A Kerberos identity authentication system and authentication method based on SM9 and biometric fuzzy extraction

Abstract

The application belongs to the technical field of network security, and relates to a Kerberos identity authentication system and method based on SM9 and biological feature fuzzy extraction. The system comprises: a biological feature key generation module for extracting a stable cryptographic key from the biological feature of a user; an SM9 digital identity management module for identity management based on the cryptographic key; a Kerberos protocol enhancement module for enhancing the security of the Kerberos protocol; and a security fusing and management module for monitoring the authentication process and executing a fusing mechanism. The application embeds the SM9 digital signature of a timestamp in a Kerberos authentication request, and takes the signature verification as a precondition for ticket issuance, so that it is difficult for an attacker to forge valid authentication credentials.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to a Kerberos identity authentication system and method based on SM9 and fuzzy extraction of biometric features. Background Technology

[0002] Identity authentication, as a fundamental core mechanism for ensuring system security in a network environment, directly affects the overall security of information systems. Current mainstream identity authentication technologies include Public Key Infrastructure (PKI), Remote User Dial-up Authentication System (RADIUS), and Open Authorization Protocol (OAuth 2.0), but all of these technologies have significant limitations: PKI relies on complex certificate lifecycle management, leading to high maintenance costs and low efficiency; the RADIUS protocol is vulnerable to man-in-the-middle attacks due to security design flaws in the interaction process; and OAuth 2.0 carries the risk of token leakage and permission abuse, making it difficult to meet the needs of high-security scenarios.

[0003] Against this backdrop, the Kerberos protocol, with its efficiency and compatibility in cross-domain authentication scenarios, has become one of the core standards for network authentication. It is widely integrated into mainstream operating systems such as Windows, Linux, and Mac, and is used in authentication services across various fields, including enterprise intranets and distributed systems. However, the Kerberos protocol still faces key security challenges in practical applications: when user terminals are maliciously compromised, attackers can steal sensitive information such as user passwords and static keys through methods such as memory reading, and then forge authentication tickets to launch attacks, posing a serious threat to the security of the entire authentication system. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and propose a Kerberos identity authentication system and method based on SM9 and fuzzy extraction of biometric features.

[0005] In a first aspect, the present invention provides a Kerberos authentication system based on SM9 and fuzzy biometric extraction, comprising: Biometric key generation module: used to extract stable cryptographic keys from the user's biometrics; includes a biometric acquisition unit, a preprocessing unit, a stable bit extraction unit, and a key generation unit; SM9 Digital Identity Management Module: Identity management based on cryptographic keys; includes a distributed identifier generation unit, a key generation center, and an identity credential management unit; Kerberos Protocol Enhancement Module: Used to enhance the security of the Kerberos protocol; includes an identity registration unit, an authentication request processing unit, and a ticket issuance unit; Security Circuit Breaker and Management Module: Used to monitor the authentication process and execute the circuit breaker mechanism; includes a behavior monitoring unit, a circuit breaker decision unit, and a recovery unit.

[0006] Furthermore, the preprocessing unit first maps the feature values ​​to the [0,1] interval, calculates the minimum and maximum values ​​of n samples for each feature dimension j (j=1,2,…,128), and then performs normalization processing to obtain a normalized feature matrix.

[0007] Furthermore, the stable bit extraction unit first calculates the mode of n samples, then performs a stability score, and then constructs a stable bit sequence based on the stability score.

[0008] Furthermore, the key generation unit generates a stable bit sequence. The bio_key biokey that meets the length requirement is generated. At the same time, the key generation unit uses error correction coding to generate auxiliary data. The auxiliary data Used for recovering the bio_key bio key.

[0009] Furthermore, the bio_key biokey generation formula is as follows: (10) in: For biometric keys; -256 is a cryptographic hash function; This is the raw input for cryptography.

[0010] Furthermore, the distributed identifier generation unit combines the user ID with the biometric key and generates a decentralized identifier (DID) through computation; the key generation center uses identity-based SM9 cryptography to generate the system master key pair and the user's SM9 private key, and the user's SM9 private key generates a private key based on the DID. .

[0011] Furthermore, the user's SM9 private key generates a private key based on the DID. The algorithm is as follows: (18) in: The key generation center algorithm; DID stands for decentralized identity identifier; Master private key; This is a hash function.

[0012] Furthermore, the identity credential management unit aggregates user identity information to form a digital credential file, and verifies the correctness of the biometric key by comparing the key hash value: ; (19) Where: SHA256(.) is the SHA-256 hash algorithm; bio_key′ is the bio key to be verified; key_hash is the pre-stored hash value of the valid key after being hashed by SHA-256.

[0013] Furthermore, the behavior monitoring unit records all authentication operations to the database in real time; the circuit breaker decision unit automatically triggers the circuit breaker mechanism when it detects consecutive authentication failures; the recovery unit forces the user to re-execute the complete registration process, creating a completely new identity binding record by re-collecting biometric features and generating new biometric keys and SM9 key pairs.

[0014] Secondly, this invention also discloses an authentication method for a Kerberos identity authentication system based on SM9 and fuzzy biometric extraction, including a registration and authentication process, such as... Figure 1 As shown; The registration process includes: A1: The biometric module extracts the biometric key by acquiring multiple temporary biometric samples; A1.1: The biometric acquisition unit acquires the user's face image through the dlib library, extracts a 128-dimensional feature vector, and forms a temporary biometric template. A1.2: The preprocessing unit uses the Min-Max normalization method to standardize multiple feature samples: (twenty two) A1.3: The stable bit extraction unit calculates the statistical stability of each feature bit: (twenty three) Bits with stability higher than the threshold of 0.8 are selected, and the final value is determined through a majority voting mechanism. A1.4: The key generation unit converts the stable bit sequence into a 256-bit biometric key. (twenty four) Then, auxiliary data σ is generated using RS error correction codes.

[0015] A2: The SM9 digital identity management module generates digital identity credentials based on biometric keys; A2.1: Distributed identifier generation unit generates decentralized identifiers: A2.2: KGC generates SM9 signing private key sk_s based on DID. A2.3: The identity credential management unit aggregates user identity information to form a digital identity credential file, which includes: user_id, DID, key_hash = SHA256 (bio_key), SM9 private key sk_s, and SM9 master public key mpk_s.

[0016] A3: The Kerberos protocol enhancement module registers with the server. A3.1 The client uses the SM9 private key to sign the registration message: (25) A3.2 Sends a registration request to the Kerberos server, including a signature and the original message.

[0017] A4: After the server verifies the signature and timestamp, it creates an identity binding record to complete the registration; A4.1: Server verifies SM9 signature validity: (26) A4.2: Verify timestamp freshness (30-minute tolerance) A4.3: Create an identity binding record containing the following fields: user_id (primary key), DID, bio_key_hash, public_key (SM9 master public key), registered_at, sm9_failures (initially 0), and is_blocked (initially false).

[0018] The authentication process includes: B1: The biometrics module acquires new biometrics and recovers the same biometric key using auxiliary data; B1.1 Collect new biometric samples B′ B1.2 Recover the biometric key using auxiliary data σ via the recovery algorithm Rep: (26) B1.3 Verify whether the recovered key hash value matches the key_hash stored during registration. B2: The SM9 digital identity management module reconstructs private keys based on biometric keys; B2.1 DID is re-derived from the recovered bio_key′; B2.2 Reconstructing the SM9 signature private key sk_s′ based on DID (completed in a TEE secure environment); B3: The Kerberos protocol enhancement module generates an authentication request; B3.1 Use sk_s′ to perform SM9 signing on authentication messages containing timestamps: (27) B3.2 Sends an authentication request to the server, including the signature and the original message; B4: The server verifies the validity of the SM9 signature and timestamp and issues an ST service ticket to provide the service.

[0019] B4.1 Query user records and check the is_blocked status; B4.2 Verify the signature using the stored public key mpk_s: (28) B4.3 Verify timestamp freshness (30-minute tolerance); B4.4 If verification fails: increment the sm9_failures counter; trigger the circuit breaker mechanism when consecutive failures reach the threshold; mark the user's status as is_blocked=true; delete all active sessions and valid tickets; force the user to re-execute the complete registration process. B4.5 If the verification is successful: Generate a random session key (session_key), create a TGT ticket (using standard Kerberos format), return the TGT and session_key to the client, the client uses the TGT to request a service ticket (ST), and after obtaining the ST, access the target service to complete the entire process.

[0020] Compared with the prior art, the present invention has the following beneficial effects: This invention integrates biometric feature fuzzy extraction technology and the national cryptographic SM9 algorithm with the Kerberos protocol. It eliminates privacy risks through non-storage-based biometric key conversion (only storing public auxiliary information, not the biometric template), and uses the SM9 algorithm for signature blocking of document forgery paths, achieving protocol-level hardening in compliance with national cryptographic standards. This solution has the following characteristics: I. Effective Defense Against Ticket Forgery and Replay Attacks. This invention patent embeds an SM9 digital signature based on a Windows system timestamp into the Kerberos authentication request and uses signature verification as a prerequisite for ticket issuance, making it difficult for attackers to forge valid authentication credentials. The server-side rigorous verification of timestamp validity (30-minute tolerance) effectively prevents replay attacks on authentication requests, resolving the ticket forgery security threat faced by the traditional Kerberos protocol.

[0021] II. Effectively addresses the risk of static key leakage. Biometric keys are dynamically generated using fuzzy biometric extraction technology. Each authentication generates new key material based on real-time biometrics, eliminating the need to store any form of static key in the system. Even if the terminal device is compromised, attackers cannot obtain long-term valid key information, thus eliminating the risk of key leakage.

[0022] III. Protecting Biometric Privacy and Security. Employing a non-storage-based biometric processing method, the system only stores publicly available auxiliary data that cannot be used to reconstruct biometrics. The original biometric template is discarded immediately after key generation and never leaves the user's device, eliminating the permanent risk of biometric information leakage.

[0023] IV. This invention patent provides a secure, privacy-preserving, and compliant identity authentication system by integrating biometric fuzzy extraction technology, the national cryptographic SM9 algorithm, and the Kerberos protocol. The core innovation of this invention lies in its use of non-storage biometric processing (only storing publicly available auxiliary data that cannot reconstruct biometric features), dynamically generating biometric keys, and combining this with the SM9 digital signature mechanism. This effectively solves the security problems faced by the traditional Kerberos protocol, such as document forgery, static key leakage, and biometric privacy leakage. The system further enhances its ability to defend against replay attacks and brute-force attacks through strict timestamp verification (30-minute tolerance) and a circuit breaker mechanism. This invention patent is suitable for distributed network environments with high security requirements, such as financial, government, and enterprise intranets, complies with national cryptographic algorithm standards, and has significant security and practical advantages. Attached Figure Description

[0024] The accompanying drawings are incorporated in and form part of this specification, and together with the description serve to explain the principles of the invention.

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a detailed schematic diagram of the process of the present invention; Figure 3 This is a system architecture diagram of the present invention. Detailed Implementation

[0027] Exemplary embodiments will be described in detail below. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples consistent with some aspects of the invention as detailed in the appended claims.

[0028] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0029] Example In a first aspect, the present invention provides a Kerberos authentication system based on SM9 and fuzzy biometric extraction, comprising: Biometric key generation module: used to extract stable cryptographic keys from the user's biometrics; includes a biometric acquisition unit, a preprocessing unit, a stable bit extraction unit, and a key generation unit; SM9 Digital Identity Management Module: Identity management based on cryptographic keys; includes a distributed identifier generation unit, a key generation center, and an identity credential management unit; Kerberos Protocol Enhancement Module: Used to enhance the security of the Kerberos protocol; includes an identity registration unit, an authentication request processing unit, and a ticket issuance unit; Security Circuit Breaker and Management Module: Used to monitor the authentication process and execute the circuit breaker mechanism; includes a behavior monitoring unit, a circuit breaker decision unit, and a recovery unit.

[0030] Specifically, the biometric key generation module's biometric acquisition unit uses the dlib library to acquire 10 face images in real time and extract 128-dimensional feature vectors. (1) in The j-th dimension of the feature vector of the i-th image is ( ).

[0031] The temporary biometric template is: (2) Template T is only temporarily stored in memory and is destroyed immediately after the key is generated, without retaining any original biometric information.

[0032] Furthermore, the preprocessing unit first maps the feature values ​​to the [0,1] interval, calculates the minimum and maximum values ​​of n samples for each feature dimension j (j=1,2,…,128), and then performs normalization processing to obtain a normalized feature matrix.

[0033] Specifically, the preprocessing unit uses the Min-Max normalization method to standardize the feature samples, eliminating dimensional differences and mapping the feature values ​​to the [0,1] interval, for each feature dimension. Calculate the minimum and maximum values ​​for 10 samples: (3) (4) Normalize the j-th dimension feature of the i-th image: (5) in To prevent division by zero errors involving extremely small positive numbers, the normalized characteristic matrix is: (6) Furthermore, the stable bit extraction unit first calculates the mode of n samples, then performs a stability score, and then constructs a stable bit sequence based on the stability score.

[0034] Specifically, the stable bit extraction unit extracts each feature bit. Perform a majority vote and calculate the mode of the 10 samples: (7) in For the majority voting function, output the most frequent bit value (0 or 1), and calculate the consistency ratio of that bit with the majority voting result to score stability: (8) in This is the Kronecker function. Here, it checks if the sample bits and the majority vote bits are equal, and based on the stability score, retains bits higher than 0.8 to form a stable bit sequence. (9) in It is length The binary sequence, where L is the number of bits that meet the stability requirements.

[0035] Furthermore, the key generation unit generates a stable bit sequence. The bio_key biokey that meets the length requirement is generated. At the same time, the key generation unit uses error correction coding to generate auxiliary data. The auxiliary data Used for recovering the bio_key bio key.

[0036] Furthermore, the bio_key biokey generation formula is as follows: (10) in: For biometric keys; -256 is a cryptographic hash function; This is the raw input for cryptography.

[0037] In summary, the key generation unit stabilizes the bit sequence. A fixed-length cryptographic key is generated as shown in equation (10), where With a length of 256 bits, it meets the requirements for cryptographic key length. Thus, we have obtained... The biometric key generation unit also uses Reed-Solomon (RS) error correction coding (RS error correction code codeword length n=255 bytes, information bits k=191 bytes, error correction capability t=32 bytes) to generate auxiliary data. First, the biometric key Convert to a 32-byte string M and pad it to 191 bytes: (11) in Generate length is The padding bytes, then... Considered as the domain of Galois The polynomial coefficients on the polynomial are used to generate codewords. : (12) in The RS encoding function outputs a 255-byte codeword containing information bits and parity bits, followed by auxiliary data. extract: (13) Auxiliary data It does not contain original biometric information and is only used for key recovery, realizing "non-storage processing". In subsequent key recovery, the newly acquired biometrics are processed by the first three units to obtain a noisy stable bit sequence: (14) Using auxiliary data and recovery algorithm Recover biometric key: (15) During the recovery process, RS decoding combines the noisy sequence B' with auxiliary data. Inputting the RS decoder can correct 32-byte errors (i.e., an error of 32 bytes is permissible) and recover the original stable bit sequence. and using the recovered original stable bit sequence Generate recovery key Additionally, to ensure the recovery key matches the original key after key deletion, the original key will be compared. key_hash: (16) To ensure the accuracy of the recovery, the biometric key generation module has achieved a complete conversion process from noisy biometrics to an attack-resistant key through a collaborative mechanism of fuzzy extraction and error correction coding. Its non-storage design (retaining only auxiliary data σ and hash digest key_hash) fundamentally avoids the risk of biometric leakage. At the same time, the error correction capability of RS code (32 bytes) ensures the reliability of key recovery, providing a secure and reliable cryptographic foundation for the subsequent key derivation of the SM9 digital identity management module and the enhancement of the Kerberos protocol.

[0038] Furthermore, the distributed identifier generation unit combines the user ID with the biometric key and generates a decentralized identifier (DID) through computation; the key generation center uses identity-based SM9 cryptography to generate the system master key pair and the user's SM9 private key, and the user's SM9 private key generates a private key based on the DID. .

[0039] Specifically, the distributed identifier generation unit combines the user ID with the biometric key and generates a decentralized identifier (DID) with the format did:sm9:<user_id> : <hash>The specific algorithm is as follows: (17) in, This indicates a concatenation operation; BLAKE2b outputs a length of 64 bytes to ensure collision resistance (collision probability is less than 100%). The unit has a built-in verification mechanism to check the uniqueness of the DID and automatically regenerate it if it is duplicated.

[0040] Furthermore, the user's SM9 private key generates a private key based on the DID. The algorithm is as follows: (18) in: The key generation center algorithm; DID stands for decentralized identity identifier; Master private key; This is a hash function.

[0041] Specifically, the Key Generation Center (KGC) uses identity-based SM9 cryptography to generate the system's master key pair (master public key). Master private key The user's SM9 private key and the user's SM9 private key are used to generate a private key derived from the DID. The algorithm is shown in Equation (18). All KGC operations are performed in a trusted execution environment to ensure the security of the master private key.

[0042] Furthermore, the identity credential management unit aggregates user identity information to form a digital credential file, and verifies the correctness of the biometric key by comparing the key hash value: ; (19) Where: SHA256(.) is the SHA-256 hash algorithm; bio_key′ is the bio key to be verified; key_hash is the pre-stored hash value of the valid key after being hashed by SHA-256.

[0043] Specifically, the identity credential management unit aggregates user identity information to form a digital credential file containing fields such as user ID, DID, biometric key hash value (key_hash), SM9 private key, master public key, etc., which are stored in JSON format for easy access by various modules and units. During the authentication recovery process, the unit verifies the correctness of the biometric key by comparing the key hash value (key_hash). The verification conditions are shown in equation (19).

[0044] Furthermore, the behavior monitoring unit records all authentication operations to the database in real time; the circuit breaker decision unit automatically triggers the circuit breaker mechanism when it detects consecutive authentication failures; the recovery unit forces the user to re-execute the complete registration process, creating a completely new identity binding record by re-collecting biometric features and generating new biometric keys and SM9 key pairs.

[0045] Furthermore, in the Kerberos protocol enhancement module, the identity registration unit handles the initial user registration request. The client uses the SM9 private key (sk_s) to sign the registration message, and the message format is: (20) The signature algorithm is as follows: (twenty one) The server verifies the validity of the SM9 signature and timestamp, and increments the failure counter when verification fails. The authentication request processing unit adds an SM9 signature verification step before the standard Kerberos AS-REQ process, using SM9 digital signatures to completely replace the traditional password hash verification method, fundamentally blocking the path of ticket forgery. After the ticket issuance unit passes SM9 verification, it continues to execute the standard Kerberos ticket issuance process, fully preserving the original ticket format and encryption method, ensuring complete compatibility with existing Kerberos clients and servers.

[0046] On the other hand, the present invention provides an authentication method based on any of the above-mentioned Kerberos identity authentication systems based on SM9 and biometric fuzzy extraction, including a registration and authentication process: like Figure 2 , Figure 3 As shown: First, the registration process covers steps one through three, aiming to establish user identity binding.

[0047] Secondly, the authentication process includes steps four through six, focusing on service access and security monitoring.

[0048] Because the system deeply integrates biometric fuzzy extraction, the national cryptographic SM9 algorithm, and the Kerberos protocol, it can effectively solve problems related to static key leakage, ticket forgery, and biometric privacy. If an anomaly occurs during implementation, a circuit breaker mechanism ensures system security.

[0049] Step 1: Biometric Key Generation: This step is executed on the client side by the biometric key generation module. Through the collaborative work of the biometric acquisition unit, preprocessing unit, stable bit extraction unit, and key generation unit, it aims to extract a stable cryptographic key from the user's biometrics. The user acquires a face image through the biometric acquisition client, uses the dlib library to detect the face and extract a 128-dimensional feature vector, forming a temporary template stored in memory. This template is discarded immediately after processing to prevent privacy leaks. To ensure key reliability, the preprocessing unit uses the Min-Max normalization method to standardize the feature samples, eliminating dimensional differences. The stable bit extraction unit calculates the stability of each bit, filters bits with a threshold of 0.8 or higher, and determines the final value through majority voting. The key generation unit converts the stable sequence into a 256-bit biometric key (bio_key) and uses the SHA-256 hash algorithm and Reed-Solomon error-correcting encoding (255 bytes code length, 32 bytes error correction capability) to generate auxiliary data σ. If acquisition or processing fails, it automatically retryes up to three times; if a key generation conflict occurs, it triggers a client-side circuit breaker, requiring a retry. At the end of this step, the biometric key and auxiliary data have been securely stored, laying the foundation for subsequent identity management.

[0050] Step Two: SM9 DID and Key Distribution: This step is executed collaboratively by the SM9 Digital Identity Management Module on both the client and server sides. Digital identity generation is achieved through a distributed identifier generation unit, a key generation center (KGC), and an identity credential management unit. The distributed identifier generation unit generates a decentralized identifier (DID) based on a biometric key, in the format did:sm9:<user_id> : <hash>It uses SHA-256 and BLAKE2b hash operations to ensure uniqueness and collision resistance. Because KGC uses identity-based cryptography, it is responsible for generating the system's master key pair (master public key). and the master private key The system generates a digital identity credential file (JSON format) and derives the SM9 signing private key sk_s based on the DID. The identity credential management unit aggregates information such as user ID, DID, biometric key hash value, SM9 private key, and master public key to form a digital identity credential file, which is securely stored in a Trusted Execution Environment (TEE). If a DID generation conflict occurs, it automatically retryes; if the KGC is unresponsive, it switches to a backup server to ensure availability. At the end of this step, the digital identity credential is ready, providing the foundation for Kerberos registration.

[0051] Step 3: Kerberos Server Registration: This step is executed collaboratively by the Kerberos protocol enhancement module on both the client and server sides, handling initial user registration through the identity registration unit. The client signs the registration message using the SM9 private key. The message includes the user ID, DID, and current timestamp. The signature formula is as follows: Then, a request is sent to the Kerberos server. The server verifies the validity of the SM9 signature using the master public key. Verification is performed, and the timestamp freshness is checked (with a 30-minute tolerance). Because the timestamp is based on NTP synchronization, it can defend against replay attacks. If verification is successful, an identity binding record is created in the database, including fields such as user_id, DID, and bio_key_hash; if verification fails, an error message is returned and the failure counter is incremented. Three consecutive failures trigger an account-level circuit breaker. At the end of this step, the user's identity has been registered on the server side, and the authentication process is enabled.

[0052] Step Four: Authentication Recovery and TGT Acquisition: This step is executed collaboratively by the Kerberos protocol enhancement module and the security circuit breaker and management module on the client, server, and Ticket Granting Service (TGS). TGT acquisition is achieved through the authentication request processing unit and the ticket issuance unit. The client collects a new biometric sample, uses auxiliary data σ to recover the biometric key using the recovery algorithm Rep, and verifies hash matching. Because the Rep algorithm is based on RS error correction codes, it can correct 32-byte errors, thus handling biometric discrepancies. Subsequently, the client reconstructs the SM9 private key from the recovered key. And sign the authentication message, the message format is as follows: The client sends a request to the server. The server queries the user record, verifies the signature and timestamp. If successful, it generates a random session key and a TGT ticket (using standard Kerberos format) and returns it to the client. If it fails, it increments the failure counter, triggering a circuit breaker after three consecutive failures. This process involves three interactions: the client initiates the request, the server verifies and issues the TGT, and the TGS participates in subsequent ticket processing to ensure authentication security. At the end of this step, the client has obtained the TGT and is ready to request a service ticket.

[0053] Step 5: Service Ticket (ST) Issuance: This step is executed collaboratively by the Kerberos protocol enhancement module on the client, server, and application server sides, and the ST is obtained through the ticket issuance unit. The client uses the TGT to request a service ticket (ST) from the TGS, specifying the target service name. After verifying the validity and authenticity of the TGT, the TGS generates a service session key and an ST ticket, which are encrypted with the target service key. Because the ST contains the user ID and service session key, access permissions can be precisely controlled. The server returns the ST to the client, completing the ticket issuance. If the TGT expires or is invalid, the session is terminated, requiring re-authentication. This process emphasizes the interaction between the three parties: the client requests the ST, the TGS verifies and issues it, and the application server prepares to receive the request. At the end of this step, the ST has been issued, and the client can access the service.

[0054] Step Six: Service Provision and Circuit Breaker Management: This step is executed on both the client and application server sides by the Kerberos protocol enhancement module and the security circuit breaker and management module. Service access and monitoring are achieved through the ticket verification unit and behavior monitoring unit. The client accesses the target service (such as a REST API) carrying the ST and service session key, including X-Service-Ticket and X-Session-Key in the HTTP header. The application server verifies the validity of the ST, decrypts it, and checks the session key match. If the verification passes, the business resource is returned; if the ST is invalid or permissions are insufficient, an access circuit breaker or permission circuit breaker is triggered, an audit log is recorded, and an alarm is issued. The security circuit breaker and management module monitors the operation in real time and triggers a circuit breaker based on rules (such as three consecutive failures), forcing the user to re-register. Because the system supports manual intervention, administrators can execute circuit breakers through the management interface to ensure security. At the end of this step, service access is complete, and the circuit breaker mechanism is ready to handle exceptions.

[0055] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention.

[0056] It should be understood that the present invention is not limited to the content already described above, and various modifications and changes can be made without departing from its scope. The scope of the present invention is limited only by the appended claims.< / hash> < / hash>

Claims

1. A Kerberos authentication system based on SM9 and fuzzy biometric extraction, characterized in that, include: Biometric key generation module: used to extract stable cryptographic keys from the user's biometrics; It includes a biometric acquisition unit, a preprocessing unit, a stable bit extraction unit, and a key generation unit; SM9 Digital Identity Management Module: Identity management based on cryptographic keys; includes a distributed identifier generation unit, a key generation center, and an identity credential management unit; Kerberos Protocol Enhancement Module: Used to enhance the security of the Kerberos protocol; includes an identity registration unit, an authentication request processing unit, and a ticket issuance unit; Security Circuit Breaker and Management Module: Used to monitor the authentication process and execute the circuit breaker mechanism; includes a behavior monitoring unit, a circuit breaker decision unit, and a recovery unit; The preprocessing unit first maps the feature values ​​to the [0,1] interval, calculates the minimum and maximum values ​​of n samples for each feature dimension j (j=1,2,…,128), and then performs normalization processing to obtain a normalized feature matrix; The stable bit extraction unit first calculates the mode of n samples, then performs a stability score, and then constructs a stable bit sequence based on the stability score. The distributed identifier generation unit combines the user ID with the biometric key and generates a decentralized identifier (DID) through computation. The key generation center uses identity-based SM9 cryptography to generate the system master key pair and the user's SM9 private key. The user's SM9 private key generates a private key based on the DID. ; The user's SM9 private key is generated based on the DID. The algorithm is as follows: （18） in: The key generation center algorithm; DID stands for decentralized identity identifier; H is the master private key; H is the hash function. The behavior monitoring unit records all authentication operations to the database in real time; the circuit breaker decision unit automatically triggers the circuit breaker mechanism when it detects consecutive authentication failures; the recovery unit forces the user to re-execute the complete registration process, and creates a brand new identity binding record by re-collecting biometric features and generating a new biometric key and SM9 key pair. Initial user registration is handled by an identity registration unit. The client signs the registration message using its SM9 private key. The message includes the user ID, DID, and current timestamp, and then sends a request to the Kerberos server. The server verifies the validity of the SM9 signature using the master public key mpk. s Perform verification and check the freshness of the timestamp; if verification is successful, create an identity binding record in the database. TGT acquisition is achieved through the authentication request processing unit and the ticket issuance unit. The client collects a new biometric sample, uses auxiliary data σ to recover the biometric key through the recovery algorithm Rep, and verifies the hash match. Subsequently, the client reconstructs the SM9 private key from the recovered key. The client signs the authentication message and sends a request to the server. The server queries the user record, verifies the signature and timestamp, and if successful, generates a random session key and TGT ticket, and returns them to the client.

2. The Kerberos authentication system based on SM9 and fuzzy biometric extraction according to claim 1, characterized in that, The key generation unit is a stable bit sequence A bio_key biometric key that meets the length requirement is generated. Simultaneously, the key generation unit uses error correction coding to generate auxiliary data. Used for recovering the bio_key bio key.

3. The Kerberos authentication system based on SM9 and fuzzy biometric extraction according to claim 2, characterized in that, The formula for generating the bio_key bio-key is: （10） in: The key is the biometric key; SHA-256 is the cryptographic hash function. This is the raw input for cryptography.

4. The Kerberos authentication system based on SM9 and fuzzy biometric extraction according to claim 1, characterized in that, The identity credential management unit aggregates user identity information to form digital credential files and verifies the correctness of biometric keys by comparing key hash values. Verification conditions: (19) Where: SHA256(.) is the SHA-256 hash algorithm; bio_key′ is the bio key to be verified; key_hash is the pre-stored hash value of the valid key after being hashed by SHA-256.

5. The authentication method based on the Kerberos identity authentication system based on SM9 and fuzzy biometric extraction as described in any one of claims 1 to 4, characterized in that, This includes the registration and authentication process; The registration process includes: A1: The biometric module extracts the biometric key by acquiring multiple temporary biometric samples; A2: The SM9 digital identity management module generates digital identity credentials based on biometric keys; A3: The Kerberos protocol enhancement module registers with the server. A4: After the server verifies the signature and timestamp, it creates an identity binding record to complete the registration; The authentication process includes: B1: The biometrics module acquires new biometrics and recovers the same biometric key using auxiliary data; B2: The SM9 digital identity management module reconstructs private keys based on biometric keys; B3: The Kerberos protocol enhancement module generates an authentication request; B4: The server verifies the validity of the SM9 signature and timestamp and issues an ST service ticket to provide the service.

Images