Multi-server bidirectional authentication and key negotiation method based on intelligent password key

Abstract

The invention discloses a multi-server bidirectional authentication and key negotiation method based on an intelligent password key, which relates to the field of network security, and comprises the following steps: a registration center carries out system initialization and generates and issues related system parameters; a user and a server respectively register in a registration center, and the registration center generates and distributes secret information for authentication; after the user logs in the verification password, login request information is generated and sent to the server; the server encrypts the login request information and the generated authentication information and forwards the login request information and the generated authentication information to a registration center; the registration center verifies identities of the user and the server, generates and distributes an encrypted authentication response message, and triggers bidirectional authentication between the server and the user; and the user negotiates with the server to generate a consistent session key. According to the invention, multi-server bidirectional strong authentication based on the intelligent password key and session key negotiation with forward security are realized, and the communication security is ensured while the identity authentication reliability is improved.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically to a method for multi-server two-way authentication and key negotiation based on smart cryptographic keys. Background Technology

[0002] In distributed information systems in key areas such as e-government, finance, and healthcare, multi-server architecture has become the mainstream model to support diverse services. Users need to securely access multiple different service nodes, requiring the system to have reliable identity authentication and key negotiation mechanisms to ensure the legitimacy of access permissions and the confidentiality of communication content.

[0003] Currently, many authentication schemes in multi-server environments still rely primarily on the traditional username-password single-factor authentication method. This method has inherent risks. User passwords are usually easy to remember and have low entropy values, making them vulnerable to offline dictionary guessing or brute-force attacks. At the same time, passwords may be leaked due to poor management when transmitted over the network or stored on the server. Once a password is compromised, attackers can impersonate legitimate users to access all authorized services, causing serious security vulnerabilities.

[0004] Furthermore, some existing multi-server authentication schemes have shortcomings in session key negotiation and management. Some schemes pre-set shared long-term keys for different servers or use simple key derivation mechanisms based on timestamps, which brings complexity to key management and may create single point of failure risks. More importantly, such schemes often lack strict forward security guarantees: if the system master key or long-term key is leaked in the future, attackers can decrypt all past communication records, resulting in the loss of historical data. At the same time, if the key negotiation process is not strongly bound to identity authentication, it may also be vulnerable to man-in-the-middle attacks.

[0005] Furthermore, existing solutions are inadequate in resisting common active attacks. For example, they lack effective mechanisms to deal with replay attacks, where attackers may illegally gain access by intercepting and repeatedly sending legitimate authentication messages. If the solution fails to achieve two-way authentication between the user and the server, the server's identity may be impersonated, leading to the user leaking sensitive information to a malicious server. At the same time, solutions that achieve strong security often come with high computational and communication overhead, making it difficult to achieve a balance between security and efficiency in resource-constrained mobile smart devices and large-scale distributed environments.

[0006] Therefore, how to design a multi-server two-way authentication and key negotiation method based on smart cryptographic keys that can effectively resist network attacks such as replay and spoofing is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of this, the present invention provides a multi-server two-way authentication and key negotiation method based on smart cryptographic keys, which aims to solve the security and management problems faced by user identity authentication in multi-server environments, enabling legitimate users to securely access multiple services with a single smart cryptographic key, and achieving mutual trusted verification between users and servers in the process. At the same time, an independent encrypted channel is established for each session negotiation to prevent security threats such as identity impersonation, data theft, and replay.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: A method for multi-server two-way authentication and key negotiation based on smart cryptographic keys includes the following steps: S1. The registration center initializes the system, generates and publishes relevant system parameters; S2. The user and the server register with the registry center, which generates and distributes secret information for authentication. S3. When a user logs in, after verifying the password using the smart password key, a login request message is generated and sent to the server. S4. The server encrypts the login request information and the generated authentication information and forwards them to the registration center; S5. After verifying the identities of the user and the server, the registration center generates and distributes an encrypted authentication response message, triggering two-way authentication between the server and the user. S6. The user and the server negotiate and generate a consistent session key based on the parameters exchanged during the authentication process.

[0009] Preferably, S1 includes: The registry center (RC) selects a large prime number N and selects a group. The generator g is selected as a random number. As the system master key, calculate the system public key. ; RC selects symmetric encryption / decryption algorithm and and cryptographic hash function and publish system parameter sets. , This indicates the key used for encryption and decryption.

[0010] Preferably, in step S2, the user registering with the registration center includes: user Select Identity and password Send via secure channel { } to RC; After receiving the request, the RC calculates the user's secret value. ,based on Calculate the verification value and protection value ; RC will The system parameter set is stored in the smart password key, and the smart password key is sent to the user through a secure channel. .

[0011] Preferably, in step S2, the server registers with the registration center, including: server Select Identity Send via secure channel To RC; After receiving the request, RC calculates the server secret value. via secure channel Send to server storage. Preferably, S3 includes: user Enter identity identifier and password Smart password key calculation and utilize storage Restore temporary value ,calculate and verify Is it equal to the stored value? If they are not equal, the process will terminate. After successful verification, generate random numbers. Calculate the temporary public key and the first intermediate key Get the current timestamp T and calculate the verification code. It is generated by encryption using the first intermediate key W. ; to server Send login request message .

[0012] Preferably, S4 includes: server receive Then, verify the validity of the timestamp T; After successful verification, generate random numbers. Calculate the temporary public key ; through stored secret values Encryption generation ; Authentication request message Forwarded to RC.

[0013] Preferably, in step S5, generating and distributing the encrypted authentication response message includes: RC received authentication request message Then, verify the validity of the timestamp T; After verification, calculate Decryption ; Calculate the second intermediate key Decryption ;calculate ,verify Is it equal to the decrypted result? ; After successful verification, calculate the session key material. ; pass Encryption, constructing messages sent to users ; by using Encryption, constructing the message to be sent to the server ; RC will Send to server .

[0014] Preferably, in step S5, triggering the completion of two-way authentication between the server and the user includes: server Received message Then, use the stored Decrypt, obtain Verify the decrypted With its own identity Are they consistent? After verification, Forward to users .

[0015] Preferably, in step S5, triggering the completion of two-way authentication between the server and the user further includes: user Received message Then, recovered through the smart password key Decrypt to obtain ,verify The identifier entered this time Whether they are consistent, and Is it consistent with the locally generated value R? After verification, calculate ,verify Is it equal to the decrypted result? ; After successful verification, calculate the session key. and calculation confirmation message Send to server .

[0016] Preferably, S6 includes: server Received message Then, calculate Verify whether it is equal to ; After successful verification, calculate the session key. Complete with users Two-way authentication and key negotiation, among which, .

[0017] As can be seen from the above technical solution, compared with the prior art, the technical solution of the present invention has the following beneficial effects: 1) This method combines the user's password with the secret information stored in the smart password key to verify the password's validity locally. During the remote authentication process, the registration center uses the system master key it holds to independently calculate and verify the secret information submitted by the user and the server, effectively preventing identity theft caused by single factor leakage and improving the reliability of the identity authentication process and its resistance to spoofing attacks.

[0018] 2) It supports unified and convenient access and scalable session key negotiation in a multi-server environment. Users only need to register once with a unified registration center. With the same smart password key and password, they can access multiple different service servers through a standardized login and authentication process. During the authentication process, the user and the server each generate a one-time random number. With the assistance of the registration center, a unique key for each session is negotiated based on the discrete logarithm problem, providing an independent, secure and scalable key establishment mechanism for different service sessions.

[0019] 3) It provides forward security with two-way authentication and anti-replay attack protection. By verifying the timestamp through the registration center and encrypting and decrypting one-time random parameters, the freshness of messages is ensured and replay attacks can be resisted. At the same time, the generation of session keys depends on the sum of random numbers generated temporarily for each session and discarded after use. Even if the system's long-term master key is leaked in the future, it will be impossible to deduce the past session keys, thus ensuring forward security of communication and ultimately completing two-way identity verification between users and service servers. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 A flowchart of a multi-server two-way authentication and key negotiation method based on a smart cryptographic key is provided in this embodiment of the invention; Figure 2 This is a framework diagram of a two-way authentication and key negotiation system in a multi-server environment provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] like Figure 1 As shown, this embodiment provides a multi-server two-way authentication and key negotiation method based on smart cryptographic keys, including the following steps: S1. The registration center initializes the system, generates and publishes relevant system parameters; S2. The user and the server register with the registry center, which generates and distributes secret information for authentication. S3. When a user logs in, after verifying the password using the smart password key, a login request message is generated and sent to the server. S4. The server encrypts the login request information and the generated authentication information and forwards them to the registration center; S5. After verifying the identities of the user and the server, the registration center generates and distributes an encrypted authentication response message, triggering two-way authentication between the server and the user. S6. The user and the server negotiate and generate a consistent session key based on the parameters exchanged during the authentication process.

[0024] like Figure 2 As shown, this method is an authentication scheme for smart device users in a multi-server system environment. Without loss of generality, a single server acts as the registration center. m distributed service servers (j=1, 2, ..., m) and n users (i=1, 2, ..., n), where, Several different access services or application services can be provided. Users can access distributed service servers connected to the Internet using their smart devices (such as mobile phones and computers) via cellular networks or wireless LANs. All security authentication and key negotiation between entities are carried out within this framework.

[0025] The above scheme effectively safeguards identity authentication security and communication privacy in a multi-server environment. It achieves strong two-factor authentication by combining smart password keys and passwords, uses a centralized verification mechanism in the registration center to ensure the authenticity of the user and server identities, and generates a session key with forward security based on a one-time random number negotiation. Thus, while providing a unified and convenient access experience, it resists network attacks such as spoofing and replay attacks.

[0026] The following provides a further detailed explanation of each step and related features in the above method; In this embodiment, S1, the registration center performs system initialization, generates and publishes relevant system parameters, including: The registry center (RC) selects a large prime number N and selects a group. The generator g is selected as a random number. As the system master key, calculate the system public key. ; RC selects symmetric encryption / decryption algorithm and and cryptographic hash function and publish system parameter sets. , This indicates the key used for encryption and decryption.

[0027] This step aims to build the basic cryptographic environment. The large prime number N chosen by the registry center (RC) defines the finite multiplication group on which the scheme's operations are based. The generator g ensures that the group is a cyclic group, which is a prerequisite for the security of ElGamal-like cryptosystems; the random number s serves as the system master key, the root of trust for the entire scheme, from which the public key is derived. The specified symmetric encryption algorithm will be publicly disclosed for subsequent key negotiation. and password hash function It is the core tool in the solution for achieving privacy protection, integrity verification and key derivation. All parameters released at this stage constitute the common security foundation of the entire multi-server system.

[0028] In this embodiment S2, the user and the server register with the registration center, and the registration center generates and distributes secret information for authentication. User registration with the registration center includes: user Select Identity and password Send via secure channel { } to RC; After receiving the request, the RC calculates the user's secret value. ,based on Calculate the verification value and protection value ; RC will The system parameter set is stored in the smart password key, and the smart password key is sent to the user through a secure channel. The smart password key here is a hardware device with storage, calculation and encryption functions, used to securely store relevant parameters and perform password verification and parameter calculation.

[0029] Furthermore, the server's registration with the registry center includes: server Select Identity Send via secure channel To RC; After receiving the request, RC calculates the server secret value. via secure channel Send to server storage. During user registration, RC uses the master key s and the user's identity. Generate a unique secret value for each user through hash calculation. Then, With user password Re-hash to generate verification value This ensures a strong binding between the smart password key, password, and user identity, while protecting the value. The construction allows for unknown In this case, the secret can be securely recovered locally using a password; the server registration process is similar, with RC for each server. Generate a secret value that is shared only by it and RC. All confidential information is distributed through secure channels, ensuring the secure establishment of initial trust.

[0030] In this embodiment, S3, when a user logs in, after verifying the password using the smart password key, a login request message is generated and sent to the server; including: user Enter identity identifier and password Smart password key calculation and utilize storage Restore temporary value ,calculate and verify Is it equal to the stored value? If they are not equal, the process will terminate. After successful verification, generate random numbers. Calculate the temporary public key and the first intermediate key Get the current timestamp T and calculate the verification code. It is generated by encryption using the first intermediate key W. ; to server Send login request message .

[0031] This step completes local verification of two-factor authentication on the user's end and initiates the authentication session. After the user enters their identity and password, the smart password key is calculated and compared. With storage The system verifies the validity of the password and smart card; after successful verification, a one-time random number is generated. Calculate the temporary public key R for this session, the intermediate key W used to encrypt login information, the timestamp T, and the server identity. Included in CAPTCHA The calculation, and together with the identity, are encrypted using W to form... This ensures the freshness, directionality, and confidentiality of login requests, effectively resisting replay and eavesdropping.

[0032] In this embodiment, S4, the server encrypts the login request information and the generated authentication information, and then forwards them to the registration center; including: server receive Next, the validity of the timestamp T is verified; in this embodiment, the validity verification of the timestamp is to verify whether the difference between the current time and the timestamp T is within the preset allowed time window. After successful verification, generate random numbers. Calculate the temporary public key ; through stored secret values Encryption generation ; Authentication request message Forwarded to RC; In this embodiment, random numbers a and b are respectively generated by the user. and server It is generated independently and used only in a single login authentication session to ensure the forward security of the session key sk.

[0033] In this phase, the server acts as a trusted relay and active participant. First, it verifies the timestamp of the login request to combat replay attacks. Then, the server independently generates its own one-time random number 'b' and calculates a temporary public key 'V', providing crucial forward security for subsequent session key negotiation. The server uses its long-term key shared with the RC. Encrypt the user's temporary public key R and its own temporary public key V into... This allows the user login request to be securely packaged with the user's own authentication contribution and submitted to the RC for centralized verification.

[0034] In this embodiment, S5, after the registration center verifies the identities of the user and the server, it generates and distributes an encrypted authentication response message, triggering two-way authentication between the server and the user. The generated and distributed encrypted authentication response messages include: RC received authentication request message Then, verify the validity of the timestamp T; After verification, calculate Decryption ; Calculate the second intermediate key Decryption ;calculate ,verify Is it equal to the decrypted result? ; After successful verification, calculate the session key material. ; pass Encryption, constructing messages sent to users ; by using Encryption, constructing the message to be sent to the server ; RC will Send to server .

[0035] Furthermore, triggering two-way authentication between the server and the user includes: server Received message Then, use the stored Decrypt, obtain Verify the decrypted With its own identity Are they consistent? After verification, Forward to users .

[0036] Furthermore, triggering two-way authentication between the server and the user also includes: user Received message Then, recovered through the smart password key Decrypt to obtain ,verify The identifier entered this time Whether they are consistent, and Is it consistent with the locally generated value R? After verification, calculate ,verify Is it equal to the decrypted result? ; After successful verification, calculate the session key. and calculation confirmation message Send to server .

[0037] In this step, the RC plays a central role as a trusted third-party arbitrator, using the system master key s to decrypt the data from the server. , restore and This allows for the calculation of an intermediate key that matches the user's key. and decrypt To obtain user identity and verification code; through independent calculation The RC then compares and verifies the identities of both the user and the server; upon successful verification, the RC generates temporary session verification material. The message is constructed by encrypting the user's secret and the server's secret respectively. and , Nested The design allows RC to securely transmit user-specific authentication information through the server. This is transmitted back, thereby triggering subsequent direct two-way authentication between the user and the server.

[0038] In embodiment S6, the user and server negotiate and generate a consistent session key based on the parameters exchanged during the authentication process; including: server Received message Then, calculate Verify whether it is equal to ; After successful verification, calculate the session key. Complete with users Two-way authentication and key negotiation, among which, .

[0039] Server decryption After verifying their identity, Forwarded to the user, the user decrypts it. Then, by verifying it and The message confirms that it indeed comes from a trusted RC and is specific to this session; calculations and comparisons are then performed. With the received The authentication of the server was completed. Finally, both parties calculated the temporary public key used in the previous exchange. Server computing According to the principle of key exchange, the two are equal. This allows a unique, forward-secure session key sk to be negotiated without transmitting the key itself. The final confirmation message 3M3 sent by the user provides the server with proof that the session key negotiation was successful.

[0040] It also includes the password update step: user Enter the original password into the smart key and new password After the smart password key verifies that the original password is correct, it calculates a new verification value. and new protection values ; use and Update the stored value in the smart password key; This password update step is initiated locally by the user and is independent of the remote authentication process. It does not require the online participation of the registry center, providing a convenient capability for periodic password security maintenance.

[0041] This embodiment provides a multi-server two-way authentication and key negotiation method based on smart cryptographic keys. It is uniformly managed by a registration center and combines the hardware security features of smart cryptographic keys with user passwords to build a two-factor authentication foundation. By using the ElGamal public key system and one-time random numbers, it achieves two-way trusted verification between users and servers while negotiating a session key with forward security. It effectively solves the problems of unified identity authentication, resistance to replay and spoofing attacks, and secure key distribution in multi-server environments, and is better suited for scenarios requiring high-security remote access, such as e-government, finance, and healthcare.

[0042] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0043] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for multi-server two-way authentication and key negotiation based on smart cryptographic keys, characterized in that, Includes the following steps: S1. The registration center initializes the system and generates and publishes relevant system parameters; S2. The user and the server register with the registry center, which generates and distributes secret information for authentication. S3. When a user logs in, after verifying the password using the smart password key, a login request message is generated and sent to the server. S4. The server encrypts the login request information and the generated authentication information and forwards them to the registration center; S5. After verifying the identities of the user and the server, the registration center generates and distributes an encrypted authentication response message, triggering two-way authentication between the server and the user. S6. The user and the server negotiate and generate a consistent session key based on the parameters exchanged during the authentication process.

2. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, S1 includes: The registry center (RC) selects a large prime number N and selects a group. The generator g is selected as a random number. As the system master key, calculate the system public key. ; RC selects symmetric encryption / decryption algorithm and and cryptographic hash function and publish system parameter sets. , This indicates the key used for encryption and decryption.

3. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, In step S2, user registration with the registration center includes: user Select Identity and password Send via secure channel { } to RC; After receiving the request, the RC calculates the user's secret value. ,based on Calculate the verification value and protection value ; RC will The system parameter set is stored in the smart password key, and the smart password key is sent to the user through a secure channel. .

4. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, In step S2, the server registers with the registration center, including: server Select Identity Send via secure channel To RC; After receiving the request, RC calculates the server secret value. via secure channel Send to server storage.

5. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, S3 includes: user Enter identity identifier and password Smart password key calculation and utilize storage Restore temporary value ,calculate and verify Is it equal to the stored value? If they are not equal, the process will terminate. After successful verification, generate random numbers. Calculate the temporary public key and the first intermediate key Get the current timestamp T and calculate the verification code. It is generated by encryption using the first intermediate key W. ; to server Send login request message .

6. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, S4 includes: server receive Then, verify the validity of the timestamp T; After successful verification, generate random numbers. Calculate the temporary public key ; through stored secret values Encryption generation ; Authentication request message Forwarded to RC.

7. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, In step S5, generating and distributing the encrypted authentication response message includes: RC received authentication request message Then, verify the validity of the timestamp T; After verification, calculate Decryption ; Calculate the second intermediate key Decryption ;calculate ,verify Is it equal to the decrypted result? ; After successful verification, calculate the session key material. ; pass Encryption, constructing messages sent to users ; by using Encryption, constructing the message to be sent to the server ; RC will Send to server .

8. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, In S5, triggering the two-way authentication between the server and the user includes: server Received message Then, use the stored Decrypt, obtain Verify the decrypted With its own identity Are they consistent? After verification, Forward to users .

9. The method for multi-server two-way authentication and key negotiation based on smart cryptographic keys according to claim 1, characterized in that, In S5, triggering the two-way authentication between the server and the user also includes: user Received message Then, recovered through the smart password key Decrypt to obtain ,verify The identifier entered this time Whether they are consistent, and Is it consistent with the locally generated value R? After verification, calculate ,verify Is it equal to the decrypted result? ; After successful verification, calculate the session key. and calculation confirmation message Send to server .

10. A multi-server two-way authentication and key negotiation method based on a smart cryptographic key according to claim 1, characterized in that, S6 includes: server Received message Then, calculate Verify whether it is equal to ; After successful verification, calculate the session key. Complete with users Two-way authentication and key negotiation, among which, .

Images