Cybersecurity method and system based on multi-party and multi-factor dynamic strong cryptographic authentication

Abstract

To provide a cyber security method and system based on multi-party and multi-factor dynamic strong encryption authentication.SOLUTION: A method includes: randomly generating an ephemeral decryption key in response to input of authentication information in a user facility; transmitting the ephemeral decryption key to a security server and retrieving a token index; generating and encrypting an electronic digital signature on the basis of a part of the ephemeral decryption key to form an authentication token accordingly; combining the authentication information, the token index and the authentication token to form an ephemeral character string and sending the ephemeral character string to a network application server device; acquiring the authentication information, the token index and the authentication token by parsing the ephemeral character string in the server device and retrieving the ephemeral decryption key from a security server facility on the basis of the token index; and decrypting the authentication token on the basis of the ephemeral decryption key and acquiring and verifying the electronic digital signature.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present invention relates to a cybersecurity method and system, and in particular to a cybersecurity method and system based on multi-party and multi-factor dynamic strong encryption authentication technology. [Background technology]

[0002] While information and communication technology (ICT) has been advancing rapidly, cybersecurity threats have been evolving at an equally fast pace. In today's Internet world, it is not surprising that a new type of cybersecurity threat could emerge at any time, and today's information and communication field faces a great number of threats to security.

[0003] These cybersecurity threats steal users' network service accounts and passwords for profit, often with the goal of infiltrating financial network services in particular. This category of cybersecurity threats includes several common types:

[0004] The most common ones include stealing user accounts and passwords through phishing text messages and phishing emails. Phishing text messages and scams are frequent, and many people have lost their savings. In addition, network service infrastructure is sometimes subjected to large-scale distributed denial of service (DDoS) attacks, and ransomware has become a major threat to business operations, with financial and insurance, trade and sales, information and communications, and manufacturing industries being targeted.

[0005] Other methods include hackers directly invading users' equipment or Internet service provider servers (ASP servers) to steal users' accounts and passwords, repeatedly using high-speed computing power to carry out brute force attacks to crack accounts and passwords, and embedding various Trojan horse programs into users' equipment through free online advertising software to steal users' account passwords. In the field of cyber security, traditional account and password-based login authentication modes are no longer secure, and it is becoming common for user accounts and passwords to be stolen.

[0006] In the face of such complex and diverse threats, many traditional cybersecurity defenses, such as Public Key Infrastructure (PKI), SSL / TLS-based https, Key Distribution Centers (KDC), Multi-Factor Authentication (MFA), and Single Sign-On (SSO) mechanisms, are no longer sufficient to address these cybersecurity threats.

[0007] Therefore, more innovative cybersecurity methods and systems are needed to deal with new kinds of cybersecurity threats. In view of this, the inventors have made careful attempts and researches, and finally devised the present invention "Cybersecurity method and system based on multi-party and multi-factor dynamic strong encryption authentication", thereby overcoming the above-mentioned shortcomings. The present invention will be briefly described as follows. Summary of the Invention

[0008] The present invention relates to a cybersecurity method and system, and in particular to a cybersecurity method and system based on multi-party and multi-factor dynamic strong cryptographic authentication.

[0009] The present invention provides a cybersecurity method, which includes the steps of: selectively requesting input of an identifier according to input of authentication information in a user equipment, randomly generating a temporary decryption key, sending the temporary decryption key to a security server equipment, and obtaining a token index from the security server equipment, generating and encrypting an electronic digital signature based on a part of the temporary decryption key to form an authentication token, combining the authentication information, the token index, and the authentication token to form a temporary string, and sending the temporary string to a network application server device, and further includes the steps of: decrypting the temporary string in the network application server device to obtain the authentication information, the token index, and the authentication token, receiving the temporary decryption key from the security server equipment based on the token index, and decrypting the authentication token based on the temporary decryption key to obtain and verify the electronic digital signature.

[0010] The present invention further provides a cybersecurity method, comprising the steps of: randomly generating a temporary decryption key in a first device in response to input of authentication information, transmitting the temporary decryption key to a third device programming module included in a fourth device and obtaining a token index from the third device programming module, generating and encrypting an electronic digital signature based on a portion of the temporary decryption key to form an authentication token, combining the authentication information, the token index, and the authentication token to form a temporary string, and transmitting the temporary string to a second device programming module included in the fourth device, executing the second device programming module to decrypt the temporary string to obtain the authentication information, the token index, and the authentication token, receiving the temporary decryption key from the third device programming module based on the token index, and decrypting the authentication token based on the temporary decryption key to obtain and verify the electronic digital signature.

[0011] The present invention further provides a cybersecurity system, which includes a security server equipment, a user equipment, and a network application server device. In the user equipment, the steps of selectively requesting input of an identifier according to input of authentication information, randomly generating a temporary decryption key, sending the temporary decryption key to the security server equipment, and obtaining a token index from the security server equipment, and generating an electronic digital signature based on a part of the temporary decryption key are performed. Then, the steps of encrypting the electronic digital signature to form an authentication token, combining the authentication information, the token index, and the authentication token to form a temporary string, and sending the temporary string to the network application server device are performed. In addition, in the network application server device, the steps of decrypting the temporary string to obtain the authentication information, the token index, and the authentication token, receiving the temporary decryption key from the security server equipment based on the token index, and decrypting the authentication token based on the temporary decryption key to obtain and verify the electronic digital signature are performed.

[0012] The present invention further provides a cybersecurity system, comprising: a fourth device including a second device programming module and a third device programming module; and a first device in communication with the fourth device. The first device randomly generates a temporary decryption key in response to input of authentication information, and transmits the temporary decryption key to the third device programming module. The first device also obtains a token index from the third device programming module; generates and encrypts an electronic digital signature based on a portion of the temporary decryption key to form an authentication token; combines the authentication information, the token index, and the authentication token to form a temporary string; transmits the temporary string to the second device programming module; and decrypts the temporary string by the second device programming module to obtain the authentication information, the token index, and the authentication token. The cybersecurity system further performs the steps of receiving the temporary decryption key from the third device programming module based on the token index; and decrypting the authentication token based on the temporary decryption key to obtain and verify the electronic digital signature.

[0013] The above disclosure is intended to provide a simplified summary of the invention to enable the reader to have a basic understanding of the invention, but is not intended to disclose a complete description of the invention, nor is it intended to point out key elements or components of embodiments of the invention or to define the scope of the invention. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a system architecture schematic diagram of a first embodiment of a cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. [Diagram 2]FIG. 2 is a schematic diagram of the system architecture of a second embodiment of a cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention; [Diagram 3] FIG. 11 is a sequence diagram of the execution flow of a third embodiment of a cybersecurity method based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. [Figure 4] FIG. 11 is a system architecture schematic diagram of a fourth embodiment of a cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. [Diagram 5] FIG. 11 is a schematic diagram of the system architecture of a fifth embodiment of cybersecurity based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. [Figure 6] 1 is a flowchart showing the execution steps of a cybersecurity method based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] 1 is a system architecture schematic diagram of a first embodiment of a cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. The cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention 10 is performed by multi-party devices and equipment in cooperation with each other, and includes at least a user equipment (first device) 100 operated by a user, a network application server device (second device) 200, and a security server equipment (third device) 300, and the three devices establish communication links with each other via the Internet to exchange messages and information, etc.

[0016] The user equipment 100 is preferably, but not limited to, a terminal device commonly used by current general consumers, such as a desktop computer, a notebook computer, a smartphone or a tablet device, etc. The security server equipment 300 is selected from one of a security intermediary server and a cloud server.

[0017] The network application server device 200 preferably includes two types of devices. The first type is an Internet application server that provides an Internet application, such as, but not limited to, an application service provider server (ASP server), an Internet content provider server (ICP server), an Internet service provider server (ISP server), a virtual machine server, a serverless Lambda function device, a CAN bus main node for a vehicle, or a main node inside a production factory. The second type is a networking device that builds a network or provides an intermediate networking device between network nodes, and includes, but is not limited to, a small cell, a router, a hub, a switch, a bridge, a gateway, a brouter, a relay, an edge server, a microcontroller (MCU), an automated teller machine (ATM), a point of sale (POS), a PC workstation, a machine tool, a programmable logic controller (PLC), a drone, an IP cam, a satellite phone, an in-vehicle CAN bus node, and an IP address translation device (NAT).

[0018] In this embodiment, the network application server device 200 is preferably a first type of Internet application server, for example, an Internet content provider server. The user equipment 100 preferably establishes a transmission connection P1 with the internetwork application server device 200 directly through one or more segments of a network, including a local area network or the Internet, without going through other networking devices. The first transmission connection P1, the second transmission connection P2, and the third transmission connection P3 preferably use allowed unencrypted, unsecure or untrusted connections. For example, in one embodiment, the first transmission connection P1 preferably uses an out-of-band channel.

[0019] FIG. 2 is a schematic diagram of the system architecture of the second embodiment of the cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. The second embodiment is based on the first embodiment and includes all the technical features of the first embodiment. In this embodiment, the connection between the user equipment 100 and the Internet application server 210 is via another networking device. Therefore, in this embodiment, the network application server device 200 is preferably a second type of Internet device, such as a home router or a 5G small cell. In addition, the user equipment 100 is preferably connected to the Internet application server 210 via the network application server device 200, i.e., the Internet device. The fourth transmission connection P4, the fifth transmission connection P5, the second transmission connection P2 and the third transmission connection P3 are preferably used as connections that are allowed to be unsecure or untrusted. The first transmission connection P1 includes a fourth transmission connection P4 and a fifth transmission connection P5, for example, in one embodiment the fourth transmission connection P4 and the fifth transmission connection P5 preferably use out-of-band channels.

[0020] In the first and second embodiments, when a user logs in to an Internet application, the user must first input his / her authentication information, including an account and a password, and undergo account and password authentication. The process is as follows:

[0021] A user operates on his / her user equipment 100, for example, a smartphone, and displays a front-end user interface (frontend UI) provided by the network application server device 200 or the Internet application server 210 via the Internet on the smartphone. For example, but not limited to, a login interface for entering an Internet application is opened by a login webpage provided by an Internet browser or a front-end application program (App) installed on the user equipment 100 via PaaS or SaaS technology. Then, the user inputs the correct account and password into the account and password fields provided by the login interface, which are symmetrically encrypted by the SSL / TLS protocol and then uploaded to the network application server device 200, verified and checked, and then allowed to log in to the Internet application service.

[0022] The entire process of login and verification operations is carried out through the user equipment 100 and the network application server device 200 constituting the sub-networks 11 and 12, and the first transmission connection P1 or the fourth transmission connection P4 connecting the user equipment 100 and the network application server device 200.

[0023] Generally, in order to keep the above account and password verification safe and effective, users need to properly store their accounts and passwords to avoid leakage. However, the security of the above account and password verification process may be breached in at least the following ways: A phishing text message or a phishing email is used to steal a user's account and password; A hacker intrudes into the first transmission connection P1 to intercept a user's account and password; A hacker intrudes into the user equipment 100 or the network application server device 200 to steal a user's account and password; A brute force attack is used to crack the account and password; Or a Trojan horse program embedded in the front-end interface is used to steal a user's account password.

[0024] The cybersecurity method based on multi-party and multi-factor dynamic strong encryption authentication provided by the present invention is implemented on the basis of the hardware architecture of a cybersecurity system 10 based on multi-party and multi-factor dynamic strong encryption authentication. In the first transmission connection P1, the user equipment 100 and the network application server device 200, a third-party security server equipment 300 is further added, and a second transmission connection P2 connecting the user equipment 100 and the security server equipment 300 and a third transmission connection P3 connecting the network application server device 200 and the security server equipment 300 are added.

[0025] In one embodiment, a security application programming module, a security agent programming module and a security intermediary programming module are further installed on the user equipment 100, the network application server device 200 and the security server equipment 300, respectively, to implement the cybersecurity method based on the multi-party and multi-factor dynamic strong encryption authentication provided by the present invention.

[0026] 3 is a sequence diagram of the execution flow of the third embodiment of the cybersecurity method based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. In this embodiment, a user first inputs authentication information on his / her user equipment 100. For example, the user operates a front-end application program installed on a smartphone, such as a smartphone app, to enter the login interface of the smartphone app, and inputs authentication information including his / her account and password, etc., in the account password field provided by the login interface. The account password input by the user is transmitted from the user equipment 100 to the network application server device 200 via the transmission connection P1 or the transmission connection P4.

[0027] When the login operation is detected, a security application programming module similarly installed in the user equipment 100 is called and started according to the input of the authentication information, and after the security application programming module is executed, in one embodiment, a passcode input interface is selectively displayed on the touch panel display of the user equipment 100, and a passcode input field is provided to request the user to further input a passcode. The security application programming module is preferably in the form of an SDK file or a callable API execution file.

[0028] In one embodiment, after the user inputs his / her passcode into the passcode input field, the security application programming module executes a first cryptography algorithm in the user equipment 100 according to the input of the passcode, using the authentication information input by the user, i.e., account and password, password or passcode as a seed value, to generate a first ephemeral decrypting key (EDK), for example, but not limited to, a length of 32 Bytes.

[0029] In one embodiment, after a user enters his / her passcode in the passcode entry field, the security application programming module executes a first cryptography algorithm in the user equipment 100 according to the input of the passcode, using a seed value that is not related to the user's account, password, or other non-fixed random value as a passcode, to randomly generate a first temporary decryption key (1ST EDK).

[0030] The first cryptography algorithm is preferably selected from the RSA algorithm, the DSA algorithm, the MD5 algorithm, the MD4 algorithm, the MD2 algorithm, the SHA-1 algorithm, the SHA-2 algorithm, the SHA-3 algorithm, the RIPEMD-160 algorithm, the MDC-2 algorithm, the GOST R 34.11-94 algorithm, the BLAKE2 algorithm, the Whirlpool algorithm, the SM3 algorithm or a combination thereof. The first cryptography algorithm is preferably used to generate a temporary decryption key, also called a key generation algorithm or an encryption key generation algorithm.

[0031] After the first temporary decryption key is generated in the user equipment 100, the second cryptography algorithm is subsequently executed in the user equipment 100 based on the first temporary decryption key to encrypt an identity information (ID info) and generate an electronic digital signature. The second cryptography algorithm is preferably selected from the following: RSA algorithm, DSA algorithm, ECDSA algorithm, ECC algorithm, HMAC algorithm, MD5 algorithm, MD4 algorithm, MD2 algorithm, SHA-1 algorithm, SHA-2 algorithm, SHA-3 algorithm, RIPEMD-160 algorithm, MDC-2 algorithm, GOST R 34.11-94 algorithm, BLAKE2 algorithm, Whirlpool algorithm, SM3 algorithm, and combinations thereof. The second cryptography algorithm is preferably used to generate an electronic digital signature. The first cryptography algorithm is preferably used to generate a temporary decryption key, also called a hash or hash encryption algorithm.

[0032] In one embodiment, the identity identification information is preferably an identity built into the security application programming module by a source of the security application programming module, such as a developer or supplier. In one embodiment, the identity identification information is a set of identity information issued by the source of the security application programming module, such as a developer or supplier, to a user who has passed identity verification, and to recognize that the user has a legitimate identity and usage right, to legitimately recognize that the user has an identity and right to use and operate the security application programming module.

[0033] The content of the identity information is preferably a single digit, numbers, words, characters, alphabets, symbols, patterns, or a combination thereof. In one embodiment, the identity information is preferably a identity identification code (PIN), which may be integrated or identical with a self-sovereign identity (SSI) defined by Web 3.0, i.e., a digital identity, also called a digital ID or an identity code.

[0034] After the electronic digital signature is generated in the user equipment 100, a scrambling process is subsequently performed in the user equipment 100, in which the scrambling process is based on the first temporary scrambling key, and then the first temporary scrambling key is modified to generate a second temporary scrambling key.

[0035] After the second temporary scrambling key is generated in the user equipment 100, the user equipment 100 continues to execute a third cryptography algorithm based on the second temporary decryption key (2ND EDK), and further encrypts an electronic digital signature and generates an authentication token. The third cryptography algorithm is preferably selected from the following: AES algorithm, RSA algorithm, DSA algorithm, HMAC algorithm, MD5 algorithm, MD4 algorithm, MD2 algorithm, SHA-1 algorithm, SHA-2 algorithm, SHA-3 algorithm, Blowfish algorithm, Camellia algorithm, Chacha20 algorithm, Poly1305 algorithm, SEED algorithm, CAST-128 algorithm, DES algorithm, IDEA algorithm, RC2 algorithm, RC4 algorithm, RC5 algorithm, SM4 algorithm, TDES algorithm and GOST 28147-89 algorithm or combination thereof. The third cryptography algorithm is also called a security encryption algorithm, and is preferably a symmetric encryption algorithm.

[0036] Then, the generated first and second temporary decryption keys are distributed to the security server equipment 300, and the security intermediary programming module on the security server equipment 300 generates a token index based on the first and second temporary decryption keys. The token index refers to the smallest content or strictly smaller portion sufficient to extract the first and second temporary decryption key information. Then, the user equipment 100 requests the corresponding token index from the security server equipment 300 to obtain the token index. The format of the first and second temporary decryption keys is not limited, but is preferably in the form of a symbol string or two-dimensional image code with a length of 256 binary bits.

[0037] Then, in the user equipment 100, the identity information, the authentication information input by the user, the generated authentication token and the obtained token index are combined to form a temporary string, and then the combined temporary string is distributed from the user equipment 100 to the network application server device 200 via the first transmission connection P1 or the fourth transmission connection P4.

[0038] In the network application server device 200, after the security agent programming module installed in the network application server device 200 receives the temporary string, it decrypts the temporary string. The decryption process preferably does not require cryptographic encryption and decryption operations to obtain the identity information, the authentication information including the account password or passcode, the token index and the authentication token from the temporary string. Then, the obtained token index is sent to the security server device 300 through the encrypted or unencrypted model, and the corresponding first and second temporary decryption keys stored in the security server device 300 are obtained from the security server device 300 according to the token index.

[0039] Then, in the network application server device 200, the security agent programming module executes a third cryptography algorithm based on the obtained second temporary decryption key to decrypt the authentication token into an electronic digital signature, and executes a signature verification process with the first temporary decryption key to verify whether the decrypted electronic digital signature has been tampered with. If it is confirmed that the electronic digital signature has not been tampered with, it executes a second cryptography algorithm with the first temporary decryption key to decrypt the electronic digital signature into identification information.

[0040] At the same time, in the network application server device 200, the security agent programming module performs an identity verification process on the acquired identity information to verify whether the identity information exactly matches the identity information recorded in the database. At the same time, in the network application server device 200, the security agent programming module performs an account and password verification process on the acquired account and password to verify whether the account and password pairs exactly match each other.

[0041] After the signature verification process, the identity verification process, and the account and password verification process are all performed, the network application server device 200 returns the verification result to the user equipment 100, and only if the signature verification process, the identity verification process, and the account and password verification process are all correct, the user can log in through the user equipment 100 to access the application service of the network application server device 200. If not, the user will be denied login to the application service.

[0042] In addition, if the signature verification process and the account and password verification process are both correct, the security agent programming module can selectively resend another authentication code to the user equipment 100 and request the user to enter the received authentication code into the security agent programming module; only after entering the authentication code can the user log in through the user equipment 100 to access application services on the network application server device 200.

[0043] After all verification processes have been completed, the security agent programming module automatically discards the first and second temporary decryption keys temporarily stored in the user equipment 100, the network application server device 200 and the security server device 300, as well as the accounts and passwords, electronic digital signatures, authentication tokens, temporary strings and token indexes temporarily stored in the user equipment 100 and the network application server device 200.

[0044] In this embodiment, the third cryptographic algorithm is executed in the user equipment 100 and the network application server device 200, but not in the security server device 300. It is preferable that the effect of edge computing can be realized. In the fifth embodiment, the network application server device 200 and the security server device 300 are integrated into the same cloud server 400.

[0045] FIG. 4 is a system architecture schematic diagram of the fourth embodiment of the cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. The fourth embodiment is based on the first to third embodiments and includes all the technical features of the first to third embodiments. In this embodiment, the cybersecurity system based on multi-party and multi-factor dynamic strong encryption authentication 10 of the present invention is integrated and combined with the existing LDAP (Lightweight Directory Access Protocol) architecture. The current technology of LDAP is not enough to prevent hackers from entering. Take a campus such as a university as an example, most of the campus services at present rely on single password verification, and as the campus uploads school data such as students' grades, course records and diplomas to the Internet, high security is required to guarantee student personal data and school data.

[0046] When the LDAP architecture is incorporated into the cybersecurity system 10 based on multi-party and multi-factor dynamic strong encryption authentication of the present invention, the cybersecurity system 10 based on multi-party and multi-factor dynamic strong encryption authentication includes at least a plurality of smartphones 111, 112 and 113 operated by users, an LDAP client server 201 serving as a network application server device 200, and a security server equipment 300, and the three devices establish transmission connections with each other via the Internet to exchange messages and information, etc.

[0047] In this embodiment, the network application server device 200 is preferably a first type of Internet application server, such as an Internet content provider server. The user equipment 100 preferably establishes a transmission connection P1 with the network application server device 200 directly through a one- or multi-layer local network or a network including the Internet, without going through other Internet devices, and the first transmission connection P1, the second transmission connection P2 and the third transmission connection P3 are allowed to be unsecure or untrusted connections.

[0048] The cyber security system 10 based on multi-party and multi-factor dynamic strong encryption authentication includes a sub-network 21, which is composed of an LDAP client server 201 and smartphones 111, 112 and 113. The sub-network 21 is an existing LDAP architecture, and the present invention can easily incorporate the existing LDAP architecture, and only requires adding one third-party security server equipment 300 in the sub-network 21.

[0049] By adding the multi-party and multi-factor identity authentication technology provided by the present invention to the LDAP architecture, the information security protection of the system can be effectively improved, and the user's identity can be verified through the multi-factor identity authentication technology, thereby enhancing the decentralization and decentralized application of the individual-driven approach. For example, the virtual (virtual ID code) and real (real ID card) of an identity card (ID card) can be combined to integrate user information obtained through multiple authentications.

[0050] In addition, multiple scrambling is performed based on the dynamic strong encryption digital signature system and symmetric encryption technologies such as ECDSA, SHA-256 and AES256 encryption technologies to generate a one-time authentication token, and the user data is encrypted and transmitted after passing the verification by the third party devices including the user device 100, the network application server device 200 and the security server device 300 to ensure the security of the user data. The security server device 300 only performs identity verification and does not participate in user privacy.

[0051] Currently, in the trend of digital transformation, hackers are rampant, and the world is paying attention to cybersecurity and privacy protection, and promoting the zero trust (ZTA) network security strategy. The cybersecurity method proposed by this invention can be easily incorporated into any existing network architecture to strengthen cybersecurity protection measures. The cyber security method proposed by the present invention can enhance the data transmission security of network users, and further avoid losses caused by attacks such as man-in-the-middle attacks and phishing attacks.

[0052] In this embodiment, the workflow between the user equipment 100, the network application server device 200 and the security server equipment 300 is roughly as follows.

[0053] Step 311: The user inputs his / her account and password, and a passcode, such as a secret key, a QR code, an ID code, or a PIN code, into the user device 100. Then, the system 10 generates a temporary decryption key and a single sign-on token (SSO-token) on the user equipment 100.

[0054] Step 312 : Send the generated temporary decryption key from the user equipment 100 to the security server equipment 300 .

[0055] Step 313: The account and password input by the user and the generated single sign-on token are sent to the network application server device 200.

[0056] Step 314: The network application server device 200 obtains a temporary decryption key from the security server device 300 for self-decryption and verification of the single sign-on token.

[0057] The cyber security method proposed in the present invention can be created as an SDK file or an embedded call API executable file, and can be installed with one click in user equipment 100 including smartphones 111-113, network application server device 200, or security server equipment 300 through AES-256 encryption and real-time temporary division ultra-high strength / high speed dynamic authentication technology, and can be integrated and introduced into existing service systems for user ID security protection.

[0058] The cybersecurity method and system proposed in the present invention is a multi-factor passwordless authentication system or a multi-factor passwordless dynamic strong encryption authentication cybersecurity system, and provides a quantum-level cybersecurity technology platform that can be directly integrated and compatible with the network architecture of all existing technical fields and industrial fields. In particular, it does not require significant changes to the network architecture and can be applied to various fields such as manufacturing, information and communications technology (ICT), electronics, medicine, and nursing care, and can be applied to various existing new and old equipment, especially legacy equipment, to strengthen cybersecurity measures. In addition, it has the following advantages.

[0059] (1)PKI like AES256+ECC256 proprietary patent / quantum cyber security communication technology. (2) The traditional account and password system will be upgraded to a quantum-level cyber security multi-factor account password system, so there is no need to worry about your account and password being stolen. (3) It can be easily integrated with other IoT systems to strengthen cybersecurity protection.

[0060] The present technology is a cyber security method based on proper identity identification, which includes the steps of: in a user device, requesting input of an identity identification code according to a user's login operation; retrieving identity information from an encrypted repository according to the input of the identity identification code, randomly generating a temporary decryption key and sending it to a security server device; encrypting the identity information based on the temporary decryption key to generate a one-time login certificate; and simultaneously sending the one-time login certificate to the security server device; the user device further sends the one-time login certificate to a network application server device, and the network application server device accesses the security server device to obtain necessary information, and then performs identity verification by itself, completing a three-party authentication architecture, and only after the verification is completed, allowing the user device to access subsequent access rights.

[0061] 5 is a schematic diagram of the system architecture of the fifth embodiment of the cyber security based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. The fifth embodiment is based on the first to fourth embodiments and includes all the technical features of the first to fourth embodiments. In this embodiment, the network application server device (second device) and the security server equipment (third device) are integrated into the same cloud server.

[0062] In this embodiment, the cybersecurity system 10 based on multi-party and multi-factor dynamic strong encryption authentication includes a user equipment 100 and a cloud server (fourth device) 400, and the user equipment 100 and the cloud server 400 are communicatively connected via a sixth transmission connection P6. The network application server device (second device) and the security server device (third device) are integrated into the same cloud server 400, and the cloud server 400 includes a second device programming module 420 and a third device programming module 430 that are independent from each other, respectively simulating all the functions of the network application server device and the security server device, and implementing the cybersecurity method based on multi-party and multi-factor dynamic strong encryption authentication through this hardware architecture.

[0063] 6 is a flowchart showing the execution steps of a cybersecurity method based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention. In summary, the cybersecurity method 500 based on multi-party and multi-factor dynamic strong encryption authentication included in the present invention preferably includes, but is not limited to, the following steps: In a user equipment, a temporary decryption key is randomly generated according to the input of authentication information (step 501), the temporary decryption key is sent to a security server equipment, and a token index is obtained from the security server equipment (step 502); an identity is acquired based on a part of the temporary decryption key; identification The information is encrypted to generate an electronic digital signature, and an authentication token is generated based on the electronic digital signature (step 503). identification The authentication information, the token index, and the authentication token are combined to generate a temporary string, and the temporary string is sent to the network application server device (step 504). identificationinformation, the token index and the authentication token are obtained, and the temporary decryption key is obtained from the security server equipment based on the token index (step 505), and the authentication token is decrypted based on the temporary decryption key to obtain and verify the electronic digital signature (step 506).

Claims

1. In the first device, generating a temporary decryption key in response to the input of authentication information; transmitting the temporary decryption key to a third device and obtaining a token index from the third device; encrypting the identity information based on the temporary decryption key to generate an electronic digital signature, and generating an authentication token based on the electronic digital signature; combining the authentication information, the identity information, the token index, and the authentication token to generate a temporary string, and transmitting the temporary string to a second device; In the second device, decrypting the temporary string to obtain the authentication information, the identification information, the token index, and the authentication token, and obtaining the temporary decryption key from the third device based on the token index; and obtaining the electronic digital signature from the authentication token, and decrypting and verifying the obtained electronic digital signature.

2. The authentication information includes an account and a password, The identification information includes one of a single digit, a number, a letter, a character, an alphabet, a symbol, a pattern, a secret key, a combination code, a two-dimensional image code, an ID code, a PIN code, and a combination thereof; randomly generating a first temporary decryption key in response to input of the authentication information; performing a scrambling step to generate a second temporary decryption key based on a portion of the first temporary decryption key, and encrypting the electronic digital signature based on the second temporary decryption key to generate the authentication token; 2. The cybersecurity method of claim 1, further comprising the step of: transmitting the second temporary decryption key along with the first temporary decryption key to the third device.

3. the step of randomly generating the first temporary decryption key is by execution of a first cryptographic algorithm based on the authentication information or the identification information; the electronic digital signature is generated by executing a second cryptographic algorithm based on the first temporary decryption key to encrypt the identifying information; the authentication token is generated by executing a third cryptographic algorithm based on the second temporary decryption key to encrypt the electronic digital signature; 3. The cybersecurity method of claim 2, further comprising the step of generating, in the third device, the token index based on the first temporary decryption key and the second temporary decryption key.

Images