Transformation-free identity authentication method and system based on intelligent password key

Abstract

The invention provides a transformation-free identity authentication method and system based on an intelligent password key, and the method comprises the steps: intercepting a user access request before the user access request reaches an original business system when the user sends out the access request, collecting user login information based on the user access request, and carrying out the random number generation based on the user login information; a random number is signed by using an intelligent password key, a public key certificate is extracted from the intelligent password key, user login information and the public key certificate are verified, a binding state is determined and stored, the public key certificate is read from a storage result, the signature and the public key certificate are verified, and based on a verification result, the user login information is verified. And judging the authenticity of the identity of the login user. According to the invention, by intercepting and processing the user access request before the user access request reaches the service system, external-mounting integration of the identity authentication function is realized, modification of original system architecture and codes is avoided, and the deployment risk and the implementation cost are reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and in particular to an identity authentication method and system based on an intelligent password key without modification. BACKGROUND

[0002] In the field of information security, using a hardware password device (such as an intelligent password key) for user identity authentication is an important means to prevent replay attacks and ensure identity authenticity.

[0003] Current mainstream business systems generally use the "account combined with password" method for user identity authentication. Using only an account and a password for login has the security risk of account and password being brute-forced. The authentication process lacks protection by cryptographic techniques such as digital certificates and digital signatures, and cannot verify the authenticity of the operator's identity, leading to a high incidence of risks such as man-in-the-middle attacks and session hijacking.

[0004] To improve security, some systems introduce identity authentication schemes based on cryptographic techniques (such as PKI and hardware tokens), but still have the following key problems: (1) High cost of business system modification The business system needs to be deeply modified to integrate the SDK of the cryptographic device (such as calling the SKF interface), which is not feasible for old systems or third-party closed-source systems, and has poor compatibility; The driving interfaces of cryptographic devices from different manufacturers (such as USB Key and TF card) differ greatly, and replacing the device requires redeveloping an adaptation layer.

[0005] (2) User data exposure risk The verification process requires the business system to provide clear access to the user system database (such as LDAP and AD), and once the proxy module is compromised, all user credentials will be leaked; The binding of certificates and accounts is usually done in the initialization phase, and the binding status cannot be dynamically updated or real-time verified, which poses a risk of certificate theft.

[0006] (3) Verification process decentralization Random number generation, signature verification, and certificate chain verification are handled by different components (such as the business system generating random numbers and the gateway verifying signatures), making it difficult to conduct centralized compliance detection using commercial cryptographic modules (such as SM2 / SM3); Decentralized verification can lead to random number reuse, such as the nonce replay vulnerability (CVE-2023-28131) disclosed in the OAuth 2.0 protocol. SUMMARY

[0007] In view of the above situation, the main purpose of the present application is to propose an identity authentication method and system based on intelligent password key without modification, which can make the user identity authentication method of the information system comply with the method of commercial password application security evaluation without any source code modification, effectively reduce the implementation difficulty of identity authentication in the modification of password application of the information system, especially for the application scene without source code modification authority or weak source code modification ability.

[0008] The present application proposes an identity authentication method based on intelligent password key without modification, which comprises the following steps: Step 1, when the user issues an access request, intercepting the user access request before the user access request reaches the original business system; Step 2, based on the user access request, collecting user login information, and generating random numbers based on the user login information; Step 3, signing the random numbers with the intelligent password key, and extracting the public key certificate from the intelligent password key; Step 4, verifying the user login information and the public key certificate, determining the binding state, and storing; Step 5, reading the public key certificate from the storage result, verifying the signature and the public key certificate, and judging the authenticity of the login user identity based on the verification result.

[0009] The present application also proposes an identity authentication system based on intelligent password key without modification, wherein the system applies the identity authentication method based on intelligent password key without modification as described above, and the system comprises: Zero modification core business module, intelligent password key calling module, commercial password device and data storage module; The zero modification core business module is deployed in front of the original business information system, which comprises a front-end data acquisition sub-module, a back-end data verification sub-module and an intelligent password key calling module; The front-end data acquisition sub-module is used for: When the user issues an access request, intercepting the user access request before the user access request reaches the original business system, and collecting user login information based on the user access request; The back-end data verification sub-module is used for: Verifying the user login information and the public key certificate to determine the binding state; The intelligent password key calling module is used for: Signing the random numbers with the intelligent password key, and extracting the public key certificate from the intelligent password key; The commercial password device is used for: Generating random numbers based on the user login information and verifying the signature and the public key certificate; The data storage module is used for: Storing the binding relationship between the user login information and the public key certificate.

[0010] Compared with the prior art, the present application has the following advantages: 1. By intercepting and processing the user access request before it reaches the business system, the external integration of the identity authentication function is realized, the original system architecture and code are avoided to be modified, and the deployment risk and implementation cost are reduced.

[0011] 2. A new "zero-reform core business module" is added as a front-end agent to completely take over the authentication process, and the original business system only receives the final login request and is completely unaware of the additional strong authentication process performed by the front-end agent without any code modification.

[0012] 3. The signature and verification are independently completed by a commercial cryptographic device, and the original business system only processes its own authentication logic, and the two communicate through an HTTP interface to realize physical and logical dual isolation.

[0013] 4. By signing the random number and binding the user login information, the integrity and authenticity of the authentication request are ensured, and the replay attack and man-in-the-middle attack are prevented.

[0014] Additional aspects and advantages of the present application will be described in part in the description that follows, and will become apparent from the description, or will be learned by practice of the embodiments of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 A flowchart of the identity authentication method based on the intelligent cryptographic key without modification proposed by the present application is shown in the figure. Figure 2 A whole business flowchart of the present application is shown in the figure. Figure 3 A work flowchart of the identity authentication system based on the intelligent cryptographic key without modification of the present application is shown in the figure. DETAILED DESCRIPTION

[0016] The embodiments of the present application will be described in detail below, and examples of the embodiments are shown in the drawings, wherein the same or similar reference signs represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the drawings are exemplary and are only used to explain the present application, and cannot be understood as a limitation of the present application. EMBODIMENTS

[0017] These and other aspects of embodiments of the present application will become apparent from the following description, taken in conjunction with the accompanying drawings. In the description below, some specific embodiments of the embodiments of the present application are specifically disclosed to represent some ways of embodying the principles of the embodiments of the present application, but it should be understood that the scope of the embodiments of the present application is not limited thereto.

[0018] Referring to Figure 1 The embodiment provides an identity authentication method based on a smart password key without reconstruction, and the method comprises the following steps: Step 1, when a user issues an access request, intercepting the user access request before the user access request reaches the original business system; Step 2, based on the user access request, collecting user login information, and generating a random number based on the user login information; Step 3, signing the random number with the smart password key, and extracting the public key certificate from the smart password key; Step 4, verifying the user login information and the public key certificate, determining the binding state, and storing; Step 5, reading the public key certificate from the storage result, verifying the signature and the public key certificate, and judging the authenticity of the login user identity based on the verification result.

[0019] In the embodiment, the identity authentication function is realized by external integration by intercepting and processing the user access request before reaching the business system, avoiding modification of the original system architecture and code, and reducing deployment risk and implementation cost.

[0020] The embodiment also provides an identity authentication system based on a smart password key without reconstruction, wherein the system applies the identity authentication method based on a smart password key without reconstruction as described above, and the system comprises: A zero-reconstruction core business module, a smart password key calling module, a commercial cryptographic device, and a data storage module; The zero-reconstruction core business module is deployed in front of the original business information system, and comprises a front-end data acquisition sub-module, a back-end data verification sub-module, and a smart password key calling module; The front-end data acquisition sub-module is configured to: When a user issues an access request, intercepting the user access request before the user access request reaches the original business system, and collecting user login information based on the user access request; The back-end data verification sub-module is configured to: Verifying the user login information and the public key certificate to determine the binding state; The smart password key calling module is configured to: Signing the random number with the smart password key, and extracting the public key certificate from the smart password key; The commercial cryptographic device is configured to: Generating a random number based on the user login information and verifying the signature and the public key certificate; The data storage module is configured to: The user login information is stored in a binding relationship with the public key certificate.

[0021] Please refer to Figure 2 In the embodiment, the smart password key calling module has a range of terminal devices, i.e., terminal devices for accessing information systems, and is mostly a personal computer. The zero-reform core business module has a range of an operating environment of information system business services, and is mostly a business server. The data storage module has a range of an operating environment of the zero-reform core business module, and is mostly a business server.

[0022] The smart password key calling module mainly generates random number data for the zero-reform core business module, calls the smart password key for digital signature, prevents the login process from being replayed, and protects the authenticity of the login user identity. The module is developed in C language, interacts with the device driver of the smart password key, calls the SKF interface of the smart password key, realizes the password algorithm calculation of the data, and opens the data message such as login information+signature value+public key certificate to the zero-reform core business module in the form of an HTTP interface, so as to provide the zero-reform core business module with the verification processing of the user login information.

[0023] The zero-reform core business module mainly preposes the information system access function, aims to realize the verification of the information system user identity authentication function through the module by using the password technology, and associates the verification result with the actual login result of the user, and returns the final login result to the user. The module can be divided into three parts, i.e., a front-end data acquisition submodule, a back-end data verification submodule, and a commercial cryptographic device. The front-end data acquisition submodule has four functions: 1. collecting user login information such as a login account; 2. calling the back-end data verification submodule to generate random numbers; 3. calling the HTTP interface of the smart password key calling module to obtain the public key digital certificate, and signing the random numbers generated by the back-end data verification submodule; and 4. sending the login information, signature value, public key certificate, and other information to the back-end data verification submodule.

[0024] The back-end data verification submodule has four functions: first, calling the interface of a commercial cryptographic device to generate a random number; second, obtaining login information and comparing it with the user information in the data storage module to determine whether the user has bound a public key certificate, and if not, completing the binding operation, and if so, extracting the public key certificate corresponding to the user; third, interacting with the commercial cryptographic device to perform integrity checking on the generated random number, the obtained signature value, and the extracted public key certificate; and fourth, after the checking is passed, forwarding the login information to the original business information system and returning the login return result to the front end. The function of the commercial cryptographic device is to provide compliant cryptographic calculation capabilities such as generating random numbers, verifying signatures, and verifying certificate trust chains to perform signature verification and digital certificate trust chain checking on data.

[0025] The data storage module is used to store configuration information related to the method, internal business logic information, account mapping relationships, and public key digital certificates.

[0026] Please refer to Figure 3 The specific workflow of the intelligent cryptographic key reconstruction-free identity authentication system is as follows: Step one, the system front-end user opens a browser; Step two, the system front-end user inputs the access address of the front-end data collection submodule in the browser, which is the access address of the information system after being proxied, inputs the user login information, and sends it to the front-end data collection submodule; Step three, the front-end data collection submodule receives the user login information sent by the client and sends it to the back-end data verification submodule for obtaining a random number; Step four, after the back-end data verification submodule receives the request for obtaining a random number, it queries whether the user login information is stored in the data storage module. If the login information does not exist, it adds the user login information in the data storage module, and then calls the interface of the commercial cryptographic device to generate a random number and bind it with the user login information. If the user login information exists, it directly calls the interface of the commercial cryptographic device to generate a random number and bind it with the user login information, and returns the generated random number to the front-end collection submodule; Step five, the front-end data collection submodule sends the obtained random number to the intelligent cryptographic key calling module; Step six, the intelligent cryptographic key calling module calls the SM2 algorithm signature interface of the intelligent cryptographic key to sign the random number, and calls the get public key certificate interface of the intelligent cryptographic key to obtain the public key certificate stored in the intelligent cryptographic key; Step seven, the intelligent cryptographic key returns the generated signature value and public key certificate to the intelligent cryptographic key calling module; Step eight, after the intelligent password key calling module receives the signature value and the public key certificate, it encapsulates and returns them to the front-end data collection sub-module; Step nine, after the front-end data collection sub-module obtains the signature value and the public key certificate, it calls the signature data verification interface of the back-end data verification sub-module to verify the signature data; Step ten, after the back-end data verification sub-module receives the signature value and the public key certificate, it compares the public key certificate with the public key certificate field bound to the user in the data storage module, if the field is empty, it binds the user and the public key certificate, stores the public key certificate into the data storage module, if the public key certificate field is not empty, it reads the data in the public key certificate field and returns it to the back-end data verification sub-module; Step eleven, the back-end data verification sub-module calls the signature verification interface of the commercial cryptographic device to verify the signature value and the public key certificate, and returns the verification result; Step twelve, after the back-end data verification sub-module receives the verification result returned by the commercial cryptographic device, it judges the authenticity of the login user identity. Embodiment

[0027] The principle of embodiment 1 of the application is to add a "zero-reform core business module" as a front-end agent to completely take over the authentication process, so that the original business system only receives the final login request and is completely unaware of the additional strong authentication process performed by the front-end agent, without any code modification. However, due to the addition of an interception verification part, login delay may occur. This embodiment further optimizes embodiment 1, under the condition of ensuring sufficient security performance, to make it as light as possible, improve verification efficiency, and reduce login delay.

[0028] In the method of embodiment 1, based on the user access request, the user login information is collected, and the random number is generated based on the user login information. In the step, the user login information is input into the pre-trained dynamic grading model to perform dynamic risk perception calculation, and the predicted risk grade is obtained. According to different grades of the predicted risk grade, different strategies are adopted for random number generation.

[0029] The complex random number generation algorithm usually has large calculation overhead, and offline true random number generation may need hardware support or consume more time. In the embodiment, by classifying the risks, for the requests with low risks, a lightweight 64-bit pseudo-random algorithm is used to reduce the CPU and delay overhead and improve the system response speed. For the requests with high risks, more calculation resources are consumed to ensure safety. By reducing the identity authentication overhead of low-risk requests, the overall system load is reduced, the user access speed and concurrent processing capacity are improved, the conflict between safety and performance is avoided, and different business scenarios and user risk levels have different strength requirements for random numbers. The grading strategy meets strict compliance requirements while ensuring system practicability. Moreover, since the dynamic grading model is adopted, the risk grading model can be dynamically adjusted as the user behavior and attack means evolve, and the random number generation strategy can be updated accordingly, maintaining the long-term safety and adaptability of the system.

[0030] As a preferred embodiment of the application, the user login information is input into the pre-trained dynamic grading model, and the risk grading prediction specifically includes the following steps: The request timestamp, mouse movement trajectory of the current session, keystroke interval time, client IP address, and device fingerprint are extracted from the user login information; The request timestamp is converted into a Fourier frequency domain feature, the fluctuation pattern in the preset time slot is extracted, and the Fourier feature vector of the current time slot is obtained; The client IP address is encoded based on the GeoHash algorithm to obtain a geographic code, and the device fingerprint is subjected to a hash operation to obtain a device fingerprint hash value; The acceleration change rate and trajectory curvature entropy value of the mouse movement trajectory of the current session are analyzed to obtain a trajectory entropy value, the keystroke interval time standard deviation and the proportion of long keystrokes and short keystrokes of the keystroke interval time are analyzed to obtain keystroke features, and the trajectory entropy value and the keystroke features are combined to obtain behavior features; A four-way Bloom filter array is constructed, wherein the first-way Bloom filter array stores user historical low-frequency abnormal type features, the second-way Bloom filter array stores historical benchmark distribution features, the third-way Bloom filter array stores device fingerprint historical trajectories, and the fourth-way Bloom filter array stores user historical behavior benchmark patterns; The geographic code and the device fingerprint hash value are input into the first-way Bloom filter array to detect user historical low-frequency abnormal feature types to obtain abnormal type markers; The Fourier feature vector of the current time slot is input into the second-way Bloom filter array, the deviation degree of the Fourier feature vector in the preset time slot from the historical benchmark distribution is calculated in a sliding window manner, and a frequency abnormality index is obtained; Input the geocoding and the device fingerprint hash value into a third Bloom filter array, compare the difference of the device fingerprint historical track, and obtain a device change degree score; Input the behavior feature into a fourth Bloom filter array, calculate the difference between the behavior feature and the user historical behavior benchmark mode, and obtain a behavior deviation degree score; The frequency anomaly index, the device change degree score and the behavior deviation degree score are weighted and calculated, and are combined with the abnormal type mark to obtain a predicted risk classification with a risk mark.

[0031] The embodiment shows a model for predicting risk classification, by dividing the space-time feature, mapping the high-dimensional space-time feature to a fixed-length hash value, and then detecting by using a multi-layer Bloom filter array, to realize the prediction of risk classification. The hash value can be calculated in the data acquisition stage, the Bloom filter array has low memory consumption, and through the cooperative design of hash slicing and layered detection, the seamless compatibility with the traditional system and the significant optimization of resource consumption are realized under the premise of ensuring the detection accuracy.

[0032] As a preferred embodiment of the application, the random number generation based on the user login information is specifically generating random numbers by using different random number generation methods according to the predicted risk classification with a risk mark, and the different random number generation methods include a lightweight 64-bit pseudo-random, a 128-bit SM3 standard random algorithm and a 256-bit true random algorithm based on a noise source.

[0033] In the embodiment, for high-risk classification, a more comprehensive and complex verification process can be used to improve the defense capability against potential attacks. For requests with low risk, a lightweight or cached verification method is used to reduce the calculation overhead and network requests, and to improve the verification speed and user access experience. Not only can appropriate security protection be provided for users with different risk levels, but also system resources can be effectively saved, user experience can be improved, and good flexibility and expansibility can be achieved.

[0034] As a preferred embodiment of the application, the binding state includes the existence of a binding record and the non-existence of a binding record: If there is no binding record of the user account and the public key certificate, a binding relationship of the user account, the public key certificate and the quantum behavior fingerprint is established and stored, and the current quantum behavior fingerprint is used as an initial quantum behavior benchmark; If there is a binding record, the public key certificate in the request is compared with the stored certificate, if they are inconsistent, it is directly determined that the authentication fails, and no subsequent verification is performed; if they are consistent, the quantum behavior fingerprint verification is performed, the coherence of the current quantum behavior fingerprint and the user historical quantum behavior fingerprint is verified to determine whether it is a legal user behavior evolution; otherwise, a high-risk alarm is triggered.

[0035] In this embodiment, the traditional behavior characteristics (mouse trajectory, keystroke pattern) can be simulated by AI. However, the physical randomness of quantum noise makes each login unique, and the attacker cannot reproduce the quantum state of the same space-time. Therefore, quantum behavior fingerprint verification is introduced in the verification of the binding state process, which generates quantum entropy through the hardware noise source of the intelligent password key, binds it with user behavior characteristics, and creates a physically unclonable "quantum behavior fingerprint".

[0036] To this end, the embodiment also discloses the acquisition process of the quantum behavior fingerprint, which solves the "easy to imitate" problem in the authentication field by fusing quantum physics (coherent state measurement), chaotic dynamics (Logistic-Tent scrambling), and behavior biometric characteristics. The specific steps are as follows: When the intelligent password key signs the random number, the quantum noise source of the hardware true random number generator is synchronously activated; In the time window of the signature operation, the voltage fluctuation sequence of the quantum noise source is continuously collected; According to the voltage fluctuation sequence, the fluctuation entropy and the autocorrelation decay coefficient are calculated; From the trajectory entropy value and the keystroke characteristics, the mouse acceleration extreme point sequence and the keystroke pressure change rate are extracted respectively; The mouse acceleration extreme point sequence and the keystroke pressure change rate are resampled to the same length as the voltage fluctuation sequence to generate a three-channel tensor; The initial value of the chaotic scrambling algorithm is generated using the fluctuation entropy and the autocorrelation decay coefficient, and the three-channel tensor is calculated using the chaotic scrambling algorithm to obtain the scrambled tensor; The scrambled tensor is input into the lightweight quantum convolutional encoder to obtain the quantum behavior fingerprint; wherein the lightweight quantum convolutional encoder uses a single-layer quantum convolution kernel, and the weight of the lightweight quantum convolutional encoder is initialized by the device unique key of the intelligent password key.

[0037] Among them, the specific steps of verifying the coherence of the current quantum behavior fingerprint and the user's historical quantum behavior fingerprint are as follows: The Hamming distance of the calculated quantum behavior fingerprint and the user historical quantum behavior fingerprint is calculated, and the Hamming distance is compared with a dynamic threshold value, if the Hamming distance is less than or equal to the dynamic threshold value, it is judged as legal user behavior evolution, if the Hamming distance is greater than or equal to the dynamic threshold value, a high-risk alarm is triggered, wherein the dynamic threshold value is calculated based on the fluctuation entropy and the autocorrelation decay coefficient obtained in each access request process. For example, a linear weighting method is used for combination, so that when the user's behavior is abnormal due to fatigue, the threshold value is automatically relaxed when the quantum coherence is high (the autocorrelation decay coefficient is low), to avoid false rejection. When the attacker attempts to tamper with the behavior slightly, the quantum coherence is low (the autocorrelation decay coefficient is high), triggering strict verification; when the attacker attempts to tamper with the behavior slightly, the quantum coherence is low (the autocorrelation decay coefficient rises) when the natural fluctuation of the user's behavior is tolerated: the threshold value is tightened, triggering strict verification, to prevent potential attacks.

[0038] As a preferred embodiment of the present application, the verification of the user login information and the public key certificate specifically includes: The public key certificate is compared with the public key certificate field bound to the user in the data storage module, if the field is empty, a binding operation is performed and stored, if the public key certificate field is not empty, it indicates that it has been bound.

[0039] As a preferred embodiment of the present application, the verification of the signature and the public key certificate specifically includes: according to the predicted risk classification with risk marks, different verification methods are selected to verify the signature and the public key certificate, different verification methods include offline lightweight verification of the signature and the public key certificate, calling a commercial cryptographic device to perform complete verification on the signature and the public key certificate, biometric authentication and manual review verification.

[0040] The verification result includes verification success and verification failure; when the verification fails: the authentication failure result is directly returned to the user, and the login information is not forwarded to the original business information system; When the verification succeeds, the user login information and the user access request are forwarded to the original business information system, the login result is obtained, the verification result is associated with the actual login result of the user, and the final login result is returned to the user.

[0041] For example: low risk + quantum matching, the risk classification result is low risk, the quantum verification result is passed, offline lightweight verification is adopted, in this state, both factors are safe, and the lowest verification cost is allowed.

[0042] Low risk + quantum mismatch, the risk classification result is low risk, the quantum verification result fails, manual review verification, in this state, the quantum layer detects an anomaly, covering the software risk misjudgment.

[0043] High risk + quantum match, the risk classification result is high risk, the quantum verification result is passed, and the complete verification of the commercial cryptographic device is called, in this state, the software layer high risk needs to be strengthened verification; High risk + quantum mismatch, the risk classification result is high risk, the quantum verification result fails, manual review + biometric secondary authentication, in this state, double abnormality, the highest security level is enabled.

[0044] It should be understood that although each step in the flowchart of each embodiment of the present application is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in each embodiment can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these sub-steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or sub-steps or stages of other steps.

[0045] It should be understood that each part of the present application can be realized by hardware, software, firmware or a combination thereof. In the above-described embodiments, a plurality of steps or methods can be realized by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if realized by hardware, as in another embodiment, it can be realized by any one or a combination of the following technologies known in the art: discrete logic circuit with logic gate circuit for implementing logic function on data signal, application specific integrated circuit with suitable combination logic gate circuit, programmable gate array (PGA), field programmable gate array (FPGA), etc.

[0046] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0047] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, several modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for identity authentication based on a smart password key without modification, characterized in that: The method comprises the following steps: Step 1: When a user sends an access request, intercept the user access request before it reaches the original business system; Step 2: Based on the user access request, collect user login information and generate a random number based on the user login information; Step 3: Sign the random number with the smart password key and extract the public key certificate from the smart password key; Step 4: Verify the user login information and public key certificate, determine the binding status, and store it; Step 5: Read the public key certificate from the stored result, verify the signature and public key certificate, and determine the authenticity of the logged-in user's identity based on the verification result.

2. The method for identity authentication based on a smart password key without modification according to claim 1, characterized in that: In step 1, based on the user access request, user login information is collected, and random number generation based on the user login information specifically includes the following steps: Input the user login information into the pre-trained dynamic grading model to perform dynamic risk perception calculation and obtain the predicted risk grading; According to the different levels of predicted risk classification, different strategies are used to generate random numbers.

3. The method for identity authentication based on a smart password key without modification according to claim 2, characterized in that: Inputting user login information into the pre-trained dynamic grading model, predicting risk grading specifically includes the following steps: Extract request timestamps, mouse movement traces for this session, keystroke intervals, client IP addresses, and device fingerprints from user login information; Convert the request timestamp into Fourier frequency domain features, extract the fluctuation pattern in the preset time slot, and obtain the Fourier feature vector of the current time slot; Encode the client IP address based on the GeoHash algorithm to obtain the geocode, and perform a hash operation on the device fingerprint to obtain the device fingerprint hash value; Analyze the acceleration change rate and the entropy value of the trajectory curvature of the mouse movement trajectory in this session to obtain the trajectory entropy value; analyze the keystroke interval standard deviation and the ratio of long keystrokes to short keystrokes to obtain the keystroke characteristics, and combine the trajectory entropy value with the keystroke characteristics to obtain the behavior characteristics; Construct a quadruple Bloom filter array, where the first Bloom filter array stores the user's historical low-frequency anomaly type characteristics, the second Bloom filter array stores the historical benchmark distribution characteristics, the third Bloom filter array stores the device fingerprint history trajectory, and the fourth Bloom filter array stores the user's historical behavior benchmark pattern; Input the geocode and device fingerprint hash value into the first Bloom filter array to detect the user's historical low-frequency abnormal feature type and obtain the abnormal type label; Input the Fourier eigenvector of the current time slot into the second Bloom filter array, calculate the deviation between the Fourier eigenvector in the preset time slot and the historical benchmark distribution through a sliding window method, and obtain the frequency anomaly index; The geocode and device fingerprint hash values ​​are input into the third Bloom filter array, and the differences in the device fingerprint history are compared to obtain the device change score. The behavioral features are input into the fourth Bloom filter array, and the difference between the behavioral features and the user's historical behavioral baseline pattern is calculated to obtain a behavioral deviation score; The frequency anomaly index, equipment change score, and behavior deviation score are weighted and calculated, and combined with the anomaly type mark to obtain a predicted risk grade with a risk mark.

4. The method for identity authentication based on a smart password key without modification according to claim 3 is characterized in that: In step 4, the binding status includes whether a binding record exists or not: If there is no binding record between the user account and the public key certificate, a binding relationship between the user account, public key certificate, and quantum behavioral fingerprint is established and stored, and the current quantum behavioral fingerprint is used as the initial quantum behavioral benchmark; If there is a binding record, the public key certificate in the request is compared with the stored certificate to see if they are consistent. If they are inconsistent, the authentication is directly judged to have failed and no subsequent verification is performed. If they are consistent, quantum behavioral fingerprint verification is performed to determine whether it is a legitimate user behavior evolution by verifying the coherence of the current quantum behavioral fingerprint and the user's historical quantum behavioral fingerprint. Otherwise, a high-risk alarm is triggered.

5. The method for identity authentication based on a smart password key without modification according to claim 4 is characterized in that: The process of obtaining quantum behavioral fingerprints specifically includes the following steps: When the smart cryptographic key signs a random number, the quantum noise source of its hardware true random number generator is synchronously activated; Within the time window of the signature operation, the voltage fluctuation sequence of the quantum noise source is continuously collected; Calculate the fluctuation entropy and autocorrelation attenuation coefficient based on the voltage fluctuation sequence; Extract the mouse acceleration extreme point sequence and keystroke pressure change rate from the trajectory entropy value and keystroke features respectively; Resample the mouse acceleration extreme point sequence and keystroke pressure change rate to the same length as the voltage fluctuation sequence to generate a three-channel tensor; The initial value of the chaos scrambling algorithm is generated by using the fluctuation entropy and the autocorrelation attenuation coefficient. The chaos scrambling algorithm is used to perform confusion calculation on the three-channel tensor to obtain the scrambled tensor. The scrambled tensor is input into a lightweight quantum convolution encoder for encoding to obtain a quantum behavioral fingerprint; wherein, the lightweight quantum convolution encoder adopts a single-layer quantum convolution kernel, and the lightweight quantum convolution encoder weight is initialized by the device unique key of the smart password key.

6. The method for identity authentication based on a smart password key without modification according to claim 5, characterized in that: The specific steps to verify the coherence of the current quantum behavior fingerprint and the user's historical quantum behavior fingerprint are as follows: The Hamming distance between the quantum behavioral fingerprint and the user's historical quantum behavioral fingerprint is calculated, and the Hamming distance is compared with the dynamic threshold. If the Hamming distance is less than or equal to the dynamic threshold, it is judged as a legitimate user behavior evolution; if the Hamming distance is greater than or equal to the dynamic threshold, a high-risk alarm is triggered; among them, the dynamic threshold is calculated based on the fluctuation entropy and autocorrelation attenuation coefficient obtained in each access request process.

7. The method for identity authentication based on a smart password key without modification according to claim 6, characterized in that: In step 4, verifying the user login information and public key certificate specifically includes: The public key certificate is compared with the public key certificate field bound to the user in the data storage module. If the field is empty, the binding operation is performed and stored; if the public key certificate field is not empty, it means that it has been bound.

8. The method for identity authentication based on a smart password key without modification according to claim 7, characterized in that: In step 5, the method for verifying the signature and public key certificate is specifically as follows: Based on the predicted risk classification with risk markers and the results of quantum behavioral fingerprint verification, different verification methods are selected to verify the signature and public key certificate. The different verification methods include offline lightweight verification of the signature and public key certificate, calling commercial cryptographic equipment to perform complete verification of the signature and public key certificate, biometric authentication, and industrial review verification.

9. The method for identity authentication based on a smart password key without modification according to claim 8, characterized in that: Step 5: Verification results include verification success and verification failure; When verification fails: the authentication failure result is directly returned to the user, and the login information is not forwarded to the original business information system; When the verification is successful, the user login information and user access request are forwarded to the original business information system, the login result is obtained, and the verification result is associated with the user's actual login result, and the final login result is returned to the user.

10. A system for identity authentication based on a smart password key without modification, the system applying the method for identity authentication based on a smart password key without modification according to any one of claims 1 to 9, characterized in that: include: Zero-modification core business module, smart password key calling module, commercial password equipment and data storage module; The zero-renovation core business module is deployed at the front end of the original business information system, including: a front-end data acquisition submodule, a back-end data verification submodule, and a smart password key calling module; Front-end data acquisition submodule, used for: When a user makes an access request, the system intercepts the user access request before it reaches the original business system and collects the user login information based on the user access request. Backend data validation submodule, used to: Verify the user login information and public key certificate to determine the binding status; Smart password key calling module, used for: By signing the random number with the smart cryptographic key and extracting the public key certificate from the smart cryptographic key; The commercial cryptographic device is used to: Generate random numbers based on user login information and verify signatures and public key certificates; The data storage module is used to: Stores the binding relationship between user login information and public key certificate.

Images