Login authentication method and system, terminal, server and medium

Abstract

The application discloses a login authentication method, a terminal, a server, a login authentication system and a computer readable storage medium. The method comprises the following steps: obtaining a first key index, a device identifier of an encryption device of the terminal, a user account and an application identifier; determining a first target key in the encryption device according to the first key index and the device identifier; encrypting the device identifier, the user account and the application identifier according to the first target key to determine a first authentication code; and assembling the device identifier, the user account, the application identifier, the first key index and the first authentication code into a first satellite short message and sending the first satellite short message to the server for login authentication. In this way, one-time pad can be realized, quantum computing cracking can be resisted, the security of satellite communication can be improved, the data required for authentication can be compressed into a single satellite short message, the satellite channel interaction can be reduced, the delay and communication cost can be reduced, and the stable transmission of the authentication request in a scenario where a ground network cannot be covered can be ensured.

Description

Technical Field

[0001] This application relates to the field of satellite communication technology, and in particular to a login authentication method, terminal, server, login authentication system, and computer-readable storage medium. Background Technology

[0002] Mobile communication satellite systems provide network access in areas such as oceans, deserts, mountains, and emergency disaster relief sites where terrestrial networks are unavailable or disabled. However, when satellite communication terminals attempt secure login in environments without terrestrial networks, the satellite communication keys are at risk of leakage, are vulnerable to quantum computing attacks, and have low security. Furthermore, the authentication protocol data is large and unsuitable for satellite SMS channels. Therefore, there is an urgent need for an authentication method capable of secure authentication within the length of a single satellite SMS message. Summary of the Invention

[0003] This application provides a login authentication method, a terminal, a server, a login authentication system, and a computer-readable storage medium.

[0004] This application provides a login authentication method for a terminal, the method comprising: Obtain the first key index, the device identifier of the encryption device of the terminal, the user account, and the application identifier; A first target key is determined in the encryption device based on the first key index and the device identifier; Based on the first target key, the device identifier, the user account, and the application identifier are encrypted to determine the first authentication code; The device identifier, the user account, the application identifier, the first key index, and the first authentication code are assembled into a first satellite SMS message, which is sent to the server for login authentication.

[0005] Thus, by generating a random first key index, a first target key can be obtained. This key is then used to encrypt the device identifier, user account, and application identifier in the encryption device, generating a first authentication code. This achieves one-time pad encryption, resisting quantum computing attacks and improving the security of satellite communication. Furthermore, by assembling the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message, the data required for authentication can be compressed into a single satellite SMS message, eliminating the need for fragmented transmission, reducing satellite channel interaction, and lowering latency and communication costs. Compared to methods using larger authentication protocol data volumes, the implementation method of this application utilizes a satellite SMS channel, ensuring stable transmission of authentication requests even in scenarios where terrestrial networks cannot provide coverage, thereby ensuring the security and reliability of login authentication.

[0006] In some implementations, determining the first target key in the encryption device based on the first key index and the device identifier includes: Based on the first preset key index-key ciphertext mapping relationship, the first key ciphertext is determined according to the first key index; Based on the target private key corresponding to the device identifier, the first key ciphertext is decrypted to determine the first target key.

[0007] Thus, based on the first preset key index-key ciphertext mapping relationship, the first key ciphertext is determined according to the first key index; based on the target private key corresponding to the device identifier, the first key ciphertext is decrypted to determine the first target key. In this way, the key is stored in ciphertext form in the encryption device, and the target private key is uniquely bound to the device identifier. The decryption process based on the target private key is also completed within the encryption device, ensuring that the plaintext key is not leaked, preventing the key from being stolen or tampered with, achieving one-time key authentication, resisting replay attacks and quantum computing attacks, and ensuring the security and reliability of subsequent login authentication based on satellite communication.

[0008] In some implementations, the step of encrypting the device identifier, the user account, and the application identifier based on the first target key to determine the first authentication code includes: The device identifier, the user account, and the application identifier are concatenated to determine the first authentication plaintext; Based on the encryption device, the first authentication plaintext is encrypted according to the first target key to determine the first authentication code.

[0009] In this way, the device identifier, user account, and application identifier are concatenated to determine the first authentication plaintext. Based on the encryption device and the first target key, the first authentication plaintext is encrypted to determine the first authentication code. By concatenating and encrypting the device identifier, user account, and application identifier, the first authentication code can be uniquely bound to the terminal, user, and application, eliminating identity impersonation and forgery at the source. Furthermore, since the encryption process is completed within the encryption device, it ensures that the first target key is not leaked, thereby resisting data eavesdropping and tampering attacks and ensuring the security and reliability of subsequent login authentication based on satellite communication.

[0010] In some implementations, assembling the device identifier, the user account, the application identifier, the first key index, and the first authentication code into a first satellite SMS message and sending it to the server includes: Based on preset assembly rules, the device identifier, the user account, the application identifier, the first key index, and the first authentication code are assembled to determine the first satellite SMS message; The first satellite SMS message is sent to the server.

[0011] Thus, based on preset assembly rules, the device identifier, user account, application identifier, first key index, and first authentication code are assembled to determine the first satellite SMS message; the first satellite SMS message is then sent to the server. In this way, the first satellite SMS message adapts to the satellite SMS message length limit, allowing the information required for authentication to be transmitted without fragmentation, thereby reducing the latency and cost of satellite communication to some extent.

[0012] This application provides a login authentication method for a server, the method comprising: The receiving terminal receives a second satellite SMS message, wherein the second satellite SMS message includes a device identifier, a user account, an application identifier, a second key index, and a second authentication code; Based on the second preset key index-key ciphertext mapping relationship, the second target key is determined from the quantum key management platform of the server according to the second key index and the device identifier; In the quantum key management platform, the device identifier, the user account, and the application identifier are encrypted based on the second target key to determine the third authentication code; Login authentication is performed based on the second authentication code and the third authentication code.

[0013] Thus, the receiving terminal receives a second satellite SMS message, which includes a device identifier, user account, application identifier, second key index, and second authentication code. Based on the second preset key index-key ciphertext mapping relationship, a second target key is determined from the server's quantum key management platform according to the second key index and the device identifier. In the quantum key management platform, the device identifier, user account, and application identifier are encrypted according to the second target key to determine a third authentication code. Login authentication is performed based on the second and third authentication codes. In this way, based on the second preset key index-key ciphertext mapping relationship, the second target key can be determined from the server's quantum key management platform according to the device identifier and the second key index, ensuring that the second target key used by the server is consistent with the terminal's first target key, avoiding authentication failure due to key inconsistency. Furthermore, since the received second satellite SMS message from the terminal includes the device identifier, user account, application identifier, second key index, and second authentication code, the entire verification logic can be completed with only one SMS reception, eliminating the need for multiple interactions with the terminal. This reduces the impact of high satellite latency to a certain extent, improving authentication efficiency and stability.

[0014] In some implementations, the login authentication based on the second authentication code and the third authentication code includes: If the second authentication code and the third authentication code match, the login authentication is successful, and a third satellite SMS message is sent to the terminal, wherein the third satellite SMS message includes the target access token and the success result; If the second authentication code and the third authentication code do not match, the login authentication fails, and a fourth satellite SMS message is sent to the terminal, wherein the fourth satellite SMS message includes the failure result.

[0015] Thus, if the second and third authentication codes match, login authentication is successful, and a third satellite SMS message is sent to the terminal, containing the target access token and a success result. If the second and third authentication codes do not match, login authentication fails, and a fourth satellite SMS message is sent to the terminal, containing a failure result. This ensures that no sensitive information such as keys or tokens is leaked when authentication fails, preventing unauthorized terminal attempts. Conversely, when authentication succeeds, the target access token is returned and bound to the device and user, enhancing business access security. This allows for result notification with only one downlink SMS, enabling full authentication through two interactions with the terminal SMS message, adapting to high-latency and unstable satellite environments.

[0016] This application embodiment uses a terminal, which is configured as follows: Obtain the first key index, the device identifier of the encryption device of the terminal, the user account, and the application identifier; A first target key is determined in the encryption device based on the first key index and the device identifier; Based on the first target key, the device identifier, the user account, and the application identifier are encrypted to determine the first authentication code; The device identifier, the user account, the application identifier, the first key index, and the first authentication code are assembled into a first satellite SMS message and sent to the server.

[0017] Thus, the first key index, the device identifier of the encryption device of the terminal, the user account, and the application identifier are obtained; Based on the first key index and the device identifier, a first target key is determined in the encryption device. Based on the first target key, the device identifier, the user account, and the application identifier are encrypted to determine a first authentication code. The device identifier, the user account, the application identifier, the first key index, and the first authentication code are assembled into a first satellite SMS message and sent to the server. In this way, by generating a random first key index, the first target key can be obtained, and then the device identifier, user account, and application identifier are encrypted in the encryption device to generate a first authentication code. This achieves one-time pad encryption, resisting quantum computing attacks and improving the security of satellite communication. Furthermore, by assembling the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message, the data required for authentication can be compressed into a single satellite SMS message, eliminating the need for fragmented transmission, reducing satellite channel interaction, and lowering latency and communication costs. Compared to methods using larger authentication protocol data volumes, the implementation method of this application utilizes a satellite SMS channel, ensuring stable transmission of authentication requests in scenarios where terrestrial networks cannot cover, thereby ensuring the security and reliability of login authentication.

[0018] This application provides a server configured as follows: The receiving terminal receives a second satellite SMS message, wherein the second satellite SMS message includes a device identifier, a user account, an application identifier, a key index, and a second authentication code; Based on the second preset key index-key ciphertext mapping relationship, the second target key is determined from the quantum key management platform of the server according to the key index and the device identifier; In the quantum key management platform, the device identifier, the user account, and the application identifier are encrypted based on the second target key to determine the third authentication code; Login authentication is performed based on the second authentication code and the third authentication code.

[0019] Thus, the receiving terminal receives a second satellite SMS message, which includes a device identifier, user account, application identifier, second key index, and second authentication code. Based on the second preset key index-key ciphertext mapping relationship, a second target key is determined from the server's quantum key management platform according to the second key index and the device identifier. In the quantum key management platform, the device identifier, user account, and application identifier are encrypted according to the second target key to determine a third authentication code. Login authentication is performed based on the second and third authentication codes. In this way, based on the second preset key index-key ciphertext mapping relationship, the second target key can be determined from the server's quantum key management platform according to the device identifier and the second key index, ensuring that the second target key used by the server is consistent with the terminal's first target key, avoiding authentication failure due to key inconsistency. Furthermore, since the received second satellite SMS message from the terminal includes the device identifier, user account, application identifier, second key index, and second authentication code, the entire verification logic can be completed with only one SMS reception, eliminating the need for multiple interactions with the terminal. This reduces the impact of high satellite latency to a certain extent, improving authentication efficiency and stability.

[0020] This application provides a login authentication system, including a terminal and a server, which implements the steps of the above method.

[0021] This application provides a computer-readable storage medium storing a computer program that, when executed by one or more processors, implements the steps of the above-described method.

[0022] This application provides a computer program product, which includes a computer program / instructions that, when executed by one or more processors, implement the steps of the above-described method.

[0023] The login authentication system, computer-readable storage medium, and computer program product provided in this application obtain a first key index, a device identifier of the terminal's encryption device, a user account, and an application identifier; determine a first target key in the encryption device based on the first key index and the device identifier; encrypt the device identifier, user account, and application identifier based on the first target key to determine a first authentication code; and assemble the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message, which is then sent to the server for login authentication. In this way, by generating a random first key index, the first target key can be obtained, and then the device identifier, user account, and application identifier can be encrypted in the encryption device to generate the first authentication code. This achieves one-time pad encryption, resisting quantum computing attacks and improving the security of satellite communication. Furthermore, by assembling the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message, the data required for authentication can be compressed into a single satellite SMS message, eliminating the need for fragmented transmission, reducing satellite channel interaction, and lowering latency and communication costs. Compared to methods that use a large amount of authentication protocol data, the implementation method of this application uses a satellite SMS channel, which can ensure stable transmission of authentication requests in scenarios where terrestrial networks cannot cover, thereby ensuring the security and reliability of login authentication.

[0024] Additional aspects and advantages of embodiments of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of embodiments of this application. Attached Figure Description

[0025] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, wherein: Figure 1 This is one of the flowcharts illustrating the login authentication method in certain embodiments of this application; Figure 2 This is a flowchart illustrating the login authentication system of some embodiments of this application; Figure 3 This is a schematic diagram of satellite text messaging according to certain embodiments of this application; Figure 4 This is a second flowchart illustrating the login authentication method in certain embodiments of this application; Figure 5 This is the third flowchart illustrating the login authentication method in some embodiments of this application; Figure 6 This is the fourth flowchart illustrating the login authentication method in some embodiments of this application; Figure 7 This is a schematic diagram of the terminal login authentication process in some embodiments of this application; Figure 8This is the fifth flowchart illustrating the login authentication method in some embodiments of this application; Figure 9 This is the sixth flowchart illustrating the login authentication method of certain embodiments of this application; Figure 10 This is a schematic diagram of the server-side login authentication process in some embodiments of this application. Detailed Implementation

[0026] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0027] Mobile communication satellite systems can provide stable network access services for remote areas such as oceans, deserts, and mountains, as well as for special scenarios such as emergency rescue and disaster relief, ensuring that various satellite communication terminals can complete operations such as data reporting, command reception, and access to business platforms.

[0028] In related technologies, satellite communication terminals mainly rely on pre-shared key mechanisms or user identification modules to achieve identity authentication and login authorization. However, their key security capabilities are insufficient, and there is a risk of leakage during the distribution and storage of pre-shared keys. This makes it difficult to cope with increasingly complex network attack threats. At the same time, the encryption algorithms used do not have the ability to resist quantum computing attacks, and in the context of the future development of quantum computing technology, they cannot meet the usage requirements of high-security scenarios.

[0029] Furthermore, the authentication protocol data volume of terrestrial networks is large, and the length of the encapsulated message exceeds the carrying capacity limit of satellite SMS, making direct transmission impossible. This leads to increased communication latency and transmission costs, and in harsh communication environments, it also increases the probability of authentication failure, making it difficult to achieve stable and reliable login authentication. Therefore, there is an urgent need for a lightweight login authentication method that can adapt to the length limit of a single satellite SMS message, while possessing a high level of security and resistance to quantum computing attacks.

[0030] Based on the above issues, please refer to Figure 1 This application provides a login authentication method for a terminal, the method including: 01: Obtain the first key index, the device identifier of the terminal's encryption device, the user account, and the application identifier; 02: Determine the first target key in the encryption device based on the first key index and device identifier; 03: Based on the first target key, encrypt the device identifier, user account, and application identifier to determine the first authentication code; 04: Assemble the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message and send it to the server for login authentication.

[0031] This application provides a login authentication system. The login authentication method of this application can be implemented by the login authentication system of this application. Specifically, the login authentication system includes a terminal. The terminal is used to obtain a first key index, a device identifier of the terminal's encrypted device, a user account, and an application identifier. The terminal is also used to determine a first target key in the encrypted device based on the first key index and the device identifier. The terminal is also used to encrypt the device identifier, user account, and application identifier in the encrypted device based on the first target key to determine a first authentication code. The terminal is also used to assemble the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message and send it to a server.

[0032] Specifically, a terminal refers to a mobile terminal equipped with a satellite communication module and encryption equipment, including but not limited to handheld satellite terminals, shipborne satellite terminals, and airborne satellite terminals, and is the initiator of the authentication request.

[0033] The first key index is a serial number randomly generated by the terminal, which corresponds one-to-one with the quantum key pre-stored in the encryption device, and is used to quickly match the quantum key pre-stored in the encryption device.

[0034] An encryption device refers to a hardware encryption card with a built-in quantum true random number source and security chip, such as a quantum-safe (TransFlash, TF) card. It can generate and protect uncopyable quantum keys based on quantum physics principles. By encrypting device identifiers, user accounts, and application identifiers inside the encryption device, it ensures that the quantum keys are not leaked, thereby ensuring communication security.

[0035] The device identifier is a unique hardware identifier (ID) for each encrypted device, used to distinguish each device and ensure the legitimacy of the terminal's identity. The device identifier is bound to the quantum key pool stored within the encrypted device, and the server-side quantum key management platform can also quickly locate the same quantum key pool within the encrypted device using the device identifier.

[0036] A user account is an identity identifier for a user logging into a business platform, such as a mobile phone number or registered account, used to identify the user currently logged in.

[0037] An application identifier is a unique code assigned to a target application by the business platform to identify which application or business system this login is for.

[0038] The first target key is the dedicated symmetric session key for this login, obtained by matching the key index with the device identifier and decrypting it within the encrypted device.

[0039] Encryption is used to encrypt device identifiers, user accounts, and application identifiers to generate the first authentication code, laying the foundation for subsequent security authentication.

[0040] The first authentication code refers to the quantum-safe digital fingerprint generated through encryption, which is used to prove the legitimacy of the terminal's identity and that the requested data has not been tampered with.

[0041] The first satellite SMS is a short message generated by assembling the device identifier, user account, application identifier, first key index, and first authentication code. The total length of the first satellite SMS is less than or equal to the preset threshold for short messages, such as less than or equal to 140 bytes, to adapt to the single transmission limit of satellite SMS.

[0042] The server is a backend server that includes a quantum key management (KMS) platform and a proxy authentication platform, used to receive the first satellite SMS and complete authentication verification.

[0043] Understandably, the key pool in the terminal's encryption device and the key pool in the KMS platform on the server are synchronized, and both can obtain the corresponding quantum key based on the same key index, ensuring that the terminal and the server can locate the same set of keys.

[0044] The terminal obtains the first key index, the device identifier of the terminal's encryption device, the user account, and the application identifier to provide basic input for subsequent key matching and authentication generation; Next, based on the first key index and the device identifier, a first target key is determined in the encryption device. In the encryption device, based on the first target key, the device identifier, user account, and application identifier are encrypted to generate a first authentication code to bind the terminal hardware, user, and application identities. By using the first target key for encryption within the security chip of the encryption device, it can be ensured that the first target key is never exposed in the terminal host memory, preventing the first target key from being stolen, thereby ensuring that the first authentication code generated based on the first target key is secure and legitimate; Finally, the device identifier, user account, application identifier, first key index, and first authentication code are assembled to generate the first satellite SMS message that meets the length requirements of satellite SMS messages. This message is then sent to the server via the satellite communication module, where it awaits authentication and verification.

[0045] In one example, such as Figure 2As shown, after the terminal's operating system starts, it can call the initialization function QCF_Init() of the quantum-safe software development kit (SDK) to initialize, so that the driver layer can successfully connect to the built-in quantum-safe TF card, that is, the encryption device in this application embodiment, and then verify the TF card with a PIN code, for example, verifying the user PIN: 12345678. After successful verification, the globally unique device identifier (DevID), which is the device identifier in this application embodiment, can be read from the TF card to open the key management application container in the TF card, laying the foundation for obtaining the first target key in the future. At this point, the SDK initialization is successful, and the terminal's security hardware environment is ready.

[0046] Next, by calling the SDK's authentication code calculation function QCF_CalcAuthMac, a random number, i.e. the first key index, can be generated in the TF card security chip. For example, KeySN=892. KeySN represents the 892nd key unit in the key pool charged in the card. Combined with the device identifier, the corresponding first target key can be obtained in the TF card security chip. Then, the DevID, UserAccount, and Application ID (AppID) are passed to the TF card, which uses the first target key to encrypt the data and generate an authentication message authentication code (AuthMac), i.e., the first authentication code. The AuthMac and the first key index are then returned to the application to achieve one-time password. Next, the application can Base64 encode the 32-byte binary AuthMac to obtain text of approximately 44 ASCII characters, and assemble all the information required for login, DevID, UserAccount, AppID, KeySN, and AuthMac, into a text message that meets the 140-byte limit, which is the first satellite text message in the implementation of this application. Finally, the text message is sent to the satellite network, i.e., the server in this embodiment of the application, via the Tiantong satellite module, to be sent to the satellite text messaging platform and the authentication platform.

[0047] In one example, it can be used as follows Figure 3The format shown assembles the device identifier, user account, application identifier, first key index, and first authentication code to generate the first satellite SMS message. The fields of device identifier, user account, application identifier, first key index, and first authentication code are separated by vertical lines to remove redundant characters, achieve no redundant information, avoid fragment loss, out-of-order transmission, and retransmission, and thus ensure more reliable login in the satellite environment.

[0048] In summary, the embodiments of this application, by generating a random first key index, can obtain a first target key, and then encrypt the device identifier, user account, and application identifier in the encryption device to generate a first authentication code. This achieves one-time pad encryption, resists quantum computing cracking, and improves the security of satellite communication. Furthermore, by assembling the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message, the data required for authentication can be compressed into a single satellite SMS message, eliminating the need for fragmented transmission, reducing satellite channel interaction, and lowering latency and communication costs. Compared to methods using larger authentication protocol data volumes, the embodiments of this application utilize satellite SMS channels, ensuring stable transmission of authentication requests in scenarios where terrestrial networks cannot cover, thereby ensuring the security and reliability of login authentication.

[0049] Please see Figure 4 In some implementations, step 02 (determining the first target key in the encryption device based on the first key index and the device identifier) ​​includes: 021: Based on the first preset key index-key ciphertext mapping relationship, determine the first key ciphertext according to the first key index; 022: Decrypt the first key ciphertext according to the target private key corresponding to the device identifier to determine the first target key.

[0050] In some embodiments, the terminal is further configured to determine the first key ciphertext based on the first preset key index-key ciphertext mapping relationship. The terminal is also configured to decrypt the first key ciphertext according to the target private key corresponding to the device identifier to determine the first target key.

[0051] Specifically, the first preset key index-key ciphertext mapping relationship is a correspondence table of key indexes and key ciphertexts pre-stored by the encryption device. Each key index uniquely matches one encrypted key ciphertext, which is used to quickly locate the first key ciphertext.

[0052] The first key ciphertext is the ciphertext encrypted with the first target key. It is stored in the secure storage area of ​​the encryption device and cannot be directly used in the authentication code encryption operation. It must be decrypted to obtain the valid key, i.e., the first target key.

[0053] The target private key is a private key that is uniquely bound to the device identifier of the encrypted device. It is stored inside the encrypted device, such as in the security chip of a TF card. It cannot be copied, exported, or tampered with, and is the only legitimate key to decrypt the first key ciphertext.

[0054] Understandably, the first preset key index-key ciphertext mapping relationship is synchronized with the second preset key index-key ciphertext mapping relationship of the quantum key management platform in the server, ensuring that the terminal and the server can locate the same set of keys, thereby ensuring the reliability of the first authentication code authentication result.

[0055] Based on the pre-configured first preset key index-key ciphertext mapping relationship inside the encryption device, the first key ciphertext can be accurately extracted according to the first key index. Then, according to the target private key corresponding to the device identifier, the first key ciphertext is decrypted to restore the first target key. This ensures that the data processing is completed within the security chip of the encryption device, and the plaintext of the first target key is never exposed in the terminal host memory, providing a secure and legitimate first target key for the subsequent generation of the first authentication code.

[0056] In one example, based on KeySN=892, which is the first key index, the corresponding encrypted session key ciphertext E(Ka_K892), i.e. the first key ciphertext, can be found in the protected storage area of ​​the TF card. This ciphertext E(Ka_K892) is encrypted by the protected Elliptic Curve Cryptography (ECC) asymmetric key Ka within the card. Inside the chip, by using the private key corresponding to Ka, i.e. the target private key in this application embodiment, to decrypt the ciphertext E(Ka_K892), the plaintext K892 (16 bytes) of the symmetric key used for this login session can be obtained, i.e., the first target key.

[0057] Thus, based on the first preset key index-key ciphertext mapping relationship, the first key ciphertext is determined according to the first key index; based on the target private key corresponding to the device identifier, the first key ciphertext is decrypted to determine the first target key. In this way, the key is stored in ciphertext form in the encryption device, and the target private key is uniquely bound to the device identifier. The decryption process based on the target private key is also completed within the encryption device, ensuring that the plaintext key is not leaked, preventing the key from being stolen or tampered with, achieving one-time key authentication, resisting replay attacks and quantum computing attacks, and ensuring the security and reliability of subsequent login authentication based on satellite communication.

[0058] Please see Figure 5 In some implementations, in the encrypted device, step 03 (encrypting the device identifier, user account, and application identifier according to the first target key to determine the first authentication code) includes: 031: The device identifier, user account, and application identifier are concatenated to determine the first authentication plaintext; 032: Based on the encryption device, the first authentication plaintext is encrypted according to the first target key to determine the first authentication code.

[0059] In some implementations, the terminal is further configured to concatenate the device identifier, user account, and application identifier to determine the first authentication plaintext. The terminal is also configured to encrypt the first authentication plaintext based on an encryption device and a first target key to determine the first authentication code.

[0060] Specifically, the splicing process is used to combine three independent identity information types—device identifier, user account, and application identifier—into a continuous, non-redundant data segment according to a preset order.

[0061] The first authentication plaintext is the original authentication data formed by concatenating the device identifier, user account, and application identifier. It can carry the triple identity information of terminal hardware, logged-in user, and target application, and is used to generate the first authentication code.

[0062] By concatenating the device identifier, user account, and application identifier, a continuous and non-redundant first authentication plaintext can be formed, eliminating the data fragmentation problem, and the first authentication plaintext can be input into the encryption device. Encryption processing can be performed based on the encryption device. The first target key, which has been securely obtained, is called to perform encryption operations on the first authentication plaintext inside the security chip to obtain the first authentication code. This ensures that the first target key is not exposed to the terminal, realizes the secure generation of the authentication code, and provides a legitimate and unique identity credential for subsequent satellite SMS transmission and server authentication.

[0063] In one example, in an encrypted device, the SM3Cryptographic Hash Algorithm can be used to calculate a hash-based message authentication code (HMAC) with a key, i.e., a hash value, which in turn generates a 32-byte binary authentication code AuthMac, i.e., the first authentication.

[0064] In this way, the device identifier, user account, and application identifier are concatenated to determine the first authentication plaintext. Based on the encryption device and the first target key, the first authentication plaintext is encrypted to determine the first authentication code. By concatenating and encrypting the device identifier, user account, and application identifier, the first authentication code can be uniquely bound to the terminal, user, and application, eliminating identity impersonation and forgery at the source. Furthermore, since the encryption process is completed within the encryption device, it ensures that the first target key is not leaked, thereby resisting data eavesdropping and tampering attacks and ensuring the security and reliability of subsequent login authentication based on satellite communication.

[0065] Please see Figure 6 In some implementations, step 04 (assembling the device identifier, user account, application identifier, first key index, and first authentication code into a first satellite SMS message and sending it to the server for login authentication) includes: 041: Based on preset assembly rules, the device identifier, user account, application identifier, first key index, and first authentication code are assembled to determine the first satellite SMS message; 042: Send the first satellite SMS to the server.

[0066] In some implementations, the terminal is further configured to assemble the device identifier, user account, application identifier, first key index, and first authentication code based on preset assembly rules to determine the first satellite SMS message. The terminal is also configured to send the first satellite SMS message to the server.

[0067] Specifically, the preset assembly rules refer to the data packet structure designed based on satellite SMS transmission restrictions, which can ensure that the message length is strictly controlled within the preset limit of a single satellite SMS message, that is, a unified standard for terminal and server to parse data.

[0068] By following the preset assembly rules, such as Figure 3 As shown, by splicing, encapsulating, and compressing five types of information—device identifier, user account, application identifier, first key index, and first authentication code—in a fixed order, fixed format, and fixed encoding, a legitimate message that meets the requirements for satellite SMS transmission can be generated. This message carries all login authentication information and can ultimately be sent directly in a single transmission via the satellite link without fragmentation. This solves the problem of satellite SMS length limitations and ensures that quantum-secure authentication information is delivered to the server completely and without error.

[0069] Thus, based on preset assembly rules, the device identifier, user account, application identifier, first key index, and first authentication code are assembled to determine the first satellite SMS message; the first satellite SMS message is then sent to the server. In this way, the first satellite SMS message adapts to the satellite SMS message length limit, allowing the information required for authentication to be transmitted without fragmentation, thereby reducing the latency and cost of satellite communication to some extent.

[0070] The following is Figure 7 Taking an example, the login authentication process of the terminal in the implementation method of this application will be explained: First, the terminal's business application can trigger the login process, send an authentication request to the security SDK, call the SDK interface QCF_CalcAuthMac, and pass in the application ID (appID) to start the authentication code calculation process; Then, a random key index KeySN is generated to implement one-time key to prevent replay attacks. The key file is located based on KeySN, and the location of the corresponding session key ciphertext pre-stored in the TF card is found based on KeySN. Next, it can be determined whether ECC(Ka) has been loaded into memory. If not, the ECC encryption structure ECC(Ka) is read from the key file. If it has already been loaded, the ECC(Ka) already cached in memory can be used directly. The terminal imports the ECC(Ka) into the TF card security chip and obtains the handle of the root key Ka, which is used to prepare for subsequent decryption. The key operation is completed within the chip. Then, the terminal can read the encrypted charging key ciphertext Ka(Kx) from the specified offset position, which is the session key ciphertext encrypted by the root key Ka, and decrypt Ka(Kx) in the chip to obtain the session key plaintext Kx; Next, the device ID (DevID) + user account (UserAccount) + application ID (appID) are combined to form the raw data to be authenticated. The SM3-HMAC calculation is then performed within the chip, which can output a 32-byte binary AuthMac (quantum secure authentication code). The 32-byte binary AuthMac is then converted into a 44-byte text format for easy transmission in SMS messages. Finally, the SDK returns the key index and authentication code for this login to the application. The terminal can assemble the login SMS message, namely L|DevID|U|Account|A|appID|K|KeySN|M|Base64(AuthMac), and send the SMS via Tiantong satellite to achieve the transmission of full authentication information in a single SMS message without the need for fragmentation, thus improving reliability.

[0071] Please see Figure 8 This application provides a login authentication method for a server, the method comprising: 05: The receiving terminal's second satellite SMS message, which includes a device identifier, user account, application identifier, second key index, and second authentication code; 06: Based on the second preset key index-key ciphertext mapping relationship, determine the second target key from the server's quantum key management platform according to the second key index and device identifier; 07: In the quantum key management platform, the device identifier, user account, and application identifier are encrypted based on the second target key to determine the third authentication code; 08: Login authentication is performed based on the second and third authentication codes.

[0072] In some implementations, the login authentication system includes a server. The server receives a second satellite SMS message from the terminal, wherein the second satellite SMS message includes a device identifier, a user account, an application identifier, a key index, and a second authentication code. The server is also used to determine a second target key from its quantum key management platform based on the key index and the device identifier. The server is further used to encrypt the device identifier, user account, and application identifier in the quantum key management platform based on the second target key to determine a third authentication code. The server is also used to perform login authentication based on the second and third authentication codes.

[0073] Specifically, the second satellite SMS refers to the satellite SMS sent by the terminal and received by the server. It contains complete login authentication information and has the same content as the first satellite SMS, only with a different name to distinguish the satellite SMS from the terminal.

[0074] The second authentication code is a quantum-safe authentication code generated on the terminal side based on the encryption device and the first target key. It can be used as the original credential for server verification. It has the same content as the first authentication code, only the name is different, and it is used to distinguish the authentication codes on the terminal and the server.

[0075] The second key index has the same content as the first key index, only the name is different, and it is used to distinguish the key indexes of the terminal and the server.

[0076] The quantum key management platform is a server-side security management system that pre-stores a quantum key pool synchronized with the terminal encryption device and a preset key index-key ciphertext mapping relationship. It is used to store keys, query keys, calculate authentication codes, and perform security verification.

[0077] The second preset key index-key ciphertext mapping relationship is identical in content to the first preset key index-key ciphertext mapping relationship, differing only in name. This difference is used to distinguish the preset key index-key ciphertext mapping relationships between the terminal and the server.

[0078] The second target key is a symmetric session key obtained by the server from the quantum key management platform based on the key index and device identifier. The second target key is completely consistent with the first target key of the terminal and is used to ensure the consistency of encryption operations between the terminal and the server.

[0079] The third authentication code is an authentication code recalculated by the server using the second target key, following the same algorithm and concatenation rules as the terminal, and is used to compare with the second authentication code sent by the terminal.

[0080] Login authentication is used to verify the legitimacy of the terminal's identity, the integrity of the requested data, and the validity of the key by comparing the authentication code, in order to determine whether the terminal can log in to the business system.

[0081] By receiving a second satellite SMS message sent via a satellite link from a terminal, the device identifier, user account, application identifier, second key index, and second authentication code can be parsed out, providing the original input for subsequent verification; Based on the second preset key index-key ciphertext mapping relationship, the key index and device identifier obtained by parsing can be matched and queried in the secure key library of the quantum key management platform to locate and extract the second target key that is exactly the same as the first target key on the terminal side, so as to ensure that the keys at both ends are consistent. Next, in the secure computing environment of the quantum key management platform, based on the second target key, and following the same splicing rules and national cryptographic SM3-HMAC encryption algorithm as the terminal, the device identifier, user account, and application identifier are encrypted, generating a third authentication code to ensure that the computing process is of the same standard and logic as the terminal. Finally, the server compares the second authentication code sent by the terminal with the third authentication code it generates, bit by bit. Based on the comparison results, it determines whether the terminal's identity is legitimate and whether the data has been tampered with. The entire verification logic can be completed with just one SMS message, thus completing the final login authentication and realizing quantum-secure login authentication without a terrestrial network. This reduces the impact of high satellite latency to a certain extent and improves authentication efficiency and stability.

[0082] Understandably, performing key management and encryption operations on a quantum key management platform can ensure that keys are not leaked and that the computing environment is secure, thereby resisting quantum computing attacks, replay attacks, and data tampering attacks.

[0083] In one example, such as Figure 2 As shown, the satellite network can send the second satellite SMS message received from the terminal to the satellite SMS gateway. After parsing, the SMS gateway confirms that it is an authentication request and forwards it to the proxy authentication server. Next, the proxy authentication server extracts each field from the SMS message, constructs a standard request, and calls the KMS verification interface so that KMS can locate the corresponding terminal device record in the key library based on DevID, and extract the session key K892, which is exactly the same as the 892nd key in the terminal TF card, from the key image based on KeySN(892) and the second preset key index-key ciphertext mapping relationship. This is the second target key. Then, according to K892, the same authentication plaintext, namely the plaintext assembled from the device identifier, user account and application identifier, is subjected to SM3-HMAC calculation, encrypted, and the calculated MAC is Base64 encoded to obtain the third authentication code; Thus, the receiving terminal receives a second satellite SMS message, which includes a device identifier, user account, application identifier, second key index, and second authentication code. Based on the second preset key index-key ciphertext mapping relationship, a second target key is determined from the server's quantum key management platform according to the second key index and the device identifier. In the quantum key management platform, the device identifier, user account, and application identifier are encrypted according to the second target key to determine a third authentication code. Login authentication is performed based on the second and third authentication codes. In this way, based on the second preset key index-key ciphertext mapping relationship, the second target key can be determined from the server's quantum key management platform according to the device identifier and the second key index, ensuring that the second target key used by the server is consistent with the terminal's first target key, avoiding authentication failure due to key inconsistency. Furthermore, since the received second satellite SMS message from the terminal includes the device identifier, user account, application identifier, second key index, and second authentication code, the entire verification logic can be completed with only one SMS reception, eliminating the need for multiple interactions with the terminal. This reduces the impact of high satellite latency to a certain extent, improving authentication efficiency and stability.

[0084] Please see Figure 9 In some implementations, step 08 (login authentication based on the second and third authentication codes) includes: 081: If the second and third authentication codes match, the login authentication is successful, and a third satellite SMS message is sent to the terminal. The third satellite SMS message includes the target access token and the success result. 082: If the second and third authentication codes do not match, login authentication fails, and a fourth satellite SMS message is sent to the terminal, which includes the failure result.

[0085] In some implementations, the server is further configured to send a third satellite SMS message to the terminal if the login authentication is successful when the second and third authentication codes match, wherein the third satellite SMS message includes the target access token and a success result. In some implementations, if the login authentication fails when the second and third authentication codes do not match, a fourth satellite SMS message is sent to the terminal, wherein the fourth satellite SMS message includes a failure result.

[0086] Specifically, the third satellite SMS is a short message sent by the server to the terminal indicating successful authentication, which includes a success identifier and access credentials.

[0087] The target access token is a valid business access credential generated by the server. When a terminal holds this token, it can legally call the business interface within the validity period without repeated authentication.

[0088] A successful result is used to inform the terminal of the authentication status, providing a basis for the terminal's service execution.

[0089] The fourth satellite SMS is a downlink short message sent by the server to the terminal indicating authentication failure. It only contains the failure status and does not carry any sensitive credential information.

[0090] The failure result is used to inform the terminal that the authentication has failed, prompting the terminal to prohibit login or re-initiate authentication.

[0091] The server compares the second authentication code sent by the terminal with the third authentication code it calculates, character by character and bit by bit. If the second authentication code and the third authentication code match, the result can be considered to be completely consistent, indicating that the terminal's identity is legitimate, the key is valid, and the data has not been tampered with. If the second and third authentication codes do not match, it can be assumed that there is a discrepancy between the two codes, indicating an illegitimate terminal, an incorrect key, information tampering, or a replay attack, resulting in authentication failure.

[0092] Upon successful login authentication, the server can confirm that the terminal is a legitimate device, the user is a legitimate user, and the requested data is complete and valid, thus allowing the terminal to access the business system. By generating a target access token with a fixed validity period, the server combines the successful status and the token into a third satellite SMS message according to a compact encapsulation rule, and sends it to the terminal via the satellite link, enabling the terminal to obtain legitimate business access permissions. In the event of login authentication failure, the server can determine that the terminal is illegitimate, the data is abnormal, or the key is invalid, and reject the terminal's login request. By encapsulating the failure result as a fourth satellite SMS and sending it to the terminal, the server can reject the terminal's login request and indicate the error.

[0093] In one example, the server can compare the third authentication code with the second authentication code sent by the terminal bit by bit. If the second authentication code and the third authentication code are completely consistent, KMS can confirm that the sender holds a legitimate quantum TF card with a matching ID, knows the correct PIN code, and that the request data has not been tampered with. Then, it can generate a target access token, i.e., Token, for example: eyJ0eXAi...5H7Tg, and set an expiration period, such as 24 hours, to return to the proxy authentication server. The proxy authentication server binds the token to the terminal information and records the expiration time. Understandably, the proxy authentication platform is responsible for maintaining the mapping relationship between the token and the terminal identity, and for initiating token lifecycle management, such as proactively triggering a re-authentication process before the token expires. Meanwhile, the proxy authentication server encapsulates the successful login result and the token into a short downlink satellite SMS message, such as: SUCC:TOK=eyJ0eXAi...5H7Tg:EXP=86400, and sends the SMS message to the handheld terminal via the satellite network; Ultimately, the terminal application received a successful response, parsed and securely stored the token, and the application interface displayed "Secure Login". This enabled the use of an ordinary handheld satellite terminal in an extreme environment without any terrestrial network support, to complete a highly secure identity authentication that can withstand future quantum computing attacks using only two satellite text messages, i.e., request and response.

[0094] Thus, if the second and third authentication codes match, login authentication is successful, and a third satellite SMS message is sent to the terminal, containing the target access token and a success result. If the second and third authentication codes do not match, login authentication fails, and a fourth satellite SMS message is sent to the terminal, containing a failure result. This ensures that no sensitive information such as keys or tokens is leaked when authentication fails, preventing unauthorized terminal attempts. Conversely, when authentication succeeds, the target access token is returned and bound to the device and user, enhancing business access security. This allows for result notification with only one downlink SMS, enabling full authentication through two interactions with the terminal SMS message, adapting to high-latency and unstable satellite environments.

[0095] The following is Figure 10 Taking an example, the login authentication process on the server side of this application will be explained: First, the server receives the compact format login SMS message sent by the terminal through the satellite gateway, which is the second satellite SMS. It can be split into DevID, UserAccount, AppID, KeySN, which are the second key index and the second authentication code according to the agreed format. Next, it can be verified whether the DevID exists. If it does not exist, the authentication can be directly determined as "device not registered, unauthorized device access denied"; If it exists, KMS can locate the session key Kx that is completely consistent with the terminal TF card by using DevID and the key index KeySN of this login. Next, the existence of the key Kx can be verified. If it does not exist, the authentication will be deemed to have failed. If the key is invalid, expired or forged KeySNs need to be intercepted. If present, the authentication code calculation process can proceed. By inputting DevID+Account+AppID, the SM3-HMAC algorithm, which is completely consistent with the terminal side, can be used to generate AuthMac, the third authentication code, to verify identity and data integrity. The calculated 32-byte binary AuthMac is then converted into text format and aligned with the Base64 format transmitted from the terminal. If the second and third authentication codes do not match, the authentication will fail. For example, if the MAC is invalid, it means that the message has been tampered with, the key is wrong, or the terminal identity is forged. If the second and third authentication codes match, the authentication is deemed successful, confirming the terminal's legitimate identity and that the data has not been tampered with. Then, a target access token with a validity period of 24 hours is created, i.e., a token is generated, and the token is associated with the current DevID to ensure that subsequent business requests are traceable. Finally, the authentication result and token are sent to the terminal via satellite SMS, and a success response is returned.

[0096] This application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the steps of the login authentication method described above.

[0097] This application also provides a computer program product, including a computer program / instructions. When the computer program / instructions are executed by a processor, the steps of the login authentication method described above can be implemented.

[0098] It is understood that a computer program includes computer program code. Computer program code can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0099] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0100] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of executable request code comprising one or more steps for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order according to the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0101] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A login authentication method, characterized in that, For a terminal, the method includes: Obtain the first key index, the device identifier of the encryption device of the terminal, the user account, and the application identifier; A first target key is determined in the encryption device based on the first key index and the device identifier; Based on the first target key, the device identifier, the user account, and the application identifier are encrypted to determine the first authentication code; The device identifier, the user account, the application identifier, the first key index, and the first authentication code are assembled into a first satellite SMS message, which is sent to the server for login authentication.

2. The method according to claim 1, characterized in that, Determining the first target key in the encryption device based on the first key index and the device identifier includes: Based on the first preset key index-key ciphertext mapping relationship, the first key ciphertext is determined according to the first key index; Based on the target private key corresponding to the device identifier, the first key ciphertext is decrypted to determine the first target key.

3. The method according to claim 1, characterized in that, The step of encrypting the device identifier, the user account, and the application identifier based on the first target key to determine the first authentication code includes: The device identifier, the user account, and the application identifier are concatenated to determine the first authentication plaintext; Based on the encryption device, the first authentication plaintext is encrypted according to the first target key to determine the first authentication code.

4. The method according to claim 1, characterized in that, The step of assembling the device identifier, the user account, the application identifier, the first key index, and the first authentication code into a first satellite SMS message and sending it to the server includes: Based on preset assembly rules, the device identifier, the user account, the application identifier, the first key index, and the first authentication code are assembled to determine the first satellite SMS message; The first satellite SMS message is sent to the server.

5. A login authentication method, characterized in that, For use with a server, the method includes: The receiving terminal receives a second satellite SMS message, wherein the second satellite SMS message includes a device identifier, a user account, an application identifier, a second key index, and a second authentication code; Based on the second preset key index-key ciphertext mapping relationship, the second target key is determined from the quantum key management platform of the server according to the second key index and the device identifier; In the quantum key management platform, the device identifier, the user account, and the application identifier are encrypted based on the second target key to determine the third authentication code; Login authentication is performed based on the second authentication code and the third authentication code.

6. The method according to claim 5, characterized in that, The login authentication based on the second authentication code and the third authentication code includes: If the second authentication code and the third authentication code match, the login authentication is successful, and a third satellite SMS message is sent to the terminal, wherein the third satellite SMS message includes the target access token and the success result; If the second authentication code and the third authentication code do not match, the login authentication fails, and a fourth satellite SMS message is sent to the terminal, wherein the fourth satellite SMS message includes the failure result.

7. A terminal, characterized in that, The terminal is configured as follows: Obtain the first key index, the device identifier of the encryption device of the terminal, the user account, and the application identifier; A first target key is determined in the encryption device based on the first key index and the device identifier; In the encryption device, the device identifier, the user account, and the application identifier are encrypted according to the first target key to determine the first authentication code; The device identifier, the user account, the application identifier, the first key index, and the first authentication code are assembled into a first satellite SMS message and sent to the server.

8. A server configured to: The receiving terminal receives a second satellite SMS message, in which... The second satellite SMS message includes a device identifier, user account, application identifier, second key index, and second authentication code; The second target key is determined from the quantum key management platform of the server based on the key index and the device identifier; In the quantum key management platform, the device identifier, the user account, and the application identifier are encrypted based on the second target key to determine the third authentication code; Login authentication is performed based on the second authentication code and the third authentication code.

9. A login authentication system, characterized in that, It includes the terminal as described in claim 7 and the server as described in claim 8, and implements the method as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by one or more processors, implements the method of any one of claims 1-6.

Images