Database Multi-Authentication via Hardware Certificate Carrier
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database authentication methods, such as those supported by PostgreSQL, rely on insecure MD5 passwords, posing a risk of password leakage and failing to ensure that the physical identity of operators corresponds to their digital identities.
Innovation Solution
A database multi-authentication method and system that initializes a hardware authentication certificate carrier using a programming interface, stores a public key and user certificate public name in a server database, and verifies user certificates through a message digest algorithm to ensure secure authentication, combining hardware authentication with MD5 password authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If MD5 password authentication is used, then the authentication process is simple, but the security is poor and password leakage risk exists
Solution Approach 1:
The authentication process is segmented into multiple independent verification stages: certificate validation, public key matching, and password verification. Each stage operates independently to provide layered security, where the certificate and public key verification forms the first layer of security, and the password serves as a second layer, thereby resolving the contradiction between simplicity and security.
Solution Approach 2:
The authentication mechanism uses composite verification methods by combining certificate-based authentication (providing strong security) with traditional password authentication (providing simplicity). This composite approach integrates multiple authentication technologies to achieve both high security and ease of operation simultaneously.
2Reliability
If hardware authentication certificate carrier is initialized and multi-factor authentication is implemented, then the security is enhanced, but the device complexity increases
Solution Approach 1:
The server is designed with multi-functional authentication capabilities that can handle both certificate-based authentication and password-based authentication through a unified authentication interface. This universal design allows the system to perform multiple authentication functions without requiring separate dedicated systems, thereby reducing overall device complexity while maintaining enhanced security.
Solution Approach 2:
The hardware authentication certificate carrier acts as an intermediary device that bridges the user and the server. It securely stores private keys and certificates, performing cryptographic operations locally without requiring the server to handle sensitive private key management. This intermediary role simplifies the server's complexity while enhancing security.
3Measurement precision
If public key and user certificate are stored in server database, then the authentication verification is accurate, but the information storage requirement increases
Solution Approach 1:
The system extracts and stores only the essential verification elements (public keys and certificate hashes) in the server database, rather than storing complete certificate files or private keys. This extraction approach maintains authentication verification accuracy while significantly reducing the storage volume required in the server database.
Solution Approach 2:
Different types of data are stored in different locations with appropriate storage characteristics: sensitive cryptographic data (private keys) is stored locally in the hardware authentication carrier with high security, while verification data (public keys, certificates) is stored in the server database with optimized storage structure. This local quality differentiation optimizes both verification accuracy and storage efficiency.
Data Source
AI summary
Provided is a database multi-authentication method and system, a terminal, and a storage medium. The method comprises: initializing a hardware authentication certificate carrier by means of a programming interface, and storing a public key of the hardware authentication certificate carrier and a user certificate public name; taking the user certificate public name as a database user name, and generating a standard message digest value; receiving an authentication request sent from a client, and returning an initial random number to the client; receiving a signature random number sent from the client, and using the public key to decrypt the signature random number to obtain a random number; in response to determining that the random number is consistent with the initial random number, acquiring an message digest value, and in response to determining that the message digest value is consistent with the standard message digest value, determining that the client passes the authentication.