A user authentication and authorization system based on a Beidou short message

Abstract

This invention discloses a user authentication and authorization system based on BeiDou short messages, comprising: a BeiDou hardware terminal, set on the user side, which includes a radio frequency module, a baseband processor, an encryption module, and a power management unit, and has a built-in BeiDou bidirectional transmission card with a unique identifier; a hardware verification server, set on the authentication service side, which includes a device identity verification engine and a time-bound authentication code generator; and a satellite authentication channel, established through a BeiDou satellite link. Through the hardware-level strong binding between the BeiDou hardware terminal and the user ID, combined with the physical isolation characteristics of the satellite authentication channel, a two-factor authentication system resistant to network attacks is achieved by separating the authentication request and response paths. With the help of BeiDou's global coverage and short message capability, hardware authentication completely eliminates dependence on terrestrial networks and can still be reliably executed 24 / 7 in extreme environments such as oceans and remote areas.

Description

Technical Field

[0001] This invention belongs to the field of satellite communication technology, specifically a user authentication and authorization system based on BeiDou short message service. Background Technology

[0002] In current technologies, user authentication and authorization are evolving from traditional static password verification to hardware-based authentication using physical devices. Mainstream standards such as FIDO (Fast Identity Online Consortium) and WebAuthn (Web Authentication Specification) achieve strong authentication across the entire user identity hierarchy by binding the user's identity to a dedicated security key (such as a USB key or biometric module), effectively resisting traditional attack methods such as password leaks and brute-force attacks. However, these solutions still have significant shortcomings in terms of security and applicability.

[0003] First, existing hardware authentication schemes heavily rely on terrestrial networks (such as the internet and mobile communication networks) to complete verification interactions. From initiating the authentication request and transmitting the challenge code to sending back the verification result, the entire process must be conducted through terrestrial networks. If a user is in an area not covered by terrestrial networks (such as during ocean voyages, in the heart of deserts, or in border mountainous areas) or in a scenario with weak network infrastructure (such as emergency rescue sites or remote inspection stations), the authentication process will be interrupted due to the inability to communicate, preventing the user from completing identity verification and authorization. This dependence on terrestrial networks significantly reduces the usability of hardware authentication technology in highly mobile and extreme environments.

[0004] Secondly, while existing solutions employ hardware binding, the request and response paths for authentication information are often transmitted within the same network channel, completely exposed to the terrestrial network environment. Attackers can still steal or tamper with authentication interaction data between users and authentication servers through man-in-the-middle attacks, DNS hijacking, phishing website forgery, session hijacking, and other methods. Although the communication process typically uses encryption protocols such as TLS, the encrypted channel itself can still be breached by downgrade attacks, certificate forgery, or endpoint hijacking, failing to fundamentally eliminate network-level security risks. Furthermore, common attack methods targeting authentication protocols, such as replay attacks and CAPTCHA theft, still pose a threat to existing solutions.

[0005] In summary, existing hardware-based authentication technologies have inherent shortcomings in terms of security and environmental adaptability, making it difficult to simultaneously meet the reliable authentication needs of scenarios with high security requirements and extreme offline environments. Summary of the Invention

[0006] The technical solution adopted in this invention is as follows: A user authentication and authorization system based on BeiDou short message service, comprising:

[0007] The Beidou hardware terminal is located on the user side and includes a radio frequency module, a baseband processor, an encryption module and a power management unit, and has a built-in Beidou two-way transmission card with a unique identifier.

[0008] The hardware verification server, located on the authentication service side, includes a device authentication engine and a time-bound authentication code generator;

[0009] The satellite authentication channel is established via the BeiDou satellite link;

[0010] The hardware verification server communicates with the BeiDou hardware terminal via the satellite authentication channel using encrypted communication.

[0011] The signal input terminal of the satellite authentication channel is connected to the signal output terminal of the hardware verification server, and the signal output terminal of the satellite authentication channel is connected to the signal input terminal of the radio frequency module of the Beidou hardware terminal.

[0012] The signal output terminal of the radio frequency module is connected to the signal input terminal of the baseband processor. The baseband processor and the encryption module are bidirectionally connected. The signal output terminal of the encryption module is also connected to the signal input terminal of the radio frequency module, so as to transmit the decrypted response information back to the hardware verification server through the satellite authentication channel.

[0013] The signal output terminal of the time-bound authentication code generator is connected to the first signal input terminal of the device authentication engine, and is used to generate a dynamic authentication code associated with the current session, device characteristics, and timestamp;

[0014] The second signal input terminal of the device authentication engine is used to receive the authentication credential returned from the Beidou hardware terminal. The device authentication engine is used to verify the timeliness, consistency and device feature matching of the authentication credential.

[0015] Furthermore, the hardware verification server also includes a security database for storing binding records formed by cryptographically binding the user ID with the unique hardware feature code of the Beidou hardware terminal.

[0016] Furthermore, the dynamic authentication code is encrypted using the SM4 algorithm and then transmitted through the satellite authentication channel.

[0017] Furthermore, the device authentication engine verifies the validity period of the authentication credentials within a window of 2 to 5 minutes.

[0018] Furthermore, the unique hardware feature code includes the Beidou card number, the security chip serial number, and the device fingerprint.

[0019] Furthermore, the authentication information transmission path of the satellite authentication channel is physically isolated from the business network.

[0020] Furthermore, the authentication request path issued by the hardware verification server and the authentication response path returned by the BeiDou hardware terminal are separated through the BeiDou satellite link.

[0021] Furthermore, the Beidou hardware terminal displays dynamic authentication information to the user after local decryption, and the encryption module independently completes encryption operations and identity verification.

[0022] Furthermore, after successful verification, the hardware verification server confirms that the user simultaneously meets both knowledge and physical factors, thus completing strong two-factor authentication.

[0023] A user authentication and authorization method based on any one of the above-described systems includes the following steps:

[0024] S1: Hardware identity binding initialization, cryptographically binding the user ID with the unique hardware feature code of the Beidou hardware terminal to form a binding record and storing it in the secure database of the hardware verification server;

[0025] S2: When a user initiates an authentication request and hardware-level verification is required, the hardware verification server starts the Beidou authentication mode.

[0026] S3: The time-bound authentication code generator generates a dynamic authentication code associated with the current session, device characteristics, and timestamp, and encrypts it using the SM4 algorithm;

[0027] S4: The hardware verification server sends the encrypted authentication command to the Beidou hardware terminal bound to the user through the satellite authentication channel;

[0028] S5: The radio frequency module of the Beidou hardware terminal receives the authentication command, transmits it to the encryption module through the baseband processor for local decryption, and displays dynamic authentication information to the user after verifying the legality of the command.

[0029] S6: The user obtains and inputs authentication information from the Beidou hardware terminal. The device authentication engine decrypts and compares the received authentication credentials to verify their timeliness, consistency with the original generated information, and device feature matching.

[0030] S7: After successful verification, the hardware verification server confirms that the user meets both the knowledge factor and the physical factor requirements, thus completing strong two-factor authentication.

[0031] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0032] (1) This invention achieves two-factor authentication based on strong physical device ownership by binding the Beidou hardware terminal with the user ID in a “one person, one device” cryptographic binding, combined with the device authentication engine and time-bound authentication code generator in the hardware verification server. This makes it necessary for attackers to obtain both the user password and the specific Beidou hardware terminal to pass the verification. Furthermore, since the Beidou hardware terminal has multiple feature codes such as a unique Beidou card number, security chip serial number, and device fingerprint, it is extremely difficult to counterfeit the hardware, which significantly improves the security and non-repudiation of user authentication.

[0033] (2) This invention utilizes the BeiDou satellite link to establish a satellite authentication channel, which separates the authentication request path from the response path at the physical level and completely isolates it from the ground service network, fundamentally eliminating traditional network threats such as man-in-the-middle attacks, DNS hijacking, phishing attacks, and replay attacks. At the same time, the dynamic authentication code is encrypted and transmitted using the SM4 national cryptographic algorithm, and a time window of 2-5 minutes is set, which further ensures the confidentiality, integrity, and freshness of the authentication information, and constructs a security protection system that far exceeds traditional network authentication schemes.

[0034] (3) By leveraging the global coverage and short message communication capabilities of the BeiDou system, this invention enables hardware authentication to completely break free from dependence on terrestrial network infrastructure. Even in areas with no or weak networks, such as ocean voyages, border patrols, emergency rescues, and deserts, users can still complete identity verification and authorization normally, achieving reliable authentication protection in all weather and all terrains. This upgrades hardware authentication from "network-dependent" to "satellite-enhanced", greatly expanding the scope of application of high-security authentication.

[0035] (4) The Beidou hardware terminal in this invention has a built-in encryption module that can independently complete local decryption, instruction legality verification and dynamic authentication information display. It can provide authentication credentials to users without relying on any external devices or network services. After the hardware verification server passes the verification, it simultaneously confirms knowledge factors and physical factors. The entire authentication process achieves end-to-end encrypted interaction through the Beidou satellite link, which not only ensures availability in extreme environments, but also strengthens the independence of identity verification in the "user-owned" dimension, and achieves a high degree of unity between security and availability. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the overall system architecture of the present invention;

[0037] Figure 2 This is a schematic diagram of the Beidou hardware terminal of the present invention;

[0038] Figure 3 This is a flowchart illustrating the hardware verification server of the present invention.

[0039] Figure 4This is a schematic diagram of the satellite authentication channel of the present invention.

[0040] In the diagram: 1. Beidou hardware terminal; 2. Hardware verification server; 3. Satellite authentication channel. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0042] Example 1, please refer to Figure 1 - Figure 4 :

[0043] A user authentication and authorization system based on BeiDou short message service includes: a BeiDou hardware terminal 1, located on the user side, comprising a radio frequency module, a baseband processor, an encryption module, and a power management unit, and a built-in BeiDou bidirectional transmission card with a unique identifier; a hardware verification server 2, located on the authentication service side, comprising a device authentication engine and a time-bound authentication code generator; and a satellite authentication channel 3, established via a BeiDou satellite link. The hardware verification server 2 communicates encrypted with the BeiDou hardware terminal 1 through the satellite authentication channel 3. The signal input of the satellite authentication channel 3 is connected to the signal output of the hardware verification server 2, and the signal output of the satellite authentication channel 3 is connected to the signal input of the radio frequency module of the BeiDou hardware terminal 1. The output terminal connects to the signal input terminal of the baseband processor. The baseband processor and the encryption module are bidirectionally connected. The signal output terminal of the encryption module is also connected to the signal input terminal of the radio frequency module to transmit the decrypted response information back to the hardware verification server 2 via satellite authentication channel 3. The signal output terminal of the time-bound authentication code generator is connected to the first signal input terminal of the device authentication engine to generate a dynamic authentication code associated with the current session, device characteristics, and timestamp. The second signal input terminal of the device authentication engine is used to receive the authentication credential returned from the Beidou hardware terminal 1. The device authentication engine is used to verify the timeliness, consistency, and device characteristic matching of the authentication credential. The Beidou hardware terminal 1 uses a built-in Beidou bidirectional transmission card with a unique identifier. Working in conjunction with the RF module, baseband processor, encryption module, and power management unit, it achieves a strong hardware-level binding between the user's digital identity and the physical device, making identity spoofing extremely difficult. Simultaneously, the encryption module can independently perform encryption operations and identity verification, ensuring that the device can still function as an autonomous satellite communication node to perform local decryption and response even offline or in extreme environments, enhancing the independence of authentication across the "user-owned" dimension. The time-bound authentication code generator in hardware verification server 2 generates dynamic authentication codes associated with the current session, device characteristics, and timestamp, and works with the device identity verification engine to verify the timeliness (2-5 minute valid window), consistency, and device characteristic matching of the returned credentials, effectively preventing replay attacks and ensuring successful verification. Afterwards, it is confirmed that the user simultaneously meets both the knowledge factor (password) and the physical factor (hardware possession), forming a strong two-factor authentication. Satellite authentication channel 3 is established through the BeiDou satellite link. Its signal input end is connected to the signal output end of the hardware verification server 2, and its signal output end is connected to the signal input end of the radio frequency module of the BeiDou hardware terminal 1. This physically separates the authentication request path from the response path and completely isolates it from the business network, thereby avoiding common man-in-the-middle attacks, phishing attacks, and replay attacks common in terrestrial networks. At the same time, with the help of the global coverage and short message encryption transmission mechanism of the BeiDou system, hardware authentication is freed from dependence on terrestrial infrastructure. It can still be reliably executed 24 / 7 and in all terrains in scenarios with no network or weak network, such as ocean navigation, border inspection, and emergency rescue.This upgrade of hardware authentication from "network-dependent" to "satellite-enhanced" significantly improves the security and usability of authentication.

[0044] Please see Figure 1 - Figure 4 Hardware verification server 2 uses a built-in security database to cryptographically bind user IDs with the unique hardware feature code of Beidou hardware terminal 1, forming a "one person, one device" binding record. This strengthens the strong association between identity and physical device from the server side, preventing identity impersonation and account theft, ensuring that each authentication is based on a legitimately bound physical device, and improving the non-repudiation of authentication. The dynamic authentication code is encrypted using the SM4 algorithm and transmitted through satellite authentication channel 3. SM4, as a national cryptographic algorithm, provides independent and controllable high-strength encryption protection, ensuring the confidentiality and integrity of authentication commands during satellite link transmission, preventing eavesdropping and tampering. The device authentication engine verifies the validity window of authentication credentials for 2 to 5 minutes. This time window ensures the rationality of user operations while effectively limiting the feasible time range for replay attacks, achieving a balance between security and ease of use. The unique hardware feature code includes the Beidou card number, security chip serial number, and device fingerprint. The joint binding of multiple feature codes further enhances the uniqueness of device identification and the difficulty of forgery, making it difficult for attackers to counterfeit the hardware terminal using a single feature. The authentication information transmission path of satellite authentication channel 3 is physically isolated from the business network, completely separating the authentication process from the terrestrial internet. This fundamentally eliminates the risks of man-in-the-middle attacks, DNS hijacking, and phishing websites at the network layer, forming a natural security barrier. The authentication request path sent by hardware verification server 2 and the authentication response path returned by Beidou hardware terminal 1 are separated through the Beidou satellite link. This separation of request and response paths greatly increases the difficulty for attackers to intercept or tamper with both simultaneously, enhancing the anti-attack capability of the authentication protocol. After local decryption, Beidou hardware terminal 1 displays dynamic authentication information to the user, and the encryption module independently completes encryption calculations and identity verification, allowing users to obtain authentication credentials without relying on any network services. At the same time, local independent calculations avoid the risk of sensitive information leakage outside the terminal. After successful verification, hardware verification server 2 confirms that the user simultaneously meets both knowledge and physical factors, completing strong two-factor authentication. This two-factor superposition mechanism ensures that even if the password is leaked, attackers cannot pass authentication without the corresponding physical hardware, significantly improving the overall security level of the system.

[0045] Please see Figure 1 - Figure 4A user authentication and authorization method based on any one of the above systems includes the following steps: S1: Hardware identity binding initialization, cryptographically binding the user ID with the unique hardware feature code of the Beidou hardware terminal 1 to form a binding record and storing it in the security database of the hardware verification server 2; S2: When the user initiates an authentication request and hardware-level verification is required, the hardware verification server 2 starts the Beidou authentication mode; S3: The time-bound authentication code generator generates a dynamic authentication code associated with the current session, device features, and timestamp, and encrypts it using the SM4 algorithm; S4: The hardware verification server 2 sends the encrypted authentication command to the user-bound Beidou hardware terminal 1 through the satellite authentication channel 3; S5: The radio frequency mode of the Beidou hardware terminal 1... The block receives the authentication command, transmits it to the encryption module via the baseband processor for local decryption, and displays dynamic authentication information to the user after verifying the command's legality. S6: The user obtains and inputs authentication information from the Beidou hardware terminal 1. The device's authentication engine decrypts and compares the received authentication credentials, verifying their timeliness, consistency with the original generated information, and device feature matching. S7: After successful verification, the hardware authentication server 2 confirms that the user simultaneously meets both knowledge and physical factors, completing strong two-factor authentication. Step S1 establishes an undeniable "one person, one device" authentication by cryptographically binding the user ID with the unique hardware feature code of the Beidou hardware terminal 1, forming a binding record, and storing it in the secure database of the hardware authentication server 2. The binding relationship provides a physical-level root of trust for all subsequent authentication operations, making identity spoofing require simultaneous acquisition of the user account and specific hardware device, resulting in extremely high attack costs. In step S2, when the user initiates an authentication request and hardware-level verification is required, the hardware verification server 2 activates the BeiDou authentication mode. This mode can flexibly enable hardware verification according to the security requirements of the application scenario, avoiding unnecessary authentication overhead, while ensuring that hardware factors are forcibly enabled in high-security scenarios. In step S3, the time-bound authentication code generator generates a dynamic authentication code associated with the current session, device characteristics, and timestamp, and encrypts it using the SM4 algorithm, combining session binding, device binding, and time binding into one, making each authentication code valid only for the current specific session and device. Even if intercepted, the authentication code cannot be reused on other devices or at other times. SM4 national cryptographic encryption further ensures that the authentication code is protected at the source of generation. In step S4, the encrypted authentication command is sent to the user-bound Beidou hardware terminal 1 through satellite authentication channel 3. Utilizing the physical isolation and wide-area coverage characteristics of the Beidou satellite link, the transmission of the authentication command does not rely on any terrestrial network, avoiding the risk of authentication unavailability due to network congestion, network outages, or attacks. In step S5, after receiving the authentication command, the radio frequency module of Beidou hardware terminal 1 transmits it to the encryption module via the baseband processor for local decryption and verification of the command's legality before displaying dynamic authentication information to the user. The entire decryption and verification process is completed independently within the hardware terminal, without exposing any sensitive information to external devices or applications.The end-to-end security of the "challenge-response" mechanism is ensured. In step S6, the user obtains and inputs authentication information from the Beidou hardware terminal 1. The device authentication engine decrypts and compares the received authentication credentials, verifying their timeliness, consistency with the original generated information, and device feature matching. This triple verification mechanism ensures the authenticity, freshness, and device binding relationship of the authentication credentials. Failure in any step will result in rejection. After successful verification in step S7, the hardware verification server 2 confirms that the user simultaneously meets both knowledge factors (e.g., password) and physical factors (hardware possession), completing strong two-factor authentication. This two-factor mechanism based on the Beidou hardware terminal adds the physical isolation characteristics of the satellite channel and the unique identification characteristics of the hardware device to the traditional two-factor authentication. This ensures that even if an attacker controls the user's knowledge factors, they cannot bypass the hardware verification. Furthermore, since the authentication signaling is transmitted entirely through the Beidou satellite, any attack methods on the ground network cannot interfere with or steal the authentication process. Therefore, it can still provide secure and reliable authentication and authorization services in extreme environments such as oceans, border areas, and emergency rescue.

[0046] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A user authentication and authorization system based on BeiDou short message service, characterized in that, include: The Beidou hardware terminal (1) is set on the user side and includes a radio frequency module, a baseband processor, an encryption module and a power management unit, and has a built-in Beidou bidirectional transmission card with a unique identifier. The hardware verification server (2) is set on the authentication service side, and includes a device authentication engine and a time-bound authentication code generator; Satellite authentication channel (3) is established through the BeiDou satellite link; The hardware verification server (2) communicates with the Beidou hardware terminal (1) in encrypted form through the satellite authentication channel (3); The signal input terminal of the satellite authentication channel (3) is connected to the signal output terminal of the hardware verification server (2), and the signal output terminal of the satellite authentication channel (3) is connected to the signal input terminal of the radio frequency module of the Beidou hardware terminal (1). The signal output terminal of the radio frequency module is connected to the signal input terminal of the baseband processor. The baseband processor is bidirectionally connected to the encryption module. The signal output terminal of the encryption module is also connected to the signal input terminal of the radio frequency module so as to transmit the decrypted response information back to the hardware verification server (2) through the satellite authentication channel (3). The signal output terminal of the time-bound authentication code generator is connected to the first signal input terminal of the device authentication engine, and is used to generate a dynamic authentication code associated with the current session, device characteristics, and timestamp; The second signal input terminal of the device authentication engine is used to receive the authentication credential returned from the Beidou hardware terminal (1), and the device authentication engine is used to verify the timeliness, consistency and device feature matching of the authentication credential.

2. The user authentication and authorization system based on BeiDou short message service according to claim 1, characterized in that, The hardware verification server (2) also includes a security database for storing binding records formed by cryptographically binding the user ID with the unique hardware feature code of the Beidou hardware terminal (1).

3. A user authentication and authorization system based on BeiDou short message service according to claim 1, characterized in that, The dynamic authentication code is encrypted using the SM4 algorithm and then transmitted through the satellite authentication channel (3).

4. A user authentication and authorization system based on BeiDou short message service according to claim 1, characterized in that, The device authentication engine verifies the validity period of the authentication credentials within 2 to 5 minutes.

5. A user authentication and authorization system based on BeiDou short message service according to claim 2, characterized in that, The unique hardware feature code includes the Beidou card number, the security chip serial number, and the device fingerprint.

6. A user authentication and authorization system based on BeiDou short message service according to claim 1, characterized in that, The authentication information transmission path of the satellite authentication channel (3) is physically isolated from the business network.

7. A user authentication and authorization system based on BeiDou short message service according to claim 1, characterized in that, The authentication request path issued by the hardware verification server (2) and the authentication response path returned by the Beidou hardware terminal (1) are separated through the Beidou satellite link.

8. A user authentication and authorization system based on BeiDou short message service according to claim 1, characterized in that, The Beidou hardware terminal (1) displays dynamic authentication information to the user after local decryption, and the encryption module independently completes encryption calculation and identity verification.

9. A user authentication and authorization system based on BeiDou short message service according to claim 1, characterized in that, After the hardware verification server (2) passes the verification, it confirms that the user meets both the knowledge factor and the physical factor, thus completing the strong two-factor authentication.

10. A user authentication and authorization method based on the system according to any one of claims 1 to 9, characterized in that, Includes the following steps: S1: Hardware identity binding initialization, cryptographically binding the user ID with the unique hardware feature code of the Beidou hardware terminal (1) to form a binding record and store it in the security database of the hardware verification server (2); S2: When a user initiates an authentication request and hardware-level verification is required, the hardware verification server (2) starts the Beidou authentication mode; S3: The time-bound authentication code generator generates a dynamic authentication code associated with the current session, device characteristics, and timestamp, and encrypts it using the SM4 algorithm; S4: The hardware verification server (2) sends the encrypted authentication command to the Beidou hardware terminal (1) bound to the user through the satellite authentication channel (3). S5: The radio frequency module of the Beidou hardware terminal (1) receives the authentication command, transmits it to the encryption module through the baseband processor for local decryption, and displays dynamic authentication information to the user after verifying the legality of the command. S6: The user obtains and inputs authentication information from the Beidou hardware terminal (1). The device authentication engine decrypts and compares the received authentication credentials to verify their timeliness, consistency with the original generated information, and device feature matching. S7: After the verification is successful, the hardware verification server (2) confirms that the user meets both the knowledge factor and the physical factor, and completes the strong two-factor authentication.

Images