result R vdf The current timestamp is set to the second time T server_current ; According to the second time T server_current and the last synchronization time T server_sync , calculate the expected VDF result R expected , where T server_sync The time of the last synchronization with the physical token recorded in the authentication server; Set a preset tolerance range δ, and determine the expected VDF result interval [R expected -δ, R expected +δ], where δ is a small positive number; Determine the VDF result R vdf Whether it is within the expected VDF result range; If the VDF result R vdf Within the expected VDF result range, that is, R expected -δ<=R vdf <=R expected +δ, then the time synchronization verification is determined to be successful; If the time synchronization verification is successful, the time synchronization information with the physical token is updated and the new synchronization time T is recorded. server_sync =T server_current .

6. The dynamic certificate update method according to claim 1, characterized in that: Before dynamically updating the authority information in the digital certificate based on fuzzy logic, the method includes: Determine the type of authority and the key factors that influence the degree of authority granted; defining a fuzzy set for each of the key factors and permission types; Determining a membership function for each of the fuzzy sets, for quantifying the degree of association between the key factors and the fuzzy sets; Formulate fuzzy rules to describe the decision logic of the degree of authority granted under different combinations of key factors; All the fuzzy rules are stored in a fuzzy rule base.

7. The dynamic certificate update method according to claim 6, characterized in that: The method of dynamically updating the authority information in the digital certificate based on fuzzy logic includes: Collect real-time data related to target user permission granting from the target data source, including the target user's role, behavior pattern, device type, network location, and request time; According to real-time data and fuzzy rule base, fuzzy reasoning algorithm is used to calculate the degree of authorization granted to the target user; Dynamically update the permission information in the digital certificate based on the degree of permission granted to the target user.

8. The dynamic certificate updating method according to claim 7, characterized in that: The method of calculating the degree of authorization granted to the target user by using a fuzzy inference algorithm based on real-time data and a fuzzy rule base includes: The real-time data is fuzzified by the membership function to be converted into a membership value of a fuzzy set; According to the fuzzified input data, the corresponding fuzzy rules are matched in the rule base; According to the matched fuzzy rules, the fuzzy output membership of the target user's permission granting degree is calculated; The fuzzy output membership is defuzzified to convert it into the authority granting degree value.

9. A dynamic certificate update system, used to implement the dynamic certificate update method according to any one of claims 1 to 8, characterized in that: The system comprises: Seed generation module: used to generate a unique secret seed for each user and store it in a secure database in encrypted form; A seed pre-installation module is used to pre-install a secret seed in a physical token and distribute each physical token to a corresponding user, wherein the physical token has a built-in time synchronization module and an encryption algorithm corresponding to the authentication server; Registration module: used for generating a unique identifier for the target user and associating it with the secret seed in the security database when the target user completes the first registration with the authentication server through the physical token and establishes an initial trust relationship; Generation module: When a target user requests to issue or renew a digital certificate, it generates a one-time password and a VDF result based on the current time and its built-in secret seed using the target user's physical token. Verification module: used to receive the one-time password and VDF result submitted by the physical token, obtain the associated secret seed from the security database based on the unique identifier of the target user, and verify the validity of the one-time password based on the secret seed and the current time, while verifying the VDF result to ensure time synchronization; Update module: If the one-time password and VDF result verification are successful, the digital certificate is issued or updated for the target user, and the permission information in the digital certificate is dynamically updated based on fuzzy logic. The new digital certificate contains the target user's unique identifier, validity period, permission information, and additional security attributes.

Images