Dynamic rotation type asymmetrically encrypted user password secure transmission method

Abstract

The invention provides a dynamic alternate asymmetrically encrypted user password secure transmission method, which comprises the following steps that: a server generates alternate public and private key pairs according to an alternate public and private key pair management strategy, constructs a distributed account book of public key update information by utilizing a block chain technology, and when an alternate public key needs to be updated or revoked, sends the public key update information to the server; the server side takes the update information as a transaction and releases the transaction to the block chain network; the client subscribes to a specific public key on the block chain to update a channel, and the client obtains an alternate public key; after acquiring the alternate public key, the client encrypts a user password by using the acquired alternate public key and transmits the encrypted user password to the server; after receiving the encrypted information, the server decrypts the encrypted information through the alternate private key in the period; and when decryption fails, the client is notified to acquire the alternate public key again, and the alternate public key is transmitted to the server again after encryption. According to the invention, encryption transmission is carried out on the user password in a dynamic alternate asymmetric encryption mode, and the problem that the public key is difficult to update and revoke is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of password security transmission, and in particular, to a method for securely transmitting user passwords with dynamic rotation asymmetric encryption. Background Art

[0002] In the current IT field, the separation of front-end and back-end has become the mainstream technical architecture. In this architecture, the front-end and back-end are independently deployed, and they communicate efficiently through RESTful APIs based on the HTTP protocol. However, this deployment mode also hides potential risks. The client code is exposed to the network environment without reservation and is extremely vulnerable to being coveted and attacked by hackers. Especially for sensitive information related to the vital interests of users, such as core data like login passwords, once leaked, it is very likely to cause serious consequences such as user privacy leakage and property damage. Therefore, ensuring the security of information during front-end and back-end communication has become the key to the stable operation of the system. Currently, the mainstream means in the industry to address this challenge is to use encryption technologies, among which symmetric encryption and asymmetric encryption are the most common.

[0003] However, there are also some defects in the use of symmetric encryption and asymmetric encryption. Symmetric encryption has the following defects: (1) The security problem of key storage. Once the location where the key is stored is hacked and the key is leaked, all the data encrypted with this key will become insecure. Moreover, as the system is upgraded or maintained, the location where the key is stored may change, which also increases the risk of key leakage. (2) Relatively weak security. Consequences of key leakage: Since the key of symmetric encryption is relatively simple and is stored on both communication parties, if the key is leaked, hackers can easily decrypt all the information encrypted with this key. Asymmetric encryption has the following defects: (3) Difficulty in public key update and revocation: When the public key needs to be updated or revoked (for example, when the private key of the server is leaked and the public key needs to be replaced), how to timely notify all clients to update the public key is a difficult problem. Summary of the Invention

[0004] The present invention provides a method for securely transmitting user passwords with dynamic rotation asymmetric encryption. By encrypting and transmitting user passwords through dynamic rotation asymmetric encryption, the problem of difficulty in public key update and revocation can be solved, and the automatic change of public-private key pairs can be realized, thereby ensuring the security of user passwords during front-end and back-end transmission.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for securely transmitting user passwords with dynamic rotation asymmetric encryption, comprising:

[0007] The server generates a rotating public-private key pair according to the rotating public-private key pair management policy, constructs a distributed ledger of public key update information using blockchain technology, and when the rotating public key needs to be updated or revoked, the server publishes the update information as a transaction to the blockchain network;

[0008] The client subscribes to a specific public key update channel on the blockchain. When new update information is published, the blockchain network automatically broadcasts a notification to the subscribed clients through a smart contract, and the client obtains the rotating public key;

[0009] After the client obtains the rotating public key, it encrypts the user password with the currently obtained rotating public key and transmits it to the server;

[0010] After the server receives the encrypted information, it decrypts it using the rotating private key within this period;

[0011] When the decryption fails, the client is notified to re-obtain the rotating public key, encrypt it, and transmit it to the server again;

[0012] When the server detects an abnormality in the rotating public key, it automatically triggers an emergency encryption and decryption switching mechanism;

[0013] The server quickly switches to an alternative encryption algorithm system and publishes the update information as a transaction to the blockchain network;

[0014] The rotating public-private key pair management policy includes:

[0015] Design a three-round rotation period;

[0016] A verification reservation time is set between each rotation period, that is, before entering the next rotation period after the end of each rotation period, the verification reservation time is entered;

[0017] A new rotating public-private key pair is generated in each new rotation period;

[0018] The rotating public-private key pair generated in the rotation period that has passed the verification reservation time will be destroyed.

[0019] In this specification, the process of detecting an abnormality in the rotating public key is as follows:

[0020] Continuously monitor the time consumed for encryption and decryption operations using the public key. When the encryption or decryption time exceeds the threshold of the normal range, it indicates that there is a problem with the public key or the related encryption algorithm, and it is marked as abnormal;

[0021] Monitor the network traffic related to the use of the public key. When requests for public key-related resources from a specific IP address or IP segment are found and the request frequency exceeds the threshold of the normal range, it indicates that the public key is being maliciously scanned or attacked, and it is marked as abnormal.

[0022] Statistically analyze the usage frequency of the public key in different time periods. When the usage frequency of the public key exceeds the normal range threshold during non-business peak periods, it indicates that the public key has been illegally obtained and maliciously exploited, and it is marked as abnormal.

[0023] In this specification, the process of generating rotating public and private keys is as follows: Obtain the current system time, and calculate the current key information key according to the rotation period and the management strategy of the rotating public and private key pairs.

[0024] Obtain the latest version of the key in memory, and determine whether the key exists. If it exists, directly provide the public key in the existing public and private key pair.

[0025] If the key does not exist in memory, obtain the latest version of the key in Redis. At the same time, determine whether the latest key to be obtained is empty. If the key in Redis is not empty, directly provide the public key in the existing public and private key pair.

[0026] If the key in Redis is empty, generate a secure public and private key pair using a specified algorithm, encrypt the public and private keys with AES, store them after encryption, and set the destruction time.

[0027] Update the memory cache and return the public key at the same time.

[0028] In this specification, the process of decrypting the rotating private key is as follows: Obtain the current system time and calculate the current key key according to the rotation period.

[0029] Obtain the current key from memory and determine whether the key exists. If it exists, use the key in the current time period for decryption.

[0030] If the key in memory does not exist, query the key information from Redis. If the key for the current rotation period does not exist in Redis, return a parameter exception and the decryption fails.

[0031] If the key for the current rotation period exists in Redis, use the key in the current time period for decryption. If the decryption is successful, the decryption process ends.

[0032] When the decryption fails, obtain the previous round of rotating key and decrypt it. If the decryption is successful, the decryption process ends.

[0033] When the decryption fails using the previous round of rotating key, determine the expiration time of the latest key. When the key has expired, return a parameter exception and the decryption fails.

[0034] In summary, the present invention has at least the following beneficial effects:

[0035] (1) Blockchain Broadcast Public Key Update: Use blockchain technology to build a distributed ledger for public key update information. When a public key needs to be updated or revoked, the server publishes the update information as a transaction to the blockchain network. The client subscribes to a specific public key update channel on the blockchain. Once new update information is published, the blockchain network automatically broadcasts a notification to the subscribed clients through a smart contract. Due to the decentralized and immutable characteristics of the blockchain, the reliability and timeliness of the notification are guaranteed, while avoiding the loss of notifications caused by single-point failures.

[0036] (2) Dynamic Rotation Update Mechanism: In traditional asymmetric encryption, the difficulty of public key update and revocation has always been a pain point. The present invention fundamentally solves this problem by automatically rotating the public-private key pair. The client subscribes to a specific public key update channel on the blockchain to obtain the rotated public key. The server automatically manages and updates the public-private key pair and publishes the rotated public key as a transaction to the blockchain network, making the public key update process natural and smooth, without worrying about the legacy issues of old public keys or untimely updates. This ensures that the system can timely adapt to changes in the security environment and always maintain a high level of security protection.

[0037] (3) Emergency Encryption Switching Mechanism: When an abnormality in the asymmetric public key is detected, the system automatically triggers the emergency encryption switching mechanism. Quickly switch to a backup encryption algorithm system and notify the client to update the public key and re-encrypt the data to ensure maximum data security and business continuity in the event of a security incident. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0039] Figure 1 It is a schematic diagram of the user password secure transmission method of the dynamic rotation asymmetric encryption involved in the present invention.

[0040] Figure 2 It is a schematic diagram of the blockchain broadcast public key update involved in the present invention.

[0041] Figure 3 It is a schematic diagram of the life cycle management of the rotated public-private key involved in the present invention.

[0042] Figure 4 It is a schematic diagram of the generation process of the rotated public-private key involved in the present invention.

[0043] Figure 5It is a schematic diagram of the rotation private key decryption process involved in the present invention. Detailed implementation manners

[0044] In the following, only some exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the spirit or scope of the embodiments of the present invention. Therefore, the drawings and the description are considered to be exemplary in nature rather than restrictive.

[0045] The following disclosure provides many different implementation manners or examples for implementing different structures of the embodiments of the present invention. To simplify the disclosure of the embodiments of the present invention, the components and settings of specific examples are described below. Of course, they are only examples and are not intended to limit the embodiments of the present invention. In addition, the embodiments of the present invention may repeat reference numerals and / or reference letters in different examples. This repetition is for the purpose of simplification and clarity and does not itself indicate the relationship between the various implementation manners and / or settings discussed.

[0046] The embodiments of the present invention will be described in detail below with reference to the drawings.

[0047] As Figure 1 shown, this embodiment provides a method for secure transmission of user passwords with dynamic rotation asymmetric encryption, including: the server generates a rotation public-private key pair according to a policy, constructs a distributed ledger of public key update information by using blockchain technology, and when the public key needs to be updated or revoked, the server publishes the update information as a transaction to the blockchain network. The client subscribes to a specific public key update channel on the blockchain to obtain the rotation public key, encrypts the user password with the rotation public key, and the server decrypts the encrypted information with the rotation private key. When the server detects an abnormality in the asymmetric public key, it automatically triggers an emergency encryption switching mechanism, quickly switches to an alternative encryption algorithm system (using existing encryption algorithms), and publishes the update information as a transaction to the blockchain network.

[0048] As Figure 2 shown, it is the design of blockchain broadcast public key update:

[0049] (1) The server generates a rotation public-private key pair according to a policy, and publishes the rotation public key information to the blockchain network through a transaction by using blockchain technology.

[0050] (2) The client subscribes to a specific public key update channel on the blockchain to obtain the rotation public key.

[0051] (3) When the server detects an abnormality in the asymmetric public key, it automatically triggers an emergency encryption switching mechanism, quickly switches to an alternative encryption algorithm system, and publishes the update information as a transaction to the blockchain network.

[0052] (4) Server, design of the mechanism for detecting abnormalities in the asymmetric public key:

[0053] a) Continuously monitor the time consumed for encryption and decryption operations using the public key. If the encryption or decryption time suddenly increases significantly and exceeds the threshold within the normal range, it means there is a problem with the public key or the related encryption algorithm, and it should be marked as abnormal.

[0054] b) Monitor the network traffic related to the use of the public key. If a large number of requests for public key-related resources (such as the public key distribution server, service ports using this public key, etc.) from a specific IP address or IP segment are found, and the request frequency far exceeds the normal business traffic, it indicates that the public key is being maliciously scanned or attacked, and it should be marked as abnormal.

[0055] c) Statistically analyze the usage frequency of the public key in different time periods. If the usage frequency of the public key suddenly increases abnormally during non-business peak hours, for example, during late night or early morning when the normal business volume is extremely low, and the number of times the public key is used suddenly increases significantly, it means that the public key has been illegally obtained and maliciously exploited, and it should be marked as abnormal.

[0056] As Figure 3 shown, the design for the life cycle management of rotating public and private keys is as follows:

[0057] (1) A total of three rounds of rotation cycles are designed.

[0058] (2) At the end of each rotation cycle, there will be a verification reservation time, which solves the critical point problem that occurs across rotation cycles.

[0059] (3) The rotation cycle and the verification reservation time are configurable.

[0060] (4) A new pair of public and private keys will be generated in each new rotation cycle.

[0061] (5) The public and private key pairs will be destroyed for rotation cycles that exceed the verification reservation time.

[0062] As Figure 4 shown, this embodiment is the design scheme for the process of generating rotating public and private keys:

[0063] (1) The rotation cycle and the verification reservation time are configurable. Taking a rotation time of 2 hours and a reserved verification time of 1 hour as an example.

[0064] (2) Obtain the current system time and calculate the current key information key according to the key rotation cycle and the rotation management strategy.

[0065] (3) Obtain the latest version of the key in memory. For example: key:pub:2024041616, determine whether the key exists. If it exists, directly provide the public key in the existing public and private key pair.

[0066] (4) If it does not exist in the memory, further obtain the latest version key from Redis. At the same time, judge whether the latest key to be obtained is empty. If there is a key in Redis, directly provide the public key in the existing public-private key pair.

[0067] (5) If the key in Redis is empty, generate a secure public-private key pair using the specified algorithm, and encrypt the public-private key with AES. The public-private key in Redis is stored after encryption, and a destruction time will be set.

[0068] (6) Next, update the memory cache and return the public key at the same time.

[0069] As Figure 5 shown, the design scheme of the rotation private key decryption process:

[0070] The encrypted user password of the client is transmitted to the server, and the server decrypts it. The design of the decryption process mainly includes the following:

[0071] a) Obtain the current system time and calculate the current key key according to the period.

[0072] b) Obtain the current key from the memory, judge whether the key exists. If it exists, use the key of the current time period for decryption.

[0073] [[ID=2 5]]c) If the memory key does not exist, query the key information from Redis. If the key of the current rotation period does not exist in Redis, directly return a parameter exception and the decryption fails.

[0074] d) If the key of the current rotation period exists in Redis, use the key of the current time period for decryption. If the decryption is successful, directly end the decryption process normally.

[0075] e) If the decryption fails, obtain the previous round of rotation key and decrypt it. If the decryption is successful, directly end the decryption process normally. [[ID= 33]]

[0076] f) If the decryption fails with the previous round of rotation key, it is necessary to judge the expiration time of the latest key. If the key has expired, directly return a parameter exception and the decryption fails.

[0077] g) If the latest key has not expired, obtain the next round of rotation key and decrypt it. If the decryption is successful, directly end the decryption process normally.

[0078] h) If the decryption fails, directly return a parameter exception and the decryption fails.

[0079] If the server decryption fails, it will notify the client to obtain the rotation public key again, encrypt it and then transmit it to the server again.

[0080] The above-described embodiments are used to illustrate the present invention and are not intended to limit the present invention. Therefore, changes in the exemplified numerical values or substitutions of equivalent elements should still fall within the scope of the present invention.

[0081] From the above detailed description, those of ordinary skill in the art can clearly understand that the present invention can indeed achieve the aforementioned objectives and has actually met the requirements of the Patent Law.

[0082] Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concept. Therefore, the appended claims are intended to be construed as including the preferred embodiments as well as all changes and modifications falling within the scope of the present invention. The above description is only the preferred embodiments of the present invention and is not intended to limit the present invention. It should be noted that any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0083] It should be noted that the above description of the process is only for illustration and explanation and does not limit the scope of application of this specification. For those skilled in the art, various corrections and changes can be made to the process under the guidance of this specification. However, these corrections and changes are still within the scope of this specification.

[0084] The basic concept has been described above. Obviously, for those of ordinary skill in the art after reading this application, the above invention disclosure is only an example and does not constitute a limitation to this application. Although not explicitly stated here, those of ordinary skill in the art may make various modifications, improvements, and corrections to this application. Such modifications, improvements, and corrections are proposed in this application, so such modifications, improvements, and corrections still fall within the spirit and scope of the exemplary embodiments of this application.

[0085] At the same time, this application uses specific terms to describe the embodiments of this application. For example, "one embodiment", "an embodiment", and / or "some embodiments" mean a certain feature, structure, or characteristic related to at least one embodiment of this application. Therefore, it should be emphasized and noted that "an embodiment" or "one embodiment" or "an alternative embodiment" mentioned twice or more at different positions in this specification is not necessarily the same embodiment. In addition, certain features, structures, or characteristics in one or more embodiments of this application can be appropriately combined.

[0086] In addition, those of ordinary skill in the art can understand that various aspects of this application can be illustrated and described by several patentable types or situations, including any new and useful process, machine, product, or composition of matter, or any new and useful improvement thereof. Therefore, various aspects of this application can be implemented entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or in a combination of hardware and software. The above-mentioned hardware or software can all be referred to as "units", "modules", or "systems". In addition, various aspects of this application can take the form of a computer program product embodied in one or more computer-readable media, in which computer-readable program code is included.

[0087] The computer program code required for the operation of each part of this application can be written in any one or more of the above programming languages, including object-oriented programming languages such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc., conventional procedural programming languages such as C programming language, VisualBasic, Fortran2103, Perl, COBOL2102, PHP, ABAP, dynamic programming languages such as Python, Ruby, and Groovy, or other programming languages. This program code can run entirely on the user's computer, or run on the user's computer as an independent software package, or run partially on the user's computer and partially on a remote computer, or run entirely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any network form, such as a local area network (LAN) or a wide area network (WAN), or connected to an external computer (for example, through the Internet), or in a cloud computing environment, or used as a service such as software as a service (SaaS).

[0088] In addition, unless clearly stated in the claims, the order of the processing elements and sequences, the use of numbers and letters, or the use of other names in this application are not used to limit the order of the processes and methods of this application. Although some currently considered useful embodiments of the invention are discussed through various examples in the above disclosure, it should be understood that such details only serve the purpose of illustration. The appended claims are not limited to the disclosed embodiments. On the contrary, the claims are intended to cover all modifications and equivalent combinations that conform to the essence and scope of the embodiments of this application. For example, although the implementation of the above various components can be embodied in a hardware device, it can also be implemented as a pure software solution. For example, it can be installed on an existing server or mobile device.

[0089] Similarly, it should be noted that, in order to simplify the description of the disclosure of the present application and thus help the understanding of one or more embodiments of the invention, in the foregoing description of the embodiments of the present application, sometimes multiple features are incorporated into one embodiment, drawing or description thereof. However, this method of the present application should not be construed as reflecting an intention that the claimed subject matter requires more features than are expressly recited in each claim. On the contrary, the subject matter of the invention should have fewer features than the above single embodiment.

Claims

1. A method for secure transmission of user passwords with dynamic rotation asymmetric encryption, characterized in that, Including: The server generates a rotation public-private key pair according to the rotation public-private key pair management policy, constructs a distributed ledger of public key update information using blockchain technology, and when the rotation public key needs to be updated or revoked, the server publishes the update information as a transaction to the blockchain network; The client subscribes to a specific public key update channel on the blockchain. When new update information is published, the blockchain network automatically broadcasts a notification to the subscribed clients through a smart contract, and the client obtains the rotation public key; After the client obtains the rotation public key, it encrypts the user password with the rotation public key obtained this time and transmits it to the server; After the server receives the encrypted information, it decrypts it with the rotation private key within this cycle; When the decryption fails, the client is notified to obtain the rotation public key again, encrypt it and transmit it to the server again; When the server detects an abnormality in the rotation public key, it automatically triggers an emergency encryption and decryption switching mechanism; The server quickly switches to an alternative encryption algorithm system and publishes the update information as a transaction to the blockchain network; The rotation public-private key pair management policy includes: Design a three-round rotation cycle; A verification reservation time is set between each rotation cycle, that is, before entering the next rotation cycle after the end of each rotation cycle, the verification reservation time is entered; A new rotation public-private key pair will be generated in each new rotation cycle; The rotation public-private key pair generated by the rotation cycle that has passed the verification reservation time will be destroyed.

2. The method for secure transmission of user passwords with dynamic rotation asymmetric encryption according to claim 1, characterized in that The process of detecting an abnormality in the rotation public key is as follows: Continuously monitor the time consumed for encryption and decryption operations using the public key. When the encryption or decryption time exceeds the threshold of the normal range, it indicates that there is a problem with the public key or the related encryption algorithm, and it is marked as abnormal; Monitor the network traffic related to the use of the public key. When a request for public key-related resources from a specific IP address or IP segment is found, and the request frequency exceeds the threshold of the normal range, it indicates that the public key is being maliciously scanned or attacked, and it is marked as abnormal. Count the usage frequency of the public key in different time periods. When the usage frequency of the public key exceeds the threshold of the normal range during non-business peak periods, it indicates that the public key has been illegally obtained and maliciously exploited, and it is marked as abnormal.

3. The method for secure transmission of user passwords with dynamic rotation asymmetric encryption according to claim 1, characterized in that, The process of generating the rotation public-private key is as follows: Obtain the current system time, and calculate the current key information key according to the rotation cycle and the rotation public-private key pair management policy; Obtain the latest version of the key in memory, and determine whether the key exists. If it exists, directly provide the public key in the existing public-private key pair; If the key does not exist in memory, obtain the latest version of the key in Redis, and at the same time determine whether the latest key to be obtained is empty. If there is a key in Redis, that is, it is not empty, directly provide the public key in the existing public-private key pair; If the key in Redis is empty, generate a secure public-private key pair using a specified algorithm, encrypt the public-private key with AES, store it after encryption and set the destruction time; Update the memory cache and return the public key at the same time.

4. The method for secure transmission of user passwords with dynamic rotation asymmetric encryption according to claim 1, characterized in that, The process of obtaining the rotation private key for decryption is as follows: Obtain the current system time and calculate the current key key according to the rotation cycle; Obtain the current key from memory and determine whether the key exists. If it exists, decrypt it using the key for the current time period; If the memory key does not exist, query the key information from Redis. If the key for the current rotation period does not exist in Redis, return parameter exception and decryption failure; If the key for the current rotation period exists in Redis, decrypt using the key for the current time period. If decryption is successful, end the decryption process; When decryption fails, obtain the previous rotation key and decrypt. If decryption is successful, end the decryption process; When decryption fails using the previous rotation key, check the expiration time of the latest key. If the key has expired, return parameter exception and decryption failure.

Images