A Modification-Free Identity Authentication Method and System Based on Smart Cryptographic Keys

Abstract

This invention proposes a smart cryptographic key-based identity authentication method and system that requires no modification. When a user sends an access request, the method intercepts the request before it reaches the original business system. Based on the request, it collects user login information and generates a random number. This random number is then signed using a smart cryptographic key, and a public key certificate is extracted from it. The user login information and the public key certificate are verified to determine the binding status and stored. The public key certificate is retrieved from the stored result, and the signature and certificate are verified again. Based on the verification result, the authenticity of the logged-in user's identity is determined. This invention achieves plug-in integration of identity authentication functionality by intercepting and processing user access requests before they reach the business system, avoiding modifications to the original system architecture and code, and reducing deployment risks and implementation costs.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a method and system for identity authentication without modification based on a smart cryptographic key. Background Technology

[0002] In the field of information security, using hardware cryptographic devices (such as smart cryptographic keys) for user authentication is an important means of preventing replay attacks and ensuring the authenticity of identities.

[0003] Currently, most mainstream business systems use an "account combined with password" method for user authentication. However, logging in using only an account and password poses a security risk of brute-force attacks. Furthermore, the authentication process lacks the protection of cryptographic technologies such as digital certificates and digital signatures, making it impossible to verify the authenticity of the operator's identity and leading to a high incidence of man-in-the-middle attacks and session hijacking.

[0004] To enhance security, some systems have introduced cryptographic authentication schemes (such as PKI and hardware tokens), but the following key issues still exist:

[0005] (1) The cost of business system transformation is too high

[0006] The business system needs to be deeply modified to integrate the cryptographic device SDK (such as calling the SKF interface). For old systems or third-party closed-source systems, the feasibility of modification is low and the compatibility is poor.

[0007] The driver interfaces of cryptographic devices (such as USB keys and TF cards) from different manufacturers vary greatly, and a new adaptation layer needs to be developed when replacing devices.

[0008] (2) Risk of user data exposure

[0009] The verification process requires the business system to provide plaintext access to the user system database (such as LDAP, AD). Once the proxy module is compromised, it will lead to the leakage of all user credentials.

[0010] The binding of certificates and accounts is usually completed during the initialization phase, and the binding status cannot be dynamically updated or verified in real time, which poses a risk of certificate theft.

[0011] (3) Decentralized verification process

[0012] The random number generation, signature verification, and certificate chain verification processes are handled by different components (such as the business system generating random numbers and the gateway verifying signatures), making it difficult to pass the centralized compliance testing of commercial cryptographic modules (such as SM2 / SM3).

[0013] Distributed authentication is prone to random number reuse, such as the nonce replay vulnerability disclosed in the OAuth 2.0 protocol (CVE-2023-28131). Summary of the Invention

[0014] In view of the above, the main objective of this invention is to propose a method and system for identity authentication based on smart cryptographic keys that does not require modification. This method enables the user authentication method of an information system to meet the security assessment requirements of commercial cryptographic applications without any source code modification. It can effectively reduce the implementation difficulty of identity authentication in the cryptographic application transformation of information systems, especially for application scenarios where there is no source code modification permission or the source code modification capability is weak.

[0015] This invention proposes a method for identity authentication without modification based on a smart cryptographic key, the method comprising the following steps:

[0016] Step 1: When a user sends an access request, intercept the user access request before it reaches the original business system.

[0017] Step 2: Based on user access requests, collect user login information and generate random numbers based on the user login information;

[0018] Step 3: Sign the random number using the smart cryptographic key and extract the public key certificate from the smart cryptographic key;

[0019] Step 4: Verify the user login information and public key certificate, determine the binding status, and store the information;

[0020] Step 5: Read the public key certificate from the stored results, verify the signature and public key certificate, and determine the authenticity of the logged-in user's identity based on the verification results.

[0021] This invention also proposes a smart password key-based identity authentication system that requires no modification, wherein the system applies the smart password key-based identity authentication method described above, and the system includes:

[0022] Zero modification required for core business modules, smart cryptographic key access modules, commercial cryptographic devices, and data storage modules;

[0023] The core business modules that require no modification are deployed at the front end of the original business information system, including: a front-end data acquisition submodule, a back-end data verification submodule, and a smart password key invocation module;

[0024] The front-end data acquisition submodule is used for:

[0025] When a user sends an access request, the user access request is intercepted before it reaches the original business system, and user login information is collected based on the user access request.

[0026] The backend data validation submodule is used for:

[0027] Verify user login information and public key certificate to determine the binding status;

[0028] The smart password key invocation module is used for:

[0029] The random number is signed using a smart cryptographic key, and the public key certificate is extracted from the smart cryptographic key.

[0030] The commercial cryptographic device is used for:

[0031] Random numbers are generated based on user login information, and signatures and public key certificates are verified.

[0032] The data storage module is used for:

[0033] Store the binding relationship between user login information and public key certificates.

[0034] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0035] 1. By intercepting and processing user access requests before they reach the business system, the identity authentication function can be integrated externally, avoiding modifications to the original system architecture and code, and reducing deployment risks and implementation costs.

[0036] 2. Add a new "zero-modification core business module" as a front-end proxy to completely take over the authentication process. The original business system only receives the final login request and is completely unaware of the additional strong authentication process performed by the front-end proxy, without requiring any code modification.

[0037] 3. Signature and verification are completed independently by commercial cryptographic equipment, while the original business system only handles its own authentication logic. The two communicate through an HTTP interface to achieve dual physical and logical isolation.

[0038] 4. By signing the random number and binding it to user login information, the integrity and authenticity of the authentication request are guaranteed, preventing replay attacks and man-in-the-middle attacks.

[0039] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by means of embodiments of the invention. Attached Figure Description

[0040] Figure 1 This is a flowchart of the identity authentication method based on a smart cryptographic key without modification proposed in this invention;

[0041] Figure 2 This is a flowchart illustrating the overall business process of the present invention.

[0042] Figure 3 This is a flowchart of the workflow of the intelligent password key-based identity authentication system of the present invention. Detailed Implementation

[0043] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention. Example

[0044] These and other aspects of the embodiments of the present invention will become clear from the following description and accompanying drawings. In these descriptions and drawings, some specific embodiments of the present invention are specifically disclosed to illustrate some ways of implementing the principles of the embodiments of the present invention; however, it should be understood that the scope of the embodiments of the present invention is not limited thereto.

[0045] Please see Figure 1 This embodiment provides a method for identity authentication without modification based on a smart password key, the method comprising the following steps:

[0046] Step 1: When a user sends an access request, intercept the user access request before it reaches the original business system.

[0047] Step 2: Based on user access requests, collect user login information and generate random numbers based on the user login information;

[0048] Step 3: Sign the random number using the smart cryptographic key and extract the public key certificate from the smart cryptographic key;

[0049] Step 4: Verify the user login information and public key certificate, determine the binding status, and store the information;

[0050] Step 5: Read the public key certificate from the stored results, verify the signature and public key certificate, and determine the authenticity of the logged-in user's identity based on the verification results.

[0051] In this embodiment, the present invention achieves plug-in integration of identity authentication function by intercepting and processing user access requests before they reach the business system, thereby avoiding modifications to the original system architecture and code, and reducing deployment risks and implementation costs.

[0052] This embodiment also provides a smart password key-based identity authentication system that requires no modification, wherein the system applies the smart password key-based identity authentication method described above, and the system includes:

[0053] Zero modification required for core business modules, smart cryptographic key access modules, commercial cryptographic devices, and data storage modules;

[0054] The core business modules that require no modification are deployed at the front end of the original business information system, including: a front-end data acquisition submodule, a back-end data verification submodule, and a smart password key invocation module;

[0055] The front-end data acquisition submodule is used for:

[0056] When a user sends an access request, the user access request is intercepted before it reaches the original business system, and user login information is collected based on the user access request.

[0057] The backend data validation submodule is used for:

[0058] Verify user login information and public key certificate to determine the binding status;

[0059] The smart password key invocation module is used for:

[0060] The random number is signed using a smart cryptographic key, and the public key certificate is extracted from the smart cryptographic key.

[0061] The commercial cryptographic device is used for:

[0062] Random numbers are generated based on user login information, and signatures and public key certificates are verified.

[0063] The data storage module is used for:

[0064] Store the binding relationship between user login information and public key certificates.

[0065] Please refer to Figure 2 In this embodiment, the smart password key calling module is used for terminal devices, that is, terminal devices used to access information systems, which are mostly personal computers.

[0066] The core business modules require zero modification and their scope is the operating environment of the information system business services, which in most cases is a commercial server.

[0067] The data storage module operates within the operating environment of the core business modules without any modifications, and in most cases, it is a commercial server.

[0068] The smart password key invocation module's primary function is to digitally sign random number data generated by the core business module (which requires no modification) using the smart password key. This prevents replay attacks during the login process and protects the authenticity of the logged-in user's identity. Developed in C, this module interacts with the smart password key's device driver, invoking the smart password key's SKF interface to perform cryptographic algorithm calculations on the data. The resulting data, presented as a custom message (login information + signature value + public key certificate) via HTTP, is then sent to the core business module for verification of the user's login information.

[0069] The core business module, requiring zero modifications, primarily functions as a front-end proxy for information system access. Its purpose is to verify user identity using cryptographic technology, linking the verification result to the user's actual login result and returning the final login information to the user. This module consists of three parts: a front-end data acquisition submodule, a back-end data verification submodule, and a commercial cryptographic device. The front-end data acquisition submodule has four functions: first, collecting user login information, such as login account; second, calling the back-end data verification submodule to generate random numbers; third, calling the smart cryptographic key's HTTP interface to obtain the public key digital certificate and signing the random number generated by the back-end data verification submodule; and fourth, sending the login information, signature value, and public key certificate to the back-end data verification submodule.

[0070] The backend data verification submodule has four functions: First, it calls the interface of the commercial cryptographic device to generate random numbers; second, it obtains login information and compares it with user information in the data storage module to determine whether the user has bound a public key certificate. If not, it completes the binding operation; if bound, it extracts the user's corresponding public key certificate; third, it interacts with the commercial cryptographic device to verify the integrity of the above information, using the generated random number, the obtained signature value, and the extracted public key certificate; fourth, after successful verification, it forwards the login information to the original business information system, obtains the login return result, and returns it to the frontend. The role of the commercial cryptographic device is to provide compliant cryptographic computation capabilities, such as random number generation, signature verification, and certificate trust chain verification, to perform signature verification and digital certificate trust chain verification on data.

[0071] The data storage module is used to store configuration information related to the method of this invention, internal business logic information, account mapping relationships, public key digital certificates, etc.

[0072] Please refer to Figure 3 The specific workflow of the intelligent password key-based identity authentication system of the present invention is as follows:

[0073] Step 1: The system's front-end user opens a browser;

[0074] Step 2: The system front-end user enters the access address of the front-end data collection submodule in the browser. The access address is the access address of the information system after it has been proxied. The user enters the login information and sends it to the front-end data collection submodule.

[0075] Step 3: The front-end data acquisition submodule receives the user login information sent by the client and sends it to the back-end data verification submodule to obtain a random number.

[0076] Step 4: After receiving the request to obtain a random number, the backend data verification submodule checks whether the user login information has been stored in the data storage module. If the login information does not exist, it adds the user login information in the data storage module, and then calls the commercial cryptographic device interface to generate a random number and bind it to the user login information. If the user login information exists, it directly calls the commercial cryptographic device interface to generate a random number and bind it to the user login information, and returns the generated random number to the frontend collection submodule.

[0077] Step 5: The front-end data acquisition submodule sends the acquired random number to the smart password key invocation module;

[0078] Step 6: The smart cryptographic key calling module calls the smart cryptographic key's national cryptographic SM2 algorithm signature interface to sign the random number, and calls the smart cryptographic key's public key certificate acquisition interface to obtain the public key certificate stored in the smart cryptographic key.

[0079] Step 7: The smart cryptographic key returns the generated signature value and public key certificate to the smart cryptographic key calling module;

[0080] Step 8: After receiving the signature value and public key certificate, the smart password key calling module encapsulates them and returns them to the front-end data collection submodule.

[0081] Step 9: After the front-end data acquisition submodule obtains the signature value and public key certificate, it calls the signature data verification interface of the back-end data verification submodule to verify the signature data.

[0082] Step 10: After receiving the signature value and public key certificate, the backend data verification submodule compares the public key certificate with the field of the public key certificate bound to the user in the data storage module. If the field is empty, the user is bound to the public key certificate and the public key certificate is stored in the data storage module. If the public key certificate field is not empty, the data in the public key certificate field is read and returned to the backend data verification submodule.

[0083] Step 11: The backend data verification submodule calls the signature verification interface of the commercial cryptographic device to verify the signature value and public key certificate, and returns the verification result;

[0084] Step 12: After receiving the verification result returned by the commercial cryptographic device, the backend data verification submodule determines the authenticity of the logged-in user's identity. Example

[0085] The principle of Embodiment 1 of this invention is to add a "zero-modification core business module" as a front-end proxy, completely taking over the authentication process. This allows the original business system to only receive the final login request and remains completely unaware of the additional strong authentication process performed by the front-end proxy, requiring no code modification. However, due to the addition of an interception verification part, login delays may occur. This embodiment further optimizes Embodiment 1, making it as lightweight as possible while ensuring sufficient security performance, improving verification efficiency, and reducing login delays.

[0086] In the step of “collecting user login information based on user access request and generating random numbers based on user login information” in the method of Example 1, the predicted risk level is obtained by inputting the user login information into the pre-trained dynamic classification model to perform dynamic risk perception calculation.

[0087] Different strategies are used to generate random numbers depending on the different risk levels predicted.

[0088] Complex random number generation algorithms typically incur significant computational overhead, and offline true random number generation may require hardware support or consume even more time. In this embodiment, risk is categorized. For low-risk requests, a lightweight 64-bit pseudo-random algorithm is employed to reduce CPU and latency overhead, improving system response speed. For high-risk requests, more computational resources are consumed to ensure security. By reducing the authentication overhead of low-risk requests, the overall system load is reduced, improving user access speed and concurrency processing capabilities, avoiding conflicts between security and performance. Furthermore, different business scenarios and user risk levels have varying requirements for random number strength; the categorization strategy meets strict compliance requirements while ensuring system usability. Moreover, because a dynamic categorization model is used, the risk categorization model can be dynamically adjusted as user behavior and attack methods evolve, and the random number generation strategy can be updated accordingly, maintaining the system's long-term security and adaptability.

[0089] In a preferred embodiment of the present invention, the user login information is input into a pre-trained dynamic classification model to predict the risk classification, specifically including the following steps:

[0090] Extract the request timestamp, mouse movement trajectory of this session, keystroke interval, client IP address, and device fingerprint from the user login information;

[0091] The requested timestamp is converted into Fourier frequency domain features, and the fluctuation pattern within the preset time slot is extracted to obtain the Fourier feature vector of the current time slot.

[0092] The client IP address is encoded using the GeoHash algorithm to obtain a geocode, and the device fingerprint is hashed to obtain the device fingerprint hash value.

[0093] The acceleration rate of change and the entropy of the trajectory curvature of the mouse movement trajectory in this session are analyzed to obtain the trajectory entropy value. The standard deviation of the keystroke interval time and the ratio of long keystrokes to short keystrokes are analyzed to obtain the keystroke characteristics. The trajectory entropy value and the keystroke characteristics are combined to obtain the behavioral characteristics.

[0094] A quadruple Bloom filter array is constructed, wherein the first Bloom filter array stores the user's historical low-frequency anomaly type characteristics, the second Bloom filter array stores the historical baseline distribution characteristics, the third Bloom filter array stores the device fingerprint historical trajectory, and the fourth Bloom filter array stores the user's historical behavior baseline pattern.

[0095] The geocode and device fingerprint hash value are input into the first Bloom filter array to detect the user's historical low-frequency abnormal feature types and obtain the abnormal type label.

[0096] The Fourier feature vector of the current time slot is input into the second Bloom filter array. The deviation of the Fourier feature vector in the preset time slot from the historical baseline distribution is calculated by using a sliding window to obtain the frequency anomaly index.

[0097] The geocode and device fingerprint hash value are input into the third Bloom filter array, and the differences in the historical trajectory of the device fingerprint are compared to obtain the device change score;

[0098] The behavioral features are input into the fourth Bloom filter array, and the difference between the behavioral features and the user's historical behavioral baseline pattern is calculated to obtain the behavioral deviation score.

[0099] The frequency anomaly index, equipment change score, and behavior deviation score are weighted and combined with the anomaly type label to obtain a predicted risk classification with risk label.

[0100] This embodiment illustrates a model for predicting risk grading. It maps high-dimensional spatiotemporal features to fixed-length hash values ​​through spatiotemporal feature segmentation, and then uses a multi-layer Bloom filter array for detection to achieve risk grading prediction. The hash values ​​can be calculated during the data acquisition phase, and the Bloom filter array has low memory consumption. Through the collaborative design of hash segmentation and hierarchical detection, seamless compatibility with traditional systems and significant optimization of resource consumption are achieved while ensuring detection accuracy.

[0101] As a preferred embodiment of the present invention, the random number generation based on user login information specifically involves generating random numbers using different random number generation methods based on the predicted risk classification with risk markers. These different random number generation methods include lightweight 64-bit pseudo-random, 128-bit SM3 standard random algorithm, and 256-bit true random algorithm based on noise sources.

[0102] In this embodiment, for high-risk categories, a more comprehensive and complex verification process may be employed to enhance defense against potential attacks. For lower-risk requests, lightweight or cached verification methods are used to reduce computational overhead and network requests, improving verification speed and user experience. This approach not only provides appropriate security for users at different risk levels but also effectively conserves system resources, enhances user experience, and offers good flexibility and scalability.

[0103] In a preferred embodiment of the present invention, the binding status includes the existence of a binding record and the absence of a binding record:

[0104] If there is no binding record between the user account and the public key certificate, then establish and store the binding relationship between the user account, the public key certificate, and the quantum behavior fingerprint, and use the current quantum behavior fingerprint as the initial quantum behavior benchmark.

[0105] If a binding record exists, the public key certificate in the request is compared with the storage certificate. If they do not match, the authentication fails directly and no further verification is performed. If they match, quantum behavior fingerprint verification is performed. The coherence between the current quantum behavior fingerprint and the user's historical quantum behavior fingerprint is verified to determine whether it is a legitimate user behavior evolution. Otherwise, a high-risk alarm is triggered.

[0106] In this embodiment, traditional behavioral characteristics (mouse trajectory, keystroke patterns) can be simulated by AI. However, the physical randomness of quantum noise ensures that each login session generates a unique quantum state, making it impossible for attackers to reproduce the quantum state in the same time and space. Therefore, quantum behavioral fingerprint verification is introduced during the verification of the binding status. Quantum entropy is generated through the hardware noise source of the smart password key and bound to the user's behavioral characteristics to create a physically unclonable "quantum behavioral fingerprint".

[0107] To this end, this embodiment also discloses the process of acquiring the quantum behavioral fingerprint, which integrates quantum physics (coherent state measurement), chaotic dynamics (Logistic-Tent scrambling), and behavioral biometrics to solve the problem of "easy counterfeiting" in the authentication field. The specific steps are as follows:

[0108] When the smart cryptographic key signs a random number, the quantum noise source of its hardware true random number generator is activated simultaneously;

[0109] Within the time window of the signature operation, the voltage fluctuation sequence of the quantum noise source is continuously acquired;

[0110] Calculate the fluctuation entropy and autocorrelation decay coefficient based on the voltage fluctuation sequence;

[0111] The mouse acceleration extreme point sequence and keystroke pressure change rate were extracted from the trajectory entropy value and keystroke features, respectively.

[0112] The mouse acceleration extreme point sequence and the keystroke pressure change rate are resampled to the same length as the voltage fluctuation sequence to generate a three-channel tensor.

[0113] The initial values ​​for the chaotic scrambling algorithm are generated using fluctuation entropy and autocorrelation decay coefficient. The chaotic scrambling algorithm is then used to perform confusion calculations on the three-channel tensor to obtain the scrambled tensor.

[0114] The scrambled tensor is input into a lightweight quantum convolutional encoder for encoding to obtain a quantum behavioral fingerprint. The lightweight quantum convolutional encoder uses a single-layer quantum convolution kernel, and the weights of the lightweight quantum convolutional encoder are initialized by the device-unique key of the smart cryptographic key.

[0115] The specific steps for verifying the coherence between the current quantum behavior fingerprint and the user's historical quantum behavior fingerprint are as follows:

[0116] The Hamming distance between the quantum behavioral fingerprint and the user's historical quantum behavioral fingerprint is calculated and compared with a dynamic threshold. If the Hamming distance is less than or equal to the dynamic threshold, it is considered a legitimate user behavior evolution; if the Hamming distance is greater than or equal to the dynamic threshold, a high-risk alarm is triggered. The dynamic threshold is calculated based on the fluctuation entropy and autocorrelation decay coefficient obtained from each access request process. For example, a linear weighted approach is used so that when a user's behavior is abnormal due to fatigue, and the quantum coherence is high (low autocorrelation decay coefficient), the threshold is automatically relaxed to avoid false rejections. When an attacker attempts minor behavioral tampering, low quantum coherence (high autocorrelation decay coefficient) triggers strict verification; when an attacker attempts minor behavioral tampering, tolerating natural fluctuations in user behavior, and the quantum coherence is low (increasing autocorrelation decay coefficient), the threshold is tightened, triggering strict verification to prevent potential attacks.

[0117] In a preferred embodiment of the present invention, the verification of user login information and public key certificate specifically includes:

[0118] The public key certificate is compared with the field of the public key certificate bound to the user in the data storage module. If the field is empty, the binding operation is performed and the data is stored. If the public key certificate field is not empty, it means that the binding has been completed.

[0119] As a preferred embodiment of the present invention, the verification of the signature and public key certificate specifically involves: selecting different verification methods to verify the signature and public key certificate based on the predicted risk level with risk markers. The different verification methods include verifying the signature and public key certificate using offline lightweight verification, calling commercial cryptographic devices to perform full verification of the signature and public key certificate, biometric authentication, and industrial verification.

[0120] The verification result includes successful verification and verification failure; when verification fails: the authentication failure result is returned directly to the user, and the login information is not forwarded to the original business information system.

[0121] Upon successful verification, the user login information and access request are forwarded to the original business information system to obtain the login result. The verification result is then associated with the user's actual login result, and the final login result is returned to the user.

[0122] For example: Low risk + quantum matching, the risk classification result is judged as low risk, the quantum verification result passes, and offline lightweight verification is adopted. In this state, both factors are safe, and the lowest overhead verification is allowed.

[0123] Low risk + quantum mismatch: The risk classification result is judged as low risk, the quantum verification result fails, and manual verification is required. In this state, the quantum layer detects an anomaly, and the risk assessment software misjudged the risk.

[0124] High risk + quantum matching, the risk classification result is judged as high risk, the quantum verification result is passed, and commercial cryptographic equipment is called for full verification. In this state, the software layer is high risk and needs to strengthen verification.

[0125] High risk + quantum mismatch: The risk classification result is high risk, the quantum verification result fails, manual review + biometric secondary authentication. In this state, there is a double anomaly, and the highest security level is activated.

[0126] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0127] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0128] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0129] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A method for identity authentication without modification based on a smart cryptographic key, characterized in that, The method includes the following steps: Step 1: When a user sends an access request, intercept the user access request before it reaches the original business system. Step 2: Based on user access requests, collect user login information and generate random numbers based on the user login information; Step 3: Sign the random number using the smart cryptographic key and extract the public key certificate from the smart cryptographic key; Step 4: Verify the user login information and public key certificate, determine the binding status, and store the information; Binding status includes whether a binding record exists or not: If there is no binding record between the user login information and the public key certificate, then establish and store the binding relationship between the user login information, the public key certificate, and the quantum behavior fingerprint, and use the current quantum behavior fingerprint as the initial quantum behavior benchmark. If a binding record exists, the public key certificate in the request is compared with the storage certificate. If they do not match, the authentication fails directly and no further verification is performed. If they match, quantum behavior fingerprint verification is performed. The coherence between the current quantum behavior fingerprint and the user's historical quantum behavior fingerprint is verified to determine whether it is a legitimate user behavior evolution. Otherwise, a high-risk alarm is triggered. The process of acquiring quantum behavioral fingerprints includes the following steps: When the smart cryptographic key signs a random number, the quantum noise source of its hardware true random number generator is activated simultaneously; Within the time window of the signature operation, the voltage fluctuation sequence of the quantum noise source is continuously acquired; Calculate the fluctuation entropy and autocorrelation decay coefficient based on the voltage fluctuation sequence; The mouse acceleration extreme point sequence and keystroke pressure change rate were extracted from the trajectory entropy value and keystroke features, respectively. The mouse acceleration extreme point sequence and the keystroke pressure change rate are resampled to the same length as the voltage fluctuation sequence to generate a three-channel tensor. The initial values ​​for the chaotic scrambling algorithm are generated using fluctuation entropy and autocorrelation decay coefficient. The chaotic scrambling algorithm is then used to perform confusion calculations on the three-channel tensor to obtain the scrambled tensor. The scrambled tensor is input into a lightweight quantum convolutional encoder for encoding to obtain a quantum behavioral fingerprint. The lightweight quantum convolutional encoder uses a single-layer quantum convolutional kernel, and the weights of the lightweight quantum convolutional encoder are initialized by the device's unique key of the smart cryptographic key. Step 5: Read the public key certificate from the stored results, verify the signature and public key certificate, and determine the authenticity of the logged-in user's identity based on the verification results.

2. The method for identity authentication based on a smart cryptographic key without modification according to claim 1, characterized in that, In step 1, collecting user login information based on user access requests and generating random numbers based on user login information specifically includes the following steps: User login information is input into a pre-trained dynamic grading model to perform dynamic risk perception calculations and obtain predicted risk grading. Different strategies are used to generate random numbers depending on the different risk levels predicted.

3. The method for identity authentication based on a smart cryptographic key without modification according to claim 2, characterized in that, The user login information is input into a pre-trained dynamic classification model to predict risk classification. The specific steps include the following: Extract the request timestamp, mouse movement trajectory of this session, keystroke interval, client IP address, and device fingerprint from the user login information; The requested timestamp is converted into Fourier frequency domain features, and the fluctuation pattern within the preset time slot is extracted to obtain the Fourier feature vector of the current time slot. The client IP address is encoded using the GeoHash algorithm to obtain a geocode, and the device fingerprint is hashed to obtain the device fingerprint hash value. The trajectory entropy value is obtained by analyzing the rate of change of acceleration and the entropy value of trajectory curvature of the mouse movement trajectory in this session; the keystroke interval standard deviation and the ratio of long keystrokes to short keystrokes are analyzed to obtain keystroke characteristics; the trajectory entropy value and keystroke characteristics are combined to obtain behavioral characteristics. A quadruple Bloom filter array is constructed, wherein the first Bloom filter array stores the user's historical low-frequency anomaly type characteristics, the second Bloom filter array stores the historical baseline distribution characteristics, the third Bloom filter array stores the device fingerprint historical trajectory, and the fourth Bloom filter array stores the user's historical behavior baseline pattern. The geocode and device fingerprint hash value are input into the first Bloom filter array to detect the user's historical low-frequency abnormal feature types and obtain the abnormal type label. The Fourier feature vector of the current time slot is input into the second Bloom filter array. The deviation of the Fourier feature vector in the preset time slot from the historical baseline distribution is calculated by using a sliding window to obtain the frequency anomaly index. The geocode and device fingerprint hash value are input into the third Bloom filter array, and the differences in the historical trajectory of the device fingerprint are compared to obtain the device change score; The behavioral features are input into the fourth Bloom filter array, and the difference between the behavioral features and the user's historical behavioral baseline pattern is calculated to obtain the behavioral deviation score. The frequency anomaly index, equipment change score, and behavior deviation score are weighted and combined with the anomaly type label to obtain a predicted risk classification with risk label.

4. The method for identity authentication based on a smart cryptographic key without modification according to claim 3, characterized in that, The specific steps to verify the coherence between the current quantum behavioral fingerprint and the user's historical quantum behavioral fingerprint are as follows: The Hamming distance between the quantum behavior fingerprint and the user's historical quantum behavior fingerprint is calculated, and the Hamming distance is compared with a dynamic threshold. If the Hamming distance is less than or equal to the dynamic threshold, it is judged as a legitimate user behavior evolution; if the Hamming distance is greater than or equal to the dynamic threshold, a high-risk alarm is triggered. The dynamic threshold is calculated based on the fluctuation entropy and autocorrelation decay coefficient obtained in each access request process.

5. The method for identity authentication based on a smart cryptographic key without modification according to claim 4, characterized in that, Step 4, verifying the user login information and public key certificate, specifically includes: The public key certificate is compared with the field of the public key certificate bound to the user in the data storage module. If the field is empty, the binding operation is performed and the data is stored; if the public key certificate field is not empty, it means that the binding has been completed.

6. The method for identity authentication based on a smart cryptographic key without modification according to claim 5, characterized in that, In step 5, the method for verifying the signature and public key certificate is as follows: Based on the predicted risk classification with risk markers and the quantum behavioral fingerprint verification results, different verification methods are selected to verify the signature and public key certificate. The different verification methods include offline lightweight verification of the signature and public key certificate, calling commercial cryptographic devices to perform full verification of the signature and public key certificate, biometric authentication, and industrial verification.

7. The method for identity authentication based on a smart cryptographic key without modification according to claim 6, characterized in that, Step 5: The verification result includes verification success and verification failure; When verification fails: return the authentication failure result directly to the user, and do not forward the login information to the original business information system; Upon successful verification, the user login information and access request are forwarded to the original business information system to obtain the login result. The verification result is then associated with the user's actual login result, and the final login result is returned to the user.

8. A smart password key-based identity authentication system without modification, wherein the system applies the smart password key-based identity authentication method as described in any one of claims 1 to 7, characterized in that, include: Zero modification required for core business modules, smart cryptographic key access modules, commercial cryptographic devices, and data storage modules; The core business modules that require no modification are deployed at the front end of the original business information system, including: a front-end data acquisition submodule, a back-end data verification submodule, and a smart password key invocation module; The front-end data acquisition submodule is used for: When a user sends an access request, the user access request is intercepted before it reaches the original business system, and user login information is collected based on the user access request. The backend data validation submodule is used for: Verify user login information and public key certificate to determine the binding status; The smart password key invocation module is used for: The random number is signed using a smart cryptographic key, and the public key certificate is extracted from the smart cryptographic key. The commercial cryptographic device is used for: Random numbers are generated based on user login information, and signatures and public key certificates are verified. The data storage module is used for: Store the binding relationship between user login information and public key certificates.

Images