An identity authentication method, system and device in a weak network environment

Abstract

The application discloses an identity authentication method, system and device suitable for a weak network environment, and the method comprises the following steps: generating and managing a device identification code in a device registration stage, applying a password security enhancement strategy in a user registration stage, recording and updating a timestamp when a user state changes, comparing and verifying the device identification code, the password and the timestamp in a login stage, carrying out identity-based zero-knowledge proof authentication in an authentication stage, and generating and verifying a process identification code in a communication stage. The application comprises the following steps: generating a unique device identification code by using an SHA3-256 algorithm; combining an Argon2id algorithm to salt and hash the password and store the confusion data; recording and dynamically updating a timestamp to manage the identity validity period; adopting multiple verification mechanisms to verify the device identification code, the password and the timestamp; based on an elliptic curve encryption technology, identity authentication is realized by using zero-knowledge proof; and the legality is verified by using the process identification code in a communication process. The application has high efficiency and safety, reduces the dependence on a server, and is suitable for identity authentication and communication requirements in a weak network environment.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network security, and particularly relates to an identity authentication method, system and device in a weak network environment. BACKGROUND

[0002] Identity authentication is an important part of modern network security. It ensures that the user or device of a system is indeed the identity it claims to be, thereby preventing unauthorized access and operation. Through identity authentication, unauthorized users can be prevented from accessing sensitive data in the system, effectively preventing hackers and malicious users from illegally accessing the system and resources, ensuring that only authorized users or devices can interpret the transmission content, thereby protecting the confidentiality and integrity of communication.

[0003] However, in a weak network environment or a centerless environment, server resources are limited, and the client must bear more authentication tasks. Traditional identity authentication methods usually rely on centralized server resources, which can easily lead to performance bottlenecks, and password leakage, brute force cracking and social engineering attacks occur frequently, especially when users reuse passwords across platforms, the risk is higher, and communication also needs to rely on trusted third-party CA institutions to issue digital certificates, which is complex to manage and difficult to implement.

[0004] Therefore, an efficient and secure solution is needed to implement identity authentication functions on the client side while reducing dependence on servers and improving the overall performance and security of the system. SUMMARY

[0005] In view of the above problems, the present application provides an identity authentication method, system and device in a weak network environment, the main purpose of which is to solve the problem of identity authentication in the case of insufficient network resources and ensure that devices, accounts and users are one-to-one.

[0006] The first aspect of the present application provides an identity authentication method in a weak network environment, specifically comprising the following steps:

[0007] Step 1: generating and managing a device identification code in the device registration stage;

[0008] In the device registration phase, a unique device identification code is generated according to device information, which specifically includes: obtaining hardware feature information, manufacturer information, operating system information, compilation information and application support information of the device; splicing the hardware feature information, manufacturer information, operating system information, compilation information and application support information according to the format "hardware feature information: manufacturer information: operating system information: compilation information: application support information" to form a set of device feature data; using SHA3-256 algorithm to perform hash operation on the device feature data to generate an irreversible hash value of the device identification code; storing the generated hash value of the device identification code in the local database of the device to ensure the integrity of the device identification code.

[0009] Step 2: Apply password security enhancement strategy in user registration phase;

[0010] In the user registration phase, the user inputs a custom password, and the password is processed to ensure its security, which specifically includes: generating a unique random salt value through a secure random number generator, combining the user input password with the generated salt value, and performing salted hash operation using Argon2id algorithm; the generated salt value and the corresponding hash value are interleaved in the order of "one-bit salt, two-bit hash", and stored in the local database of the device; the software generates multiple pseudo passwords and their corresponding random salt values, combines the pseudo passwords with the corresponding salt values, processes them using the same Argon2id algorithm as the real password, and interleaves the salt values with the generated pseudo password hash values in the order of "one-bit salt, two-bit hash", and stores them in the same local database as the salt and hash interleaved values of the real password to form a confusion data set; the software stores an index marking the real password in a separate secure data storage.

[0011] Step 3: Record and update timestamp when user status changes;

[0012] 31) When the user registration is completed, the software records the registration timestamp and calculates the expiration timestamp of the user identity validity period, and initializes the expiration flag bit to the unexpired state;

[0013] 32) When the legitimate user logs in, the software dynamically extends the identity validity period according to the current time, updates the expiration timestamp, and resets the expiration flag bit to the unexpired state;

[0014] 33) When the expired user attempts to log in, the software updates the expiration flag bit to the expired state, and requires the user to complete identity authentication again to restore the legal identity state;

[0015] 34) When the user is offline, the software records the offline timestamp;

[0016] 35) Both the timestamp and the flag bit are stored in the local database to ensure the persistence and consistency of the data.

[0017] Step 4: Login phase device identification code, password and timestamp comparison verification;

[0018] 41) In the login phase, the user inputs identity information, and after clicking the login button, the software reads the expired timestamp, offline timestamp, expired flag, device identification code hash value, salt and hash interlaced value from the database;

[0019] 42) Get the current system time of the device, and judge whether the current timestamp is less than the expired timestamp: if the current timestamp is less than the expired timestamp, it means that the identity is still valid, otherwise it means that the identity authentication has expired, and the expired flag bit is set to expired and login is refused; Check if the offline timestamp is less than the current timestamp: if the offline timestamp is less than the current timestamp, it means that the device time is flowing normally, otherwise it means that the device system time has been tampered with and login is refused;

[0020] 43) Read the current device information, calculate the device identification code according to the method described in step 1, and compare the calculation result with the stored device identification code hash value to confirm the legality of the device;

[0021] 44) Separate the salt value and the hash value, combine the user input password with the salt value, and calculate the hash value using the Argon2id algorithm described in step 2; Compare the calculated hash value with the stored hash value to verify the correctness of the password: if the verification is successful, the user successfully logs in; If the verification fails and the user inputs k incorrect passwords, the software triggers the security locking mechanism to restrict further login attempts;

[0022] 45) If the user input password matches the stored pseudo password hash value, the software will guide the user to enter the pseudo honey pot account environment, and the honey pot account environment will record the attack behavior by simulating the behavior and data content of the real account, including the input password, login time, access path, login IP, operation record.

[0023] Step 5: Identity-based zero-knowledge proof authentication in the authentication phase;

[0024] 51) The key generation center generates and publishes public parameters, which specifically include: selecting elliptic curve parameters that satisfy the following formula:

[0025] y 2 =x 3 +ax+b mod p (1)

[0026] 4a 3 +27b 2 ≠0 (2)

[0027] where p is a prime number, a and b are elliptic curve parameters, x and y are points on the elliptic curve;

[0028] Selecting the base point and its order, generating global parameters and master key, satisfying the following formula:

[0029] n·G=O (3)

[0030] params=(p,a,b,G,n) (4)

[0031] master_key=Random([1,n-1]) (5)

[0032] where G is the base point on the elliptic curve, n is the order of the base point G, O is the point at infinity, params is the public parameter, and master_key is the system master key;

[0033] 52) The legitimate user submits the identity to the key generation center through the client software, and the key generation center calculates the private key using the user's identity and the master key, as follows:

[0034] SK=H(ID)·master_key mod n (6)

[0035] where SK is the user's private key, and H(ID) is the identity hash value;

[0036] The key generation center securely distributes SK to the user, who stores it encrypted on the local device;

[0037] 53) The key generation center defines a public key generation function, and any entity only needs to know the user's identity and public parameters params to calculate the corresponding user's public key, as follows:

[0038] PK=H(ID)·G (7)

[0039] where PK is the public key, used for subsequent identity authentication;

[0040] 54) The prover realizes identity authentication by Schnorr zero-knowledge proof to the verifier, while not revealing any information, which specifically includes: the prover generates a context according to the current timestamp and identity, and generates a proof using the private key and the context, as follows:

[0041] MM=H(T||ID A ) (8)

[0042] R=r·G (9)

[0043] r=Random([1,n-1]) (10)

[0044] c = H(R||M) (11)

[0045] z = r + c · SK A mod n (12)

[0046] π = (R, z) (13)

[0047] Wherein, M is context, T is current timestamp, ID A is the identity of the prover, H(·) represents the hash calculation inside the parentheses, R is a point on the ellipse, r is a random value, c is the challenge, z is the response, π is the proof;

[0048] The prover sends his identity, current timestamp and proof to the verifier, and the verifier calculates the public key of the prover according to the user identity, as follows:

[0049] PK A = H(ID A )·G (14)

[0050] Wherein PK A is the public key of the prover user;

[0051] The verifier checks whether the timestamp is within the allowed m-minute time window, and rejects the request if it is not;

[0052] The verifier calculates the challenge and verifies whether the following equation is true:

[0053]

[0054] If the equation is true, the proof is valid and the identity authentication is successful.

[0055] Step 6: Generation and verification of process identification code in communication phase

[0056] In the communication phase, a unique process identification code is generated for each message to verify the legality of the communication; the process identification code is composed of user identification, timestamp and random characters, wherein the random characters are generated based on pre-defined rules and are consecutive GBK encoded characters after permutation; the generated process identification code is attached to the message to be sent and transmitted together with the message to the receiving end; the receiving end verifies the legality of the attached process identification code after receiving the message, which specifically includes checking whether the user identification matches, whether the timestamp is within the pre-defined valid range, and whether the random characters meet the generation rules; the software manages the process identification code using a hierarchical storage strategy: short-term storage is used for real-time verification during the session to ensure the integrity and reliability of the message transmission process; long-term storage is used for post-audit and anomaly detection to support the security and tracking ability of the software.

[0057] The second aspect of the present application relates to an identity authentication system in a weak network environment, located at a client, which is mainly used to implement the identity authentication method in a weak network environment proposed by the present application. It comprises:

[0058] A registration module for generating and managing device identification codes in the device registration stage;

[0059] A login module for applying password security enhancement strategies in the user registration stage;

[0060] A timestamp recording and updating module for recording and updating timestamps when the user state changes;

[0061] A device identification code, password and timestamp verification comparison module for comparing and verifying the device identification code, password and timestamp in the login stage;

[0062] An identity authentication module for identity-based zero-knowledge proof authentication in the authentication stage;

[0063] A process identification code generation and verification module for generating and verifying process identification codes in the communication stage.

[0064] The third aspect of the present application relates to an identity authentication device in a weak network environment, comprising a memory and one or more processors, wherein the memory stores executable code. When the one or more processors execute the executable code, the identity authentication method in a weak network environment proposed by the present application can be implemented.

[0065] The beneficial effects of the present application are as follows:

[0066] 1) The present application improves the key protection level by entrusting the generation, storage and management of the key to an independent Keystore module, preventing the risk of key leakage caused by device attacks or data leakage.

[0067] 2) The present application uses the Argon2id algorithm to perform salted hash processing on the password, generates a unique secure hash value, and stores the salt values and hash values of the real password and the pseudo password mixedly, effectively preventing rainbow table attacks and brute force attacks, while using the pseudo password and the honeypot mechanism to confuse attackers, further improving the security of password storage.

[0068] 3) The present application is based on the identity-based zero-knowledge proof technology, which can complete the authentication without exposing any private information of the user's identity, significantly enhancing the system's ability to resist man-in-the-middle attacks, while simplifying the trust management and key distribution process and reducing the system complexity.

[0069] 4) The design of the present application fully considers the limitations in a weak network environment, reduces the dependence on servers, and uses local verification and secure storage mechanisms to achieve efficient and secure identity authentication and communication. BRIEF DESCRIPTION OF DRAWINGS

[0070] Figure 1 is a flow chart of the method of the present application.

[0071] Figure 2 is a client system framework diagram of the present application.

[0072] Figure 3 is an electronic device block diagram of the present application.

[0073] Figure 4 is a message format diagram of the process identification code in the preferred embodiment of the present application.

[0074] Figure 5 is a message format diagram of the process identification code in the preferred embodiment of the present application. DETAILED DESCRIPTION

[0075] The present application will be further described below with reference to the accompanying drawings, taking an Android client as an example.

[0076] Embodiment 1

[0077] Referring to Figure 1 A weak network environment identity authentication method, comprising the following steps:

[0078] Step 1: generating and managing device identification code in the device registration stage;

[0079] In the device registration stage, first read the device hardware feature information, manufacturer information, operating system information, compilation information and application support information of the mobile phone, and the optional information list is shown in Table 1 as follows:

[0080] Table 1

[0081]

[0082]

[0083] Select the device brand, device hardware name, version number, device manufacturer and build timestamp, and splice them into the device feature information "Redmi:mt6768:SP1A.210812.016:Xiaomi:1689573760000". Then, call the SHA3-256 hash function to calculate the device feature information, generate a 256-bit length hash value as the device identification code. Finally, store the generated device identification code in the local database SQLite.

[0084] Step 2: apply password security enhancement strategy in the user registration stage;

[0085] In the user registration phase, the user inputs the password "123456". The software first generates a unique random salt value with a length of 16 bytes by calling the secure random number generation method SecureRandom. Then, the user's input password is combined with the generated salt value, and a salted hash calculation is performed using the Argon2id algorithm to generate a hash value with a length of 32 bytes. The recommended Argon2id algorithm parameter configuration is: iteration count of 4, memory cost of 96MB, and parallelism of 2. On devices with strong hardware performance, the iteration count and memory cost can be appropriately increased, and the parallelism can be adjusted to be consistent with the number of CPU cores of the device, to balance between security and performance. Finally, the generated salt value and hash value are interleaved and combined according to the "one-bit salt, two-bit hash" rule to form a mixed data with a total length of 48 bytes. This mixed data is stored in the local database SQLite to ensure the security of the password data. Figure 4

[0086] At the same time, to enhance the anti-attack ability of the software, multiple pseudo passwords and their corresponding random salt values are generated during the processing of the user's password. The generation of pseudo passwords is diversified, such as: character replacement of the user's password to generate pseudo passwords like "123678"; appending a suffix to the password to generate pseudo passwords like "123456Bob"; completely random generation, such as pseudo passwords like "f5tG846Dh". Each pseudo password and its corresponding random salt value are combined and then subjected to salted hash processing using the same Argon2id algorithm and parameter configuration as the real password to generate the corresponding pseudo password hash value. The pseudo password hash value and its salt value are processed according to the same interleaving rule, and are stored together with the mixed data of the real password in the same database table to form a confusion data set. The serial number information of the real password is stored in a separate index database to mark and identify the correct password. This design effectively improves the anti-attack ability of the data and reduces the possibility of cracking the real password through data analysis, while ensuring the security and privacy protection ability of the system in weak network environment.

[0087] Step 3: Recording and updating of user state change time stamp;

[0088] 31) When the user completes the registration, the software initializes the expiration flag of the user's identity to "not expired" and records the time stamp 1732591137562 at the time of registration as the initial login time stamp. This time stamp is used to identify the time node of the user's first registration.

[0089] ​32) When the legal user logs in, the software updates the login timestamp, dynamically extends the validity period of the user's identity according to the preset identity validity time, and resets the expiration flag to "not expired". The login timestamp of this time, such as 1732591204547, will also be recorded in the software as reference data for subsequent verification.

[0090] 33) When the expired user logs in, the software updates the expiration flag to "expired" and requires the user to complete the identity authentication again to restore the legal identity status.

[0091] 34) When the user completes the communication and enters the offline state, the software records the offline timestamp, such as 1732591426765, and combines it with the set identity validity time, such as 12 hours, to calculate the new expiration timestamp 1732634591000.

[0092] 35) The flag and timestamp are stored through SQLite local database to ensure the reliability and consistency of the data. The timestamp recording mechanism can effectively support the dynamic management of the user's identity status by the software, guarantee the security of the user's identity verification, and improve the stability and practicality of the software in weak network environment.

[0093] Step 4: Comparison and verification of device identification code, password and timestamp in login stage;

[0094] 41) In the login stage, the user inputs the ID number 64001 obtained during registration and the initial password 123456 set, and clicks the login button. The software will extract the information related to the user from the database SQLite, including the expiration timestamp, offline timestamp, expiration flag, device identification code hash value, and the interlaced data set of salt and hash value, for verifying the validity of the user's identity and the legality of the device.

[0095] 42) Get the current system time of the device, and judge whether the current timestamp is less than the expiration timestamp: if the current timestamp is less than the expiration timestamp, it means that the identity is still valid, otherwise it means that the identity authentication has expired, set the expiration flag to expired state and refuse to log in; check whether the offline timestamp is less than the current timestamp: if the offline timestamp is less than the current timestamp, it means that the device time is flowing normally, otherwise it means that the device system time may be tampered and refuse to log in.

[0096] 43) Read the current device hardware feature information, manufacturer information, operating system information, compilation information and application support information. Select the device brand, device hardware name, version number, device manufacturer and build timestamp, and concatenate the device feature information in the format of "brand: hardware name: version number: manufacturer: build timestamp", for example "Redmi: mt6768: SP1A.210812.016: Xiaomi: 1689573760000". Then, use the SHA3-256 hash function to calculate the hash of the device feature information, generate a 256-bit device identification code hash value, and compare it with the stored device identification code. If they are equal, the device is legal, otherwise it is an illegal device, and the user's login request is rejected.

[0097] 44) Separate salt value and hash value, combine user input password with salt value, call Argon2id algorithm to calculate hash value, and compare generated hash value with stored hash value. If the hash values are equal, the password is correct, otherwise the password is incorrect. If the verification fails and the user inputs the wrong password 3 times, the software triggers the security lock mechanism to restrict further login attempts, preventing brute force attacks and dictionary attacks.

[0098] 45) If the user input password matches the stored pseudo password hash value, the software will guide the user to enter the pseudo honey pot account environment. The honey pot account environment records the attack behavior by simulating the behavior and data content of the real account, including the input password, login timestamp, access path, login IP, and operation record. For example, an attack record may show that the input password is "123678", the login timestamp is 1732604513897, the access path is " / storage / emulated / 0 / Download", and the login IP is "192.168.20.133". These records are stored in the log file, providing important data support for the design and optimization of subsequent security policies.

[0099] Step 5: The authentication phase is based on identity-based zero-knowledge proof authentication;

[0100] 51) The key generation center initializes the system parameters, selects appropriate elliptic curve parameters, and makes them satisfy the following conditions:

[0101] y 2 =x 3 +ax+b mod p (1)

[0102] 4a 3 +27b 2 ≠0 (2)

[0103] where p is a prime number, a and b are elliptic curve parameters, and x and y are points on the elliptic curve.

[0104] Select the base point and its order, generate the global public parameters (p, a, b, G, n), and publish through a secure channel, while randomly selecting a master key master_key, satisfying the following formula:

[0105] n·G = O (3)

[0106] params = (p, a, b, G, n) (4)

[0107] master_key = Random([1, n-1]) (5)

[0108] Where G is the base point on the elliptic curve, n is the order of the base point G, O is the point at infinity, params is the public parameter, master_key is the system master key, and is only stored inside the key generation center;

[0109] 52) The legitimate user submits the identity to the key generation center through the client software, and the key generation center calculates the private key using the user's identity and the master key master_key, as follows:

[0110] SK = H(ID)·master_key mod n (6)

[0111] Where SK is the user's private key, and H(ID) is the identity hash value;

[0112] The key generation center securely distributes SK to the user, who stores it encrypted on the local device;

[0113] 53) The key generation center defines a public key generation function, and any entity only needs to know the user's identity and public parameters params to calculate the corresponding user public key, as follows:

[0114] PK = H(ID)·G (7)

[0115] Where PK is the public key, used for subsequent identity authentication;

[0116] 54) For example, the prover Alice wants to achieve identity authentication through Schnorr zero-knowledge proof to the verifier Bob, while not revealing any information, first use the current timestamp and its own identity to generate the context, select a random number, calculate the random point, then calculate the challenge value according to the context and random point, finally calculate the response value, construct the proof, as follows:

[0117] M = H(T||ID A ) (8)

[0118] R = r·G (9)

[0119] r = Random([1, n-1]) (10)

[0120] c = H(R || M) (11)

[0121] z = r + c • SK A mod n (12)

[0122] π = (R, z) (13)

[0123] Where M is the context, T is the current timestamp, ID A is the user identification of the prover Alice, H(·) represents the hash calculation inside the parentheses, R is a point on the ellipse, r is a random value, c is the challenge, z is the response, and π is the proof.

[0124] The prover Alice sends her user identification, current timestamp, and proof to the verifier Bob, who calculates Alice's public key based on the user identity, as follows:

[0125] PK A = H(ID A ) • G (14)

[0126] Where PK A is the public key of user Alice.

[0127] The verifier checks whether the timestamp is within the allowed time window, for example, within 5 minutes, and if it is out of time, the authentication request is rejected.

[0128] The verifier calculates the challenge and verifies whether the following equation holds:

[0129]

[0130] If the equation holds, the authentication is successful; otherwise, the authentication fails.

[0131] Through the design and implementation of the above zero-knowledge proof, the system effectively guarantees the security and privacy of identity authentication, without the need to directly transmit user private keys or other sensitive information.

[0132] Step 6: Generate and verify the process identification code in the communication phase.

[0133] During the communication process, the software generates a unique process identification code for each message to ensure that the identification code cannot be reused, effectively preventing forgery and replay attacks. The rules for the process identification code are as follows: refer to Figure 5, length is 16 bytes, including user ID 4 bytes, timestamp 8 bytes, random character 4 bytes, random character is composed of two consecutive GBK encoded Chinese characters, for example, 0xB6C0 and 0xB6C1 corresponding Chinese character "Duo Du". Before sending the message, the sender reads the user ID and fills the first 4 bytes of the process identification code, obtains the current system timestamp and fills the middle part of the identification code, generates a 4-byte random character and fills the end of the process identification code, and the generated process identification code is combined with the message to be sent and sent to the receiver.

[0134] The receiver receives the message, parses the process identification code, and verifies whether the process identification code meets the rules, including: whether the user ID matches the current communication object; whether the timestamp is within the allowed difference range, such as 5 minutes, from the last message timestamp, to prevent replay of expired messages; whether the random character meets the predefined generation rule.

[0135] The software manages the process identification code in layers: during the valid session, the process identification code is saved in short-term storage to verify the legality of communication in real time; to meet the audit requirements and abnormal detection, the software stores all used process identification codes for a long time, recording information including process identification code, generation time and associated message. For example, through auditing, it can be detected whether there is repeated use or fake process identification code, and data support is provided for optimizing communication security policy.

[0136] The embodiment includes device registration phase to generate and manage device identification code, user registration phase to apply password security enhancement strategy, user state change time stamp recording and updating, login phase device identification code, password and timestamp comparison verification, authentication phase identity-based zero-knowledge proof authentication, and communication phase process identification code generation and verification. Specifically, it includes: generating a unique device identification code through SHA3-256 algorithm; combining Argon2id algorithm to salt hash the password and store the obfuscated data; recording and dynamically updating the timestamp to manage the identity validity period; using multiple mechanisms to verify the device identification code, password and timestamp; based on elliptic curve encryption technology, identity authentication is realized by using zero-knowledge proof; in the communication process, the legality is verified by the process identification code. The application has high efficiency and security, reduces the dependence on the server, and adapts to identity authentication and communication needs in weak network environment.

[0137] Embodiment 2

[0138] Reference Figure 2 The embodiment relates to an identity authentication system based on a weak network environment. Located at the client side, it is divided into a registration module, a login module, a communication module and a storage module, the storage module further includes a database module and a Keystore module, and the system is used for realizing the identity authentication method for the weak network environment in embodiment 1.

[0139] Embodiment 3

[0140] With reference to Figure 3 The embodiment relates to an identity authentication device based on a weak network environment. The device comprises a memory and one or more processors, the memory stores executable code, and the one or more processors execute the executable code to implement the identity authentication method for the weak network environment in the embodiment 1.

[0141] The embodiments of the present specification are merely a list of implementation forms of the inventive concept, and are only used for the purpose of description. The protection scope of the present application should not be regarded as being limited to the specific forms presented in the embodiments, and the protection scope of the present application also extends to equivalent technical means that can be thought of by those skilled in the art according to the inventive concept.

Claims

1. A method for identity authentication in a weak network environment, characterized in that, Comprising the following steps: Step 1: Device registration phase generates and manages device identification code; Step 2: User registration phase applies password security enhancement strategy; In the user registration phase, the user inputs a custom password, and the password is processed to ensure its security, including: 21) A unique random salt value is generated by a secure random number generator, and the user's input password is combined with the generated salt value, and a salted hash operation is performed using the Argon2id algorithm; 22) The generated salt value and the corresponding hash value are interleaved in the order of "one-bit salt, two-bit hash", and stored in the local database of the device; 23) The software generates multiple pseudo passwords and their corresponding random salt values, combines the pseudo passwords with the corresponding salt values, and processes them using the same Argon2id algorithm as the real password, and the salt value and the generated pseudo password hash value are interleaved in the order of "one-bit salt, two-bit hash", and the salt and hash interleaved value of the real password is stored in the same local database, forming a confusion data set; 24) The software stores the index of the real password in a separate secure data storage; Step 3: Record and update the timestamp when the user's status changes; Step 4: Compare and verify the device identification code, password and timestamp in the login phase; Step 5: Identity-based zero-knowledge proof authentication in the authentication phase; Step 6: Generate and verify the process identification code in the communication phase. 2.The identity authentication method in a weak network environment according to claim 1, characterized in that, Step 1 includes: 11) In the device registration phase, a unique device identification code is generated based on device information, including: obtaining hardware feature information, manufacturer information, operating system information, compilation information and application support information; The hardware feature information, manufacturer information, operating system information, compilation information and application support information are spliced according to the format "hardware feature information: manufacturer information: operating system information: compilation information: application support information" to form a set of device feature data; 12) The device feature data is hashed using the SHA3-256 algorithm to generate an irreversible hash value of the device identification code; 13) The generated hash value of the device identification code is stored in the local database of the device to ensure the integrity of the device identification code. 3.The identity authentication method in a weak network environment according to claim 2, characterized in that, Step 3 includes: 31) When the user registration is completed, the software records the registration timestamp and calculates the expiration timestamp of the user's identity validity period, and initializes the expiration flag bit to the unexpired state; 32) When the legal user logs in, the software dynamically extends the identity validity period according to the current time, updates the expiration timestamp, and resets the expiration flag bit to the unexpired state; 33) When the expired user attempts to log in, the software updates the expiration flag bit to the expired state, and requires the user to complete the identity authentication again to restore the legal identity state; 34) When the user is offline, the software records the offline timestamp; 35) The timestamp and flag bit are stored in the local database to ensure the persistence and consistency of the data.

4. The identity authentication method in a weak network environment according to claim 3, characterized in that, Step 4 includes: 41) In the login phase, the user inputs the identity information, clicks the login button, and the software reads the expiration timestamp, offline timestamp, expiration flag, device identification code hash value, salt and hash interleaved value from the database; 42) Obtain the current system time of the device, and determine whether the current timestamp is less than the expiration timestamp: if the current timestamp is less than the expiration timestamp, it indicates that the identity is still valid, otherwise it indicates that the identity authentication has expired, and the expiration flag is set to expired and login is refused; check whether the offline timestamp is less than the current timestamp: if the offline timestamp is less than the current timestamp, it indicates that the device time is flowing normally, otherwise it indicates that the device system time is tampered with and login is refused; 43) Read the current device information, calculate the device identification code, and compare the calculation result with the stored device identification code hash value to confirm the legality of the device; 44) Separate the salt value and the hash value, combine the user input password with the salt value, and calculate the hash value; compare the calculated hash value with the stored hash value to verify the correctness of the password: if the verification is successful, the user successfully logs in; if the verification fails and the user inputs the password k times, the software triggers the security locking mechanism to restrict further login attempts; 45) If the user input password matches the stored pseudo password hash value, the software will guide the user to enter the fake honeypot account environment, and the honeypot account environment records the attack behavior by simulating the behavior and data content of the real account, including the input password, login time, access path, login IP, and operation record.

5. The identity authentication method in a weak network environment according to claim 1, characterized in that, Step 5 includes: 51) The key generation center generates and publishes public parameters, including: selecting elliptic curve parameters to satisfy the following formula: y 2 = x 3 + ax + b mod p (1) 4a 3 +27b 2 ≠0 (2) Where p is a prime number, a and b are elliptic curve parameters, and x and y are points on the elliptic curve; Select the base point and its order to generate global parameters and master keys, which satisfy the following formula: n·G=O (3) params=(p,a,b,G,n) (4) master_key=Random([1,n-1]) (5) Where G is the base point on the elliptic curve, n is the order of the base point G, O is the infinite point, params is the public parameter, and master_key is the system master key; 52) The legitimate user submits the identity to the key generation center through the client software, and the key generation center calculates the private key using the user's identity and the master key master_key, as follows: SK=H(ID)·master_key mod n (6) Where SK is the user's private key, and H(ID) is the identity hash value; The key generation center securely distributes SK to the user, who encrypts it and stores it locally on the device; 53) The key generation center defines a public key generation function, and any entity only needs to know the user's identity and the public parameter params to calculate the corresponding user's public key, as follows: PK=H(ID)·G (7) Where PK is the public key, which is used for subsequent identity authentication; 54) The prover realizes identity authentication through Schnorr zero-knowledge proof to the verifier, while not revealing any information, which specifically includes: the prover generates a context based on the current timestamp and the identity, and generates a proof using the private key and the context, as follows: M = H(T || ID A ) (8) R=r·G (9) r=Random([1,n-1]) (10) c = H(R||M) (11) z = r + c - SK A mod n (12) π = (R, z) (13) where M is a context, T is a current timestamp, ID A is an identifier of the proving party, H(·) represents a hash calculation on the inside of the parentheses, R is a point on an ellipse, r is a random value, c is a challenge, x is a response, and π is a proof. The prover sends the identity, current timestamp and proof to the verifier, and the verifier calculates the public key of the prover according to the user identity, and the formula is as follows: PK A = H(ID A ) · G (14) where PK A is the prover's user's public key; The verifier checks whether the timestamp is within the allowed m-minute time window, and rejects the request if it is not; The verifier calculates the challenge and verifies whether the following equation is true: If the equation is true, the proof is valid, and the identity authentication is successful.

6. The identity authentication method in a weak network environment according to claim 1, characterized in that, Step 6 includes: In the communication phase, a unique process identification code is generated for each message to verify the legitimacy of the communication; the process identification code is composed of user identification, timestamp and random characters, wherein the random characters are generated based on a predefined rule and are consecutive GBK encoded characters after arrangement; the generated process identification code is attached to the message to be sent and transmitted together with the message to the receiving end; the receiving end verifies the legitimacy of the attached process identification code after receiving the message, which specifically includes checking whether the user identification matches, whether the timestamp is within the predefined valid range, and whether the random characters meet the generation rule; the software manages the process identification code using a hierarchical storage strategy: short-term storage is used for real-time verification during the session to ensure the integrity and reliability of the message transmission process; long-term storage is used for post-audit and anomaly detection to support the security and tracking ability of the software.

7. An identity authentication system in a weak network environment, characterized in that, Located at the client side, comprising: A registration module for generating and managing device identification codes during the device registration phase; A login module for applying password security enhancement strategies during the user registration phase; during the user registration phase, the user inputs a custom password and processes the password to ensure its security, which specifically includes: 21) generating a unique random salt value using a secure random number generator, combining the user-input password with the generated salt value, and performing a salted hash operation using the Argon2id algorithm; 22) interleaving the generated salt value and the corresponding hash value in the order of "one-bit salt, two-bit hash", and storing them in the local database of the device; 23) the software generates multiple pseudo passwords and their corresponding random salt values, combines the pseudo passwords with the corresponding salt values, processes them using the same Argon2id algorithm as the real password, interleaves the salt values with the generated pseudo password hash values in the order of "one-bit salt, two-bit hash", and stores them in the same local database as the salt and hash interleaved values of the real password, forming a set of obfuscated data; 24) the software stores an index marking the real password in a separate secure data storage; A timestamp recording and updating module for recording and updating timestamps when the user's state changes; A device identification code, password and timestamp verification comparison module for comparing and verifying the device identification code, password and timestamp during the login phase; An identity authentication module for identity-based zero-knowledge proof authentication during the authentication phase; A process identification code generation and verification module for generating and verifying process identification codes during the communication phase.

8. An identity authentication apparatus in a weak network environment, characterized by comprising: The memory stores executable code, and the one or more processors execute the executable code to implement the identity authentication method in a weak network environment according to any one of claims 1-7.

Images