Dynamic identity authentication method and system based on HMAC-SHA256 algorithm, and medium

Abstract

The invention discloses a dynamic identity authentication method and system based on an HMAC-SHA256 algorithm and a medium, and mainly relates to the technical field of identity authentication. The method and the device are used for solving the problems that in an existing dynamic identity authentication scheme, a static key is prone to brute force cracking or key leakage, a fixedly arranged message body structure is cracked, and a receiving end lacks an effective time window verification mechanism. Comprising the following steps: encrypting a message body by using a data key through an HMAC-SHA256 algorithm, then carrying out Base64 transcoding to obtain a final message body, and sending the final message body to a receiver; when a receiver receives a final message body, decoding the final message body by using Base64, and obtaining the message body by using a data key; disassembling the message body by using a preset permutation and combination mode and a preset separator; and when the server timestamp in the message body is within a preset synchronization interval, identity authentication code verification is carried out to receive a message plaintext after verification succeeds.

Description

Technical Field

[0001] This application relates to the technical field of identity authentication, and particularly to a dynamic identity authentication method, system, and medium based on the HMAC-SHA256 algorithm. Background Art

[0002] With the development of network communication, the importance of network information security has become increasingly prominent. Information encryption, digital signature, data integrity authentication, identity verification, etc. have become important contents in the field of information security. Message authentication is a process used to verify the authenticity (sent by the entity that generated it) and integrity (not tampered with, inserted, or deleted) of the received message, and is also used to verify the sequence and timeliness of the message (not reordered, replayed, or delayed). Among them, identity authentication is an important security mechanism that can help confirm whether the senders of messages are all trustworthy to prevent malicious attacks.

[0003] Existing authentication technologies based on hash algorithms can ensure message integrity, but there are the following technical bottlenecks: static key risk: most systems use fixed keys, which are easily brute-forced or leaked over long-term use. For example, in a financial transaction system, a man-in-the-middle attack event occurred due to the key not being updated for more than 90 days; message construction singularity: existing methods mostly directly splice the authentication code and data, and attackers can crack the communication protocol through pattern analysis. As a result, the data tampering rate of Internet of Things devices is as high as 28%; lack of synchronization mechanism: the receiving end lacks an effective time window verification mechanism, and the authentication failure rate of cross-time zone business systems due to clock deviation exceeds 15%. Summary of the Invention

[0004] In view of the above deficiencies of the prior art, this application provides a dynamic identity authentication method, system, and medium based on the HMAC-SHA256 algorithm to solve the problems that existing dynamic identity authentication schemes have static keys that are easily brute-forced or leaked, message body structures with fixed arrangements that have been cracked, and the receiving end lacks an effective time window verification mechanism.

[0005] In the first aspect, this application provides a dynamic identity authentication method based on the HMAC-SHA256 algorithm. The method includes: Automatically send the data key, identity authentication code, preset delimiter, and preset permutation and combination method within the current preset sending interval to the sender and the receiver according to the preset sending interval; The sender arranges and combines the identity authentication code, server timestamp, and message plaintext according to the preset permutation and combination method, and separates them with the preset delimiter to form a message body; after encrypting the message body using the data key through the HMAC-SHA256 algorithm, perform Base64 encoding to obtain the final message body, and send the final message body to the receiver; When the receiver receives the final message body, it decodes it with Base64 and then uses the data key to obtain the message body; disassembles the message body using the preset permutation and combination method and the preset delimiter; when the server timestamp in the message body is within the preset synchronization interval, perform the authentication code verification to receive the message plaintext after successful verification.

[0006] In an implementation manner of the present application, before automatically sending the data key, the authentication code, the preset delimiter, and the preset permutation and combination method within the current preset sending interval to the sender and the receiver according to the preset sending interval, the method further includes: Deploy a key generation module in the preset key management server, and automatically generate a new data key and an authentication code every preset sending interval; at the same time, randomly select any delimiter from the preset delimiter database as the corresponding preset delimiter within the current preset sending interval, and randomly select any permutation and combination method from the preset permutation and combination library as the corresponding preset permutation and combination method within the current preset sending interval; Generate the data key using the national cryptography SM4 algorithm, and generate the authentication code by combining the HMAC-SHA256 algorithm with the server hardware fingerprint; After generating the authentication code, store the data key in the hardware security module and mark the validity period as the preset sending interval + clock synchronization tolerance.

[0007] In an implementation manner of the present application, sending the final message body to the receiver specifically includes: Adopt a dynamic authentication strategy to send the final message body to the receiver.

[0008] In an implementation manner of the present application, after the receiver receives the final message body, decodes it with Base64, then uses the data key to obtain the message body, and disassembles the message body using the preset permutation and combination method and the preset delimiter, the method further includes: When the server timestamp in the message body is not within the preset synchronization interval, stop the authentication and delete the corresponding message body.

[0009] In an implementation manner of the present application, after performing the authentication code verification when the server timestamp in the message body is within the preset synchronization interval, the method further includes: When the server timestamp in the message body is within the preset synchronization interval, perform the verification of the authentication code and the message plaintext; When the authentication code is consistent with the current receiver's authentication code and there is no current authentication code in the verification record, determine that the verification is successful, and record adding the authentication code to the verification record; When the authentication code is inconsistent with the current receiver's authentication code or there is a current authentication code in the verification record, determine that the verification fails.

[0010] In a second aspect, the present application provides a dynamic identity authentication system based on the HMAC-SHA256 algorithm. The system includes: An automatic module, configured to automatically send a data key, an identity authentication code, a preset delimiter, and a preset permutation and combination method within the current preset sending interval to a sender node and a receiver node according to a preset sending interval; The sender node is configured to arrange the identity authentication code, the server timestamp, and the message plaintext according to a preset permutation and combination method, and separate them with a preset delimiter to form a message body; after encrypting the message body using the data key through the HMAC-SHA256 algorithm, perform Base64 transcoding to obtain a final message body, and send the final message body to the receiver node; The receiver node is configured to, when receiving the final message body, perform Base64 decoding, and then use the data key to obtain the message body; disassemble the message body using the preset permutation and combination method and the preset delimiter; when the server timestamp in the message body is within a preset synchronization interval, perform identity authentication code verification to receive the message plaintext after successful verification.

[0011] In an implementation manner of the present application, the automatic module includes a generation unit, configured to deploy a key generation module in a preset key management server, and automatically generate a new data key and an identity authentication code every preset sending interval; at the same time, randomly extract any delimiter from a preset delimiter database as the corresponding preset delimiter within the current preset sending interval, and randomly extract any permutation and combination method from a preset permutation and combination library as the corresponding preset permutation and combination method within the current preset sending interval; generate a data key using the national cryptography SM4 algorithm, and generate an identity authentication code through the HMAC-SHA256 algorithm in combination with the server hardware fingerprint; after generating the identity authentication code, store the data key in a hardware security module, and mark the validity period as the preset sending interval + clock synchronization tolerance.

[0012] In an implementation manner of the present application, the sender node includes a sending unit, configured to send the final message body to the receiver node by adopting a dynamic identity authentication strategy.

[0013] In an implementation manner of the present application, the receiver node includes a verification unit, configured to, when the server timestamp in the message body is within a preset synchronization interval, perform verification of the identity authentication code and the message plaintext; when the identity authentication code is consistent with the current receiver identity authentication code and there is no current identity authentication code in the verification record, determine that the verification is successful, and record adding the identity authentication code to the verification record; when the identity authentication code is inconsistent with the current receiver identity authentication code or there is a current identity authentication code in the verification record, determine that the verification fails.

[0014] In a third aspect, the present application provides a non-volatile computer storage medium, on which computer instructions are stored, and when the computer instructions are executed, a dynamic identity authentication method based on the HMAC-SHA256 algorithm as described in any one of the above is implemented.

[0015] Those skilled in the art can understand that the present application has at least the following beneficial effects: The present application provides a dynamic identity authentication method, system and medium based on the HMAC-SHA256 algorithm, which automatically distributes data keys to both communication parties at a preset sending interval, and solves the risk of brute force cracking caused by the long-term use of traditional fixed keys (such as man-in-the-middle attacks caused by unupdated keys in the financial system); this mechanism conforms to the core attributes of "confidentiality" and "controllability" in information security technology, and reduces the probability of leakage by refreshing keys regularly. Combining the resource optimization idea of "single encryption card serving multiple systems" in the national cryptography transformation technology, dynamic key distribution can improve the utilization rate of encryption resources and avoid performance bottlenecks caused by key solidification.

[0016] By combining the identity authentication code, timestamp and plaintext in a preset permutation and combination manner and separator, the traditional fixed splicing mode is broken (such as the high tampering rate caused by the single structure of Internet of Things devices). Using the HMAC-SHA256 algorithm combined with Base64 transcoding increases the difficulty of reverse cracking while ensuring data integrity, meeting the requirements of "non-repudiation" and "anti-repudiation" in information security technology.

[0017] The receiving end verifies the timeliness of the message through the server timestamp (such as the authentication failure problem caused by the clock deviation of the cross-time zone system), and this mechanism directly corresponds to the "availability" requirement in the information security guarantee system. The preset interval of timestamp verification can be dynamically adjusted to adapt to the clock synchronization requirements of different business scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the present invention, the drawings required for description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts.

[0019] Figure 1 is a flowchart of a dynamic identity authentication method based on the HMAC-SHA256 algorithm provided by an embodiment of the present application.

[0020] Figure 2 is a schematic internal structure diagram of a dynamic identity authentication system based on the HMAC-SHA256 algorithm provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0021] Those skilled in the art should understand that the embodiments described below are only preferred embodiments of the present disclosure, and do not mean that the present disclosure can only be implemented through these preferred embodiments. These preferred embodiments are only used to explain the technical principles of the present disclosure and are not used to limit the protection scope of the present disclosure. Based on the preferred embodiments provided by the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative efforts should still fall within the protection scope of the present disclosure.

[0022] It should also be noted that the term "including", "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such a process, method, commodity or device. Without further limitation, the element defined by the statement "including one..." does not exclude the existence of another identical element in the process, method, commodity or device including the element.

[0023] The technical solutions proposed in the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0024] The embodiment provides a dynamic identity authentication method based on the HMAC-SHA256 algorithm. As Figure 1 shown, the method provided by the embodiment of the present application mainly includes the following steps: Step 110: Automatically send the data key, identity authentication code, preset delimiter, and preset permutation and combination method within the current preset sending interval to the sender and the receiver according to the preset sending interval.

[0025] It should be noted that in this step, the key information is automatically sent through the preset sending interval, which improves the automation degree of data transmission, reduces manual intervention, and improves the system efficiency. By regularly updating and sending the data key and identity authentication code, the risk of the key being cracked or leaked for a long time is reduced, and the security of data transmission is enhanced.

[0026] For example, assume that the preset sending interval is once a day. The system will automatically send the latest data key, identity authentication code, etc. to the sender and the receiver every day to ensure that both parties use the latest and secure information.

[0027] In some embodiments, before this step, the method further includes: Deploy a key generation module on the preset key management server, and automatically generate a new data key and an identity authentication code every preset sending interval (through the regular operation of the key generation module, the dynamic update of the data key and the identity authentication code is realized, improving the security of the system. The cumbersome process of manually generating keys is reduced, and the automation level of key management is improved. For example: the key generation module on the key management server automatically generates a new data key and an identity authentication code every 24 hours); at the same time, randomly select any delimiter from the preset delimiter database as the corresponding preset delimiter within the current preset sending interval, and randomly select any permutation and combination method from the preset permutation and combination library as the corresponding permutation and combination method within the current preset sending interval (randomly selecting the delimiter and the permutation and combination method increases the difficulty for attackers to crack the communication protocol through pattern analysis. Through random selection, the data format for each transmission is different, improving the flexibility of the system. For example: before each data transmission, the system randomly selects "|" as the delimiter from the delimiter database and randomly selects the permutation method of "plaintext - authentication code - timestamp" from the permutation and combination library); Use the national cipher SM4 algorithm to generate the data key, and generate the identity authentication code by combining the server hardware fingerprint through the HMAC-SHA256 algorithm (for example: the system uses the national cipher SM4 algorithm to generate a 256-bit data key and generates a unique identity authentication code by combining the unique hardware fingerprint of the server through the HMAC-SHA256 algorithm); After generating the identity authentication code, store the data key in the hardware security module and mark the validity period as the preset sending interval + clock synchronization tolerance (for example: after generating the identity authentication code, the system stores the data key in the hardware security module and sets the validity period as 24 hours + 1 hour clock synchronization tolerance to ensure the validity of the key within the validity period).

[0028] Step 120: The sender arranges and combines the identity authentication code, the server timestamp, and the message plaintext according to the preset permutation and combination method, and separates them with the preset delimiter to form a message body; after encrypting the message body by using the data key through the HMAC-SHA256 algorithm, perform Base64 transcoding to obtain the final message body, and send the final message body to the receiver.

[0029] Those skilled in the art can understand that by means of the preset permutation and combination method and the delimiter, the key information (identity authentication code, server timestamp, message plaintext) is combined together, ensuring the integrity and immutability of the data. Through reasonable permutation and combination and the use of the delimiter, the message body structure is clear and easy for the receiver to parse and process.

[0030] For example, assume that the preset arrangement and combination method is "authentication code - server timestamp - message plaintext", and the preset delimiter is "|". The sender combines "ABC123" (authentication code), "20250305120000" (server timestamp), and "This is a test message" (message plaintext) in this way and separates them with "|", obtaining the message body "ABC123|20250305120000|This is a test message". The sender uses the data key "DEF456" to perform HMAC - SHA256 encryption on the message body "ABC123|20250305120000|This is a test message", obtaining the encrypted binary data. Then, this binary data is transcoded using Base64 to obtain the final message body (a string of Base64 - encoded characters).

[0031] Among them, sending the final message body to the receiver specifically includes: Adopt a dynamic authentication strategy to send the final message body to the receiver.

[0032] Step 130: When the receiver receives the final message body, perform Base64 decoding, and then use the data key to obtain the message body; disassemble the message body using the preset arrangement and combination method and the preset delimiter; when the server timestamp in the message body is within the preset synchronization interval, perform authentication code verification to receive the message plaintext after successful verification.

[0033] It should be noted that in this step, through Base64 decoding and the use of the data key, the security of the message body during transmission is ensured, preventing data from being stolen or tampered with. By using the preset arrangement and combination method and delimiter, the receiver can quickly and accurately disassemble the message body to obtain the required information. By verifying the server timestamp in the message body, it is ensured that the received data is within the preset synchronization interval, guaranteeing the timeliness and effectiveness of the data.

[0034] For example: The receiver receives a Base64 - encrypted final message body. First, perform the decryption operation, and then use the known data key to decrypt the message body to obtain the original message content. Then, according to the preset arrangement and combination method and delimiter (such as "|"), disassemble the message body into parts such as the authentication code, server timestamp, and message plaintext. Finally, check whether the server timestamp is within the preset synchronization interval (such as within 5 minutes). If so, perform authentication code verification, and receive the message plaintext after successful verification.

[0035] In some embodiments, after when the receiver receives the final message body, performs Base64 decoding, then uses the data key to obtain the message body, and disassembles the message body using the preset arrangement and combination method and the preset delimiter, the method further includes: When the server timestamp in the message body is not within the preset synchronization interval, stop the authentication and delete the corresponding message body.

[0036] It should be noted that by checking whether the server timestamp is within the preset synchronization interval, obsolete data can be filtered out in a timely manner to prevent it from interfering with or misjudging the system. For obsolete data, directly stop the authentication and delete it to avoid unnecessary calculations and resource consumption.

[0037] For example: After disassembling the message body, the receiving party finds that the server timestamp indicates that the message was sent 1 hour ago, while the preset synchronization interval is 5 minutes. Therefore, the receiving party decides to stop authenticating the message and directly delete the message body.

[0038] Among them, when the server timestamp in the message body is within the preset synchronization interval, after performing the authentication code verification, the method further includes: When the server timestamp in the message body is within the preset synchronization interval, verify the authentication code and the message plaintext (while verifying the server timestamp, also verify the authentication code and the message plaintext to ensure the integrity and authenticity of the data. For example: After confirming that the server timestamp is within the preset synchronization interval, the receiving party not only verifies the authentication code but also verifies the message plaintext in some way (such as hash verification) to ensure that it has not been tampered with); When the authentication code is consistent with the current receiving party's authentication code and there is no current authentication code in the verification record, determine that the verification is successful and record the authentication code in the verification record (by checking whether the current authentication code exists in the verification record, avoid repeated verification of the same message and improve system efficiency. Record and add the authentication code to the verification record to ensure the uniqueness and traceability of each message body. For example: When the receiving party verifies the authentication code, it finds that it is consistent with the current receiving party's authentication code and the verification record has not yet recorded this authentication code. Therefore, the receiving party determines that the verification is successful and adds this authentication code to the verification record); When the authentication code is inconsistent with the current receiving party's authentication code or the current authentication code exists in the verification record, determine that the verification fails (promptly identify and handle abnormal data: By verifying the consistency of the authentication code and the existence of the verification record, promptly identify and handle abnormal data to prevent it from posing a potential threat to the system. For example: When the receiving party verifies the authentication code, it finds that it is inconsistent with the current receiving party's authentication code or the verification record already exists with this authentication code. Therefore, the receiving party determines that the verification fails and takes corresponding measures, such as discarding the message body, recording error logs, etc.).

[0039] In addition, this application Figure 2A dynamic identity authentication system based on the HMAC-SHA256 algorithm provided by the embodiments of this application. As Figure 2 shown, the system provided by the embodiments of this application mainly includes: An automatic module 210, which is used to automatically send the data key, identity authentication code, preset delimiter, and preset permutation and combination method within the current preset sending interval to the sender node 220 and the receiver node 230 according to the preset sending interval.

[0040] The automatic module 210 includes a generating unit, which is used to deploy a key generation module in the preset key management server, and automatically generate a new data key and identity authentication code every preset sending interval (through the regular operation of the key generation module, the dynamic update of the data key and identity authentication code is realized, improving the security of the system. The cumbersome process of manually generating keys is reduced, and the automation level of key management is improved. For example: the key generation module on the key management server automatically generates a new data key and identity authentication code every 24 hours); at the same time, randomly extract any delimiter from the preset delimiter database as the corresponding preset delimiter within the current preset sending interval, and randomly extract any permutation and combination method from the preset permutation and combination library as the corresponding preset permutation and combination method within the current preset sending interval (randomly extracting the delimiter and permutation and combination method increases the difficulty for attackers to crack the communication protocol through pattern analysis. Through random selection, the data format for each transmission is different, improving the flexibility of the system. For example: before each data transmission, the system randomly selects "|" as the delimiter from the delimiter database and randomly selects the permutation method of "plaintext - authentication code - timestamp" from the permutation and combination library); use the national secret SM4 algorithm to generate the data key, and generate the identity authentication code by combining the server hardware fingerprint through the HMAC-SHA256 algorithm (for example: the system uses the national secret SM4 algorithm to generate a 256-bit data key, and generates a unique identity authentication code by combining the unique hardware fingerprint of the server through the HMAC-SHA256 algorithm); after generating the identity authentication code, store the data key in the hardware security module and mark the validity period as the preset sending interval + clock synchronization tolerance (for example: after generating the identity authentication code, the system stores the data key in the hardware security module and sets the validity period as 24 hours + 1 hour clock synchronization tolerance to ensure the validity of the key within the validity period).

[0041] The sender node 220 is used to arrange and combine the identity authentication code, server timestamp, and message plaintext according to the preset permutation and combination method, and separate them with the preset delimiter to form a message body; after encrypting the message body by using the data key through the HMAC-SHA256 algorithm, perform Base64 transcoding to obtain the final message body, and send the final message body to the receiver node 230.

[0042] The sender node 220 includes a sending unit, which is used to send a final message body to the receiver node 230 by adopting a dynamic identity authentication strategy.

[0043] The receiver node 230 is used to, when receiving the final message body, decode it with Base64 and then obtain the message body using the data key; disassemble the message body by using a preset permutation and combination method and a preset delimiter; when the server timestamp in the message body is within a preset synchronization interval, perform an identity authentication code verification so as to receive the message plaintext after the verification is successful.

[0044] The receiver node 230 includes a verification unit, which is used to, when the server timestamp in the message body is within a preset synchronization interval, perform the verification of the identity authentication code and the message plaintext (while verifying the server timestamp, also verify the identity authentication code and the message plaintext to ensure the integrity and authenticity of the data. For example: after confirming that the server timestamp is within the preset synchronization interval, the receiver node 230 not only verifies the identity authentication code, but also verifies the message plaintext by a certain method (such as hash check) to ensure that it has not been tampered with); when the identity authentication code is consistent with the identity authentication code of the current receiver node 230 and there is no current identity authentication code in the verification record, determine that the verification is successful, and record and add the identity authentication code to the verification record (by checking whether the current identity authentication code exists in the verification record, avoid repeated verification of the same message and improve the system efficiency. Record and add the identity authentication code to the verification record to ensure the uniqueness and traceability of each message body. For example: when verifying the identity authentication code, the receiver node 230 finds that it is consistent with the identity authentication code of the current receiver node 230 and the verification record has not recorded this identity authentication code yet. Therefore, the receiver node 230 determines that the verification is successful and adds this identity authentication code to the verification record); when the identity authentication code is inconsistent with the identity authentication code of the current receiver node 230 or there is a current identity authentication code in the verification record, determine that the verification fails (timely identify and process abnormal data: by verifying the consistency of the identity authentication code and the existence of the verification record, timely identify and process abnormal data to prevent potential threats to the system. For example: when verifying the identity authentication code, the receiver node 230 finds that it is inconsistent with the identity authentication code of the current receiver node 230 or the verification record already exists this identity authentication code. Therefore, the receiver node 230 determines that the verification fails and takes corresponding processing measures, such as discarding the message body, recording error logs, etc.).

[0045] In addition, the embodiment of the present application also provides a non-volatile computer storage medium, on which executable instructions are stored, and when the executable instructions are executed, the dynamic identity authentication method based on the HMAC-SHA256 algorithm as described above is implemented.

[0046] So far, the technical solutions of the present disclosure have been described in combination with multiple embodiments in the foregoing text. However, it is easy for those skilled in the art to understand that the protection scope of the present disclosure is not limited to these specific embodiments. Without departing from the technical principle of the present disclosure, those skilled in the art can split and combine the technical solutions in the above-mentioned various embodiments, and can also make equivalent changes or replacements to the relevant technical features. Any changes, equivalent replacements, improvements, etc. made within the technical concept and / or technical principle of the present disclosure will fall within the protection scope of the present disclosure.

Claims

1. A dynamic identity authentication method based on HMAC-SHA256 algorithm, characterized in that: The method comprises: According to the preset sending interval, the data key, identity authentication code, preset separator, and preset permutation and combination method within the current preset sending interval are automatically sent to the sender and the receiver; The sender arranges and combines the identity authentication code, server timestamp, and message plaintext in a preset arrangement and combination manner, and separates them with a preset delimiter to form a message body; encrypts the message body using the data key through the HMAC-SHA256 algorithm, performs Base64 transcoding, obtains the final message body, and sends the final message body to the receiver; When the recipient receives the final message body, it decodes it with Base64 and then uses the data key to obtain the message body; the message body is disassembled using the preset permutation and combination method and the preset separator; when the server timestamp in the message body is within the preset synchronization interval, the identity authentication code is verified to receive the plain text of the message after the verification is successful.

2. The dynamic identity authentication method based on the HMAC-SHA256 algorithm according to claim 1, characterized in that: Before automatically sending the data key, identity authentication code, preset separator, and preset permutation and combination method within the current preset sending interval to the sender and the receiver according to the preset sending interval, the method further includes: A key generation module is deployed on the preset key management server to automatically generate a new data key and identity authentication code at each preset sending interval; at the same time, any separator is randomly selected from the preset separator database as the preset separator corresponding to the current preset sending interval, and any permutation and combination method is randomly selected from the preset permutation and combination database as the preset permutation and combination method corresponding to the current preset sending interval; Use the national secret SM4 algorithm to generate the data key, and use the HMAC-SHA256 algorithm combined with the server hardware fingerprint to generate the identity authentication code; After the authentication code is generated, the data key is stored in the hardware security module and marked with a validity period equal to the preset sending interval + clock synchronization tolerance.

3. The dynamic identity authentication method based on the HMAC-SHA256 algorithm according to claim 1, characterized in that: Send the final message body to the recipient, including: Adopt dynamic identity authentication strategy and send the final message body to the recipient.

4. The dynamic identity authentication method based on the HMAC-SHA256 algorithm according to claim 1, characterized in that: When the receiver receives the final message body, it decodes it using Base64 and then uses the data key to obtain the message body. After decomposing the message body using the preset permutation and combination method and the preset separator, the method further includes: When the server timestamp in the message body is not within the preset synchronization interval, the identity authentication is stopped and the corresponding message body is deleted.

5. The dynamic identity authentication method based on the HMAC-SHA256 algorithm according to claim 1, characterized in that: After performing identity authentication code verification when the server timestamp in the message body is within the preset synchronization interval, the method further includes: When the server timestamp in the message body is within the preset synchronization interval, the identity authentication code and the message plaintext are verified; When the identity authentication code is consistent with the current recipient's identity authentication code and there is no current identity authentication code in the verification record, it is determined that the verification is successful, and the identity authentication code is added to the verification record; When the identity authentication code is inconsistent with the current recipient identity authentication code or the current identity authentication code exists in the verification record, it is determined that the verification has failed.

6. A dynamic identity authentication system based on HMAC-SHA256 algorithm, characterized in that: The system comprises: The automatic module is used to automatically send the data key, identity authentication code, preset separator, and preset permutation and combination method within the current preset sending interval to the sending node and the receiving node according to the preset sending interval; The sender node is used to arrange and combine the identity authentication code, server timestamp and message plaintext according to a preset arrangement and combination method, and separate them with a preset separator to form a message body; after encrypting the message body with the data key through the HMAC-SHA256 algorithm, Base64 transcoding is performed to obtain the final message body, and the final message body is sent to the receiving node; The receiving node is used to decode the final message body with Base64 when it is received, and then use the data key to obtain the message body; disassemble the message body using the preset permutation and combination method and the preset separator; and perform identity authentication code verification when the server timestamp in the message body is within the preset synchronization interval, so as to receive the plain text of the message after the verification is successful.

7. The dynamic identity authentication system based on the HMAC-SHA256 algorithm according to claim 6, characterized in that: The automatic module includes the generation unit, Used to deploy a key generation module on a preset key management server, automatically generate a new data key and identity authentication code at each preset sending interval; at the same time, randomly extract any separator from the preset separator database as the preset separator corresponding to the current preset sending interval, and randomly extract any permutation and combination method from the preset permutation and combination library as the preset permutation and combination method corresponding to the current preset sending interval; use the national secret SM4 algorithm to generate a data key, and use the HMAC-SHA256 algorithm combined with the server hardware fingerprint to generate an identity authentication code; after generating the identity authentication code, store the data key in the hardware security module, and mark the validity period as the preset sending interval + clock synchronization tolerance.

8. The dynamic identity authentication system based on the HMAC-SHA256 algorithm according to claim 6, characterized in that: The sender node includes a sending unit, Used to adopt a dynamic identity authentication strategy to send the final message body to the receiving node.

9. The dynamic identity authentication system based on the HMAC-SHA256 algorithm according to claim 6, characterized in that: The receiving node includes a verification unit, Used to verify the identity authentication code and the message plain text when the server timestamp in the message body is within the preset synchronization interval; when the identity authentication code is consistent with the current recipient's identity authentication code and there is no current identity authentication code in the verification record, it is determined that the verification is successful, and the identity authentication code is added to the verification record; When the identity authentication code is inconsistent with the current recipient identity authentication code or the current identity authentication code exists in the verification record, it is determined that the verification has failed.

10. A non-volatile computer storage medium, characterized in that: Computer instructions are stored thereon, and when the computer instructions are executed, the dynamic identity authentication method based on the HMAC-SHA256 algorithm as described in any one of claims 1 to 5 is implemented.

Images