Secure authentication service method based on secret key and random algorithm

Abstract

The invention relates to the related technical field of security authentication service, in particular to a security authentication service method based on a secret key and a random algorithm. Specifically, firstly, a client initiates an authentication request to a server, the server generates a public key and a private key after receiving the request, and the public key is distributed to the client; and the client randomly selects a target encryption algorithm from a plurality of preset encryption algorithms, encrypts plaintext information required by authentication by using the target encryption algorithm and the public key to generate ciphertext information, and sends the ciphertext information to the server. The ciphertext information comprises indication information used for indicating a target encryption algorithm category, and the server determines an encryption algorithm according to the indication information and decrypts the ciphertext information by using a private key to obtain plaintext information to complete security authentication. Through the arrangement, the problem of insufficient authentication security in the prior art is solved.

Description

Technical Field

[0001] This application relates to the technical field of security authentication services, specifically to a security authentication service method based on keys and random algorithms. Background Technology

[0002] With the rapid development of internet technology, network services have been widely applied in various fields, and users' needs for data transmission, identity authentication, and access control via the network are increasing daily. However, the openness and complexity of the network environment have also brought many security risks. Traditional security authentication methods usually rely on fixed encryption algorithms and key management mechanisms, which are difficult to effectively cope with increasingly complex network attack methods, such as replay attacks, man-in-the-middle attacks, data tampering, and quantum computing attacks. Summary of the Invention

[0003] In view of this, the embodiments of this application aim to provide a secure authentication service method based on keys and random algorithms to ensure secure authentication under increasingly complex network attack methods.

[0004] This application provides a secure authentication service method based on a key and a random algorithm, applied to the server side. The method includes: Obtain the authentication request initiated by the client, the authentication request including user identity information; A public key and a private key pair are generated using a key generator, and the public key is distributed to the client. Obtain the ciphertext information sent by the client; wherein the ciphertext information is obtained by encrypting plaintext information based on the public key and the target encryption algorithm; The target encryption algorithm is randomly selected from a set of preset encryption algorithms; the ciphertext information includes indication information indicating the category of the target encryption algorithm; the specific indication method of the indication information is predetermined; and the plaintext information is used for authentication. Based on the indicated information, the target encryption algorithm is determined; Based on the target encryption algorithm and the key, the ciphertext information is decrypted to obtain plaintext information; Security authentication services are provided based on the plaintext information.

[0005] In some embodiments, the preset plurality of encryption algorithms includes quantum-resistant encryption algorithms.

[0006] Also includes: The network resolution plugin is distributed to the server based on preset rules; The network parsing plugin includes multiple preset encryption algorithms and specific indication methods for indication information, used to encrypt and decrypt data based on multiple preset encryption algorithms, specific indication methods for indication information, public keys, and private keys.

[0007] In some embodiments, the preset rules include: The network parsing plugin is distributed and updated based on a preset frequency.

[0008] In some embodiments, it further includes: After the security authentication service is passed, the access control certificate is distributed to the server based on the preset rules.

[0009] In some embodiments, it also includes: Obtain task data sent by the client in encrypted form; Based on the task corresponding to the task data, the task data is sent to the corresponding task processing terminal; thus enabling parallel processing of different tasks. Obtain feedback from each task processing terminal regarding the task data; The feedback is sent to the client in an encrypted manner.

[0010] In some embodiments, obtaining the encrypted information sent by the client includes: Obtain the secondary ciphertext information and tag ID sent by the client; The secondary ciphertext information is obtained by the client through secondary encryption of the ciphertext information based on a pre-generated one-time ciphertext; wherein the tag ID corresponds one-to-one with the one-time ciphertext. The client is requested based on the tag ID; Obtain the one-time encrypted string; Based on the one-time encrypted string, the secondary encrypted information is decrypted to obtain the encrypted information.

[0011] This application also provides a secure authentication service method based on a key and a random algorithm, applied to a client, the method including: Send an authentication request to the server, the authentication request including user identity information; Obtain the public key sent by the server, wherein the server, after receiving the user's identity information, generates a pair of public and private keys through a key generator and distributes the public key to the client; Based on the public key and the target encryption algorithm, plaintext information is encrypted to obtain ciphertext information; wherein, the target encryption algorithm is randomly selected from a set of multiple preset encryption algorithms; the ciphertext information includes indication information indicating the category of the target encryption algorithm; the specific indication method of the indication information is predetermined; the plaintext information is used to implement authentication; The encrypted information is sent to the server for the server to perform security authentication services.

[0012] In some embodiments, the preset plurality of encryption algorithms includes quantum-resistant encryption algorithms.

[0013] In some embodiments, it also includes: The network resolution plugin is distributed to the server based on preset rules; The network parsing plugin includes multiple preset encryption algorithms and specific indication methods for indication information, used to encrypt and decrypt data based on multiple preset encryption algorithms, specific indication methods for indication information, public keys, and private keys.

[0014] In some embodiments, sending the encrypted information to the server includes: Generate pairs of tag IDs and one-time encrypted strings; The ciphertext information is encrypted based on the one-time ciphertext to obtain secondary ciphertext information; Send the secondary encrypted information and the tag ID to the preset server; Obtain the secret string request sent by the server, the secret string request being used to request a one-time secret string corresponding to the tag ID; Based on the tag ID in the encrypted string request, the one-time encrypted string is returned so that the server can decode the secondary encrypted information based on the one-time encrypted string to obtain the encrypted information.

[0015] In some embodiments, it also includes: Obtain the distribution permission control certificate distributed by the server; Access control is performed based on the aforementioned access control certificate.

[0016] This application provides a secure authentication service method based on keys and random algorithms. First, it obtains an authentication request initiated by a client, the request including user identity information. Then, it generates a public key and a private key pair using a key generator and distributes the public key to the client. Next, it obtains ciphertext information sent by the client, where the ciphertext information is obtained by encrypting plaintext information based on the public key and a target encryption algorithm. The target encryption algorithm is randomly selected from a set of preset encryption algorithms. The ciphertext information includes indication information indicating the category of the target encryption algorithm; the specific indication method of the indication information is predetermined. The plaintext information is used for authentication. Based on the indication information, the target encryption algorithm is determined. Based on the target encryption algorithm and the private key, the ciphertext information is decrypted to obtain plaintext information. Finally, a secure authentication service is performed based on the plaintext information. This method significantly improves the security and reliability of the network authentication process. By dynamically generating keys and randomly selecting encryption algorithms, each authentication process is unique, effectively preventing attackers from predicting and cracking the system, and greatly enhancing the system's anti-attack capability. Attached Figure Description

[0017] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0018] Figure 1 This is a flowchart illustrating a security authentication service method based on a key and a random algorithm provided in one embodiment of this application.

[0019] Figure 2 This is a flowchart illustrating a security authentication service method based on a key and a random algorithm provided in one embodiment of this application.

[0020] Figure 3 This is a schematic diagram of an electronic device structure provided in one embodiment of this application. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This application provides a secure authentication service method based on key generation and random algorithms, aiming to improve the security, efficiency, and flexibility of network authentication processes. The method begins with the server receiving an authentication request from a client and dynamically generating a public and private key pair using a key generator. The public key is then distributed to the client. The client uses this public key to randomly select a target algorithm from a set of preset encryption algorithms to encrypt the plaintext information required for authentication, generating ciphertext information which is then sent to the server. The ciphertext information includes indication information indicating the type of encryption algorithm used. Upon receiving the ciphertext, the server determines the specific target encryption algorithm based on the indication information and decrypts the ciphertext using the corresponding private key to obtain the plaintext information, thus completing the secure authentication process. Through dynamic key generation and random algorithm selection, this scheme effectively prevents attackers from predicting and cracking the authentication process, significantly improving security. Furthermore, this method supports flexible access control and efficient data processing, simplifies the authentication process, and provides good traceability, making it suitable for security authentication needs in various complex network environments.

[0023] After introducing the basic principles of this application, various non-limiting embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0024] Figure 1 This is a flowchart illustrating a secure authentication service method based on a key and a random algorithm provided in one embodiment of this application. Figure 1 As shown, this method is applied to the server side, and the method is as follows.

[0025] Step S110: Obtain the authentication request initiated by the client, wherein the authentication request includes user identity information; In this step, the server first receives an authentication request from the client. This authentication request contains at least the user's identity information, such as username, user ID, device identifier, or other information that can uniquely identify the user. This user identity information is the foundation for subsequent authentication and access control. An initial communication connection is established between the server and the client, initiating the authentication process.

[0026] Specifically, the client sends an authentication request to the server through an application (such as a web browser or mobile app), typically using the HTTPS protocol to ensure the security of the initial communication.

[0027] Step S120: Generate a pair of public and private keys using a key generator, and distribute the public key to the client; Upon receiving an authentication request from the client, the server invokes a key generator to dynamically generate a public and private key pair. The public key is used for data encryption and can be shared with the client; the private key is used for data decryption and is securely stored by the server, not disclosed to the public. After generating the key pair, the server sends the public key to the client, which then uses it to encrypt data in subsequent communications. This provides the foundation for encrypted data transmission and ensures the confidentiality of data transmission.

[0028] Specifically, the key generator can use standard asymmetric encryption algorithms, such as RSA and ECC (elliptic curve cryptography), and the key length should meet current security standards (such as RSA 2048 bits or more).

[0029] Step S130: Obtain the ciphertext information sent by the client; wherein the ciphertext information is obtained by encrypting plaintext information based on the public key and the target encryption algorithm; The target encryption algorithm is randomly selected from a set of preset encryption algorithms; the ciphertext information includes indication information indicating the category of the target encryption algorithm; the specific indication method of the indication information is predetermined; and the plaintext information is used for authentication. After receiving the public key distributed by the server, the client performs the following operations: Randomly select a target encryption algorithm from a set of preset encryption algorithms; Using the target encryption algorithm and the public key provided by the server, plaintext information (such as user credentials and authentication data) is encrypted to generate ciphertext information; Indicative information is embedded in the ciphertext to identify the category of the target encryption algorithm used; Send the encrypted information to the server.

[0030] The encryption algorithm consists of: plaintext information, which contains the specific data used for authentication, such as user passwords, tokens, and authentication codes; the target encryption algorithm, which is randomly selected from a set of preset encryption algorithms, including symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA and ECC), or quantum-resistant encryption algorithms (such as Lattice-based encryption); and an indication message, which is used by the server to identify the encryption algorithm selected by the client and is typically embedded in the ciphertext header or footer in a specific format.

[0031] Step S140: Determine the target encryption algorithm based on the indication information; After receiving the encrypted information from the client, the server first extracts the indication information. Based on pre-agreed rules (such as a mapping table between indication information and algorithm categories), the server can accurately identify the target encryption algorithm used by the client. This ensures that the server correctly selects the corresponding decryption algorithm, avoiding decryption failure. The indication information can be an algorithm identifier, algorithm number, or a hash value of the algorithm name; the server matches it according to a pre-defined mapping relationship.

[0032] Step S150: Based on the target encryption algorithm and the key, the ciphertext information is decrypted to obtain plaintext information; After determining the target encryption algorithm, the server uses its locally stored private key, combined with the determined target encryption algorithm, to decrypt the ciphertext information and recover the original plaintext information. This process retrieves the original authentication data sent by the client for subsequent authentication. The appropriate decryption algorithm library is then invoked, and the ciphertext is decrypted using the private key; the decryption process must ensure security.

[0033] Step S160: Perform security authentication service based on the plaintext information.

[0034] After successfully decrypting the plaintext information, the server performs authentication and access control operations based on the specific content of the plaintext information (such as user credentials, authentication tokens, etc.): It verifies the validity of the user's identity information, such as checking if the username and password match, and if the token is valid; it determines the user's access permissions based on their identity, and generates and distributes access control certificates (such as Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC); it returns the authentication result (success or failure) to the client. If authentication is successful, a secure communication channel is established, allowing the client to access protected resources. This configuration completes the entire authentication process, ensuring that only legitimate users can access system resources. Combined with the user database, access control system, and audit logs, authentication and permission allocation are completed.

[0035] Through the above six steps, this application realizes a complete process from the client initiating an authentication request to the server completing the authentication. This method, through dynamic key generation, random algorithm selection, encrypted data transmission, and a rigorous authentication mechanism, significantly improves the security, flexibility, and efficiency of the network authentication process. It can effectively resist various network attacks and meet the high security and high performance requirements of modern network services.

[0036] The preset multiple encryption algorithms include quantum-resistant encryption algorithms.

[0037] In this application, "preset multiple encryption algorithms" refers to a set of encryption algorithms pre-configured by the system, from which the client randomly selects one for data encryption each time it authenticates. "Quantum-resistant encryption algorithms" refers to encryption algorithms that can resist attacks from quantum computers, also known as "post-quantum cryptography (PQC) algorithms."

[0038] With the development of quantum computing technology, traditional encryption algorithms (such as RSA and ECC) will no longer be secure in the face of quantum computers. For example, Shor's algorithm can break RSA and ECC in polynomial time; this means that once quantum computers are put into practical use, a large number of existing encryption systems will face serious security threats.

[0039] Therefore, the introduction of quantum-resistant encryption algorithms is to ensure that the technical solution of this application has forward security, maintaining the confidentiality of data and the reliability of authentication even in the era of quantum computing.

[0040] In a preferred embodiment of this application, the preset plurality of encryption algorithms includes at least one quantum-resistant encryption algorithm. The quantum-resistant encryption algorithm can be selected from one or more of the following: lattice-based encryption algorithms, hash-based signature algorithms, encoding theory-based encryption algorithms, multivariate polynomial-based encryption algorithms, or homologous mapping-based encryption algorithms. By introducing a quantum-resistant encryption algorithm, this application can maintain the security of the authentication process and the confidentiality of data even in a quantum computing environment, thereby improving the long-term security and technological foresight of the system.

[0041] In some embodiments, a network resolution plugin is distributed to the server based on preset rules; The network parsing plugin includes multiple preset encryption algorithms and specific indication methods for indication information, used to encrypt and decrypt data based on multiple preset encryption algorithms, specific indication methods for indication information, public keys, and private keys.

[0042] Specifically, the server distributes network resolution plugins to clients based on preset rules. These plugins are executable modules or script components generated and maintained by the server, and are dynamically obtained and loaded by the client before or during the authentication process.

[0043] The network parsing plugin is pre-configured with multiple encryption algorithms, including but not limited to symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA and ECC), and quantum-resistant encryption algorithms (such as Kyber, FrodoKEM, and SPHINCS+). These algorithms constitute an algorithm library, from which the client can randomly select a target encryption algorithm when performing data encryption, thereby achieving dynamic randomization of the encryption algorithm and improving the system's resistance to attacks.

[0044] Furthermore, the plugin defines the specific format or rules for the indication information. This indication information identifies the specific algorithm type used by the client during the encryption process. The indication information can be embedded in the ciphertext as specific fields, identifiers, encoding methods, or data structures, ensuring that the server, upon receiving the ciphertext, can accurately identify and invoke the corresponding decryption algorithm to restore the data.

[0045] By loading this network parsing plugin, the client can encrypt the plaintext information involved in the authentication process based on the encryption algorithm library, instruction information format, public key and private key provided in the plugin, generate ciphertext information and send it to the server; correspondingly, the server can also decrypt and verify the ciphertext information based on the decryption logic and private key defined in the plugin.

[0046] The distribution and updates of plugins are centrally controlled by the server. The server can define plugin distribution rules based on factors such as client type, user permissions, security policies, geographical location, or time period. Plugins can be distributed to clients via secure communication channels (such as HTTPS, VPN, or TLS encrypted channels), ensuring the integrity and confidentiality of the plugins during transmission. After receiving the plugin, the client can perform integrity verification (such as digital signature verification or hash verification) before loading and executing it, preventing plugin tampering or forgery.

[0047] By introducing a network parsing plugin mechanism, this application realizes the dynamic updating and distribution of encryption algorithms, avoiding the security risks caused by fixed algorithms in traditional systems. At the same time, it reduces the development complexity of clients and improves the maintainability, scalability and security of the system.

[0048] In some embodiments, the preset rules include: distributing and updating network parsing plugins based on a preset frequency.

[0049] Specifically, the preset rules include distributing and updating the network parsing plugin based on a preset frequency. The preset frequency can be a fixed time period (e.g., daily, weekly, or monthly) or a dynamically adjusted time interval based on system security policies. The server periodically generates new versions of the plugin according to this frequency and distributes them to clients through a secure communication channel. Upon receiving an update instruction or detecting an expired plugin version, the client automatically downloads and loads the latest version of the plugin to ensure the timeliness and security of the encryption algorithm, instruction information format, and key management mechanism. Through the plugin update mechanism based on a preset frequency, this application can effectively address security risks such as the cracking of encryption algorithms and the reverse engineering of plugins, improving the overall security and adaptability of the system.

[0050] In some embodiments, the method further includes: after the security authentication service is passed, distributing and issuing an access control certificate to the server based on preset rules.

[0051] In some embodiments, after the security authentication service is successful, the server distributes an access control certificate to the client based on preset rules. These preset rules include, but are not limited to, factors such as user role, device type, security level, access time, and geographical location. The access control certificate defines the client's access permissions within the system, such as accessible resources and executable operations. Certificates can be generated and managed using role-based access control (RBAC) or attribute-based access control (ABAC) models. By dynamically distributing access control certificates, this application achieves fine-grained access management and flexible access control, improving system security and maintainability.

[0052] In some embodiments, the method further includes: acquiring task data sent by the client in encrypted form; sending the task data to the corresponding task processing terminal based on the task corresponding to the task data; implementing parallel processing of different tasks; acquiring feedback from each task processing terminal on the task data; and sending the feedback to the client in encrypted form.

[0053] Specifically, in some embodiments, after completing the security authentication service for the client, the server further receives the task data sent by the client in encrypted form. The task data is encrypted by the client using a target encryption algorithm and the server's public key to generate encrypted information, ensuring the confidentiality and integrity of the task data during transmission and preventing the data from being illegally stolen or tampered with.

[0054] After receiving the encrypted task data sent by the client, the server first decrypts the ciphertext using its locally stored private key and the corresponding target encryption algorithm to obtain the original task data. Then, based on the specific content, task type, priority, processor load, or a preset task allocation strategy, the server distributes the task data to one or more corresponding task processing endpoints for parallel processing. These task processing endpoints can be dedicated service modules, microservices, containerized applications, or distributed computing nodes designed to handle specific task types. Each endpoint operates independently and can process multiple tasks simultaneously, significantly improving the system's task processing efficiency and response speed.

[0055] After processing the task data, each task processing terminal generates corresponding processing results or feedback information and returns the feedback information to the server. Upon receiving the feedback information from each task processing terminal, the server can selectively summarize, analyze, or format the feedback information. Subsequently, the server uses the client's public key to encrypt the feedback information, generating ciphertext feedback information to ensure the security of the feedback information during transmission. Finally, the server sends the encrypted feedback information to the client. Upon receiving the ciphertext feedback information, the client uses its stored private key to decrypt it and obtain the original task processing result or feedback information.

[0056] Through the aforementioned mechanisms, this application achieves secure encrypted transmission of task data, parallel distributed processing of tasks, and secure feedback of processing results, significantly improving the overall system performance, data processing efficiency, and security. Simultaneously, this mechanism also enhances the system's ability to handle complex tasks, making it suitable for network service scenarios with high concurrency and high security requirements.

[0057] In some embodiments, obtaining ciphertext information sent by the client includes: obtaining secondary ciphertext information and a tag ID sent by the client; the secondary ciphertext information is obtained by the client encrypting the ciphertext information twice based on a pre-generated one-time cipher string; wherein the tag ID and the one-time cipher string correspond one-to-one; requesting the one-time cipher string from the client based on the tag ID; obtaining the one-time cipher string; and decrypting the secondary ciphertext information based on the one-time cipher string to obtain the ciphertext information.

[0058] In other words, to further enhance the anti-theft and anti-tampering capabilities of data transmission during the authentication process, the process of "obtaining the encrypted information sent by the client" in step S130 can further include a two-way authentication and one-time password enhancement mechanism, specifically including the following steps: The server receives the secondary encrypted information sent by the client and a corresponding tag ID.

[0059] The secondary ciphertext information is generated by the client after generating the ciphertext information required for this authentication, and then performing the following operations: The client pre-generates a one-time random secret locally. This secret has sufficient randomness and length, such as a 32-byte random number.

[0060] The client uses an encryption algorithm (such as the symmetric encryption algorithm AES) to encrypt the previously generated ciphertext information a second time using the one-time cipher string, to obtain the final secondary ciphertext information.

[0061] Simultaneously, the client generates or assigns a unique identifier (e.g., a UUID or an incrementing sequence number) corresponding to this session and the one-time password. The client stores the mapping between the generated one-time password and the identifier in its local secure area.

[0062] After receiving the secondary encrypted information and the tag ID, the server cannot decrypt it directly and must request the "key" needed for decryption from the client. Based on the received tag ID, the server initiates a targeted request to the client, requiring the client to provide a one-time encrypted string that matches the tag ID.

[0063] After receiving a request from the server, the client queries its local storage for the one-time password corresponding to the tag ID. Upon successful query, the client sends the one-time password to the server through a secure, established communication channel (such as the aforementioned authenticated channel). The client can then immediately destroy the mapping between the password and the tag ID in its local storage, ensuring it cannot be reused.

[0064] After receiving the one-time encrypted string returned by the client, the server uses a decryption algorithm that matches the string (i.e., the reverse process of the algorithm used by the client for secondary encryption) to decrypt the secondary encrypted information. The result of this decryption is the ciphertext information initially generated by the client and encrypted with the public key and the target encryption algorithm. Afterward, the server can continue to execute step S140 and subsequent processes, that is, determine the algorithm according to the instruction information and decrypt the ciphertext information with the private key to obtain the final plaintext information.

[0065] This configuration, through the introduction of secondary encryption and a request-based encryption string exchange mechanism, achieves end-to-end bidirectional authentication. Even if the secondary encrypted information and the tag ID are maliciously stolen during transmission, the attacker will fail to decrypt because they cannot receive the encryption string request from the server or cannot provide the correct encryption string. This effectively prevents "man-in-the-middle attacks" and data replay tampering. Furthermore, since the one-time encryption string expires after only one session, it achieves a "one-time key" security effect, greatly enhancing the overall security of the system. This mechanism, combined with the aforementioned dynamic key and random algorithm selection, constitutes a multi-layered and in-depth security authentication and defense system.

[0066] This application also provides a secure authentication service method based on a key and a random algorithm applied to a client, the method including: Step S210: Initiate an authentication request to the server, the authentication request including user identity information; Step S220: Obtain the public key sent by the server, wherein the server, after receiving the user's identity information, generates a pair of public and private keys through a key generator and distributes the public key to the client. After sending an authentication request containing user identity information to the server, the client receives a public key returned by the server. This public key is a pair of public and private keys dynamically generated by the server using a key generator upon receiving the client's authentication request, and is then distributed to the client. The public key is used for subsequent data encryption operations to ensure the confidentiality and security of data during transmission.

[0067] Step S230: Based on the public key and the target encryption algorithm, the plaintext information is encrypted to obtain ciphertext information; wherein, the target encryption algorithm is randomly selected from a set of multiple preset encryption algorithms; the ciphertext information includes indication information for indicating the category of the target encryption algorithm; the specific indication method of the indication information is predetermined; the plaintext information is used to implement authentication. After obtaining the public key distributed by the server, the client randomly selects a target encryption algorithm from a set of preset encryption algorithms. The preset encryption algorithms include, but are not limited to, symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA, ECC), and quantum-resistant encryption algorithms (such as Kyber, FrodoKEM, etc.).

[0068] The client uses the selected target encryption algorithm and the public key provided by the server to encrypt the plaintext information used for authentication (such as user credentials, authentication tokens, etc.) to generate ciphertext information. The ciphertext information also includes indication information indicating the type of the selected target encryption algorithm. The specific format or encoding method of the indication information is pre-agreed upon by the client and the server to ensure that the server can accurately identify the encryption algorithm used by the client.

[0069] Step S240: Send the encrypted information to the server for the server to perform security authentication services.

[0070] After encrypting the data, the client sends the generated ciphertext to the server. Upon receiving the ciphertext, the server identifies the target encryption algorithm used by the client based on the instructions and decrypts the ciphertext using its locally stored private key to obtain the plaintext. Subsequently, the server uses the decrypted plaintext to perform authentication and access control, completing the security authentication service.

[0071] Through the above steps, a secure and reliable identity authentication process is achieved between the client and the server, effectively preventing data from being illegally stolen or tampered with during transmission, and significantly improving the system's security and authentication efficiency.

[0072] In some embodiments, the client may perform integrity verification on the encrypted information (such as adding a digital signature or hash value) before sending it to further enhance the security of data transmission. Furthermore, after receiving the authentication result returned by the server, the client can decide whether to continue subsequent operations, such as accessing protected resources or performing specific tasks, based on the authentication result.

[0073] In some embodiments, the preset plurality of encryption algorithms includes quantum-resistant encryption algorithms.

[0074] The preset multiple encryption algorithms include quantum-resistant encryption algorithms. These quantum-resistant encryption algorithms refer to post-quantum cryptography (PQC) algorithms capable of resisting quantum computing attacks. For example, these quantum-resistant encryption algorithms may include, but are not limited to, one or more of the following: lattice-based encryption algorithms (such as the Kyber algorithm), hash-based signature algorithms (such as the SPHINCS+ algorithm), encoding theory-based encryption algorithms (such as the McEliece algorithm), multivariate polynomial-based encryption algorithms (such as the Rainbow algorithm), or homologous mapping-based encryption algorithms (such as the SIKE algorithm).

[0075] By introducing a quantum-resistant encryption algorithm, this application can effectively address the security threats posed by future quantum computing technology to traditional encryption algorithms, ensuring that the authentication process and data transmission still have high security in a quantum computing environment, thereby improving the long-term security and technological foresight of the system.

[0076] In some embodiments, the method further includes: distributing a network parsing plugin to the server based on preset rules; the network parsing plugin includes preset multiple encryption algorithms, specific indication methods of indication information, and is used to encrypt and decrypt data based on preset multiple encryption algorithms, specific indication methods of indication information, public keys, and private keys.

[0077] This application also includes distributing a network resolution plugin to the client based on preset rules. The network resolution plugin is an executable module or script component generated and maintained by the server, and the client dynamically obtains and loads the plugin before initiating an authentication request or during the authentication process.

[0078] The network parsing plugin is pre-configured with multiple encryption algorithms, including but not limited to symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA and ECC), and quantum-resistant encryption algorithms (such as Kyber, FrodoKEM, and SPHINCS+). These algorithms constitute an algorithm library, from which the client can randomly select a target encryption algorithm when performing data encryption, thereby achieving dynamic randomization of the encryption algorithm and improving the system's resistance to attacks.

[0079] Furthermore, the plugin defines the specific format or rules for the indication information. This indication information is used to identify the specific algorithm type used by the client during the encryption process. The indication information can be embedded in the ciphertext as a specific field, identifier, encoding method, or data structure to ensure that the server can accurately identify the encryption algorithm used by the client after receiving the ciphertext.

[0080] By loading this network parsing plugin, the client can encrypt the plaintext information involved in the authentication process based on the encryption algorithm library, instruction information format, public key and private key provided in the plugin, generate ciphertext information and send it to the server; correspondingly, the server can also decrypt and verify the ciphertext information based on the decryption logic and private key defined in the plugin.

[0081] The distribution and updates of plugins are centrally controlled by the server. The server can define plugin distribution rules based on factors such as client type, user permissions, security policies, geographical location, or time period. Plugins can be distributed to clients via secure communication channels (such as HTTPS, VPN, or TLS encrypted channels), ensuring the integrity and confidentiality of the plugins during transmission. After receiving the plugin, the client can perform integrity verification (such as digital signature verification or hash verification) before loading and executing it, preventing plugin tampering or forgery.

[0082] By introducing a network parsing plugin mechanism, this application realizes the dynamic updating and distribution of encryption algorithms, avoiding the security risks caused by fixed algorithms in traditional systems. At the same time, it reduces the development complexity of clients and improves the maintainability, scalability and security of the system.

[0083] In some embodiments, sending the ciphertext information to a server includes: generating a pair of tag IDs and a one-time cipher string; encrypting the ciphertext information based on the one-time cipher string to obtain secondary ciphertext information; sending the secondary ciphertext information and the tag ID to a preset server; obtaining a cipher string request sent by the server, the cipher string request being used to request a one-time cipher string corresponding to the tag ID; and sending back the one-time cipher string based on the tag ID in the cipher string request, so that the server can decode the secondary ciphertext information based on the one-time cipher string to obtain the ciphertext information.

[0084] Specifically, in order to actively respond to the server's security policy and jointly build a more robust data channel that is resistant to theft and tampering, the process of "sending the encrypted information to the server" in step S240 may further include a secondary encryption and collaborative decryption mechanism initiated by the client, specifically including the following steps: After generating the ciphertext information for authentication, the client does not send it immediately. Instead, it first generates a pair of token IDs and a one-time encryption string locally. The token ID is used to uniquely identify this secondary encryption session, and can be generated using, for example, a UUID (Universally Unique Identifier) ​​or a timestamp-based sequence number. The one-time encryption string is a high-strength random number generated by a cryptographically secure random number generator, specifically used as the secondary encryption key for this data exchange, and it corresponds strictly one-to-one with the token ID.

[0085] Subsequently, the client uses an efficient encryption algorithm (such as the symmetric encryption algorithm AES) to encrypt the generated ciphertext information a second time based on the one-time cipher string, obtaining the secondary ciphertext information. This process protects the original ciphertext information with an additional layer of dynamically generated key.

[0086] After encryption is complete, the client sends the secondary ciphertext information and its corresponding tag ID to the server. At this point, the server receives secondary ciphertext information that cannot be directly deciphered, along with a "credential" (i.e., tag ID) used to request the decryption key.

[0087] After sending the message, the client does not passively wait but listens for the server's response. The client receives a password request from the server, which explicitly includes the previously sent tag ID, intending to retrieve the "key"—the one-time password—that matches that ID.

[0088] Upon receiving the request, the client parses the tag ID and retrieves the unique one-time password corresponding to this ID from its local secure storage. If the query is successful, the client sends the one-time password back to the server through the current secure channel. After this step, the client can immediately or later, according to its policy, destroy the local mapping record between the tag ID and the one-time password to ensure the "one-time" use of the key.

[0089] Once the server obtains the one-time cipher string, it can decode the received secondary ciphertext information to restore the ciphertext information originally generated by the client and encrypted with the public key, and then continue with the subsequent authentication process.

[0090] This configuration, by generating a key locally on the client and performing secondary encryption, separates the critical elements required for decryption (the one-time encrypted string) from the ciphertext data (the secondary ciphertext information) during transmission. This prevents decryption from being completed by any single party intercepting the data. Only through a complete and verified request-response interaction between the server and client can all the decryption elements be gathered, effectively mitigating the risks of data theft and man-in-the-middle tampering during transmission. This not only strengthens data confidentiality but also provides traceable audit trails (identifier IDs) for each authentication interaction, further enhancing the overall security and reliability of the system.

[0091] In some embodiments, the method further includes: obtaining a distribution access control certificate issued by the server; and performing access control based on the access control certificate. This application also includes obtaining a distribution access control certificate issued by the server and performing access control based on the access control certificate. The access control certificate is an important credential used to define and control the client's access permissions in the system, and its content may include, but is not limited to, information such as the scope of resources accessible to the client, the types of operations that can be performed, access time limits, and applicable device types.

[0092] The generation and distribution of the access control certificates are based on preset rules, which can be flexibly configured according to the system's security requirements and business scenarios. For example, preset rules may include user role information (such as administrator, ordinary user, visitor, etc.), device type information (such as mobile device, desktop device, IoT device, etc.), security level information (such as high, medium, and low security levels), geographical location information (such as the user's country, region, or network environment), access time information (such as weekdays, holidays, specific time periods, etc.), or user behavior information (such as the user's historical access records, risk assessment results, etc.).

[0093] Access control certificates can be generated using either a role-based access control (RBAC) model or an attribute-based access control (ABAC) model. In the RBAC model, access control certificates assign permissions based on the user's role; in the ABAC model, access control certificates make dynamic permission decisions based on multi-dimensional information such as user attributes, environmental conditions, and resource attributes.

[0094] The distribution of access control certificates is conducted through a secure communication channel to ensure the confidentiality and integrity of the certificates during transmission. Upon receiving the access control certificate, the client stores it in a local secure storage area (such as a secure chip or trusted execution environment) and includes the certificate in subsequent access requests for server-side authorization verification and access control.

[0095] By dynamically distributing access control certificates, this application achieves fine-grained access management and flexible access control policies, effectively preventing unauthorized access after authentication and improving the overall security and maintainability of the system. At the same time, the use of access control certificates facilitates the auditing and tracing of user access behavior, meeting security compliance requirements.

[0096] The specific implementation of the security authentication service method based on key and random algorithm applied to the client can refer to the specific implementation of the security authentication service method based on key and random algorithm applied to the server. The two are a set of security authentication service methods that correspond to each other. For details not disclosed in the embodiments of the security authentication service method based on key and random algorithm applied to the client in this application, please refer to the embodiments of the security authentication service method based on key and random algorithm applied to the client in this application.

[0097] In summary, the specific implementation method of the solution provided in this application is as follows: First, use a key generator to generate a public-key pair for service authentication and data encryption. Standard key generators such as RSA and ECDSA can be used. The key length should be long enough to ensure security. Key storage and protection are also crucial, as key leakage can lead to data breaches and unauthorized access.

[0098] Distribute keys to client applications (including apps and web applications) and embed API request methods to provide access data authentication and pairing.

[0099] A network parsing plugin is integrated into client applications (including apps and web applications) to provide a mechanism for parsing and validating network service data. This plugin primarily parses network request data and sends it to the appropriate service. During the parsing process, the network parsing plugin can validate the data to ensure its accuracy and integrity. Network parsing plugins are typically implemented using standard or custom protocols.

[0100] The client program requests the server's authentication service (an authentication and authorization mechanism for network client registration services). The service uses a public-key pair to authenticate the user and issues an access control certificate upon successful authentication. The authorization certificate can be either Role-Based Access Control (RBAC) or Policy-Based Access Control (ABAC), chosen according to actual needs. The authentication service then issues and registers permissions to the client service.

[0101] The authentication service involves the following steps: First, the client application requests authentication using its username and password. The authentication service then calls a random algorithm set service. This service randomly selects a large number of random algorithms, labels their sequences, and stores them on the authentication server. The authentication server then generates corresponding key sequences based on these random algorithms, forming algorithm-key pairs to ensure data traceability. Keys are randomly distributed with each client request, ensuring random key allocation, random data encryption, and security against attacks and theft. The client encrypts subsequent request data using a key and a network micro-plugin, and sums the data according to a given algorithm before sending the encrypted data to the server. The server then inputs the data into an encryption / decryption module to transform and restore the network request and response data. During data transmission, all data is converted to encrypted data in this module. In the decryption module, the data is restored to its original state. It is crucial that the encryption and decryption processes be sufficiently secure to ensure that the data is not eavesdropped on or tampered with.

[0102] The server also provides a data input and verification service, a mechanism for verifying and validating network request data. During data transmission, this service verifies and validates the data to ensure its accuracy and integrity. This service ensures data traceability and data integrity.

[0103] Simultaneously, during data interaction, data passes through an intermediate layer distributed orchestration registrar. This mechanism orchestrates and distributes data based on service tags to register request services. This service improves data processing efficiency and mitigates network latency. It can be implemented using containerization technologies such as Docker and Kubernetes.

[0104] Below, for reference Figure 3 This describes an electronic device according to embodiments of the present application. Figure 3 A block diagram of an electronic device according to an embodiment of this application is illustrated.

[0105] like Figure 3 As shown, the electronic device 300 includes one or more processors 310 and memory 320.

[0106] The processor 310 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 300 to perform desired functions.

[0107] The memory 320 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 310 may execute the program instructions to implement the key-based and random algorithm-based secure authentication service methods and / or other desired functions described in the various embodiments of this application above. Various contents, such as category correspondences, may also be stored in the computer-readable storage medium.

[0108] In one example, the electronic device 300 may also include an input device 330 and an output device 340, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0109] In addition, the input device 330 may also include, for example, a keyboard, mouse, interface, etc. The output device 340 can output various information to the outside, including analysis results, etc. The output device 340 may include, for example, a display, speaker, printer, and communication network and its connected remote output devices, etc.

[0110] Of course, for the sake of simplicity, Figure 3 Only some of the components of the electronic device relevant to this application are shown in this illustration; components such as buses, input / output interfaces, etc., are omitted. In addition, the electronic device may include any other suitable components depending on the specific application.

[0111] In addition to the methods and devices described above, embodiments of this application may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps of the key-based and random algorithm-based security authentication service method according to various embodiments of this application as described in the "Exemplary Methods" section above.

[0112] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0113] Furthermore, embodiments of this application may also be computer-readable storage media storing computer program instructions that, when executed by a processor, cause the processor to perform the steps of the key-based and random algorithm-based security authentication service method according to various embodiments of this application as described in the "Exemplary Methods" section above.

[0114] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0115] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A secure authentication service method based on a key and a random algorithm, characterized in that, Applied to the server side, the methods include: Obtain the authentication request initiated by the client, the authentication request including user identity information; A public key and a private key pair are generated using a key generator, and the public key is distributed to the client. Obtain the ciphertext information sent by the client; wherein the ciphertext information is obtained by encrypting plaintext information based on the public key and the target encryption algorithm; The target encryption algorithm is randomly selected from a set of preset encryption algorithms; the ciphertext information includes indication information indicating the category of the target encryption algorithm; the specific indication method of the indication information is predetermined; and the plaintext information is used for authentication. Based on the indicated information, the target encryption algorithm is determined; Based on the target encryption algorithm and the key, the ciphertext information is decrypted to obtain plaintext information; Security authentication services are provided based on the plaintext information.

2. The secure authentication service method based on key and random algorithm according to claim 1, characterized in that, The preset multiple encryption algorithms include quantum-resistant encryption algorithms.

3. The secure authentication service method based on key and random algorithm according to claim 1, characterized in that, Also includes: The network resolution plugin is distributed to the server based on preset rules; The network parsing plugin includes multiple preset encryption algorithms and specific indication methods for indication information, used to encrypt and decrypt data based on multiple preset encryption algorithms, specific indication methods for indication information, public keys, and private keys.

4. The secure authentication service method based on key and random algorithm according to claim 1, characterized in that, The preset rules include: The network parsing plugin is distributed and updated based on a preset frequency.

5. The secure authentication service method based on key and random algorithm according to claim 1, characterized in that, Also includes: After the security authentication service is passed, the access control certificate is distributed to the server based on the preset rules.

6. The secure authentication service method based on key and random algorithm according to claim 1, characterized in that, Also includes: Obtain task data sent by the client in encrypted form; Based on the task corresponding to the task data, the task data is sent to the corresponding task processing terminal; To achieve parallel processing of different tasks; Obtain feedback from each task processing terminal regarding the task data; The feedback is sent to the client in an encrypted manner.

7. The secure authentication service method based on key and random algorithm according to claim 1, characterized in that, Obtain the encrypted information sent by the client, including: Obtain the secondary ciphertext information and tag ID sent by the client; The secondary ciphertext information is obtained by the client through secondary encryption of the ciphertext information based on a pre-generated one-time ciphertext; wherein the tag ID corresponds one-to-one with the one-time ciphertext. The client is requested based on the tag ID; Obtain the one-time encrypted string; Based on the one-time encrypted string, the secondary encrypted information is decrypted to obtain the encrypted information.

8. A secure authentication service method based on a key and a random algorithm, characterized in that, Applied to the client side, the methods include: Send an authentication request to the server, the authentication request including user identity information; Obtain the public key sent by the server, wherein the server, after receiving the user's identity information, generates a pair of public and private keys through a key generator and distributes the public key to the client; Based on the public key and the target encryption algorithm, plaintext information is encrypted to obtain ciphertext information; wherein, the target encryption algorithm is randomly selected from a set of multiple preset encryption algorithms; the ciphertext information includes indication information indicating the category of the target encryption algorithm; the specific indication method of the indication information is predetermined; the plaintext information is used to implement authentication; The encrypted information is sent to the server for the server to perform security authentication services.

9. The secure authentication service method based on key and random algorithm according to claim 8, characterized in that, Sending the encrypted information to the server includes: Generate pairs of tag IDs and one-time encrypted strings; The ciphertext information is encrypted based on the one-time ciphertext to obtain secondary ciphertext information; Send the secondary encrypted information and the tag ID to the preset server; Obtain the secret string request sent by the server, the secret string request being used to request a one-time secret string corresponding to the tag ID; Based on the tag ID in the encrypted string request, the one-time encrypted string is returned so that the server can decode the secondary encrypted information based on the one-time encrypted string to obtain the encrypted information.

10. The secure authentication service method based on key and random algorithm according to claim 8, characterized in that, Also includes: Obtain the distribution permission control certificate distributed by the server; Access control is performed based on the aforementioned access control certificate.

Images