A password encryption method, system and readable medium based on masking transformation

Abstract

The application belongs to the technical field of information security and cryptography, and relates to a password encryption method and system based on masking transformation and a readable medium, comprising the following steps: establishing a password carrier library, performing masking transformation on the password carrier library, and generating at least one group of candidate carrier subsets; when a preset condition is met, decrypting and presenting the candidate carrier subsets, obtaining a carrier selection result by interactively selecting one or more candidate carriers in the candidate carrier subsets, and determining an input password according to the carrier selection result; and mapping the password to key derivation information or authentication information, and performing decryption, unpacking, unlocking protected data and / or authorizing sensitive operations on a target object according to the key derivation information or the authentication information. The application enables pictures or other private information to be used as password input carriers, significantly improves the trial cost of attackers on the premise of ensuring the availability of legitimate users, and supports two-level or higher-level hierarchical protection.

Description

Technical Field

[0001] This invention belongs to the field of information security and cryptography technology, and specifically relates to a password encryption method, system and readable medium based on masking transformation. Background Technology

[0002] Password encryption, as a fundamental mechanism for identity authentication and data confidentiality protection in cyberspace, relies on key derivation functions (KDF) to transform low-entropy, human-memorized passwords into high-entropy key material suitable for symmetric encryption. Traditional password encryption systems often use character passwords or fixed biometric features as input, making them vulnerable to offline dictionary attacks, credential stuffing attacks, phishing attacks, and social engineering attacks. Attacks can exhaustively search for all possible permutations and combinations of key features to obtain the key, thus reducing system security.

[0003] Existing technologies can improve system security through multi-step processes, i.e., multi-step authentication, such as terminal login verification, application login verification, and payment confirmation. However, attackers can still obtain the key for each layer by exhaustively trying all possible combinations of features at each layer, thereby gaining the key for the entire system. For example, if the first layer of features has 'a' combinations, the second layer has 'b' combinations, and the third layer has 'c' combinations, an attacker only needs to try a+b+c times to obtain the system key. Without multi-step processes, system security is even more compromised, and this contradicts the product goals of tiered protection and tiered confirmation. Summary of the Invention

[0004] To address the aforementioned problems, the purpose of this invention is to provide a password encryption method, system, and readable medium based on masking transformation, enabling images or other private information to serve as password input carriers. This significantly increases the probing cost for attackers while ensuring the availability of legitimate users, and supports secondary or higher-level hierarchical protection.

[0005] To achieve the above objectives, this invention proposes the following technical solution: a password encryption method based on masking transformation, comprising the following steps: establishing a password carrier library; performing a masking transformation on the password carrier library to generate at least one subset of candidate carriers; decrypting and presenting the subset of candidate carriers when preset conditions are met; obtaining a carrier selection result by interactively selecting one or more candidate carriers in the subset of candidate carriers; and determining the input password based on the carrier selection result; the preset conditions include one or more of the following: upstream authentication passed, business risk conditions met, operation level conditions met, session state valid, or policy rules met. The password is mapped to key derivation information or authentication information, and decryption, decapsulation, unlocking of protected data, and / or authorization of sensitive operations are performed on the target object based on the key derivation information or authentication information.

[0006] Furthermore, a decoy candidate set is generated, and the candidate carrier subset is mixed with the decoy candidate set to generate a candidate carrier set, in which only a very small number of carriers are real candidate carriers.

[0007] Furthermore, the encryption system has two or more layers. Each layer is configured with a password carrier library and masking transformation parameters, and the password verification results of each layer are used to unlock the password carrier library of the next layer. After completing the password verification of the k-th layer, based on the masking transformation parameters, only the candidate carrier subset of the next layer is decrypted and presented, and a candidate carrier subset and a decoy candidate set are generated. After completing the password verification of the k-th layer or the final business verification, access to the corresponding level of protected data, decryption key, decapsulation key, access token and / or sensitive operation authorization is allowed.

[0008] Furthermore, the password is a segmented password chain; the verification success or failure is delayed until at least the next level of password input before feedback is given. By delaying the verifiability of the segmented password to the downstream of the password chain, the complexity of the attacker's exhaustive search increases exponentially.

[0009] Furthermore, the number of hierarchical layers L of the encryption system is determined by the user and kept confidential from unauthorized parties, based on a threshold amount, risk score, frequency threshold, resource sensitivity threshold, or policy rules.

[0010] Furthermore, the masking transformation includes hash mapping, index permutation, random sampling, pseudo-random function mapping, encryption selection, coded blocks, and combinations thereof, and the masking transformation is kept confidential from unauthorized parties.

[0011] Furthermore, after successful password verification at any level, a temporary password or temporary credential is generated. The temporary password or temporary credential is bound to the number of times it can be used, its validity period, its scope of use, and / or risk control conditions, and is used for subsequent access or temporary external authorization. When entering the temporary password mode, the subset of candidate carriers used for regular password input is not presented or the carrier content is not displayed, and temporary access to the target object is obtained based on the temporary password or temporary credential. It will automatically expire or be revoked when the expiration conditions are met.

[0012] Furthermore, when authorization changes, risk events, or policy updates occur, the masking transformation parameters, candidate carrier subset generation rules, key encapsulation information, and / or the ciphertext of the password carrier library are updated, rendering existing password input or decryption capabilities invalid.

[0013] This invention also discloses a password encryption system based on masking transformation, comprising: a candidate carrier subset generation module, used to establish a password carrier library, perform masking transformation on the password carrier library, and generate at least one set of candidate carrier subsets; a password generation module, used to decrypt and present the candidate carrier subsets when preset conditions are met, and obtain a carrier selection result by interactively selecting one or more candidate carriers in the candidate carrier subsets, and determine the input password based on the carrier selection result; and an authentication module, used to map the password to key derivation information or authentication information, and perform decryption, decapsulation, unlocking of protected data and / or authorization of sensitive operations on the target object based on the key derivation information or authentication information.

[0014] The present invention also discloses a computer-readable storage medium storing a computer program that is executed by a processor to implement the password encryption method based on masking transformation as described in any of the preceding claims.

[0015] The technical solution of the present invention has at least the following technical effects or advantages: 1. The present invention enables images or other private information to be used as password input carriers, significantly increasing the probing cost for attackers while ensuring the availability of legitimate users, and supporting secondary or higher-level hierarchical protection.

[0016] 2. Multiplicative resistance to brute force: By using delayed verifiability and decoy grouping, attackers cannot determine success segment by segment, and the overall complexity increases exponentially. 3. User-friendly: Only n candidate carriers are presented to avoid the interface becoming unusable due to full database display; 3) Consistent and configurable hierarchical protection: Password link supports two levels and above, and the hierarchical level L is configured by the user and can be saved as a secret parameter to match the hierarchical confirmation targets of different businesses.

[0017] 4. Operable: Supports parameter rotation and encrypted side reversal updates, facilitating enterprise security policy iteration.

[0018] 5. Controllable temporary access: Access can be limited by number or time or authorized to others for temporary access through temporary passwords, and can be revoked at any time. It can also prevent the display of private media in insecure input environments.

[0019] The solution of this invention has the advantages of availability, scalability and anti-guessing ability, and is suitable for scenarios such as terminal login, payment confirmation, key decryption and encapsulation, and enterprise internal control. Attached Figure Description

[0020] Figure 1 This is a flowchart of a password encryption method based on masking transformation in one embodiment of the present invention; Figure 2This is a schematic diagram of the decoy grouping and delay verifiable mechanism in one embodiment of the present invention; Figure 3 This is a schematic diagram of level 2 and above hierarchical passwords and service thresholds in one embodiment of the present invention; Figure 4 This is a flowchart of temporary password generation and limited access in one embodiment of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention is described in detail through specific embodiments. However, it should be understood that the specific embodiments are provided only for a better understanding of the present invention and should not be construed as limiting the present invention. In the description of the present invention, it should be understood that the terminology used is for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0022] To address the shortcomings of existing password encryption methods, which rely on character or biometric unlocking and are vulnerable to brute-force attacks, this invention proposes a password encryption method, system, and readable medium based on masking transformation. The method includes the following steps: establishing a password carrier library; performing a masking transformation on the password carrier library to generate at least one subset of candidate carriers; decrypting and presenting the candidate carrier subset under preset conditions; interactively selecting one or more candidate carriers from the subset to obtain a carrier selection result; and determining the input password based on the carrier selection result; mapping the password to key derivation information or authentication information; and performing decryption, decapsulation, unlocking of protected data, and / or authorization of sensitive operations on the target object based on the key derivation information or authentication information. This allows images or other private information to be used as password input carriers, significantly increasing the attacker's probing cost while ensuring the usability for legitimate users, and supporting secondary or higher-level hierarchical protection. The invention is described in detail below with reference to the accompanying drawings.

[0023] Example 1 This embodiment discloses a password encryption method based on masking transformation, such as... Figure 1 As shown, it includes the following steps: S1 establishes a password carrier library, performs a masking transformation on the password carrier library, and generates at least one subset of candidate carriers.

[0024] The password carrier library includes images, graphics, audio, phrases, gestures, spatial location sequences, or other easily remembered private information.

[0025] Based on upstream authentication input, session parameters, and / or policy parameters, a masking transformation is performed on the password carrier library to generate at least one subset of candidate carriers. The size of the candidate carrier subset is controlled to n, and only n carriers are displayed according to preset rules. The entire carrier library can be decrypted for auditing or recovery when needed, but by default, interaction is only directed to the candidate carrier subset to balance usability and leakage control. The masking transformation includes hash mapping, index permutation, random sampling, pseudo-random function mapping, encryption selection, encoding grouping, and combinations thereof. The masking transformation is kept confidential from unauthorized parties. The masking transformation hides the real password information among a large number of candidate carriers and generates a verifiable input window that is only user-friendly. The candidate carrier subset is used to limit the user's visible or interactive input range, and it is not required that all carriers in the candidate carrier subset constitute the input password. The input password is determined by one or more candidate carriers selected by the user from the candidate carrier subset, along with their selection order, selection position, selection count, or combinations thereof.

[0026] When the preset conditions are met, S2 decrypts and presents a subset of candidate carriers. By interactively selecting one or more candidate carriers in the subset of candidate carriers, the carrier selection result is obtained, and the input password is determined based on the carrier selection result.

[0027] The preset conditions include one or more of the following: upstream authentication passed, business risk conditions met, operation level conditions met, session status valid, or policy rules met. For example, after completing the first stage of authentication, only a subset of candidate carriers of size n is decrypted and presented, allowing legitimate users to complete the selection input within a controllable interface; alternatively, when the amount threshold, risk score, frequency threshold, or resource sensitivity threshold meets the preset policy, the corresponding level of candidate carrier subset is presented.

[0028] S3 maps passwords to key-derived information or authentication information, and performs decryption, decapsulation, unlocking of protected data, and / or authorized sensitive operations on the target object based on the key-derived information or authentication information.

[0029] like Figure 2 As shown, for the same upstream authentication input, a decoy candidate set is generated. This decoy candidate set is indistinguishable from the candidate carrier subset in appearance, quantity, and interaction path. The candidate carrier subset is mixed with the decoy candidate set to generate multiple presentable candidate carrier sets. Among these multiple presentable candidate carrier sets or candidate groups, only one or a few sets correspond to the real and valid next-layer password carrier path; the remaining sets or groups are decoy paths. The real and valid path accounts for a small proportion of all generated candidate carrier sets or groups. For different upstream inputs (including erroneous inputs), a consistent set of candidate windows can be generated, making it impossible for attackers to determine whether their current attempt has hit the real link based solely on interface feedback.

[0030] That is, assuming the total number of steps of the password link is r, X candidate groups / subsets can be constructed at each step, among which only a very small number of x types (x X) are located on the valid link; an attacker cannot reliably determine whether the selected one is valid before completing the final verification, and the probability of hitting the valid link within the first a steps (a<r) of the complete path is approximately (x / X)^a, which can be designed to be negligible. Therefore, even if the attacker conducts offline or online exhaustive enumeration, it is difficult to judge whether a certain attempt is successful, and the attacker must continue to attempt along the password link to the deepest layer for verification, so that the overall exhaustive complexity is increased from the segmented sum of a+b+c to the multiplicative level of a×b×c.

[0031] In this embodiment, as Figure 3 shown, the encryption system has two or more layers, the password link supports two-level or higher-level hierarchical protection, each level is respectively configured with a password carrier library and masking transformation parameters, and the password verification result of each level is used to unlock the password carrier library, key material and / or access conditions of the next level; after completing the k-th level password verification, only the candidate carrier subset of the next level is decrypted and presented based on the masking transformation parameters, and its scale is , and a candidate carrier subset and a decoy candidate set are generated. After completing the k-th level password verification or final service verification, access to protected data, decryption keys, decapsulation keys, access tokens and / or sensitive operation authorizations of the corresponding level is permitted.

[0032] The password is a segmented password link; the feedback of whether the verification is successful is delayed until at least the next layer of password is input. By delaying the verifiability of the segmented password to the downstream of the password link, the attacker cannot judge whether the attempt is successful only by the single-step feedback, and the exhaustive complexity of the attacker increases multiplicatively.

[0033] The hierarchical layer number L of the encryption system is set by the user and kept confidential to unauthorized parties, and can respectively correspond to different levels of protected data access, decryption key / decapsulation key recovery or sensitive operation authorization. The number of hierarchical layers is determined based on the amount threshold, risk score, frequency threshold, resource sensitivity threshold or policy rules. For example, a character password is used for general important level access; a first-level media password is used for relatively important level confirmation; a second-level media password is used for extremely important level confirmation, and can be triggered by thresholds such as amount / frequency. Specifically, the character password is used to complete general important level access and obtain decryption capability or access authorization of general important level; when it is necessary to access a higher level protected object, a first-level candidate picture group is generated and presented based on the verified session, after the user completes the input of the first-level picture password, the second-level private carrier group is further decrypted, and after the user completes the input of the second-level picture password in the second-level carrier group, the high-level decryption key, decapsulation key, access token and / or sensitive operation authorization can be obtained. The secondary private carrier group can be any easy-to-remember information form such as private photos, private phrases, and private sounds.

[0034] In another embodiment of the invention, the hierarchical level L is configured by the user and stored as a secret parameter. Taking three levels as an example: a character password is used for login or basic authorization; the first-level media password serves as a payment password or enhanced confirmation, suitable for medium-risk operations; and the second-level media password is used for large-amount transfers or high-risk operation confirmation. The system can determine whether to trigger a higher-level media password based on thresholds such as amount range and risk score.

[0035] like Figure 4 As shown, a temporary password or temporary credential is generated after successful password verification at any level. This temporary password or credential is bound to the number of uses, validity period, scope of use, and / or risk control conditions for subsequent access or temporary external authorization. When entering temporary password mode, the subset of candidate data carriers used for regular password input is not presented or the carrier content is not displayed to avoid leaking private data carriers in insecure input environments. Temporary access to the target object is obtained based on the temporary password or temporary credential, and it automatically expires or is revoked when the expiration conditions are met. Without exposing core authentication factors, revocable and limited-use / limited-time temporary access capabilities are derived for the target's decryption capabilities or access to protected data. When entering the temporary password channel, the small window displaying the private data carrier used for input in normal circumstances is not shown to adapt to insecure input environments such as open fields and crowded areas.

[0036] Specifically, after verifying the upstream password and the masking carrier password (or other masking password) and obtaining the master key or target key material, the user is allowed to set a temporary password for temporary use in insecure environments or to authorize others to temporarily access the system. A temporary sharing list or temporary derived information is generated based on the target decryption capability or target key material and the temporary password, and this list is bound to a maximum usage count Lmax, a counter c, and an optional expiration time. When temporary access occurs, the user enters the temporary password, and the system recovers the session key, access token, or decapsulation key from the temporary sharing list or temporary derived information without displaying the regular candidate carrier in a small window. After completing decryption or authorizing sensitive operations, the counter is updated. When the count reaches the upper limit or expires / is revoked, the temporary sharing list or temporary derived information is deleted or invalidated, blocking subsequent access.

[0037] When authorization changes, risk events, or policy updates occur, the masking transformation parameters, candidate carrier subset generation rules, key encapsulation information, and / or password carrier library ciphertext are updated, rendering existing password input or decryption capabilities invalid.

[0038] Example 2 Based on the same inventive concept, this embodiment discloses a password encryption system based on masking transformation, comprising: The candidate carrier subset generation module is used to establish a password carrier library, perform masking transformation on the password carrier library, and generate at least one set of candidate carrier subsets. The password generation module is used to decrypt and present a subset of candidate carriers when preset conditions are met. By interactively selecting one or more candidate carriers in the subset of candidate carriers, the carrier selection result is obtained, and the input password is determined based on the carrier selection result. The authentication module is used to map passwords to key derivation information or authentication information, and to perform decryption, decapsulation, unlocking of protected data and / or authorization of sensitive operations on the target object based on the key derivation information or authentication information.

[0039] Example 3 Based on the same inventive concept, this embodiment discloses a computer-readable storage medium storing a computer program, which is executed by a processor to implement the password encryption method based on masking transformation as described above.

[0040] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0041] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0042] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0043] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0044] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific embodiments of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention. The above content is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims

1. A password encryption method based on masking transformation, characterized in that, Includes the following steps: Establish a password carrier library, perform a masking transformation on the password carrier library, and generate at least one subset of candidate carriers; When preset conditions are met, the candidate carrier subset is decrypted and presented. By interactively selecting one or more candidate carriers in the candidate carrier subset, a carrier selection result is obtained, and the input password is determined based on the carrier selection result. The password is mapped to key derivation information or authentication information, and decryption, decapsulation, unlocking of protected data and / or authorization of sensitive operations are performed on the target object based on the key derivation information or authentication information.

2. The password encryption method based on masking transformation as described in claim 1, characterized in that, The carrier selection result includes the identifier of the selected candidate carrier, the selection order, the selection position, the number of selections, or a combination thereof; the preset conditions include one or more of the following: upstream authentication passed, business risk conditions met, operation level conditions met, session state valid, or policy rules met. A candidate decoy set is generated, and the subset of candidate carriers is mixed with the candidate decoy set to generate a candidate carrier set, in which only a very small number of carriers are real candidate carriers.

3. The password encryption method based on masking transformation as described in claim 1 or 2, characterized in that, The encryption system has two or more layers. Each layer is configured with a password carrier library and masking transformation parameters, and the password verification results of each layer are used to unlock the password carrier library of the next layer. After completing the password verification at level k, based on the masking transformation parameters, only the candidate carrier subset of the next level is decrypted and presented, and a candidate carrier subset and a decoy candidate set are generated. After completing the password verification at level k or the final business verification, access to the corresponding level of protected data, decryption key, decapsulation key, access token and / or sensitive operation authorization is allowed.

4. The password encryption method based on masking transformation as described in claim 3, characterized in that, The password is a segmented password chain; the verification success or failure is delayed until at least the next level of password input before feedback is given. By delaying the verifiability of the segmented password to the downstream of the password chain, the complexity of the attacker's exhaustive search increases exponentially.

5. The password encryption method based on masking transformation as described in claim 3, characterized in that, The number of hierarchical layers L of the encryption system is determined by the user and kept confidential from unauthorized parties, based on a threshold amount, risk score, frequency threshold, resource sensitivity threshold, or policy rules.

6. The password encryption method based on masking transformation as described in claim 5, characterized in that, The masking transformation includes hash mapping, index permutation, random sampling, pseudo-random function mapping, encryption selection, encoding grouping and their combinations, and the masking transformation is kept confidential from unauthorized parties.

7. The password encryption method based on masking transformation as described in claim 3, characterized in that, After successful password verification at any level, a temporary password or temporary credential is generated. The temporary password or temporary credential is bound to the number of times it can be used, its validity period, its scope of use, and / or risk control conditions, and is used for subsequent access or temporary external authorization. When entering the temporary password mode, the subset of candidate carriers used for regular password input is not presented or the carrier content is not displayed. Temporary access to the target object is obtained based on the temporary password or temporary credential. The temporary password or temporary credential will automatically expire or be revoked when the expiration conditions are met.

8. The password encryption method based on masking transformation as described in claim 1 or 2, characterized in that, When authorization changes, risk events, or policy updates occur, the masking transformation parameters, candidate carrier subset generation rules, key encapsulation information, and / or password carrier library ciphertext are updated, rendering existing password input or decryption capabilities invalid.

9. A password encryption system based on masking transformation, characterized in that, include: A candidate carrier subset generation module is used to establish a password carrier library, perform masking transformation on the password carrier library, and generate at least one set of candidate carrier subsets. The password generation module is used to decrypt and present the candidate carrier subset when a preset condition is met, and to obtain the carrier selection result by interactively selecting one or more candidate carriers in the candidate carrier subset, and to determine the input password based on the carrier selection result. The authentication module is used to map the password to key derivation information or authentication information, and to perform decryption, decapsulation, unlocking of protected data and / or authorization of sensitive operations on the target object based on the key derivation information or authentication information.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that is executed by a processor to implement the password encryption method based on masking transformation as described in any one of claims 1-8.

Images