A unified identity authentication method for information systems based on national cryptographic algorithms

Abstract

This invention relates to the field of identity authentication technology, specifically to a unified identity authentication method for information systems based on national cryptographic algorithms. This method introduces a mechanism where microservice nodes update the total dwell time and the total number of routing nodes point-by-point, eliminating reliance on network time protocol synchronization accuracy. This ensures that the total dwell time is always non-negative and accurately reflects the actual survival and queuing time of credentials within the system, thus eliminating the risk of misjudgment caused by clock synchronization errors. This invention extracts the number of concurrent repetitions through a rotation mechanism using a double-buffered two-dimensional counting matrix, and uses this as the core penalty factor for abnormal concurrency weights, effectively solving the problem of fixed degradation strategies being vulnerable to replay attacks. Furthermore, by adding the abnormal concurrency weights to the idle computing power weights to obtain a dynamic verification judgment value, it achieves adaptive differentiation between normal business congestion and replay attacks, reducing network and computational losses and ensuring the high availability and security of unified identity authentication.

Description

Technical Field

[0001] This invention relates to the field of identity authentication technology, and specifically to a unified identity authentication method for information systems based on national cryptographic algorithms. Background Technology

[0002] As information system architecture evolves towards microservice clusters, information systems commonly employ national cryptographic asymmetric algorithms for digital signature verification during the identity authentication process. The conventional authentication architecture is as follows: a unified application gateway receives terminal requests and invokes underlying commercial cryptographic hardware to perform asymmetric signature verification; upon successful verification, the gateway issues a valid identity access credential to the request; downstream microservice nodes verify the validity of this credential to determine whether to grant access. In centralized business access scenarios, high-concurrency requests can easily exceed the maximum throughput of the underlying cryptographic hardware, leading to hardware queuing congestion and widespread interface timeouts.

[0003] To alleviate hardware congestion, existing technologies typically employ a downgraded release strategy when the queue is full. This involves using the server's absolute timestamp to calculate the time difference and comparing it with plaintext hashes to replace asymmetric signature verification. However, attackers can exploit the fixed rule of downgrading release when the hardware queue is full to submit massive amounts of duplicate requests carrying legitimate old credentials to the information system within a very short period. This operation can quickly fill the hardware queue and trigger the downgrade mechanism, creating a replay attack risk. Summary of the Invention

[0004] To address the technical problem in existing technologies that cannot accurately distinguish between normal business surges and replay attacks that deliberately crowd out hardware queues, the present invention aims to provide a unified identity authentication method for information systems based on national cryptographic algorithms. The specific technical solution adopted is as follows: This invention proposes a unified identity authentication method for information systems based on national cryptographic algorithms, the method comprising: Obtain identity access credentials, update the total dwell time of identity access credentials and the total number of flow nodes node by node during the microservice node flow process, and obtain the current backlog of tasks; A double-buffered two-dimensional counting matrix is ​​constructed based on a timed rotation mechanism to extract the concurrent repetition count of identity access credentials; Obtain the static scheduling judgment value of the current business interface, comprehensively analyze the total dwell time, the total number of flow nodes and the number of concurrent repetitions, and generate abnormal concurrency weights; determine the idle computing power weight based on the number of backlogged tasks and the static scheduling judgment value, and combine the abnormal concurrency weight and the idle computing power weight to obtain the dynamic verification judgment value; The dynamic verification judgment value is compared with the static scheduling judgment value to perform the branch verification process.

[0005] Furthermore, the identity access credentials include: The credentials include a unique identifier, the original message hash value, the user's public key identifier, the total number of transit nodes, and the total dwell time. The original message hash value is obtained by performing a one-way hash calculation on the original data using the national cryptographic SM3 hash algorithm.

[0006] Furthermore, the initial value of the total dwell time is zero milliseconds, which is obtained by summing the dwell time of each microservice node.

[0007] Furthermore, the initial value of the total number of flow nodes is zero, and the total number of flow nodes increases by one each time a microservice node is passed.

[0008] Furthermore, the construction of the double-buffered two-dimensional counting matrix based on the timed rotation mechanism includes: The microservice node is configured with a timed rotation task that is consistent with the preset maximum lifespan. When the timed rotation task is triggered, the data pointer references of the current period two-dimensional counting matrix and the previous period two-dimensional counting matrix are swapped, and the count values ​​of all slots in the new current period two-dimensional counting matrix are reset to zero.

[0009] Furthermore, the method for extracting the number of concurrent repetitions includes: Multiple independent non-cryptographic hash functions are used to perform multiple mappings on the unique identifier of the credential, respectively locating the corresponding slots in the current period's two-dimensional counting matrix and the previous period's two-dimensional counting matrix. The count values ​​of the corresponding slots in the two two-dimensional counting matrices are added together to obtain multiple comprehensive frequency values, and the minimum value of the multiple comprehensive frequency values ​​is taken as the concurrent repetition count.

[0010] Furthermore, the method for obtaining the abnormal concurrency weight includes: The total number of circulation nodes, total dwell time, number of concurrent repetitions, and dimensional alignment weight coefficients after incremental correction are multiplied together to obtain the abnormal concurrency weight; the dimensional alignment weight coefficient is a pre-configured empirical scalar.

[0011] Furthermore, the method for obtaining the idle computing power weight includes: The static scheduling judgment value is used as the numerator, and the backlog of tasks after incrementing by one is used as the denominator. A division operation is then performed to obtain the weight of idle computing power.

[0012] Furthermore, the method for obtaining the dynamic verification judgment value includes: The abnormal concurrency weight and the idle computing power weight are added together to obtain a dynamic verification judgment value.

[0013] Furthermore, the branch inspection process includes: When the dynamic verification judgment value is less than the static scheduling judgment value, the national cryptographic SM3 hash algorithm is executed to calculate the instant hash value of the current request body. The instant hash value is compared with the original message hash value. If the comparison matches, a valid release command is issued. If the comparison does not match, the request is blocked. When the dynamic verification judgment value is greater than or equal to the static scheduling judgment value, the concurrent repetition count is compared with the preset abnormal concurrency threshold. If the concurrent repetition count is less than the abnormal concurrency threshold, the underlying commercial cryptographic service platform is invoked to perform the national cryptographic SM2 asymmetric signature verification in combination with the user's public key identifier. After the signature verification is successful, a valid release instruction is issued. If the concurrent repetition count is greater than or equal to the abnormal concurrency threshold, a re-signature request message is returned to the terminal.

[0014] The present invention has the following beneficial effects: This invention introduces a mechanism where microservice nodes update the total dwell time and the total number of routing nodes point by point, eliminating the dependence on the synchronization accuracy of network time protocols. This ensures that the total dwell time is always non-negative and accurately reflects the actual survival and queuing time of credentials within the system, thus eliminating the risk of misjudgment caused by clock synchronization errors. Furthermore, this invention extracts the number of concurrent repetitions through a rotation mechanism using a double-buffered two-dimensional counting matrix, and uses this as the core penalty factor for abnormal concurrency weights, effectively solving the problem of fixed degradation strategies being vulnerable to replay attacks. Moreover, by adding the abnormal concurrency weights to the idle computing power weights to obtain a dynamic verification judgment value, it achieves adaptive differentiation between normal business congestion and replay attacks, reducing network and computational losses, while implementing the strongest blocking when an attack occurs, ensuring the high availability and security of unified identity authentication. Attached Figure Description

[0015] Figure 1 The flowchart illustrates a unified identity authentication method for an information system based on national cryptographic algorithms, as provided in one embodiment of the present invention. Detailed Implementation

[0016] The following description, in conjunction with the accompanying drawings, details the specific scheme of the unified identity authentication method for information systems based on national cryptographic algorithms provided by this invention.

[0017] Please see Figure 1 , Figure 1 A flowchart of a unified identity authentication method for an information system based on a national cryptographic algorithm is provided according to an embodiment of the present invention. The method includes: Step S1: Obtain identity access credentials, update the total dwell time of identity access credentials and the total number of flow nodes for each node during the microservice node flow process, and obtain the current backlog of tasks.

[0018] In a typical microservice architecture information system, the unified application gateway has completed the SM2 asymmetric signature verification of terminal requests and issued identity access credentials for each legitimate request. These credentials are sequentially transmitted between multiple microservice nodes along the business call chain. When an identity access credential arrives at a microservice node, that node needs to update the total dwell time and the total number of nodes traversed by the credential. The total dwell time reflects the total number of milliseconds the credential has been queued and processed within all the nodes it has passed through from issuance to the current node; a higher value indicates greater system congestion. The total number of nodes traversed reflects the depth of the call chain traversed by the credential; a higher value indicates a more complex request path. In addition, the microservice node sends a lightweight status query to the underlying commercial cryptographic service platform to obtain the number of tasks currently queued for asymmetric signature verification. This number is called the backlog of tasks. The larger the backlog of tasks, the more severe the congestion of the underlying cryptographic hardware.

[0019] Step S2: Construct a double-buffered two-dimensional counting matrix based on a timed rotation mechanism to extract the concurrent repetition count of identity access credentials.

[0020] Existing technical solutions trigger a downgraded release policy when the hardware queue is full, replacing the national standard SM2 asymmetric signature verification with absolute timestamps and plaintext hash comparisons. Attackers exploit vulnerabilities in this downgraded release policy to submit a massive number of duplicate requests carrying legitimate old credentials to the information system within a very short period. Since each request carries the same old credential, these requests quickly fill the queuing queue of the underlying commercial cryptographic service platform hardware, causing the system to mistakenly believe it is in a high-concurrency congestion state, thus triggering the downgrade mechanism. Once the downgraded release takes effect, strict asymmetric signature verification is no longer executed, allowing attackers to bypass the core national standard SM2 asymmetric signature verification using old credentials and complete a replay attack. The essence of a replay attack lies in the repeated submission of the same identity access credential within a short period. In normal business scenarios, a legitimate credential is usually submitted only once, or a small number of times due to network retransmissions, but not hundreds or thousands of times within milliseconds or seconds. Therefore, a quantitative indicator that can characterize the density of repeated submissions of the same identity access credential in a recent period is introduced: the concurrent repetition count.

[0021] If a traditional hash table is used to record the occurrence count of each identity access credential individually, memory usage will increase linearly with the number of requests in high-concurrency scenarios, easily leading to memory overflow and crashes in microservice nodes. If a single-window counter is periodically reset, high-frequency continuous requests crossing the window boundary will be forcibly cut off, resulting in severely distorted statistical results. Therefore, this invention introduces a double-buffered two-dimensional counting matrix constructed based on a timed rotation mechanism. The double-buffered rotation mechanism only occupies two fixed-size memory spaces, and memory usage will not increase regardless of the number of requests per second the system receives, thus avoiding the memory overflow risk of traditional hash tables in extreme congestion scenarios.

[0022] Step S3: Obtain the static scheduling judgment value of the current business interface, comprehensively analyze the total dwell time, the total number of flow nodes and the number of concurrent repetitions, and generate abnormal concurrency weights; determine the idle computing power weight based on the number of backlogged tasks and the static scheduling judgment value, and combine the abnormal concurrency weight and the idle computing power weight to obtain the dynamic verification judgment value.

[0023] Total dwell time, total number of routing nodes, concurrent repetition count, and current backlog of tasks reflect the lifespan of a request, call chain depth, frequency of repeated submissions, and the real-time load of the underlying hardware, respectively. However, total dwell time is measured in milliseconds, total number of routing nodes is a hop count, concurrent repetition count is a frequency count, and the backlog of tasks is the length of the hardware queue. If a fixed threshold is set based on experience to determine whether to downgrade, such as "enable local verification when the backlog exceeds 100," it cannot handle the mixed scenario of a surge in concurrent repetition counts and a high backlog of tasks in a replay attack, nor can it distinguish between idle periods and attack periods. Therefore, these multi-source heterogeneous parameters are integrated into a unified comparable value, called the dynamic verification judgment value.

[0024] First, obtain the static scheduling judgment value of the current business interface. Different business interfaces have different tolerances for security and availability. For example, a public data query interface allows appropriate degradation during hardware congestion, so its static scheduling judgment value is set relatively low, usually between 200 and 1000; while an interface involving core data submission must adhere to stricter security standards, and its static scheduling judgment value is set relatively high, usually between 1000 and 3000.

[0025] Furthermore, by comprehensively analyzing the total dwell time, the total number of nodes in the process, and the number of concurrent repetitions, an abnormal concurrency weight is generated. The longer a request survives in the system, the more nodes it passes through, and the higher the number of times it is submitted repeatedly, the greater the abnormal concurrency weight. During normal business congestion, although the total dwell time may increase due to queuing, the number of concurrent repetitions is usually 1, so the abnormal concurrency weight will not increase significantly. However, when an attacker frequently replays the same old credential, the number of concurrent repetitions jumps by an order of magnitude, from 1 to hundreds or even thousands, and the abnormal concurrency weight increases sharply, becoming the dominant penalty factor in the dynamic verification judgment value.

[0026] Simultaneously, the idle computing power weight is determined based on the current backlog of tasks and the static scheduling judgment value. The backlog of tasks reflects the number of tasks queued by the underlying cryptographic hardware. When the backlog of tasks is large, it indicates that the hardware is in a high-load congestion state, and the idle computing power weight approaches zero; when the backlog of tasks is small or even zero, it indicates that the hardware is very idle, and the idle computing power weight is relatively large. The higher the static scheduling judgment value, the greater the idle computing power weight under the same idle hardware conditions.

[0027] Finally, the abnormal concurrency weight and the idle computing power weight are combined to derive the dynamic verification judgment value. This makes the dynamic verification judgment value affected by two directions simultaneously: when there is normal business congestion and no attack, both are at low levels, the dynamic verification judgment value is small, and it is easy to fall below the static scheduling judgment value; when the hardware is idle and there is no attack, the idle computing power weight is large, and the dynamic verification judgment value may exceed the static scheduling judgment value, but at this time the number of concurrent repetitions is very low, and subsequent branches can be further distinguished; when subjected to a replay attack, the abnormal concurrency weight expands dramatically, and the dynamic verification judgment value will quickly exceed the static scheduling judgment value.

[0028] Step S4: Compare the dynamic verification judgment value with the static scheduling judgment value to perform the branch verification process.

[0029] When the dynamic verification judgment value is less than the static scheduling judgment value, it indicates that the overall risk score of the current request is lower than the preset security allowance baseline for that interface. This situation usually occurs when the underlying cryptographic hardware is under high load, the backlog of tasks is large, causing the idle computing power weight to approach zero, and the request itself does not exhibit obvious replay attack characteristics.

[0030] When the dynamic verification judgment value is greater than or equal to the static scheduling judgment value, it indicates that the overall risk score of the current request has reached or exceeded the security baseline of the interface. There are two possibilities in this situation: First, the underlying hardware is extremely idle, the number of backlogged tasks is very small or zero, and the weight of idle computing power is relatively large. At this time, although the request itself is not abnormal, the system has sufficient computing power to perform strict authentication. Second, the request exhibits obvious replay attack characteristics, the number of concurrent repetitions increases sharply, and the weight of abnormal concurrency dominates the final dynamic verification judgment value.

[0031] The specific actions of the branch verification process include, but are not limited to, local hash comparison, hardware asymmetric signature verification, or forced re-signature, and these actions vary depending on the comparison results. However, regardless of which branch is entered, the goal is to ensure the credibility of identity authentication while adapting to the current system load and security posture, and avoiding false interceptions or security vulnerabilities caused by fixed policies.

[0032] Preferably, in this embodiment of the invention, the identity access credential includes: a unique credential identifier, an original message hash value, a user public key identifier, a total number of transit nodes, and a total dwell time; the original message hash value is obtained by performing a one-way hash calculation on the original data using the national cryptographic SM3 hash algorithm.

[0033] The unique credential identifier is a globally unique code that distinguishes different requests. The original message hash value is a fixed-length hash value calculated by the gateway when issuing credentials, based on the original business data sent by the terminal, using the SM3 cryptographic hash algorithm. SM3 is a one-way hash function that takes data of arbitrary length as input and outputs a 256-bit hash result. The original message hash value serves as a baseline anchor for data integrity during node transfer. The user public key identifier is an index used to locate the actual public key of the terminal user. The total number of transfer nodes and the total dwell time are two dynamically accumulated fields during the microservice node transfer process.

[0034] Preferably, in this embodiment of the invention, the initial value of the total dwell time is zero milliseconds, which is obtained by accumulating the dwell time of each microservice node.

[0035] This invention abandons the cross-node clock comparison approach. First, the total dwell time is initialized to zero milliseconds. When the access credential enters the current node, a monotonically increasing clock that only increments forward and is unaffected by external time synchronization is invoked to record the entry time. After the node completes the necessary processing of the request and before forwarding the access credential to the next node, the same monotonically increasing clock is invoked again to record the departure time. The difference between the two times is the dwell time of the access credential within the current microservice node. Because the monotonically increasing clock is unaffected by time synchronization callbacks, the difference between the departure and entry times is always non-negative. Subsequently, the total dwell time written by the previous node is read from the access credential, and the current dwell time is added to obtain a new total dwell time, which is then written back to the access credential.

[0036] Preferably, in this embodiment of the invention, the initial value of the total number of transit nodes is zero, and the total number of transit nodes is incremented by one for each microservice node traversed. The total number of transit nodes records the number of microservice nodes that the identity access credential has traversed after being issued by the gateway. For example, if it has traversed 10 microservice nodes, the corresponding total number of transit nodes is 10.

[0037] Preferably, in this embodiment of the invention, constructing a double-buffered two-dimensional counting matrix based on a timed rotation mechanism includes: The microservice node is configured with a timed rotation task that is consistent with the preset maximum lifespan. When the timed rotation task is triggered, the data pointer references of the current period two-dimensional counting matrix and the previous period two-dimensional counting matrix are swapped, and the count values ​​of all slots in the new current period two-dimensional counting matrix are reset to zero.

[0038] When counting the number of repeated submissions of identity access credentials, using a single counting matrix and periodically resetting it presents an inherent boundary problem: consecutive repeated requests spanning the resetting time are split into two independent periods, leading to a significant underestimation of the statistical results. For example, an attacker might submit an old credential once before the end of a period and again after the beginning of the period. These two actions, which should be counted as two repeated actions, are counted as only 1 each because the resetting operation isolates them in two windows, failing to reflect the true replay frequency. Therefore, a method is used to swap the pointers of the two-dimensional counting matrices for the two periods.

[0039] First, a timed rotation task is set up, consistent with the maximum lifespan of the access credentials. In one specific implementation of this invention, the preset maximum lifespan is set to 5 minutes. This 5-minute validity period is short enough to limit attackers from using intercepted credentials for replay attacks. Furthermore, during peak business periods, queuing and inter-node network latency can reach hundreds of milliseconds or even seconds; the 5-minute time window is ample enough to cover occasional delays such as network jitter, preventing legitimate requests from being frequently misjudged as expired due to an overly narrow time window, thus ensuring system stability and reliability. In other specific implementations of this invention, the preset maximum lifespan value can be adjusted according to the business's security level and concurrency pressure.

[0040] Every maximum survival period, the data pointer references of the two two-dimensional counting matrices are swapped, making the original two-dimensional counting matrix of the current period the two-dimensional counting matrix of the previous period, and the original two-dimensional counting matrix of the previous period the new two-dimensional counting matrix of the current period. Then, all slot count values ​​in the new two-dimensional counting matrix of the current period are reset to zero. In this way, the system retains the statistical information of the two most recent consecutive time windows at any given time.

[0041] Preferably, in this embodiment of the invention, the method for extracting the number of concurrent repetitions includes: Multiple independent non-cryptographic hash functions are used to perform multiple mappings on the unique identifier of the credential, respectively locating the corresponding slots in the current period's two-dimensional counting matrix and the previous period's two-dimensional counting matrix. The count values ​​of the corresponding slots in the two two-dimensional counting matrices are added together to obtain multiple comprehensive frequency values, and the minimum value of the multiple comprehensive frequency values ​​is taken as the concurrent repetition count.

[0042] Since the number of slots in a two-dimensional counting matrix is ​​finite, while the value space of a unique voucher identifier is almost infinite, different hash mappings will inevitably collide. That is, multiple different unique voucher identifiers will be mapped to the same slot, causing the count value of that slot to be collectively inflated. If the original count value of a slot is read directly, the actual number of occurrences of a single voucher will be significantly overestimated.

[0043] To obtain accurate concurrent repetition counts in a hash collision environment, this invention employs an estimation method combining multiple hashing and minimum value taking. Specifically, multiple independent hash functions are pre-configured; these hash functions are all non-cryptographic hash functions, such as different seed variants of the MurmurHash algorithm family. Non-cryptographic hash functions are characterized by fast computation speed, uniform distribution, and no requirement for collision-resistant cryptographic strength, making them suitable for use in high-frequency concurrent statistical scenarios. Each hash function independently maps the unique identifier of the credential to a column coordinate in a matrix. Combined with preset row coordinates (each hash function corresponds to a fixed row number), a unique slot can be located in the matrix. Whenever a microservice node receives and processes an access credential, it uses the multiple independent hash functions to map the current unique identifier of the credential and locate the corresponding slot in the current periodic two-dimensional counting matrix, then increments the count value in all located slots.

[0044] Since there are two two-dimensional counting matrices, one for the current period and one for the previous period, it is necessary to simultaneously read the slot count values ​​at the same row and column positions in both matrices and add them together. The purpose of adding them is to include duplicate submissions that cross the window boundary in the statistics: if a request appears once at the end of the previous period and once at the beginning of the current period, each of the two two-dimensional counting matrices records one instance, and the sum reflects the actual two repetitions. After mapping through all hash functions, several comprehensive frequency values ​​are obtained, equal to the number of hash functions.

[0045] In this set of composite frequency values, the different hash functions are independent of each other. A particular voucher may collide with other vouchers under a certain hash function (causing the slot count to be higher), but the probability of a particular voucher colliding with a large number of other vouchers simultaneously across all hash functions is extremely low. The minimum value among the multiple composite frequency values ​​is closest to the actual, collision-free occurrence count of a particular voucher, while the maximum value is likely to contain severe collision interference. Therefore, the minimum value of the composite frequency values ​​is selected as the concurrent repetition count.

[0046] Preferably, in this embodiment of the invention, the method for obtaining the abnormal concurrency weight includes: The total number of circulation nodes, total dwell time, number of concurrent repetitions, and dimensional alignment weight coefficients after incremental correction are multiplied together to obtain the abnormal concurrency weight; the dimensional alignment weight coefficient is a pre-configured empirical scalar.

[0047] The initial value of the total number of circulation nodes is zero. If the product is multiplied directly without correction, the product will always be zero regardless of the total dwell time and the number of concurrent repetitions. In a specific implementation method of this invention, the product is prevented from always being zero by incrementally correcting the total number of circulation nodes. Specifically, the total number of circulation nodes is incremented by 1, so that the corrected value starts from 1. This preserves the contribution of each factor and avoids the invalidation caused by a zero value.

[0048] The dimensional alignment weighting coefficient is a pre-configured empirical scalar designed to eliminate scale differences between different physical dimensions. Since the total dwell time is measured in milliseconds and can reach thousands of milliseconds, far exceeding other factors, it would dominate the product without scaling, causing the influence of other parameters to be ignored. The dimensional alignment weighting coefficient, being a decimal less than 1, compresses the total dwell time from the millisecond level to a similar order of magnitude as the other factors, thus ensuring a more balanced contribution from the four factors in the product.

[0049] The method for obtaining the dimensional alignment weight coefficient is empirical calibration. The total dwell time can reach several thousand milliseconds, while the total number of flow nodes is usually several to tens. The normal concurrent repetition count is 1. The system wants the abnormal concurrency weight to remain low (e.g., not exceeding 100) under normal scenarios. Therefore, the dimensional alignment weight coefficient is set to 0.001, with units of 1. This ensures that the product of the total dwell time and the total dwell time maintains the same dimensions.

[0050] Preferably, in this embodiment of the invention, the method for obtaining the idle computing power weight includes: The static scheduling judgment value is used as the numerator, and the backlog of tasks after incrementing by one is used as the denominator. A division operation is then performed to obtain the weight of idle computing power.

[0051] Using the static scheduling judgment value as the numerator provides a benchmark range for the idle computing power weight that matches the sensitivity of the business interface. Interfaces with higher static scheduling judgment values ​​will receive a larger idle computing power weight for the same number of backlogged tasks, so that the idle computing power weight not only reflects the hardware status but also reflects the tolerance of the business interface to security degradation.

[0052] The backlog of tasks is a non-negative integer. A smaller backlog indicates less idle hardware, while a larger backlog indicates more congested hardware. A backlog of zero indicates that the hardware is completely idle, with no tasks in the queue. Increasing the backlog by one is used as the denominator to avoid division by zero errors. Furthermore, the increment operation does not significantly affect the calculation result when the denominator is large, as the slight relative difference in the denominator is negligible when the backlog is very large.

[0053] Preferably, in this embodiment of the invention, the method for obtaining the dynamic verification judgment value includes: The abnormal concurrency weight and the idle computing power weight are added together to obtain a dynamic verification judgment value.

[0054] The abnormal concurrency weight reflects the risk level of the request itself; a larger value indicates a more suspicious request. The idle computing power weight reflects the idle level of the underlying cryptographic hardware; a larger value indicates that the hardware is more capable of performing high-strength asymmetric signature verification. The sum of these two values ​​results in a dynamic verification judgment value that carries both aspects of information, keeping it low during normal business congestion and increasing when the hardware is idle or under attack. In a specific implementation of this invention, the dynamic verification judgment value is expressed by the formula: ; in, Indicates the dynamic verification judgment value; Indicates the total duration of stay; Indicates the dimensional alignment weighting coefficient; Indicates the total number of nodes in the circulation process; Indicates the number of concurrent repetitions; Indicates the static scheduling decision value; Indicates the number of backlogged tasks; Indicates abnormal concurrency weights; This indicates the weight of idle computing power.

[0055] Preferably, in this embodiment of the invention, the branch verification process includes: When the dynamic verification judgment value is less than the static scheduling judgment value, the national cryptographic SM3 hash algorithm is executed to calculate the instant hash value of the current request body. The instant hash value is compared with the original message hash value. If the comparison matches, a valid release command is issued. If the comparison does not match, the request is blocked. When the dynamic verification judgment value is greater than or equal to the static scheduling judgment value, the concurrent repetition count is compared with the preset abnormal concurrency threshold. If the concurrent repetition count is less than the abnormal concurrency threshold, the underlying commercial cryptographic service platform is invoked to perform the national cryptographic SM2 asymmetric signature verification in combination with the user's public key identifier. After the signature verification is successful, a valid release instruction is issued. If the concurrent repetition count is greater than or equal to the abnormal concurrency threshold, a re-signature request message is returned to the terminal.

[0056] When the dynamic verification judgment value is less than the static scheduling judgment value, the system determines that it is currently in a normal business congestion state, with severe queuing in the underlying cryptographic hardware and no obvious replay attack characteristics. At this time, the microservice node does not forward the request to the hardware for asymmetric signature verification, but instead calls the local national cryptographic SM3 hash algorithm.

[0057] The national cryptographic standard SM3 is a lightweight hash operation with high computational efficiency, capable of being completed quickly on a local processor without requiring the use of underlying commercial cryptographic system hardware, thus relieving hardware computing power pressure. In this branch's verification process, the role of SM3 is to verify data integrity. The hash value of the current request body is calculated immediately and compared with the original message hash value in the identity access credential. Since the unified application gateway has already performed national cryptographic standard SM2 identity verification and generated the original hash value on the original request data when issuing the credential, its legality and integrity can be confirmed as long as it is proven that the current request body has not been tampered with during subsequent intranet transfers.

[0058] When the dynamic verification judgment value is greater than or equal to the static scheduling judgment value, two scenarios may exist: the underlying hardware computing power is idle, or the system is under replay attack. In this case, the branch process further calls the national cryptographic SM2 algorithm in two different ways based on the comparison result between the number of concurrent repetitions and the preset abnormal concurrency threshold. The abnormal concurrency threshold ranges from 3 to 10, with a common value of 5.

[0059] When the number of concurrent repetitions is less than the abnormal concurrency threshold, it indicates that the hardware is idle. At this time, the main reason for the dynamic verification judgment value exceeding the standard is that the number of backlogged tasks is very small, resulting in a large weight of idle computing power. The system directly calls the underlying commercial cryptographic service platform and performs national cryptographic SM2 asymmetric signature verification on the current request in combination with the user's public key identifier.

[0060] The Chinese national cryptographic standard SM2 is an asymmetric cryptographic algorithm based on elliptic curve public-key cryptography, capable of verifying digital signatures. Since the backlog of tasks is small and the underlying cryptographic hardware has available computing power, executing SM2 signature verification will not cause congestion.

[0061] When the number of concurrent repetitions exceeds or equals the abnormal concurrency threshold, it indicates that the system is under replay attack. The dominant factor causing this exceeding of the threshold is a sharp increase in the number of concurrent repetitions, indicating that the attacker is replaying old credentials at high frequency. The system forces a re-signing request message to the terminal, requiring it to re-sign the message containing the latest timestamp using a valid private key. This achieves adaptive scheduling of two national cryptographic algorithms: relying on the lightweight national cryptographic algorithm SM3 to ensure efficiency in low-risk, high-load scenarios; and relying on national cryptographic algorithm SM2 to ensure security in idle or high-attack-risk scenarios, thus achieving an overall balance between security and availability.

[0062] For example, when the dimensional alignment weight coefficient is set to 0.001, the static scheduling judgment value is 500, and the abnormal concurrency threshold is 5, under normal business congestion scenarios, if the total number of flow nodes is 4, the total dwell time is 2000 milliseconds, the number of concurrent repetitions is 1, the number of backlogged tasks is 100, and the dynamic verification judgment value is approximately 14.95, which is less than 500, triggering the local national cryptographic SM3 hash comparison fast branch; In a scenario where the hardware is completely idle and the request is normal, if the total number of circulation nodes is 3, the total dwell time is 1500 milliseconds, the number of concurrent repetitions is 1, the number of backlogged tasks is 0, and the dynamic verification judgment value is approximately 506, which is greater than or equal to 500 and the number of concurrent repetitions is less than 5, the underlying commercial cryptographic service platform is directly called to execute the national cryptographic SM2 asymmetric signature verification. In the scenario of being subjected to a replay attack, if the total number of circulation nodes is 4, the total dwell time is 2000 milliseconds, the number of concurrent repetitions is 200, the number of backlogged tasks is 100, and the dynamic verification judgment value is approximately 2004.95, which is greater than or equal to 500 and the number of concurrent repetitions is greater than or equal to 200, a resigning request message will be forcibly returned to the terminal. In a scenario with light hardware load, if the total number of flow nodes is 2, the total dwell time is 1000 milliseconds, the number of concurrent repetitions is 1, the number of backlogged tasks is 1, and the dynamic verification judgment value is approximately 253, which is less than 500, the local national cryptographic SM3 downgrade release branch is triggered. In a legitimate long session scenario where hardware is idle but the total dwell time is relatively long, if the total number of transfer nodes is 6, the total dwell time is 3000 milliseconds, the number of concurrent repetitions is 1, the number of backlogged tasks is 0, and the dynamic verification judgment value is approximately 521, which is greater than or equal to 500 and the number of concurrent repetitions is 1 less than 5, the national cryptographic SM2 asymmetric signature verification is executed directly.

[0063] In summary, this invention, by introducing a mechanism where microservice nodes update the total dwell time and the total number of routing nodes point by point, eliminates the dependence on the synchronization accuracy of the network time protocol. This ensures that the total dwell time is always non-negative and accurately reflects the actual survival and queuing time of the credentials within the system, thus eliminating the risk of misjudgment caused by clock synchronization errors. Furthermore, this invention extracts the number of concurrent repetitions through a rotation mechanism using a double-buffered two-dimensional counting matrix, and uses this as the core penalty factor for abnormal concurrency weights, effectively solving the problem of fixed degradation strategies being vulnerable to replay attacks. Moreover, by adding the abnormal concurrency weights to the idle computing power weights to obtain a dynamic verification judgment value, it achieves adaptive differentiation between normal business congestion and replay attacks, reducing network and computational losses, while implementing the strongest blocking when an attack occurs, ensuring the high availability and security of unified identity authentication.

[0064] It should be noted that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the protection scope of the present invention.

Claims

1. A unified identity authentication method for information systems based on national cryptographic algorithms, characterized in that, The method includes: Obtain identity access credentials, update the total dwell time of identity access credentials and the total number of flow nodes node by node during the microservice node flow process, and obtain the current backlog of tasks; A double-buffered two-dimensional counting matrix is ​​constructed based on a timed rotation mechanism to extract the concurrent repetition count of identity access credentials; Obtain the static scheduling judgment value of the current business interface, comprehensively analyze the total dwell time, the total number of flow nodes and the number of concurrent repetitions, and generate abnormal concurrency weights; determine the idle computing power weight based on the number of backlogged tasks and the static scheduling judgment value, and combine the abnormal concurrency weight and the idle computing power weight to obtain the dynamic verification judgment value; The dynamic verification judgment value is compared with the static scheduling judgment value to perform the branch verification process.

2. The unified identity authentication method for an information system based on national cryptographic algorithms according to claim 1, characterized in that, The identity access credentials include: The credentials include a unique identifier, the original message hash value, the user's public key identifier, the total number of transit nodes, and the total dwell time. The original message hash value is obtained by performing a one-way hash calculation on the original data using the national cryptographic SM3 hash algorithm.

3. The unified identity authentication method for an information system based on national cryptographic algorithms according to claim 1, characterized in that, The initial value of the total dwell time is zero milliseconds, which is obtained by summing the dwell time of each microservice node.

4. The unified identity authentication method for an information system based on national cryptographic algorithms according to claim 1, characterized in that, The initial value of the total number of transfer nodes is zero. The total number of transfer nodes increases by one each time a microservice node is passed.

5. The unified identity authentication method for an information system based on national cryptographic algorithms according to claim 2, characterized in that, The construction of a double-buffered two-dimensional counting matrix based on a timed rotation mechanism includes: The microservice node is configured with a timed rotation task that is consistent with the preset maximum lifespan. When the timed rotation task is triggered, the data pointer references of the current period two-dimensional counting matrix and the previous period two-dimensional counting matrix are swapped, and the count values ​​of all slots in the new current period two-dimensional counting matrix are reset to zero.

6. The unified identity authentication method for an information system based on national cryptographic algorithms according to claim 5, characterized in that, The method for extracting the concurrent repetition count includes: Multiple independent non-cryptographic hash functions are used to perform multiple mappings on the unique identifier of the credential, respectively locating the corresponding slots in the current period's two-dimensional counting matrix and the previous period's two-dimensional counting matrix. The count values ​​of the corresponding slots in the two two-dimensional counting matrices are added together to obtain multiple comprehensive frequency values, and the minimum value of the multiple comprehensive frequency values ​​is taken as the concurrent repetition count.

7. The unified identity authentication method for an information system based on national cryptographic algorithms according to claim 1, characterized in that, The method for obtaining the abnormal concurrency weight includes: The total number of circulation nodes, total dwell time, number of concurrent repetitions, and dimensional alignment weight coefficients after incremental correction are multiplied together to obtain the abnormal concurrency weight; the dimensional alignment weight coefficient is a pre-configured empirical scalar.

8. The unified identity authentication method for an information system based on national cryptographic algorithms according to claim 1, characterized in that, The method for obtaining the idle computing power weight includes: The static scheduling judgment value is used as the numerator, and the backlog of tasks after incrementing by one is used as the denominator. A division operation is then performed to obtain the weight of idle computing power.

9. A unified identity authentication method for an information system based on national cryptographic algorithms according to claim 1, characterized in that, The method for obtaining the dynamic verification judgment value includes: The abnormal concurrency weight and the idle computing power weight are added together to obtain a dynamic verification judgment value.

10. A unified identity authentication method for an information system based on national cryptographic algorithms according to claim 2, characterized in that, The branch inspection process includes: When the dynamic verification judgment value is less than the static scheduling judgment value, the national cryptographic SM3 hash algorithm is executed to calculate the instant hash value of the current request body. The instant hash value is compared with the original message hash value. If the comparison matches, a valid release command is issued. If the comparison does not match, the request is blocked. When the dynamic verification judgment value is greater than or equal to the static scheduling judgment value, the concurrent repetition count is compared with the preset abnormal concurrency threshold. If the concurrent repetition count is less than the abnormal concurrency threshold, the underlying commercial cryptographic service platform is invoked to perform the national cryptographic SM2 asymmetric signature verification in combination with the user's public key identifier. After the signature verification is successful, a valid release instruction is issued. If the concurrent repetition count is greater than or equal to the abnormal concurrency threshold, a re-signature request message is returned to the terminal.

Images