WO2017020669A1 - 分布式系统节点身份认证方法及装置 - Google Patents

分布式系统节点身份认证方法及装置 Download PDF

Info

Publication number
WO2017020669A1
WO2017020669A1 PCT/CN2016/087704 CN2016087704W WO2017020669A1 WO 2017020669 A1 WO2017020669 A1 WO 2017020669A1 CN 2016087704 W CN2016087704 W CN 2016087704W WO 2017020669 A1 WO2017020669 A1 WO 2017020669A1
Authority
WO
WIPO (PCT)
Prior art keywords
primitive
authentication
target
node
semantic
Prior art date
Application number
PCT/CN2016/087704
Other languages
English (en)
French (fr)
Inventor
王显雷
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2017020669A1 publication Critical patent/WO2017020669A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention relates to the field of network security, and in particular, to a distributed system node identity authentication method and apparatus.
  • node authentication In distributed systems, there is large-scale data access between nodes. In order to achieve network and system security, in the process of data interactive access, the node is usually authenticated to prevent the node from being impersonated. Currently, there are three main methods for distributed system node authentication:
  • the first type of method uses the "What you know" mechanism.
  • the party performing the authentication requires the authenticated party to give a unique authentication credential, such as a common username/password authentication method, where the password is an authentication credential only known to the user.
  • a unique authentication credential such as a common username/password authentication method
  • the party performing the authentication finds the pre-stored modified password corresponding to the user name, and performs the same deformation processing on the received password, for example, by hash (HASH).
  • the algorithm processes to obtain the modified password, and then compares the modified password with the pre-stored modified password. If the two match, the authentication passes, otherwise the authentication fails.
  • the second type of approach uses the "What You Have" certification mechanism.
  • the party performing the authentication requires the authenticated party to give an authentication certificate proving its identity, and the identity authentication is implemented by the authentication credential.
  • the sender and the responder need to send the sender (the authenticated party) to the responder before establishing the connection.
  • One party) provides a CA (Certificate Authority) certificate, or both parties need to provide each other with a CA certificate to verify the authenticity of the other party's identity.
  • CA Certificate Authority
  • the third type of approach uses the "Who are you/What you are" certification mechanism.
  • the authenticated one-way performing authentication party provides its own identity information different from other parties to implement identity authentication, such as fingerprint data and the like.
  • identity authentication such as fingerprint data and the like.
  • the party performing the authentication After receiving the feature information transmitted by the authenticated party, the party performing the authentication performs the feature information data of the authentication party based on the feature information.
  • the search is performed in the library, and if the feature information is found, the authenticated party passes the identity authentication.
  • the disadvantages of the first method are: 1.
  • the authentication certificate is easy to leak; 2.
  • the authentication certificate has a certain complexity and anti-brute force mechanism. Therefore, the management of the authentication certificate is difficult; Certification credentials are difficult to remember and are not easy to check and modify.
  • the disadvantage of the second type of method is that it is inconvenient to use.
  • the certificate is required to be applied to the certification authority, and the certificate usually has a large amount of data, which affects the data transmission performance.
  • the disadvantage of the third type of method is that the complexity is high and the implementation is difficult.
  • the fingerprint data of the authenticated party is first collected, and the fingerprint data is usually complicated, the data volume is large, and the data transmission performance is affected. The retrieval process also consumes more computing resources.
  • the node may only need to authenticate the interaction of some data.
  • the confidentiality of the data is not important. The important thing is the authenticity of the data, such as management commands and NTP (Network Time Protocol). Time synchronization messages, etc.
  • NTP Network Time Protocol
  • Time synchronization messages etc.
  • both parties to the authentication adopt the above-mentioned first-class authentication method, after the authentication is completed, the validity of the authentication status must be maintained to perform authorization and access control based on validity; if the second or third type is adopted The method, after passing the identity authentication, also maintains the authentication status and establishes a secure channel to ensure the interaction of other data.
  • the embodiment of the invention provides a distributed system node identity authentication method and device, so as to solve the problem that the node identity authentication method at present is difficult to meet the requirements of simple and lightweight.
  • an embodiment of the present invention provides a distributed system node identity authentication method, which is applied to an authenticated node, and includes:
  • the authenticated node selects a target authentication primitive from the primitive database, and the primitive pool is a set of authentication primitives, and the authentication primitive is A statement characterizing the uniqueness of the authenticated node and satisfying a preset semantic rule of the authenticated node;
  • the authenticated node randomly selects a target authentication primitive from the primitive pool.
  • the method before the sending the target authentication primitive to the node performing the authentication, includes: encrypting the target authentication primitive.
  • the embodiment of the present invention further provides a distributed system node identity authentication method, which is applied to a node for performing authentication, including:
  • the identity authentication of the authenticated node passes; otherwise, the identity authentication of the authenticated node fails;
  • the primitive semantic library is generated in advance according to a primitive library, and the primitive library is a set of authentication primitives, and the authentication primitive is a statement that represents the uniqueness of the authenticated node, and meets the preset of the authenticated node. Semantic rules.
  • the extracting the semantics of the target authentication primitive as the target semantics and verifying whether the target semantics exists in the semantic library of the primitive includes:
  • the Bronze hash is configured to obtain a hash value of the authentication primitive of the original language library, and is configured according to the hash value of the authentication primitive, where the primitive semantic library is composed of the Bronze hash .
  • the extracting the semantics of the target authentication primitive as the target semantics, and verifying whether the target semantics exists in the primitive semantic database includes:
  • the primitive semantic library is a set of features of the authentication primitive in the primitive database, and the feature of the authentication primitive is extracted by using the learning algorithm for the authentication primitive.
  • the method after receiving the target authentication primitive sent by the authenticated node, before extracting the semantics of the target authentication primitive, further includes:
  • the step of extracting the semantics of the target authentication primitive is allowed to be performed.
  • the receiving the target authentication sent by the authenticated node After extracting the semantics of the target authentication primitive, the primitive includes:
  • the embodiment of the present invention further provides a distributed system node identity authentication method, including:
  • the primitive library is a set of authentication primitives
  • the authentication primitive is a statement characterizing the uniqueness of the authenticated node, and meets a preset semantic rule of the authenticated node
  • the authenticated node selects a target authentication primitive from the primitive database
  • the authenticated node sends the target authentication primitive to the node performing the authentication
  • the node performing the authentication receives the target authentication primitive sent by the authenticated node;
  • the node performing the authentication extracts the semantics of the target authentication primitive as the target semantics and verifies Whether the target semantics exists in the primitive semantic library;
  • the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node fails.
  • the authenticated node when the authenticated node and the node performing the authentication need to perform identity authentication, the authenticated node randomly selects one from the primitive pool. Target certification primitive.
  • the generating a primitive semantic library according to the primitive library includes:
  • Extracting the semantics of the target authentication primitive as the target semantics, and verifying whether the target semantics exists in the primitive semantic database including: obtaining a hash value of the target authentication primitive as the target semantics, and verifying Whether the target semantics exist in the Bloom hash.
  • the generating a primitive semantic library according to the primitive pool includes:
  • the method after receiving the target authentication primitive sent by the authenticated node, before extracting the semantics of the target authentication primitive, further includes :
  • the node performing the authentication checks whether the target authentication primitive meets the preset semantic rule of the authenticated node
  • the step of extracting the semantics of the target authentication primitive is allowed to be performed.
  • the method when the target authentication primitive is sent Before the node performing the authentication, the method further includes: the authenticated node encrypts the target authentication primitive.
  • the method after receiving the target authentication primitive sent by the authenticated node, extracting the target authentication primitive Before the semantics, it also includes:
  • the node performing the authentication checks whether the target authentication primitive is encrypted
  • an embodiment of the present invention provides a distributed system node identity authentication device, which is applied to an authenticated node, and includes:
  • the authentication primitive selecting unit is configured to: when the authenticated node and the node performing the authentication need to perform identity authentication, the authenticated node selects a target authentication primitive from the original language library, where the primitive database is the authentication primitive. a set, the authentication primitive is a statement characterizing the uniqueness of the authenticated node, and meets a preset semantic rule of the authenticated node;
  • the authentication primitive sending unit is configured to send the target authentication primitive to the node performing the authentication, so that the node performing the authentication authenticates the authenticated node according to the target authentication primitive.
  • the authentication primitive selecting unit is specifically configured to: when identity authentication is required between the authenticated node and the node performing authentication, A target authentication primitive is randomly selected from the original language library.
  • the device further includes an authentication primitive encryption unit, where the authentication primitive encryption unit is used Sending the target authentication primitive to the node performing the authentication at the authenticated node
  • the target authentication primitive is encrypted before.
  • the embodiment of the present invention further provides a distributed system node identity authentication device, which is applied to a node for performing authentication, including:
  • An authentication primitive receiving unit configured to receive a target authentication primitive sent by the authenticated node
  • a target semantic extraction unit configured to extract semantics of the target authentication primitive as target semantics
  • a verification unit configured to verify whether the target semantics exists in the primitive semantic library, if the target semantics exists in the primitive semantic library, the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node fails ;
  • the primitive semantic library is generated in advance according to a primitive library, and the primitive library is a set of authentication primitives, and the authentication primitive is a statement that represents the uniqueness of the authenticated node, and meets the preset of the authenticated node. Semantic rules.
  • the target semantic extraction unit is specifically configured to: obtain a hash value of the target authentication primitive as a target semantic;
  • the verification unit is specifically configured to: verify whether the target semantic exists in a Bronze hash;
  • the blob hash is configured to obtain a hash value of the authentication primitive of the primitive pool, and is configured according to a hash value of the authentication primitive, where the primitive semantic library is used by the cloth
  • the dragon is composed of hashes.
  • the target semantic extraction unit is specifically configured to: extract, by using a learning algorithm, a feature of the target authentication primitive as a target semantic;
  • the verification unit is specifically configured to:
  • the primitive semantic library is a set of features of the authentication primitive in the primitive pool, and the recognition The characteristics of the proof primitive are extracted by using the learning algorithm for the authentication primitive.
  • the device further includes:
  • a pre-verification unit configured to check whether the target authentication primitive meets a preset semantic rule of the authenticated node
  • an extraction enabling unit configured to enable the target semantic extraction unit when the target authentication primitive meets the preset semantic rule.
  • the device further includes an authentication primitive decryption unit,
  • the authentication primitive decryption unit includes:
  • An encryption verification module configured to check whether the target authentication primitive is encrypted before extracting the semantics of the target authentication primitive after receiving the target authentication primitive
  • An encryption method analysis module configured to analyze an encryption method of the target authentication primitive when the target authentication primitive is encrypted
  • a decryption module configured to acquire a decryption method corresponding to the encryption method, and decrypt the target authentication primitive by using the decryption method.
  • an embodiment of the present invention provides a distributed system node identity authentication apparatus, including:
  • a primitive library establishing unit configured to establish a primitive library, where the primitive library is a set of authentication primitives, the authentication primitive is a statement characterizing the uniqueness of the authenticated node, and meets a preset semantic rule of the authenticated node ;
  • a primitive semantic library generating unit configured to generate a primitive semantic library according to the primitive database
  • the authentication primitive selection unit is applied to the authenticated node, and is used to select a target authentication primitive from the original language library when the authenticated node and the node performing the authentication need to perform identity authentication;
  • the authentication primitive sending unit is applied to the authenticated node, and is configured to send the target authentication primitive to the node that performs authentication;
  • the authentication primitive receiving unit is configured to perform a node for performing authentication, and is configured to receive a target authentication primitive sent by the authenticated node;
  • a target semantic extraction unit configured to perform a node for performing authentication, for extracting semantics of the target authentication primitive as target semantics
  • a verification unit configured to perform a node for performing authentication, for verifying whether the target semantics exists in the primitive semantic library, and if the target semantics exists in the primitive semantic library, the identity authentication of the authenticated node passes; otherwise, The authentication of the authenticated node failed.
  • the authentication primitive selecting unit is specifically configured to: when identity authentication is required between the authenticated node and the node performing authentication, A target authentication primitive is randomly selected from the original language library.
  • the primitive semantic library generating unit is specifically configured to obtain a hash value of the authentication primitive of the original language library, construct a Bronze hash according to the hash value of the authentication primitive, and form a Bronze hash according to the hash hash Primitive semantic library;
  • the target semantic extraction unit is specifically configured to: obtain a hash value of the target authentication primitive as a target semantic;
  • the verification unit is specifically configured to: verify whether the target semantic exists in the Bloom hash.
  • the primitive semantic library generating unit is specifically configured to extract a feature of the authentication primitive in the original language library by using a learning algorithm, and use the set of the feature as a primitive semantic library;
  • the target semantic extraction unit is specifically configured to: extract, by using the learning algorithm, a feature of the target authentication primitive as a target semantic;
  • the verification unit is specifically configured to:
  • the device further includes:
  • a pre-verification unit configured to perform a node for performing authentication, for verifying whether the target authentication primitive meets a preset semantic rule of the authenticated node
  • an extraction enabling unit configured to perform a node for performing authentication, to enable the target semantic extraction unit when the target authentication primitive meets the preset semantic rule.
  • the device further includes an authentication primitive encryption unit, where The authentication primitive encryption unit is applied to the authenticated node for encrypting the target authentication primitive before transmitting the target authentication primitive to the node performing the authentication.
  • the device further includes an authentication primitive decryption unit, where the authentication primitive decryption unit is used to perform authentication Nodes, including:
  • An encryption verification module configured to check whether the target authentication primitive is encrypted before extracting the semantics of the target authentication primitive after receiving the target authentication primitive
  • An encryption method analysis module configured to analyze an encryption method of the target authentication primitive when the target authentication primitive is encrypted
  • a decryption module configured to acquire a decryption method corresponding to the encryption method, and decrypt the target authentication primitive by using the decryption method.
  • the technical solution provided by the embodiment of the present invention uses the authentication primitive as the authentication credential. Since the authentication primitive is only the description clause of the authenticated node, the construction of the authentication primitive and the establishment of the original language library are simple and easy; When identity authentication is required between the node performing authentication, the authenticated node selects the target authentication primitive from the original language library and sends it to the node performing the authentication for identity authentication. There may be a plurality of authentication primitives in the original language library, so that the authentication is performed.
  • the target authentication primitives sent by the node are not unique each time, which effectively prevents the target authentication primitive from being cracked, and does not require time and resources to maintain the target authentication primitive.
  • the authenticated node may select and send the target authentication primitive only when identity authentication is required, and each time the target authentication primitive is not unique, the authenticated node does not need to save the authentication state.
  • the node performing the authentication After receiving the target authentication primitive sent by the authenticated node, the node performing the authentication extracts the semantics of the primitive authentication primitive when generating the primitive semantic library, extracts the semantics of the target authentication primitive as the target semantic, and then verifies Whether the target semantics exists in the semantics library of primitives. Since the authentication primitive and the target authentication primitive are simple character statements, the existing semantic extraction method is used to extract the semantics, and whether the semantics of the target semantics and the semantics in the original semantic library are matched, the process is simple and easy. The resource consumption is small, and the node performing authentication in the entire authentication process does not need to save the authentication state, so that the authenticated node and the node performing the authentication can implement the on-demand authentication.
  • FIG. 1 is a schematic flowchart of a distributed system node identity authentication method applied to an authenticated node according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a distributed system node identity authentication method applied to a node performing authentication according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart diagram of a distributed system node identity authentication method according to an embodiment of the present disclosure
  • FIG. 4 is a block diagram of a distributed system node identity authentication apparatus applied to an authenticated node according to an embodiment of the present invention
  • FIG. 5 is a block diagram of a distributed system node identity authentication apparatus applied to a node performing authentication according to an embodiment of the present invention
  • FIG. 6 is a block diagram of a distributed system node identity authentication apparatus according to an embodiment of the present invention.
  • FIG. 1 is a schematic flowchart of a method for authenticating a node identity of a distributed system according to an embodiment of the present invention. The method is applied to an authenticated node. As shown in FIG. 1 , the method includes the following steps:
  • Step S101 When identity authentication is required between the authenticated node and the node performing authentication, the authenticated node selects a target authentication primitive from the original language library, where the primitive database is a set of authentication primitives.
  • the authentication primitive is a statement characterizing the uniqueness of the authenticated node, and meets a preset semantic rule of the authenticated node;
  • Step S102 Send the target authentication primitive to the node performing the authentication, so that the node performing the authentication authenticates the authenticated node according to the target authentication primitive.
  • the authenticated node initiates identity authentication at the same time as the data access is initiated, that is, the authenticated node needs to perform identity authentication while the data access is initiated, and the authenticated node needs to send identity authentication information while sending data.
  • the identity authentication information is a target authentication primitive.
  • the authenticated node first sends a data access request to the node performing the authentication, and the node performing the authentication returns an identity authentication request message, and after the authenticated node receives the identity authentication request message, the node performs authentication. After the identity authentication is sent, the data is sent to the node performing the authentication. In this case, the authenticated node receives the identity authentication request message, that is, the authenticated node and the node performing the authentication need to perform identity authentication.
  • the primitive library is pre-established, which is a collection of authentication primitives.
  • the authentication primitive is a statement characterizing the uniqueness of the authenticated node, for example, a plurality of statements describing the uniqueness of the authenticated node. Since the irregular statement is difficult to extract semantics, the authentication primitive needs to conform to the preset semantic rule of the authenticated node.
  • the default semantic rules for authentication primitives can be of the following categories:
  • Replacement class semantic rule replace the table according to the preset character, and replace the character in the statement with other characters corresponding to the character in the character substitution table, for example: o is replaced by 0, l is replaced by 1, and b is replaced by 6, g is replaced by 9, etc., S is replaced by $, etc.
  • the authentication primitives are generated in a preset mode, for example, after the even-numbered characters of the authentication primitives, a fixed-length random character combination is added.
  • Punctuation class semantic rules add fixed punctuation at a fixed position of the authentication primitive, for example, each authentication primitive ends with a question mark.
  • the preset semantic rules are not limited to the above three types, and the above three types may be used in combination of two or two or a combination of the three.
  • the authentication primitives are constructed according to the preset semantic rules, and the authentication primitives are stored in the original language library.
  • Each authentication primitive corresponds to an index in the original language library, and each authenticated node has a one-to-one correspondence with the original language library.
  • the authentication primitives in the original language library contain at least two articles, so that the selection of the authentication primitives is not unique.
  • the original language library may be stored at the authenticated node or may be separated from the authenticated node. When the original language library is separated from the authenticated node, the authenticated node accesses the original language database through the network.
  • the primitive library can be encrypted to save or add an access control mechanism to prevent the authentication primitive from leaking.
  • the authenticated node is required when identity authentication is required between the authenticated node and the node performing authentication.
  • a target authentication primitive is selected from the original language library, and the selection manner may be randomly selected or selected according to a cyclical law.
  • the random selection may randomly generate an index value for the authenticated node (the index value is within the index value range of the original language library), and then select an authentication primitive corresponding to the index value in the original language library.
  • the authenticated node may sequentially select the authentication primitive corresponding to the index value according to the order of the index values of the original language library, and after the identity authentication is performed multiple times, the authentication primitive selected by the authenticated node corresponds to When the index value has reached the end of the original library index value arrangement, at the next identity authentication, the authenticated node re-selects from the first index value of the index value of the original language library. After the target authentication primitive is selected, the authenticated node sends the target authentication primitive to the node performing the authentication, so that the node performing the authentication authenticates the authenticated node according to the target authentication primitive.
  • the target authentication primitive may be encrypted before the authenticated node sends the target authentication primitive to the node performing the authentication.
  • the node performing the authentication decrypts the target authentication primitive after receiving the target authentication primitive.
  • the authentication primitive is used as the authentication credential. Since the authentication primitive is only the description clause of the authenticated node, the construction of the authentication primitive and the establishment of the original language library are simple and easy; When identity authentication is required between the node performing authentication, the authenticated node selects the target authentication primitive from the original language library and sends it to the node performing the authentication for identity authentication. There may be a plurality of authentication primitives in the original language library, so that the authentication is performed.
  • the target authentication primitives sent by the node are not unique each time, which effectively prevents the target authentication primitive from being cracked. It does not need to periodically modify the authentication credentials like the user/password identity authentication method, and does not require time and resources to maintain the authentication. certificate.
  • the authenticated node uses the random selection method to select the target authentication primitive, the target authentication primitives sent each time are unpredictable, which is more conducive to preventing the target authentication primitive from being cracked and reducing the maintenance cost of the authentication credentials.
  • the authenticated node may select and send the target authentication primitive only when the identity authentication is required, and the target authentication primitive is not unique each time, and the authenticated node does not need to save the authentication state. This enables on-demand authentication, or "one-time-one authentication.”
  • FIG. 2 is a schematic flowchart of a method for authenticating a node identity of a distributed system according to an embodiment of the present invention. The method is applied to a node that performs authentication. As shown in FIG. 2, the method includes the following steps:
  • Step S201 Receive a target authentication primitive sent by the authenticated node.
  • Step S202 extracting semantics of the target authentication primitive as target semantics
  • Step S203 verifying whether the target semantics exists in the primitive semantic library, if the original language If the target semantics exists in the sense database, the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node fails.
  • the primitive semantic library is generated in advance according to the original language library.
  • the primitive semantic library is a collection of semantics of the authentication primitives in the original language library.
  • the semantics of each authentication primitive in the primitive library are extracted and stored in the primitive semantic library.
  • the primitive semantic library may be located at a node performing authentication, or may be separated from a node performing authentication. When the primitive semantic library is separated from a node performing authentication, the node performing authentication accesses the primitive semantic library through a network. If the authenticated node and the node performing authentication have a one-to-one correspondence, that is, a node performing authentication only authenticates one authenticated node, only the primitive semantic library accessed by the node performing the authentication stores the The semantics of the authentication primitive in the original language library of the authenticated node.
  • the semantics of the authentication primitive in the primitive database of the corresponding authenticated node is stored in the primitive semantic library accessed by the node performing the authentication.
  • all nodes performing authentication may share a primitive semantic library, that is, extract the semantics of the authentication primitives in all the primitives, and store them in a primitive semantic library.
  • a statement in which a primitive is a character is also data, and the semantics of the primitive is the meaning of the statement, that is, the logical representation or feature of the data. Extract the semantics of the primitives, logically organize the primitives in a preset manner, or extract features in a preset manner.
  • generating a primitive semantic library according to the primitive library includes: obtaining a hash value of the authentication primitive of the primitive library, and constructing a Bronze hash according to the hash value of the authentication primitive,
  • the Bronze hash is a collection of semantics of the authentication primitives, stored in the primitive semantic library.
  • generating the primitive semantic library according to the primitive library is an irreversible process, so the security of the authentication primitive can be better protected, and the attacker will not be able to obtain the authentication primitive through the primitive semantic library, also because In this way, the primitive semantic library can be made public.
  • the hash value of the authentication primitive of the original language library can be obtained by using the hash function to act on the authentication primitive of the original language library.
  • the Bronze hash can be constructed by initializing all the bits in the bron vector (b1, b2, ..., bm) of length m bits to 0, and then The k mutually independent fast HASH functions (h1, h2, ..., hk) with a return value between 1 and m are applied to the hash value of each input authentication primitive to obtain k return values (r1, R2,...,rk), and set the bit position of r1, r2, ..., rk in the bronze vector to 1, and finally obtain the entire bron vector, that is, the bronze hash, and the bronze hash is stored in Primitive semantic library.
  • the node performing the authentication acquires a hash value of the target authentication primitive, acquires the hash value, and acquires the authentication original in the original language library when generating the primitive semantic library.
  • the hash value of the language is the same.
  • the node performing the authentication takes the hash value of the target authentication primitive as the target semantics, and then processes the hash value of the input authentication primitive when constructing the Bloom hash. And processing the target semantics to obtain a return value, and then determining whether a bit corresponding to the return value in the bloom envelope is 1; if 1, determining that the target semantic exists in the Bloom A hash, if 0, determines that the target semantics are not present in the Bloom hash. If the target semantics exists in the Bronze hash, the target semantics exists in the primitive semantic database, and the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node fails.
  • generating the primitive semantic library according to the primitive database comprises: using a learning algorithm to extract features of the authentication primitive of the original language library, and using the set of features of the authentication primitive as the primitive semantic library.
  • learning algorithms such as support vector algorithms, etc.
  • the characteristics of the authentication primitive extracted by the learning algorithm may be a vector or a matrix, which varies with the learning algorithm.
  • the support vector algorithm as an example, with the authentication primitive in the original language library as input, the support vector that characterizes the authentication primitive can be obtained, and the set of support vectors of the authentication primitive is the primitive semantic library.
  • the node performing the authentication extracts the feature of the target authentication primitive using the same learning algorithm, takes the feature of the target authentication primitive as the target semantic, and then calculates the target semantic and primitive semantic library.
  • the matching degree of the feature determining whether the matching degree is greater than or equal to a preset threshold, if the matching degree is greater than or equal to the preset threshold, the target semantics exists in the primitive semantic library, otherwise, The target semantics does not exist in the primitive semantic library.
  • the support vector algorithm taking the target authentication primitive as input, using the support vector algorithm to obtain the support vector for characterizing the target authentication primitive, using the support vector as the target semantic, and then using the target semantics and the semantic semantic library The support vector in the matching is matched, and the matching degree between the target semantics and the support vector in the primitive semantic database is calculated. If the matching degree is greater than or equal to 85%, it is determined that the target semantic exists in the primitive semantic database, and the authenticated node The identity authentication is passed. Otherwise, if the matching degree is less than 85%, it is determined that the target semantics does not exist in the primitive semantic database, and the identity authentication of the authenticated node fails, where “85%” is a preset threshold.
  • the preset semantic rule is the preset semantic rule of the authenticated node.
  • the authentication primitive in the original language library must conform to the preset semantic rule of the authenticated node, and if the target authentication primitive received by the node performing the authentication does not comply with the preset semantic rule, it can be determined that the target authentication primitive is illegal.
  • the identity authentication of the authenticated node cannot pass; if the target authentication primitive received by the node performing the authentication conforms to the preset semantic rule, performing the step of extracting the semantics of the target authentication primitive, for the authenticated node Identity for further verification. Since it is simple and easy to test whether the target authentication primitive conforms to the preset semantic rule, and the resource consumption is small, the step of extracting the semantics of the target authentication primitive can be avoided only when the target authentication primitive conforms to the preset semantic rule. Right place There are target authentication primitives that extract the resource cost of semantics.
  • Decryption can specifically include the following steps:
  • the authenticated node can encrypt the target authentication primitive to ensure the security of the target authentication primitive and prevent the target authentication primitive from being rewritten or destroyed.
  • a protocol can be established between the authenticated node and the node performing the authentication. According to the protocol, the authenticated node encrypts the target authentication primitive by using a predetermined encryption method, and the node performing the authentication defaults.
  • the received target authentication primitive is encrypted and decrypted using a default decryption method set in advance. In this case, step (a1) and step (a2) may not be performed.
  • the method for encrypting the target authentication primitive by the authenticated node may be various, for example, performing character misalignment processing on the authentication primitive.
  • the authenticated node adds an algorithm identifier to the encrypted target authentication primitive, and the algorithm identifier is used to identify an encryption algorithm used by the authenticated node to encrypt the target authentication primitive.
  • the step (a1) determines whether the received target authentication primitive includes the algorithm identifier, and if the algorithm identifier is included, the target authentication primitive is encrypted data.
  • step (a2) analyzes an encryption algorithm corresponding to the algorithm identifier, and step (a3) finds a decryption algorithm corresponding to the encryption algorithm in a pre-stored decryption algorithm, and decrypts the target authentication using the decryption algorithm. Primitive. If the result of the step (a1) is that the algorithm identifier is not included in the target authentication primitive, it is determined that the target authentication primitive is not encrypted.
  • the authenticated node encrypts the target authentication primitive by using an encryption algorithm with encrypted data having a unique data structure.
  • step (a1) identifies the data structure of the target authentication primitive, and compares the data structure of the identified target authentication primitive with various data structures stored in advance. If the data structure of the target authentication primitive matches a certain data structure stored in advance, it is determined that the received target authentication primitive is encrypted.
  • Step (a2) is based on a pre-stored data structure that matches the data structure of the target authentication primitive.
  • step (a3) searches for a decryption algorithm corresponding to the encryption algorithm in the pre-stored decryption algorithm, and decrypts the received target authentication primitive using the decryption algorithm.
  • the technical solution provided by the embodiment provides a method for extracting the semantics of the original authentication primitive when the primitive semantic library is generated, extracts the semantics of the target authentication primitive as the target semantic, and then verifies whether the target semantic exists and the primitive. In the semantic library, if it exists, the identity of the authenticated node passes the authentication. Otherwise, the authentication of the authenticated node fails. Since the authentication primitive and the target authentication primitive are simple character statements, the existing semantic extraction method is used to extract the semantics, and whether the semantics of the target semantics and the semantics of the original semantics are matched, the process is simple and the resource consumption is small. The node that performs authentication in the entire authentication process does not need to save the authentication status, and only authenticates the target authentication primitive received at the current time, so that the authenticated node and the node performing the authentication can implement the on-demand authentication.
  • FIG. 3 is a schematic flowchart of a method for authenticating a node identity in a distributed system according to an embodiment of the present invention. As shown in FIG. 3, the method includes the following steps:
  • Step S301 establishing a primitive library, where the primitive library is a set of authentication primitives, the authentication primitive is a statement characterizing the uniqueness of the authenticated node, and meets a preset semantic rule of the authenticated node;
  • Step S302 generating a primitive semantic library according to the primitive database
  • Step S303 when identity authentication is required between the authenticated node and the node performing authentication, the authenticated node selects a target authentication primitive from the primitive database;
  • Step S304 the authenticated node sends the target authentication primitive to the node that performs authentication
  • Step S305 the node performing authentication receives the target authentication primitive sent by the authenticated node
  • Step S306 the node performing the authentication extracts the semantics of the target authentication primitive as the target semantics, and verifies whether the target semantics exists in the primitive semantic library.
  • the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node fails.
  • the authenticated node initiates identity authentication at the same time as the data access is initiated, and the authenticated node needs to send the identity authentication information while transmitting the data.
  • the identity authentication information is the target authentication original. language.
  • the authenticated node first sends a data access request to the node performing the authentication, and the node performing the authentication returns an identity authentication request message, and after the authenticated node receives the identity authentication request message, the node performs authentication.
  • the identity authentication information is sent.
  • the authenticated node receives the identity authentication request message, that is, the identity authentication is required between the authenticated node and the node performing the authentication.
  • the primitive database is pre-established as a collection of authentication primitives.
  • the authentication primitive is a statement that characterizes the uniqueness of the authenticated node. Since the irregular statement is difficult to extract semantics, the authentication primitive needs to conform to the preset semantic rules of the authenticated node.
  • the default semantic rules for authentication primitives can be of the following categories:
  • Replacement class semantic rule replace the table according to the preset character, and replace the character in the statement with the other characters corresponding to the character in the character replacement table.
  • the authentication primitives are generated in a preset mode, for example, after the even-numbered characters of the authentication primitives, a fixed-length random character combination is added.
  • Punctuation class semantic rules add fixed punctuation at a fixed position of the authentication primitive.
  • the preset semantic rules are not limited to the above three types, and the above three types may be used in combination of two or two or a combination of the three.
  • the authentication primitives are constructed according to the preset semantic rules, and the authentication primitives are stored in the original language library.
  • Each authentication primitive corresponds to an index in the original language library, and each authenticated node has a one-to-one correspondence with the original language library.
  • the authentication primitives in the original language library contain at least two articles, so that the selection of the authentication primitives is not unique.
  • the original language library may be stored at the authenticated node or may be separated from the authenticated node. When the original language library is separated from the authenticated node, the authenticated node accesses the original language database through the network.
  • the primitive library can be encrypted to save or add an access control mechanism to prevent the authentication primitive from leaking.
  • the primitive semantic library is generated in advance according to the original language library.
  • the primitive semantic library is a collection of semantics of the authentication primitives in the original language library.
  • the semantics of each authentication primitive in the primitive library are extracted and stored in the primitive semantic library.
  • the primitive semantic library may be located at a node performing authentication, or may be separated from a node performing authentication. When the primitive semantic library is separated from a node performing authentication, the node performing authentication accesses the primitive semantic library through a network. If the authenticated node and the node performing authentication have a one-to-one correspondence, that is, a node performing authentication only authenticates one authenticated node, only the primitive semantic library accessed by the node performing the authentication stores the The semantics of the authentication primitive in the original language library of the authenticated node.
  • the semantics of the authentication primitive in the primitive database of the corresponding authenticated node is stored in the primitive semantic library accessed by the node performing the authentication.
  • all nodes performing authentication may share a primitive semantic library, that is, extract the semantics of the authentication primitives in all the primitives, and store them in a primitive semantic library.
  • a statement in which a primitive is a character is also data, and the semantics of the primitive is the meaning of the statement, that is, the logical representation or feature of the data. Extract the semantics of the primitives, logically organize the primitives in a preset manner, or extract features in a preset manner.
  • generating a primitive semantic library according to the primitive library includes: obtaining a hash value of the authentication primitive of the primitive library, and constructing a Bronze hash according to the hash value of the authentication primitive, Bron A collection of semantics hashed as authentication primitives, stored in a primitive semantic library.
  • generating the primitive semantic library according to the primitive library is an irreversible process, so the security of the authentication primitive can be better protected, and the attacker will not be able to obtain the authentication primitive through the primitive semantic library, also because In this way, the primitive semantic library can be made public.
  • the hash value of the authentication primitive of the original language library can be obtained by using the hash function to act on the authentication primitive of the original language library.
  • the Bronze hash can be constructed by initializing all the bits in the bron vector (b1, b2, ..., bm) of length m bits to 0, and then The k mutually independent fast HASH functions (h1, h2, ..., hk) with a return value between 1 and m are applied to the hash value of each input authentication primitive to obtain k return values (r1, R2,...,rk), and set the bit position of r1, r2, ..., rk in the bronze vector to 1, and finally obtain the entire bron vector, that is, the bronze hash, and the bronze hash is stored in Primitive semantic library.
  • generating the primitive semantic library according to the primitive database comprises: using a learning algorithm to extract features of the authentication primitive of the original language library, and using the set of features of the authentication primitive as the primitive semantic library.
  • learning algorithms such as support vector algorithms, etc.
  • the characteristics of the authentication primitive extracted by the learning algorithm may be a vector or a matrix, which varies with the learning algorithm.
  • the support vector algorithm as an example, with the authentication primitive in the original language library as input, the support vector that characterizes the authentication primitive can be obtained, and the set of support vectors of the authentication primitive is the primitive semantic library.
  • Using the learning algorithm to generate the primitive semantic library based on the original language library is also irreversible, which is beneficial to ensure the security of the authentication primitive, and the primitive semantic library can also be disclosed.
  • the authenticated node selects a target authentication primitive from the original language library, and the selection manner may be randomly selected or may be selected according to a cyclical rule.
  • the random selection may randomly generate an index value for the authenticated node (the index value is within the index value range of the original language library), and then select an authentication primitive corresponding to the index value in the original language library.
  • the authenticated node may sequentially select the authentication primitive corresponding to the index value according to the order of the index values of the original language library, and after the identity authentication is performed multiple times, the authentication primitive selected by the authenticated node corresponds to When the index value has reached the end of the original library index value arrangement, at the next identity authentication, the authenticated node re-selects from the first index value of the index value of the original language library.
  • the authenticated node may also authenticate the target before sending the target authentication primitive to the node performing the authentication.
  • Primitive encryption The method for encrypting the target authentication primitive by the authenticated node may be various, for example, performing character misalignment processing on the authentication primitive.
  • the node performing the authentication decrypts the target authentication primitive after receiving the target authentication primitive.
  • the node performing the authentication After the node performing the authentication receives the target authentication primitive sent by the authenticated node, the node extracts Declaring the semantics of the target authentication primitive as the target semantics and verifying whether the target semantics exists in the primitive semantic library.
  • the Bronze hash is constructed according to the hash value of the authentication primitive
  • the Bronze hash is A set of semantics of the authentication primitive
  • the node performing the authentication acquires a hash value of the target authentication primitive, acquires the hash value, and generates a primitive semantic library
  • the method of obtaining the hash value of the authentication primitive in the original language library is the same, and the node performing the authentication takes the hash value of the target authentication primitive as the target semantic, and then constructs the Bronze hash to the input authentication primitive.
  • the hash value is processed in the same manner, the target semantics is processed, a return value is obtained, and then it is determined whether the bit corresponding to the return value in the Bronze hash is 1 or, if 1, the target semantic is determined. Existing in the bronze hash, if it is 0, it is determined that the target semantics are not present in the bronze hash. If the target semantics exists in the Bronze hash, the target semantics exists in the primitive semantic database, and the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node fails.
  • the learning algorithm is used to extract the feature of the authentication primitive of the original language library, and the set of the features of the authentication primitive is used as the primitive semantic library.
  • the node performing the authentication extracts the feature of the target authentication primitive using the same learning algorithm, takes the feature of the target authentication primitive as the target semantic, and then calculates the target semantic and primitive semantics. a matching degree of the feature in the library, determining whether the matching degree is greater than or equal to a preset threshold, and if the matching degree is greater than or equal to the preset threshold, the target semantic exists in the primitive semantic library; otherwise, The target semantics do not exist in the primitive semantic library.
  • the support vector algorithm taking the target authentication primitive as input, using the support vector algorithm to obtain the support vector for characterizing the target authentication primitive, using the support vector as the target semantic, and then using the target semantics and the semantic semantic library The support vector in the matching is matched, and the matching degree between the target semantics and the support vector in the primitive semantic database is calculated. If the matching degree is greater than or equal to 85%, it is determined that the target semantic exists in the primitive semantic database, and the authenticated node The identity authentication is passed. Otherwise, if the matching degree is less than 85%, it is determined that the target semantics does not exist in the primitive semantic database, and the identity authentication of the authenticated node fails, where “85%” is a preset threshold.
  • the node performing the authentication may be added to check whether the target authentication primitive conforms to the pre-authentication node.
  • Set the steps for semantic rules The authentication primitive in the original language library must conform to the preset semantic rule of the authenticated node, and if the target authentication primitive received by the node performing the authentication does not comply with the preset semantic rule, it can be determined that the target authentication primitive is illegal.
  • the identity authentication of the authenticated node cannot pass; if the target authentication primitive received by the node performing the authentication conforms to the Determining the semantic rules, performing the step of extracting the semantics of the target authentication primitive, and further verifying the identity of the authenticated node.
  • the step of extracting the semantics of the target authentication primitive can be avoided only when the target authentication primitive conforms to the preset semantic rule.
  • the resource cost of semantics is extracted for all target authentication primitives.
  • Decryption can specifically include the following steps:
  • a protocol can be established between the authenticated node and the node performing the authentication.
  • the authenticated node encrypts the target authentication primitive by using a predetermined encryption method, and the node performing the authentication defaults.
  • the received target authentication primitive is encrypted and decrypted using a default decryption method set in advance. In this case, step (a1) and step (a2) may not be performed.
  • the authenticated node adds an algorithm identifier to the encrypted target authentication primitive, and the algorithm identifier is used to identify an encryption algorithm used by the authenticated node to encrypt the target authentication primitive.
  • the step (a1) determines whether the received target authentication primitive includes the algorithm identifier, and if the algorithm identifier is included, the target authentication primitive is encrypted data.
  • step (a2) analyzes an encryption algorithm corresponding to the algorithm identifier, and step (a3) finds a decryption algorithm corresponding to the encryption algorithm in a pre-stored decryption algorithm, and decrypts the target authentication using the decryption algorithm. Primitive. If the result of the step (a1) is that the algorithm identifier is not included in the target authentication primitive, it is determined that the target authentication primitive is not encrypted.
  • the authenticated node encrypts the target authentication primitive by using an encryption algorithm with a unique data structure after the encrypted data, and after the node performing the authentication receives the target authentication primitive, step (a1) identifies the target authentication.
  • the data structure of the primitive, and the data structure of the identified target authentication primitive is compared with various data structures stored in advance, and if the data structure of the target authentication primitive matches a certain data structure stored in advance, Determine that the received target authentication primitive is encrypted of.
  • Step (a2) obtains an encryption algorithm corresponding to the pre-stored data structure according to a pre-stored data structure matching the data structure of the target authentication primitive, and then (a3) searches in a pre-stored decryption algorithm.
  • the authentication primitive is used as the authentication credential. Since the authentication primitive is only the description clause of the authenticated node, the construction of the authentication primitive and the establishment of the original language library are simple and easy; When identity authentication is required between the node performing authentication, the authenticated node selects the target authentication primitive from the original language library and sends it to the node performing the authentication for identity authentication. There may be a plurality of authentication primitives in the original language library, so that the authentication is performed.
  • the target authentication primitives sent by the node are not unique each time, which effectively prevents the target authentication primitive from being cracked, and does not require time and resources to maintain the target authentication primitive.
  • the authenticated node uses the random selection method to select the target authentication primitive, the target authentication primitives sent each time are unpredictable, which is more conducive to preventing the target authentication primitive from being cracked and reducing the maintenance cost of the target authentication primitive. Moreover, the authenticated node may select and send the target authentication primitive only when identity authentication is required, and each time the target authentication primitive is not unique, the authenticated node does not need to save the authentication state.
  • the node performing the authentication extracts the semantics of the primitive authentication primitive when generating the primitive semantic library, extracts the semantics of the target authentication primitive as the target semantic, and then verifies Whether the target semantics exists in the semantics library of primitives.
  • the existing semantic extraction method is used to extract the semantics, and whether the semantics of the target semantics and the semantics of the original semantics are matched, the process is simple and the resource consumption is small.
  • the node that performs authentication in the entire authentication process does not need to save the authentication status, and only authenticates the target authentication primitive received at the time, so that the authenticated node and the node performing the authentication can implement the on-demand authentication.
  • FIG. 4 is a block diagram of a distributed system node identity authentication apparatus according to an embodiment of the present invention.
  • the device is applied to an authenticated node.
  • the apparatus includes the following:
  • the authentication primitive selecting unit U401 is configured to select a target authentication primitive from the original language library when the authenticated node and the node performing the authentication need to perform identity authentication, where the primitive language library is a set of the authentication primitives. And pre-established, the authentication primitive is a statement that satisfies a preset semantic rule of the authenticated node;
  • the authentication primitive sending unit U402 is configured to send the target authentication primitive to the node that performs authentication.
  • the authenticated node initiates identity authentication at the same time as the data access is initiated, that is, the authenticated node needs to perform identity authentication while the data access is initiated.
  • the authenticated node first sends a data access request to the node performing the authentication, and the node performing the authentication returns an identity authentication request message. After receiving the identity authentication request message, the authenticated node sends the identity authentication information to the node performing the authentication. In this case, the authenticated node receives the identity authentication request message, which is the identity authentication between the authenticated node and the node performing authentication.
  • the primitive library is pre-established, which is a collection of authentication primitives.
  • the authentication primitive is a statement that characterizes the uniqueness of the authenticated node. Since the irregular statement is difficult to extract semantics, the authentication primitive needs to conform to the preset semantic rules of the authenticated node.
  • the default semantic rules for authentication primitives can be of the following categories:
  • Replacement class semantic rule replace the table according to the preset character, and replace the character in the statement with the other characters corresponding to the character in the character replacement table.
  • the authentication primitives are generated in a preset mode, for example, after the even-numbered characters of the authentication primitives, a fixed-length random character combination is added.
  • Punctuation class semantic rules add fixed punctuation at a fixed position of the authentication primitive.
  • the preset semantic rules are not limited to the above three types, and the above three types may be used in combination of two or two or a combination of the three.
  • the authentication primitives are constructed according to the preset semantic rules, and the authentication primitives are stored in the original language library.
  • Each authentication primitive corresponds to an index in the original language library, and each authenticated node has a one-to-one correspondence with the original language library.
  • the authentication primitives in the original language library contain at least two articles, so that the selection of the authentication primitives is not unique.
  • the original language library may be stored at the authenticated node or may be separated from the authenticated node. When the original language library is separated from the authenticated node, the authenticated node accesses the original language database through the network.
  • the authentication primitive selecting unit U401 selects a target authentication primitive from the original language library, and the selection manner may be randomly selected or may be selected according to a cyclical rule.
  • the random selection may randomly generate an index value for the authentication primitive selection unit U401 (the index value is within the index value range of the original language library), and then select an authentication primitive corresponding to the index value in the original language database. .
  • the target authentication primitive sent by the authentication primitive sending list U402 is unpredictable, which is more conducive to preventing the target authentication primitive from being cracked and reducing the target authentication. Primitive maintenance costs.
  • the authentication primitive selection unit U401 may sequentially select the authentication primitive corresponding to the index value according to the order of the index values of the original language library, and after the identity authentication is performed multiple times, the authentication primitive selection unit U401 When the index value corresponding to the selected authentication primitive has reached the end of the original library index value arrangement, at the next identity authentication, the authentication primitive selection unit U401 re-arranges the first index value from the index value of the original language library. Start picking.
  • the authentication primitive sending list U402 sends the target authentication primitive to the node performing the authentication, so that the node performing the authentication authenticates the authenticated node according to the target authentication primitive. .
  • the device may further include an authentication primitive encryption unit, configured to send the target authentication primitive to the execution authentication in the authentication primitive sending list U402.
  • the target authentication primitive is encrypted before the node.
  • the node performing the authentication decrypts the target authentication primitive after receiving the target authentication primitive.
  • the target authentication primitive when identity authentication is required between the authenticated node and the node performing authentication, the target authentication primitive is selected from the original language library and sent to the node performing the authentication for identity authentication, and the original language library may exist. Numerous authentication primitives, such that the target authentication primitives sent by the authentication node are not unique each time, thereby effectively preventing the target authentication primitive from being cracked, and does not require time and resources to maintain the authentication credentials, and the device
  • the target authentication primitive can be selected and sent only when identity authentication is required, and the target authentication primitive is not unique each time, and the authentication state is not required, thereby enabling on-demand authentication.
  • FIG. 5 is a block diagram of a distributed system node identity authentication apparatus according to an embodiment of the present invention.
  • the device is applied to a node for performing authentication.
  • the apparatus includes the following:
  • the authentication primitive receiving unit U501 is configured to receive the target authentication primitive sent by the authenticated node
  • a target semantic extraction unit U502 configured to extract semantics of the target authentication primitive as target semantics
  • a verification unit U503 configured to verify whether the target semantics exists in the primitive semantic library, and if the target semantics exists in the primitive semantic library, the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node failure;
  • the primitive semantic library is generated according to the original language library and is pre-established.
  • the original language library is a set of authentication primitives, and is pre-established, and the authentication primitive is a preset semantic rule that satisfies the authenticated node. Statement.
  • the primitive semantic library is a collection of semantics of the authentication primitives in the original language library.
  • the semantics of each authentication primitive in the primitive library are extracted and stored in the primitive semantic library.
  • the primitive semantic library may be located at a node performing authentication, or may be separated from a node performing authentication. When the primitive semantic library is separated from a node performing authentication, the node performing authentication accesses the primitive semantic library through a network. If the authenticated node and the node performing authentication have a one-to-one correspondence, that is, a node performing authentication only authenticates one authenticated node, only the primitive semantic library accessed by the node performing the authentication stores the The semantics of the authentication primitive in the original language library of the authenticated node.
  • the semantics of the authentication primitive in the original language library of the corresponding authenticated node is stored in the primitive semantic library accessed by the node performing the authentication.
  • all nodes performing authentication may share a primitive semantic library, that is, extract the semantics of the authentication primitives in all the primitives, and store them in a primitive semantic library.
  • generating a primitive semantic library according to the primitive library includes: obtaining a hash value of the authentication primitive of the primitive library, and constructing a Bronze hash according to the hash value of the authentication primitive,
  • the Bronze hash is a collection of semantics of the authentication primitives, stored in the primitive semantic library.
  • the hash value of the authentication primitive of the original language library can be obtained by using the hash function to act on the authentication primitive of the original language library.
  • the Bronze hash can be constructed by initializing all the bits in the bron vector (b1, b2, ..., bm) of length m bits to 0, and then The k mutually independent fast HASH functions (h1, h2, ..., hk) with a return value between 1 and m are applied to the hash value of each input authentication primitive to obtain k return values (r1, R2,...,rk), and set the bit position of r1, r2, ..., rk in the bronze vector to 1, and finally obtain the entire bron vector, that is, the bronze hash, and the bronze hash is stored in Primitive semantic library.
  • the target semantic extracting unit U502 acquires a hash value of the target authentication primitive, acquires the hash value, and generates a primitive semantic library.
  • the method of obtaining the hash value of the authentication primitive in the original language library is the same.
  • the target semantic extraction unit U502 takes the hash value of the target authentication primitive as the target semantic, and then the verification unit U503 processes the target semantics in the same manner as the hash value of the input authentication primitive when constructing the Bronze hash.
  • generating the primitive semantic library according to the primitive database comprises: using a learning algorithm to extract features of the authentication primitive of the original language library, and using the set of features of the authentication primitive as the primitive semantic library.
  • the characteristics of the authentication primitive extracted by the learning algorithm may be a vector or a matrix, which varies with the learning algorithm. Taking the support vector algorithm as an example, with the authentication primitive in the original language library as input, the support vector that characterizes the authentication primitive can be obtained, and the set of support vectors of the authentication primitive is the primitive semantic library.
  • the target semantic extracting unit U502 extracts the feature of the target authentication primitive using the same learning algorithm, uses the feature of the target authentication primitive as the target semantic, and then verifies Unit U503 calculates the target semantics and primitive semantic library The matching degree of the feature, determining whether the matching degree is greater than or equal to a preset threshold, if the matching degree is greater than or equal to the preset threshold, the target semantics exists in the primitive semantic library, otherwise, The target semantics does not exist in the primitive semantic library.
  • the target semantic extraction unit U502 takes the target authentication primitive as an input, and uses the support vector algorithm to obtain a support vector for characterizing the target authentication primitive, with the support vector as the target semantic, and then the verification unit U503 will The target semantics is matched with the support vector in the primitive semantic library, and the matching degree between the target semantics and the support vector in the primitive semantic database is calculated. If the matching degree is greater than or equal to 85%, it is determined that the target semantic exists in the original In the semantic library, the identity of the authenticated node is authenticated. Otherwise, if the matching degree is less than 85%, it is determined that the target semantics does not exist in the semantic database of the primitive, and the identity authentication of the authenticated node fails. %" is the preset threshold.
  • the authentication primitive in the original language library must conform to the preset semantic rule of the authenticated node. If the target authentication primitive received by the authentication primitive receiving unit U501 does not comply with the preset semantic rule, the target authentication primitive can be determined. It is illegal, the identity authentication of the authenticated node cannot pass; if the target authentication primitive received by the authentication primitive receiving unit U501 conforms to the preset semantic rule, the identity of the authenticated node is further verified. Therefore, the apparatus may further include a pre-verification unit and an extraction enabling unit, the pre-verification unit configured to check whether the target authentication primitive meets a preset semantic rule of the authenticated node; the extraction enabling unit uses The target semantic extraction unit is enabled when the target authentication primitive conforms to the preset semantic rule.
  • the semantic extraction unit U502 extracts the semantics of the target authentication primitive by the target semantic extraction unit U502, and can avoid resource consumption caused by extracting semantics for all target authentication primitives.
  • the device may further include:
  • An encryption verification unit configured to check whether the target authentication primitive is encrypted before extracting the semantics of the target authentication primitive after the node performing the authentication receives the target authentication primitive
  • An encryption method analysis module configured to analyze an encryption method of the target authentication primitive when the target authentication primitive is encrypted
  • a decryption module configured to acquire a decryption method corresponding to the encryption method, and decrypt the target authentication primitive.
  • the library extracts the semantics of the primitive authentication primitive, extracts the semantics of the target authentication primitive as the target semantics, and then the verification unit U503 verifies whether the target semantic exists and the semantics of the primitive, and if so, is authenticated
  • the identity authentication of the node passes. Otherwise, the authentication of the authenticated node fails.
  • the authentication primitive and the target authentication primitive are simple character statements
  • the existing semantic extraction method is used to extract the semantics, and whether the semantics of the target semantics and the semantics of the original semantics are matched, the process is simple and the resource consumption is small.
  • the node that performs the authentication process in the entire authentication process does not need to save the authentication state, so that the authenticated node and the node performing the authentication can implement the on-demand authentication.
  • FIG. 6 is a block diagram of a distributed system node identity authentication apparatus according to an embodiment of the present invention.
  • the device is applied to a node performing authentication, as shown in FIG. 6, the apparatus includes the following:
  • the original language library establishing unit U601 is configured to establish a primitive library, where the primitive language library is a set of authentication primitives, and the authentication primitive is a statement characterizing the uniqueness of the authenticated node, and meets preset semantics of the authenticated node. rule;
  • a primitive semantic library generating unit U602 configured to generate a primitive semantic library according to the primitive database
  • the authentication primitive selection unit U603 is applied to the authenticated node, and is used to select a target authentication primitive from the original language library when identity authentication is required between the authenticated node and the node performing authentication;
  • the authentication primitive sending unit U604 is applied to the authenticated node, and is configured to send the target authentication primitive to the node that performs authentication;
  • the authentication primitive receiving unit U605 is applied to the node performing the authentication, and is configured to receive the target authentication primitive sent by the authenticated node;
  • a target semantic extraction unit U606 configured to perform a node for performing authentication, for extracting semantics of the target authentication primitive as target semantics;
  • a verification unit U607 configured to perform a node for performing authentication, for verifying whether the target semantics exists in the semantic library of the primitive, and if the target semantics exists in the semantic library of the primitive, the identity authentication of the authenticated node passes, otherwise The authentication of the authenticated node failed.
  • the broken line in Fig. 6 indicates the authentication primitive receiving unit U605, which is connected to the authentication primitive transmitting unit U604 via the network.
  • the authenticated node initiates identity authentication at the same time as the data access is initiated, and the authenticated node needs to send the identity authentication information while transmitting the data.
  • the identity authentication information is the target authentication original. language.
  • the authenticated node first sends a data access request to the node performing the authentication, and the node performing the authentication returns an identity authentication request message, and after the authenticated node receives the identity authentication request message, the node performs authentication. Send identity Authentication information.
  • the authenticated node receives the identity authentication request message, which is the identity authentication between the authenticated node and the node performing authentication.
  • the original language library establishing unit U601 pre-establishes the original language library, first constructs the authentication primitive, and then uses the set of authentication primitives as the original language library.
  • the authentication primitive is a statement that characterizes the uniqueness of the authenticated node. Since the irregular statement is difficult to extract semantics, the authentication primitive needs to conform to the preset semantic rules of the authenticated node.
  • the default semantic rules for authentication primitives can be of the following categories:
  • Replacement class semantic rule replace the table according to the preset character, and replace the character in the statement with the other characters corresponding to the character in the character replacement table.
  • the authentication primitives are generated in a preset mode, for example, after the even-numbered characters of the authentication primitives, a fixed-length random character combination is added.
  • Punctuation class semantic rules add fixed punctuation at a fixed position of the authentication primitive.
  • the preset semantic rules are not limited to the above three types, and the above three types may be used in combination of two or two or a combination of the three.
  • the original language library establishing unit U601 constructs an authentication primitive according to a preset semantic rule, and the set of the authentication primitives constitutes a library, and when the primitive database establishing unit U601 establishes the original language library, a corresponding one is set in the original language library for each authentication primitive. index.
  • Each authenticated node has a one-to-one correspondence with its original language library.
  • the original language library established by the original language library establishing unit U601 has at least two authentication primitives, so that the selection of the authentication primitives is not unique.
  • the original language library established by the original language library establishing unit U601 may be stored in the authenticated node, or may be stored in other parts of the distributed system, and separated from the authenticated node.
  • the authenticated node passes Network access primitive library.
  • the original language library establishing unit U601 establishes the original language library
  • the original language library may also be encrypted or added with an access control mechanism to prevent the authentication primitive from leaking.
  • the primitive semantic library generating unit U602 generates a primitive semantic library in advance based on the primitive library.
  • the primitive semantic library is a collection of semantics of the authentication primitives in the original language library.
  • the primitive semantic library generating unit U602 extracts the semantics of each authentication primitive in the primitive library and stores it in the primitive semantic library.
  • the primitive semantic library generating unit U602 may store the generated primitive semantic library in a node that performs authentication, or may be stored elsewhere in the distributed system, and separate from the node that performs authentication, the primitive semantic library and the execution of the authentication. When the nodes are separated, the node performing the authentication accesses the primitive semantic library through the network.
  • the primitive semantic library generating unit U602 extracts only the primitive of the authenticated node.
  • the primitive semantic library generating unit U602 extracts the authentication original in the original library of the authenticated node.
  • all the nodes performing the authentication may share a primitive semantic library, and the primitive semantic library generating unit U602 extracts the semantics of the authentication primitives in all the original libraries, and the semantics of the authentication primitives in all the original libraries.
  • the set is synthesized into a primitive semantic library.
  • the primitive semantic database generating unit U602 obtains the hash value of the authentication primitive of the original language library, constructing a Bronze hash according to the hash value of the authentication primitive, A collection of semantics listed as authentication primitives, stored in the primitive semantic library.
  • generating the primitive semantic library according to the primitive library is an irreversible process, so the security of the authentication primitive can be better protected, and the attacker will not be able to obtain the authentication primitive through the primitive semantic library, also because In this way, the primitive semantic library can be made public.
  • the primitive semantic library generating unit U602 can obtain the hash value of the authentication primitive of the original language library by using the hash function to act on the authentication primitive of the original language library.
  • the method of constructing the bronze hash may be: all of the bron vectors (b1, b2, ..., bm) of length m bits.
  • the bit is initialized to 0, and then k mutually independent fast HASH functions (h1, h2, ..., hk) with values between 1 and m are returned, which are applied to the hash value of each input authentication primitive.
  • k return values (r1, r2, ..., rk)
  • the Bronze hash is stored in the primitive semantic library.
  • the primitive semantic library generating unit U602 extracts the features of the authentication primitive of the primitive library using the learning algorithm, and uses the set of features of the authenticating primitive as the primitive semantic library.
  • the characteristics of the authentication primitive extracted by the learning algorithm may be a vector or a matrix, which varies with the learning algorithm.
  • the primitive semantic library generating unit U602 takes the authentication primitive in the original language library as an input, and can obtain a support vector for characterizing the authentication primitive, and the set of the support vector of the authentication primitive is a primitive. Semantic library. Using the learning algorithm to generate the primitive semantic library based on the original language library is also irreversible, which is beneficial to ensure the security of the authentication primitive, and the primitive semantic library can also be disclosed.
  • the authentication primitive selection unit U603 applied to the authenticated node selects a target authentication primitive from the original language library, and the selection manner may be randomly selected. According to the law of circulation.
  • the random selection may randomly generate an index value for the authentication primitive selection unit U603 (the index value is within the index value range of the original language library), and then select an authentication primitive corresponding to the index value in the original language database. .
  • the authentication primitive selection unit U603 may sequentially select the authentication primitive corresponding to the index value according to the order of the index values of the original language library, and after the identity authentication is performed multiple times, the authentication primitive selection unit U603 When the index value corresponding to the selected authentication primitive has reached the end of the original library index value arrangement, at the next identity authentication, the authentication primitive selection unit U603 re-arranges the first index value from the index value of the original language library. Start picking.
  • the apparatus may further include an encryption unit for transmitting the target authentication primitive in the authentication primitive sending unit U604.
  • the target authentication primitive is encrypted before the node performing the authentication.
  • the encryption unit may encrypt the target authentication primitive by various methods, for example, performing character misalignment processing on the authentication primitive.
  • the node performing the authentication decrypts the target authentication primitive after receiving the target authentication primitive.
  • the authentication primitive receiving unit U605 applied to the node performing the authentication after receiving the target authentication primitive sent by the authenticated node, the target semantic extracting unit U606 extracts the semantics of the target authentication primitive as the target semantic, and then verifies Unit U607 verifies whether the target semantics are present in the primitive semantic library.
  • the target semantic extracting unit U606 obtains the hash value of the target authentication primitive, and obtains the hash value.
  • the target semantic extracting unit U606 takes the hash value of the target authentication primitive as the target semantic, and then verifies the unit U607 to construct the Bulongsan.
  • the target semantics is processed to obtain a return value, and then it is determined whether the bit corresponding to the return value in the Bronze hash is 1, If it is 1, it is determined that the target semantic exists in the Bloom hash, and if it is 0, it is determined that the target semantic does not exist in the Bloom hash. If the target semantics exists in the Bronze hash, the target semantics exists in the primitive semantic database, and the identity authentication of the authenticated node passes, otherwise, the identity authentication of the authenticated node fails.
  • the primitive semantic library establishing unit U602 is a feature that uses a learning algorithm to extract an authentication primitive of the original language library, and uses a set of features of the authentication primitive as a primitive semantic library. Then, after the authentication primitive receiving unit U605 receives the target authentication primitive, the target semantic extracting unit U606 extracts the feature of the target authentication primitive using the same learning algorithm, and takes the feature of the target authentication primitive as the target semantic, and then The verification unit U607 calculates the matching degree between the target semantics and the features in the primitive semantic library, and determines whether the matching degree is greater than or equal to a preset threshold.
  • the target semantic extraction unit U606 takes the target authentication primitive as an input, and uses the support vector algorithm to obtain a support vector for characterizing the target authentication primitive, with the support vector as the target semantic, and then the verification unit U607 will The target semantics are matched with the support vectors in the primitive semantic database, and the matching degree between the target semantics and the support vectors in the primitive semantic database is calculated.
  • the matching degree is greater than or equal to 85%, it is determined that the target semantic exists in the primitive semantic library, and the identity authentication of the authenticated node passes, otherwise, it is determined that the target semantic does not exist in the primitive semantic database, and is authenticated. The identity authentication of the node failed.
  • the authentication primitive in the original language library must conform to the preset semantic rule of the authenticated node, and if the target authentication primitive received by the authentication primitive receiving unit U605 does not comply with the preset semantic rule, the target authentication primitive can be determined. If the identity authentication primitive received by the authentication primitive receiving unit U605 meets the preset semantic rule, the identity of the authenticated node is further verified. Therefore, the apparatus may further include a pre-verification unit and an extraction enabling unit, the pre-verification unit configured to check whether the target authentication primitive meets a preset semantic rule of the authenticated node; the extraction enabling unit uses The target semantic extraction unit is enabled when the target authentication primitive conforms to the preset semantic rule.
  • the semantic extraction unit U606 extracts the semantics of the target authentication primitive by the target semantic extraction unit U606, and can avoid resource consumption caused by extracting semantics for all target authentication primitives.
  • the device may further include:
  • An encryption verification unit configured to check whether the target authentication primitive is encrypted before extracting the semantics of the target authentication primitive after the node performing the authentication receives the target authentication primitive
  • An encryption method analysis module configured to analyze an encryption method of the target authentication primitive when the target authentication primitive is encrypted
  • a decryption module configured to acquire a decryption method corresponding to the encryption method, and decrypt the target authentication primitive.
  • the construction of the authentication primitive and the establishment of the original language library are simple and easy; when the identity authentication is required between the authenticated node and the node performing the authentication, the authentication primitive selection unit U603 is from the primitive.
  • the library selects the target authentication primitive and sends it to the node performing the authentication for identity authentication.
  • the authentication primitive receiving unit U605 receives the authentication primitive selection After taking the target authentication primitive sent by the unit U604, the authentication primitive extracting unit U604 extracts the semantics of the original authentication primitive when the primitive semantic library is generated, and extracts the semantics of the target authentication primitive as the target semantic, and then verifies Unit U607 verifies whether the target semantics are present in the primitive semantics library. Since the authentication primitive and the target authentication primitive are simple character statements, the existing semantic extraction method is used to extract the semantics, and whether the semantics of the target semantics and the semantics of the original semantics are matched, the process is simple and the resource consumption is small. The node that performs authentication in the entire authentication process does not need to save the authentication status, so that the authenticated node and the node performing the authentication can implement the on-demand authentication.
  • the techniques in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution in the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, which may be stored in a storage medium such as a ROM/RAM. , a disk, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.

Abstract

本发明实施例公开了一种分布式系统节点身份认证方法及装置。所述方法包括：建立原语库，原语库为认证原语的集合，认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；根据原语库生成原语语义库；当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库中选取一个目标认证原语，并将该目标认证原语发送给执行认证的节点；执行认证的节点接收到目标认证原语后，提取目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在该目标语义；如果存在，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。本发明实施例公开的技术方案，安全性高、简单易行、轻量且能实现按需认证。

Description

分布式系统节点身份认证方法及装置
本申请要求于2015年7月31日提交中国专利局、申请号为201510465057.3、发明名称为“分布式系统节点身份认证方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络安全领域，尤其涉及分布式系统节点身份认证方法及装置。
背景技术
分布式系统中，节点之间存在大规模的数据访问。为实现网络和系统安全，在数据交互访问过程中，通常要对节点进行身份认证，以防止节点被假冒。目前，分布式系统节点身份认证主要有三类方法：
第一类方法采用“你知道的/What you know”认证机制。该类方法中，执行认证的一方要求被认证的一方给出唯一性的认证凭证，例如常见的用户名/口令认证方法，其中口令是只有用户知道的认证凭证。执行认证的一方在接收到被认证的一方传入的用户名和口令后，找到与用户名对应的预先存储的变形口令，并将接收到的口令进行同样的变形处理，例如经过哈希(HASH)算法处理，得到变形后的口令，然后，将所述变形后的口令与所述预先存储的变形口令进行比对，如果两者匹配，则认证通过，否则认证失败。
第二类方法采用“你拥有的/What you have”认证机制。该类方法中，执行认证的一方要求被认证的一方给出证明其身份的认证凭证，通过所述认证凭证实现身份认证。例如，SSL/TLS(Secure Sockets Layer/Transport Layer Security，安全套接层/传输层安全)协议中，发送方和应答方在建立连接前，需要发送方(被认证的一方)向应答方(执行认证的一方)提供CA(Certificate Authority，电子商务认证授权机构)证书，或者需要双方相互提供CA证书，以验证对方身份的真实性。
第三类方法采用“你是谁/What you are”认证机制。该类方法中，被认证的一方向执行认证的一方提供自己区别于其他方的特征信息来实现身份认证，所述特征信息，例如指纹数据等。执行认证的一方接收到被认证的一方发送的特征信息后，根据所述特征信息在执行认证一方的特征信息数据 库中进行检索，如果找到所述特征信息，则被认证的一方通过身份认证。
上述三类方法中，第一类方法的缺点是：1、认证凭证容易泄露；2、认证凭证要有一定的复杂度和防暴力破解机制，因此，认证凭证的管理难度高；3、复杂的认证凭证难于记忆，不便于检查和修改。第二类方法的缺点是使用不方便，按照第二类方法，需向认证证书颁发机构申请证书，，而且认证证书通常数据量较大，影响数据传输性能。第三类方法的缺点是复杂度高，实现困难，按照第三类方法，首先要采集被认证一方的指纹数据，所述指纹数据通常比较复杂，数据量较大，影响数据传输性能，而且，检索过程消耗的计算资源也较多。
另外，节点之间可能只需对部分数据的交互进行身份认证，这些数据其本身的机密性并不重要，重要的是数据的真实性，例如管理命令和NTP(Network Time Protocol，网络时间协议)时间同步消息等。在这种情况下，如果认证双方采用上述第一类认证方法，在认证完成后，还要维护认证状态的有效性，以便基于有效性进行授权和访问控制；如果采用第二类或第三类方法，在通过身份认证后，还要保持认证状态，建立安全通道，以此来保证其它数据的交互。
发明内容
本发明实施例提供了一种分布式系统节点身份认证方法及装置，以解决现阶段节点身份认证方法难以满足简便轻量的要求的问题。
第一方面，本发明实施例提供一种分布式系统节点身份认证方法，应用于被认证节点，包括：
当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库中选取一个目标认证原语，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
将所述目标认证原语发送给执行认证的节点，以使所述执行认证的节点根据所述目标认证原语对被认证节点进行认证。
结合第一方面，在第一方面第一种可能的实现方式中，所述被认证节点从所述原语库中随机选取一个目标认证原语。
结合第一方面或第一方面第一种可能的实现方式，在第一方面第二种可能的实现方式中，所述方法，在将所述目标认证原语发送给执行认证的节点之前，还包括：加密所述目标认证原语。
第二方面，本发明实施例还提供一种分布式系统节点身份认证方法，应用于执行认证的节点，包括：
接收被认证节点发送的目标认证原语；
提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义；
如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败；
其中，所述原语语义库预先根据原语库生成，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则。
结合第二方面，在第二方面第一种可能的实现方式中，所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：
获取所述目标认证原语的哈希值，作为目标语义，并验证所述目标语义是否存在于所述原语语义库的布隆散列；
所述布隆散列，为获取原语库的认证原语的哈希值后，根据所述认证原语的哈希值构建而成，所述原语语义库由所述布隆散列组成。
结合第二方面，在第二方面第二种可能的实现方式中，所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：
使用学习算法提取所述目标认证原语的特征，作为目标语义；
计算所述目标语义与所述原语语义库中特征的匹配度；
判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语 义库中不存在所述目标语义；
其中，所述原语语义库为所述原语库中认证原语的特征的集合，所述认证原语的特征通过对认证原语使用所述学习算法提取得到。
结合第二方面，在第二方面第三种可能的实现方式中，所述方法，在接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
检验所述目标认证原语是否符合被认证节点的预设语义规则；
当所述目标认证原语符合所述预设语义规则时，允许执行提取所述目标认证原语的语义的步骤。
结合第二方面或第二方面第一种至第三种可能的实现方式其中任意一种，在第二方面第四种可能的实现方式中，所述方法，在接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
检验所述目标认证原语是否被加密；
当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
第三方面，本发明实施例还提供一种分布式系统节点身份认证方法，包括：
建立原语库，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
根据所述原语库生成原语语义库；
当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从所述原语库中选取一个目标认证原语；
被认证节点将所述目标认证原语发送给执行认证的节点；
执行认证的节点接收所述被认证节点发送的目标认证原语；
执行认证的节点提取所述目标认证原语的语义，作为目标语义，并验证 所述原语语义库中是否存在所述目标语义；
如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
结合第三方面，在第三方面第一种可能的实现方式中，当被认证节点和执行认证的节点之间需要进行身份认证时，所述被认证节点从所述原语库中随机选取一个目标认证原语。
结合第三方面，在第三方面第二种可能的实现方式中，所述根据所述原语库生成原语语义库，包括：
获取原语库的认证原语的哈希值，并根据所述认证原语的哈希值构建布隆散列；
所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：获取所述目标认证原语的哈希值，作为目标语义，并验证所述目标语义是否存在于所述布隆散列。
结合第三方面，在第三方面第三种可能的实现方式中，所述根据所述原语库生成原语语义库，包括：
使用学习算法提取原语库中认证原语的特征，以所述特征的集合为原语语义库；
所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：
使用所述学习算法提取所述目标认证原语的特征，作为目标语义；
计算所述目标语义与所述原语语义库中特征的匹配度；
判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。
结合第三方面，在第三方面第四种可能的实现方式中，所述方法，在接收所述被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
执行认证的节点检验所述目标认证原语是否符合被认证节点的预设语义规则；
当所述目标认证原语符合所述预设语义规则时，允许执行提取所述目标认证原语的语义的步骤。
结合第三方面或第三方面第一种至第四种可能的实现方式其中任意一种，在第三方面第五种可能的实现方式中，所述方法，在将所述目标认证原语发送给执行认证的节点之前，还包括：被认证节点加密所述目标认证原语。
结合第三方面第五种可能的实现方式，在第三方面第六种可能的实现方式中，所述方法，在接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
执行认证的节点检验所述目标认证原语是否被加密；
当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
第四方面，本发明实施例提供一种分布式系统节点身份认证装置，应用于被认证节点，包括：
认证原语选取单元，用于当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库中选取一个目标认证原语，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
认证原语发送单元，用于将所述目标认证原语发送给执行认证的节点，以使所述执行认证的节点根据所述目标认证原语对被认证节点进行认证。
结合第四方面，在第四方面第一种可能的实现方式中，所述认证原语选取单元，具体用于：当被认证节点和执行认证的节点之间需要进行身份认证时，从所述原语库中随机选取一个目标认证原语。
结合第四方面或第四方面第一种可能的实现方式，在第四方面第二种可能的实现方式中，所述装置，还包括认证原语加密单元，所述认证原语加密单元，用于在所述被认证节点将所述目标认证原语发送给执行认证的节点之 前，将所述目标认证原语加密。
第五方面，本发明实施例还提供一种分布式系统节点身份认证装置，应用于执行认证的节点，包括：
认证原语接收单元，用于接收被认证节点发送的目标认证原语；
目标语义提取单元，用于提取所述目标认证原语的语义，作为目标语义；
验证单元，用于验证原语语义库中是否存在所述目标语义，如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败；
其中，所述原语语义库预先根据原语库生成，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则。
结合第五方面，在第五方面第一种可能的实现方式中，
所述目标语义提取单元，具体用于：获取所述目标认证原语的哈希值，作为目标语义；
所述验证单元，具体用于：验证所述目标语义是否存在于布隆散列；
其中，所述布隆散列，为获取所述原语库的认证原语的哈希值后，根据所述认证原语的哈希值构建而成，所述原语语义库由所述布隆散列组成。
结合第五方面，在第五方面第二种可能的实现方式中，
所述目标语义提取单元具体用于：使用学习算法提取所述目标认证原语的特征，作为目标语义；
所述验证单元具体用于：
计算所述目标语义与所述原语语义库中特征的匹配度；
判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义；
其中，所述原语语义库为所述原语库中认证原语的特征的集合，所述认 证原语的特征通过对认证原语使用所述学习算法提取得到。
结合第五方面，在第五方面第三种可能的实现方式中，所述装置，还包括：
预检验单元，用于检验所述目标认证原语是否符合被认证节点的预设语义规则；
提取使能单元，用于当所述目标认证原语符合所述预设语义规则时，使能所述目标语义提取单元。
结合第五方面或第五方面第一种至第三种可能的实现方式其中任意一种，在第五方面第四种可能的实现方式中，所述装置，还包括认证原语解密单元，所述认证原语解密单元包括：
加密检验模块，用于在接收所述目标认证原语之后，提取所述目标认证原语的语义之前，检验所述目标认证原语是否被加密；
加密方法分析模块，用于当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
解密模块，用于获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
第六方面，本发明实施例提供一种分布式系统节点身份认证装置，包括：
原语库建立单元，用于建立原语库，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
原语语义库生成单元，用于根据所述原语库生成原语语义库；
认证原语选取单元，应用于被认证节点，用于当被认证节点和执行认证的节点之间需要进行身份认证时，从原语库中选取一个目标认证原语；
认证原语发送单元，应用于被认证节点，用于将所述目标认证原语发送给执行认证的节点；
认证原语接收单元，应用于执行认证的节点，用于接收被认证节点发送的目标认证原语；
目标语义提取单元，应用于执行认证的节点，用于提取所述目标认证原语的语义，作为目标语义；
验证单元，应用于执行认证的节点，用于验证原语语义库中是否存在所述目标语义，如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
结合第六方面，在第六方面第一种可能的实现方式中，所述认证原语选取单元，具体用于：当被认证节点和执行认证的节点之间需要进行身份认证时，从所述原语库中随机选取一个目标认证原语。
结合第六方面，在第六方面第二种可能的实现方式中，
所述原语语义库生成单元，具体用于获取原语库的认证原语的哈希值，根据所述认证原语的哈希值构建布隆散列，并根据所述布隆散列组成原语语义库；
所述目标语义提取单元具体用于：获取所述目标认证原语的哈希值，作为目标语义；
所述验证单元具体用于：验证所述目标语义是否存在于所述布隆散列。
结合第六方面，在第六方面第三种可能的实现方式中，
所述原语语义库生成单元，具体用于使用学习算法提取原语库中认证原语的特征，以所述特征的集合作为原语语义库；
所述目标语义提取单元具体用于：使用所述学习算法提取所述目标认证原语的特征，作为目标语义；
所述验证单元具体用于：
计算所述目标语义与所述原语语义库中特征的匹配度；
判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。
结合第六方面，在第六方面第四种可能的实现方式中，所述装置，还包括：
预检验单元，应用于执行认证的节点，用于检验所述目标认证原语是否符合被认证节点的预设语义规则；
提取使能单元，应用于执行认证的节点，用于当所述目标认证原语符合所述预设语义规则时，使能所述目标语义提取单元。
结合第六方面或第六方面第一种至第四种可能的实现方式其中任意一种，在第六方面第五种可能的实现方式中，所述装置，还包括认证原语加密单元，所述认证原语加密单元，应用于被认证节点，用于在将所述目标认证原语发送给执行认证的节点之前，将所述目标认证原语加密。
结合第六方面第五种可能的实现方式，在第六方面第六种可能的实现方式中，所述装置，还包括认证原语解密单元，所述认证原语解密单元，应用于执行认证的节点，包括：
加密检验模块，用于在接收所述目标认证原语之后，提取所述目标认证原语的语义之前，检验所述目标认证原语是否被加密；
加密方法分析模块，用于当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
解密模块，用于获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
本发明实施例提供的技术方案，以认证原语为认证凭证，由于认证原语只是被认证节点的描述语句，因此认证原语的构建和原语库的建立都简单易行；在被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库选取目标认证原语发送给执行认证的节点进行身份认证，原语库中可以存在众多的认证原语，这样被认证节点每次发送的目标认证原语都是不唯一的，从而有效防止目标认证原语被破解，也不需耗费时间和资源来维护目标认证原语。而且被认证节点可以只在需要进行身份认证的时候选取目标认证原语并发送，且每次的目标认证原语不唯一，被认证节点不需保存认证状态。执行认证的节点接收到被认证节点发送的目标认证原语后，以生成原语语义库时提取原语库认证原语的语义的方法，提取目标认证原语的语义，作为目标语义，然后验证所述目标语义是否存在与原语语义库中。由于认证原语及目标认证原语为简单的字符语句，使用已有的语义提取方法提取语义，以及验证目标语义与原语语义库中的语义是否匹配，过程皆简单易行， 资源耗费少，且整个认证过程执行认证的节点也不需保存认证状态，使得被认证节点和执行认证的节点之间能够实现按需认证。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，对于本领域普通技术人员而言，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种应用于被认证节点的分布式系统节点身份认证方法的流程示意图；
图2为本发明实施例提供的一种应用于执行认证的节点的分布式系统节点身份认证方法的流程示意图；
图3为本发明实施例提供的一种分布式系统节点身份认证方法的流程示意图；
图4为本发明实施例提供的一种应用于被认证节点的分布式系统节点身份认证装置的框图；
图5为本发明实施例提供的一种应用于执行认证的节点的分布式系统节点身份认证装置的框图；
图6为本发明实施例提供的一种分布式系统节点身份认证装置的框图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整的描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
参见图1，为本发明实施例提供的一种分布式系统节点身份认证方法的流程示意图，该方法应用于被认证节点，如图1所示，该方法包括如下步骤：
步骤S101，当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库中选取一个目标认证原语，所述原语库为认证原语的集 合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
步骤S102，将所述目标认证原语发送给执行认证的节点，以使所述执行认证的节点根据所述目标认证原语对被认证节点进行认证。
在一种应用场景中，被认证节点在数据访问发起的同时发起身份认证，也就是被认证节点在数据访问发起的同时需要进行身份认证，被认证节点在发送数据的同时需要发送身份认证信息，在本发明中，所述身份认证信息即目标认证原语。在另一种应用场景中，被认证节点先向执行认证的节点发送数据访问请求，执行认证的节点返回身份认证请求消息，被认证节点收到所述身份认证请求消息后，向执行认证的节点发送身份认证信息，通过身份认证后再向执行认证的节点发送数据，在这种情况下，被认证节点收到身份认证请求消息即为被认证节点和执行认证的节点之间需要进行身份认证。
所述原语库预先建立，其为认证原语的集合。认证原语为表征被认证节点唯一性的语句，例如多种描述被认证节点唯一性特征的语句，由于无规则的语句难以提取语义，因此认证原语需符合被认证节点的预设语义规则。认证原语的预设语义规则可以为以下几类：
(1)替换类语义规则：根据预设的字符替换表，将语句中的字符用字符替换表中与该字符对应的其他字符替换，例如：o替换为0，l替换为1，b替换为6，g替换为9等，S替换为$等。
(2)模式类语义规则：认证原语按预设的模式生成，例如在认证原语的偶数字符的后面，加入固定长度的随机字符组合。
(3)标点类语义规则：在认证原语的固定位置加入固定的标点，例如每个认证原语都以问号结尾。
预设语义规则并不仅限于上述三种，上述三种也可以两两组合或者三者组合使用。
按照预设语义规则构建认证原语，并将认证原语存储在原语库中，每个认证原语在原语库中对应一个索引，每个被认证节点与其原语库一一对应。原语库中的认证原语至少包含2条，以使认证原语的选取不唯一。原语库可以保存于被认证节点处，也可以与被认证节点分离，原语库与被认证节点分离时，被认证节点通过网络访问原语库。所述原语库可以加密保存或添加访问控制机制，以防止认证原语泄漏。
当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点 从原语库中选取一个目标认证原语，选取方式可以为随机选取，也可以按照循环性规律选取。所述随机选取，可以为被认证节点先随机生成一个索引值(所述索引值在原语库的索引值范围内)，然后选取原语库中与所述索引值对应的认证原语。所述按照循环性规律选取，可以为被认证节点按照原语库的索引值排列顺序，依次选取索引值对应的认证原语，当多次进行身份认证后，被认证节点选取的认证原语对应的索引值已达到原语库索引值排列的尾端时，在下一次身份认证的时候，被认证节点重新从原语库的索引值排列的第一个索引值开始选取。选取目标认证原语后，被认证节点将所述目标认证原语发送给执行认证的节点，以使所述执行认证的节点根据所述目标认证原语对被认证节点进行认证。
另外，为进一步保证被选中的目标认证原语的安全，防止目标认证原语被破坏，在被认证节点将目标认证原语发送给执行认证的节点之前，还可以将所述目标认证原语加密，相应地，执行认证的节点在收到所述目标认证原语后，对所述目标认证原语进行解密。
本实施例所提供的技术方案，以认证原语为认证凭证，由于认证原语只是被认证节点的描述语句，因此认证原语的构建和原语库的建立都简单易行；在被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库选取目标认证原语发送给执行认证的节点进行身份认证，原语库中可以存在众多的认证原语，这样被认证节点每次发送的目标认证原语都是不唯一的，从而有效防止目标认证原语被破解，不需像用户/口令身份认证方法那样定期修改认证凭证，也不需耗费时间和资源来维护认证凭证。被认证节点使用随机选取方式来选取目标认证原语时，由于每次发送的目标认证原语都不可预料，更有利于防止目标认证原语被破解以及减少认证凭证维护耗费。而且本实施例所提供的技术方案，被认证节点可以只在需要进行身份认证的时候选取目标认证原语并发送，且每次的目标认证原语不唯一，被认证节点不需保存认证状态，从而能够实现按需认证，或者说“一次一认证”。
参见图2，为本发明实施例提供的一种分布式系统节点身份认证方法的流程示意图，该方法应用于执行认证的节点，如图2所示，该方法包括如下步骤：
步骤S201，接收被认证节点发送的目标认证原语；
步骤S202，提取所述目标认证原语的语义，作为目标语义；
步骤S203，验证原语语义库中是否存在所述目标语义，如果所述原语语 义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
其中，所述原语语义库预先根据原语库生成。
原语语义库为原语库中认证原语的语义的集合。提取原语库中每个认证原语的语义，存储于原语语义库中。所述原语语义库可以位于执行认证的节点，也可以与执行认证的节点分离，所述原语语义库与执行认证的节点分离时，执行认证的节点通过网络访问所述原语语义库。如果被认证节点和执行认证的节点是一一对应的，也就是说一个执行认证的节点只对一个被认证的节点进行认证，则该执行认证的节点访问的原语语义库中，只存储该被认证节点的原语库中认证原语的语义。如果执行认证的节点会对至少两个被认证节点进行认证，则该执行认证的节点访问的原语语义库中，存储对应的被认证节点的原语库中认证原语的语义。在一种实施方式中，所有执行认证的节点可以共用一个原语语义库，也就是提取所有原语库中认证原语的语义，存储在一个原语语义库中。
原语为字符组成的语句，其本质也为数据，原语语义即语句的含义，亦即数据的逻辑表示或者特征。提取原语的语义，即将原语按预设的方式进行逻辑组织，或者按预设的方式提取特征。
在一种实施方式中，根据原语库生成原语语义库，包括：获取原语库的认证原语的哈希值，根据所述认证原语的哈希值构建布隆散列，以所述布隆散列为认证原语的语义的集合，存储于原语语义库中。这种实施方式中，根据原语库生成原语语义库是不可逆的过程，因此可以更好地保护认证原语的安全，攻击者将无法通过原语语义库来得到认证原语，也正因为这样，原语语义库可以公开。使用哈希函数作用于原语库的认证原语，便能获取原语库的认证原语的哈希值。在获取到认证原语的哈希值后，构建布隆散列的方式可以为：将长度为m比特的布隆向量(b1,b2,…,bm)中的所有比特位初始化为0，然后将返回值在1到m间的k个相互独立的快捷HASH函数(h1,h2,…,hk)，作用于每个输入的认证原语的哈希值上，得到k个返回值(r1,r2,…,rk)，并将布隆向量中位置在r1,r2,…,rk的比特位设置为1，最后得到的整个布隆向量即布隆散列，所述布隆散列存储于原语语义库。相应地，执行认证的节点接收到目标认证原语后，获取所述目标认证原语的哈希值，获取所述哈希值的方法，与生成原语语义库时获取原语库中认证原语的哈希值的方法相同。执行认证的节点将目标认证原语的哈希值作为目标语义，然后以构建布隆散列时对输入的认证原语的哈希值进行处理的方式一 样，处理所述目标语义，得到返回值，然后判断所述布隆散列中对应于所述返回值的比特位是否为1，如果为1，则确定所述目标语义存在于所述布隆散列，如果为0，则确定所述目标语义不存在于所述布隆散列。如果所述目标语义存在于所述布隆散列，则原语语义库中存在所述目标语义，被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
在另一种实施方式中，根据原语库生成所述原语语义库，包括：使用学习算法提取原语库的认证原语的特征，以认证原语的特征的集合作为原语语义库。学习算法有多种，例如支持向量算法等，都可以应用于本发明中。学习算法提取的认证原语的特征，可以为向量，也可以为矩阵，随学习算法的不同而不同。以支持向量算法为例，以原语库中的认证原语为输入，可以得到表征认证原语的特征的支持向量，以认证原语的支持向量的集合为原语语义库。利用学习算法根据原语库生成原语语义库也是不可逆的，有利于保证认证原语的安全，原语语义库也可以公开。相应地，执行认证的节点接收到目标认证原语后，使用相同的学习算法提取所述目标认证原语的特征，以目标认证原语的特征为目标语义，然后计算目标语义与原语语义库中特征的匹配度，判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。以支持向量算法为例，以目标认证原语为输入，使用支持向量算法得到表征目标认证原语的特征的支持向量，以所述支持向量为目标语义，然后将该目标语义与原语语义库中的支持向量进行匹配，计算该目标语义与原语语义库中支持向量的匹配度，如果所述匹配度大于或者等于85％，则确定该目标语义存在于原语语义库中，被认证节点的身份认证通过，否则，如果所述匹配度小于85％，则确定该目标语义不存在于原语语义库中，被认证节点的身份认证失败，其中，“85％”为预设阈值。
在执行认证的节点接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还可以加上检验所述目标认证原语是否符合预设语义规则的步骤，所述预设语义规则即被认证节点的预设语义规则。原语库中的认证原语必须符合被认证节点的预设语义规则，如果执行认证的节点接收到的目标认证原语不符合所述预设语义规则，则能够确定该目标认证原语是非法的，被认证节点的身份认证不能通过；如果执行认证的节点接收到的目标认证原语符合所述预设语义规则，则执行提取所述目标认证原语的语义的步骤，对被认证节点的身份进行进一步验证。由于检验目标认证原语是否符合预设语义规则简单易行，资源耗费很小，因此只在目标认证原语符合预设语义规则的时候执行提取所述目标认证原语的语义的步骤，可以避免对所 有目标认证原语都提取语义所带来的资源耗费。
如果被认证节点发送的是经过加密的目标认证原语，则执行认证的节点在接收所述目标认证原语之后，提取所述目标认证原语的语义之前，需要对接收到的目标认证原语解密，具体可以包括以下步骤：
(a1)检验所述目标认证原语是否被加密；
(a2)当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
(a3)获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
被认证节点为保证目标认证原语的安全，防止目标认证原语被改写或破坏，可以对目标认证原语加密。对于目标认证原语的加密和解密，在被认证节点和执行认证的节点之间可以建立协议，根据协议被认证节点对目标认证原语都使用规定的加密方法进行加密，执行认证的节点则默认接收到的目标认证原语是经过加密的，并使用预先设置的默认的解密方法进行解密，这种情况下，可以不执行步骤(a1)和步骤(a2)。被认证节点加密目标认证原语的方法可以有多种，例如对认证原语进行字符错位处理。
在一种实施方式下，被认证节点在加密后的目标认证原语中加入算法标识，所述算法标识用于表征被认证节点在加密该目标认证原语时所用的加密算法。执行认证的节点接收到目标认证原语后，步骤(a1)判断接收到的目标认证原语中是否包含所述算法标识，如果包含所述算法标识，则所述目标认证原语为加密数据，然后步骤(a2)分析得到对应于所述算法标识的加密算法，步骤(a3)则在预先存储的解密算法中找到与所述加密算法对应的解密算法，并使用该解密算法解密所述目标认证原语。如果步骤(a1)判断得到的结果是目标认证原语中不包含所述算法标识，则确定所述目标认证原语未被加密。
对一些加密算法而言，其加密后的数据具有独特的数据结构，因此，在另一种实施方式中，被认证节点使用加密后数据有独特的数据结构的加密算法，来加密目标认证原语，执行认证的节点接收到目标认证原语后，步骤(a1)识别目标认证原语的数据结构，并且将识别出的目标认证原语的数据结构，与预先存储的各种数据结构进行比对，如果目标认证原语的数据结构与预先存储的某个数据结构匹配，则确定接收到的目标认证原语是加密的。步骤(a2)则根据与目标认证原语的数据结构相匹配的预先存储的数据结构，得 到与该预先存储的数据结构对应的加密算法，然后步骤(a3)在预先存储的解密算法中，查找与该加密算法对应的解密算法，并使用该解密算法解密接收到的目标认证原语。
本实施例提供的技术方案，以生成原语语义库时提取原语库认证原语的语义的方法，提取目标认证原语的语义，作为目标语义，然后验证所述目标语义是否存在与原语语义库中，如果存在，则被认证节点的身份认证通过，否则，被认证节点身份认证失败。由于认证原语及目标认证原语为简单的字符语句，使用已有的语义提取方法提取语义，以及验证目标语义与原语语义库中的语义是否匹配，过程皆简单易行，资源耗费少，且整个认证过程执行认证的节点并不需保存认证状态，只针对当次接收的目标认证原语进行认证，从而使得被认证节点和执行认证的节点之间能够实现按需认证。
参见图3，为本发明实施例提供的一种分布式系统节点身份认证方法的流程示意图，如图3所示，该方法包括如下步骤：
步骤S301，建立原语库，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
步骤S302，根据所述原语库生成原语语义库；
步骤S303，当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从所述原语库中选取一个目标认证原语；
步骤S304，被认证节点将所述目标认证原语发送给执行认证的节点；
步骤S305，执行认证的节点接收所述被认证节点发送的目标认证原语；
步骤S306，执行认证的节点提取所述目标认证原语的语义，作为目标语义，并验证所述原语语义库中是否存在所述目标语义；
如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
其中，在一种应用场景中，被认证节点在数据访问发起的同时发起身份认证，被认证节点在发送数据的同时需要发送身份认证信息，在本发明中，所述身份认证信息即目标认证原语。在另一种应用场景中，被认证节点先向执行认证的节点发送数据访问请求，执行认证的节点返回身份认证请求消息，被认证节点收到所述身份认证请求消息后，向执行认证的节点发送身份认证信息，在这种情况下，被认证节点收到身份认证请求消息即为被认证节点和执行认证的节点之间需要进行身份认证。
所述原语库预先建立，为认证原语的集合。认证原语为表征被认证节点唯一性的语句，由于无规则的语句难以提取语义，因此认证原语需符合被认证节点的预设语义规则。认证原语的预设语义规则可以为以下几类：
(1)替换类语义规则：根据预设的字符替换表，将语句中的字符用字符替换表中与该字符对应的其他字符替换。
(2)模式类语义规则：认证原语按预设的模式生成，例如在认证原语的偶数字符的后面，加入固定长度的随机字符组合。
(3)标点类语义规则：在认证原语的固定位置加入固定的标点。
预设语义规则并不仅限于上述三种，上述三种也可以两两组合或者三者组合使用。
按照预设语义规则构建认证原语，并将认证原语存储在原语库中，每个认证原语在原语库中对应一个索引，每个被认证节点与其原语库一一对应。原语库中的认证原语至少包含2条，以使认证原语的选取不唯一。原语库可以保存于被认证节点处，也可以与被认证节点分离，原语库与被认证节点分离时，被认证节点通过网络访问原语库。所述原语库可以加密保存或添加访问控制机制，以防止认证原语泄漏。
其中，所述原语语义库预先根据原语库生成。原语语义库为原语库中认证原语的语义的集合。提取原语库中每个认证原语的语义，存储于原语语义库中。所述原语语义库可以位于执行认证的节点，也可以与执行认证的节点分离，所述原语语义库与执行认证的节点分离时，执行认证的节点通过网络访问所述原语语义库。如果被认证节点和执行认证的节点是一一对应的，也就是说一个执行认证的节点只对一个被认证的节点进行认证，则该执行认证的节点访问的原语语义库中，只存储该被认证节点的原语库中认证原语的语义。如果执行认证的节点会对至少两个被认证节点进行认证，则该执行认证的节点访问的原语语义库中，存储对应的被认证节点的原语库中认证原语的语义。在一种实施方式中，所有执行认证的节点可以共用一个原语语义库，也就是提取所有原语库中认证原语的语义，存储在一个原语语义库中。
原语为字符组成的语句，其本质也为数据，原语语义即语句的含义，亦即数据的逻辑表示或者特征。提取原语的语义，即将原语按预设的方式进行逻辑组织，或者按预设的方式提取特征。
在一种实施方式中，根据原语库生成原语语义库，包括：获取原语库的认证原语的哈希值，根据所述认证原语的哈希值构建布隆散列，以所述布隆 散列为认证原语的语义的集合，存储于原语语义库中。这种实施方式中，根据原语库生成原语语义库是不可逆的过程，因此可以更好地保护认证原语的安全，攻击者将无法通过原语语义库来得到认证原语，也正因为这样，原语语义库可以公开。使用哈希函数作用于原语库的认证原语，便能获取原语库的认证原语的哈希值。在获取到认证原语的哈希值后，构建布隆散列的方式可以为：将长度为m比特的布隆向量(b1,b2,…,bm)中的所有比特位初始化为0，然后将返回值在1到m间的k个相互独立的快捷HASH函数(h1,h2,…,hk)，作用于每个输入的认证原语的哈希值上，得到k个返回值(r1,r2,…,rk)，并将布隆向量中位置在r1,r2,…,rk的比特位设置为1，最后得到的整个布隆向量即布隆散列，所述布隆散列存储于原语语义库。
在另一种实施方式中，根据原语库生成所述原语语义库，包括：使用学习算法提取原语库的认证原语的特征，以认证原语的特征的集合作为原语语义库。学习算法有多种，例如支持向量算法等，都可以应用于本发明中。学习算法提取的认证原语的特征，可以为向量，也可以为矩阵，随学习算法的不同而不同。以支持向量算法为例，以原语库中的认证原语为输入，可以得到表征认证原语的特征的支持向量，以认证原语的支持向量的集合为原语语义库。利用学习算法根据原语库生成原语语义库也是不可逆的，有利于保证认证原语的安全，原语语义库也可以公开。
当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库中选取一个目标认证原语，选取方式可以为随机选取，也可以按照循环性规律选取。所述随机选取，可以为被认证节点先随机生成一个索引值(所述索引值在原语库的索引值范围内)，然后选取原语库中与所述索引值对应的认证原语。所述按照循环性规律选取，可以为被认证节点按照原语库的索引值排列顺序，依次选取索引值对应的认证原语，当多次进行身份认证后，被认证节点选取的认证原语对应的索引值已达到原语库索引值排列的尾端时，在下一次身份认证的时候，被认证节点重新从原语库的索引值排列的第一个索引值开始选取。
另外，为进一步保证被选中的目标认证原语的安全，防止目标认证原语被改写或被破坏，在将目标认证原语发送给执行认证的节点之前，被认证节点还可以将所述目标认证原语加密。被认证节点加密目标认证原语的方法可以有多种，例如对认证原语进行字符错位处理。相应地，执行认证的节点在收到所述目标认证原语后，对所述目标认证原语进行解密。
执行认证的节点接收到所述被认证节点发送的目标认证原语后，提取所 述目标认证原语的语义，作为目标语义，并验证所述原语语义库中是否存在所述目标语义。
如果根据原语库生成原语语义库，是获取原语库的认证原语的哈希值后，根据所述认证原语的哈希值构建布隆散列，以所述布隆散列为认证原语的语义的集合，相应地，执行认证的节点接收到目标认证原语后，获取所述目标认证原语的哈希值，获取所述哈希值的方法，与生成原语语义库时获取原语库中认证原语的哈希值的方法相同，执行认证的节点将目标认证原语的哈希值作为目标语义，然后以构建布隆散列时对输入的认证原语的哈希值进行处理的方式一样，处理所述目标语义，得到返回值，然后判断所述布隆散列中对应于所述返回值的比特位是否为1，如果为1，则确定所述目标语义存在于所述布隆散列，如果为0，则确定所述目标语义不存在于所述布隆散列。如果所述目标语义存在于所述布隆散列，则原语语义库中存在所述目标语义，被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
如果根据原语库生成所述原语语义库，是使用学习算法提取原语库的认证原语的特征，以认证原语的特征的集合作为原语语义库。则相应地，执行认证的节点接收到目标认证原语后，使用相同的学习算法提取所述目标认证原语的特征，以目标认证原语的特征为目标语义，然后计算目标语义与原语语义库中特征的匹配度，判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。以支持向量算法为例，以目标认证原语为输入，使用支持向量算法得到表征目标认证原语的特征的支持向量，以所述支持向量为目标语义，然后将该目标语义与原语语义库中的支持向量进行匹配，计算该目标语义与原语语义库中支持向量的匹配度，如果所述匹配度大于或者等于85％，则确定该目标语义存在于原语语义库中，被认证节点的身份认证通过，否则，如果所述匹配度小于85％，则确定该目标语义不存在于原语语义库中，被认证节点的身份认证失败，其中，“85％”为预设阈值。
在执行认证的节点接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还可以加上执行认证的节点检验所述目标认证原语是否符合被认证节点的预设语义规则的步骤。原语库中的认证原语必须符合被认证节点的预设语义规则，如果执行认证的节点接收到的目标认证原语不符合所述预设语义规则，则能够确定该目标认证原语是非法的，被认证节点的身份认证不能通过；如果执行认证的节点接收到的目标认证原语符合所 述预设语义规则，则执行提取所述目标认证原语的语义的步骤，对被认证节点的身份进行进一步验证。由于检验目标认证原语是否符合预设语义规则简单易行，资源耗费很小，因此只在目标认证原语符合预设语义规则的时候执行提取所述目标认证原语的语义的步骤，可以避免对所有目标认证原语都提取语义所带来的资源耗费。
如果被认证节点发送的是经过加密的目标认证原语，则执行认证的节点在接收所述目标认证原语之后，提取所述目标认证原语的语义之前，需要对接收到的目标认证原语解密，具体可以包括以下步骤：
(a1)检验所述目标认证原语是否被加密；
(a2)当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
(a3)获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
对于目标认证原语的加密和解密，在被认证节点和执行认证的节点之间可以建立协议，根据协议被认证节点对目标认证原语都使用规定的加密方法进行加密，执行认证的节点则默认接收到的目标认证原语是经过加密的，并使用预先设置的默认的解密方法进行解密，这种情况下，可以不执行步骤(a1)和步骤(a2)。
在一种实施方式下，被认证节点在加密后的目标认证原语中加入算法标识，所述算法标识用于表征被认证节点在加密该目标认证原语时所用的加密算法。执行认证的节点接收到目标认证原语后，步骤(a1)判断接收到的目标认证原语中是否包含所述算法标识，如果包含所述算法标识，则所述目标认证原语为加密数据，然后步骤(a2)分析得到对应于所述算法标识的加密算法，步骤(a3)则在预先存储的解密算法中找到与所述加密算法对应的解密算法，并使用该解密算法解密所述目标认证原语。如果步骤(a1)判断得到的结果是目标认证原语中不包含所述算法标识，则确定所述目标认证原语未被加密。
在另一种实施方式中，被认证节点使用加密后数据有独特的数据结构的加密算法，来加密目标认证原语，执行认证的节点接收到目标认证原语后，步骤(a1)识别目标认证原语的数据结构，并且将识别出的目标认证原语的数据结构，与预先存储的各种数据结构进行比对，如果目标认证原语的数据结构与预先存储的某个数据结构匹配，则确定接收到的目标认证原语是加密 的。步骤(a2)则根据与目标认证原语的数据结构相匹配的预先存储的数据结构，得到与该预先存储的数据结构对应的加密算法，然后步骤(a3)在预先存储的解密算法中，查找与该加密算法对应的解密算法，并使用该解密算法解密接收到的目标认证原语。
本实施例所提供的技术方案，以认证原语为认证凭证，由于认证原语只是被认证节点的描述语句，因此认证原语的构建和原语库的建立都简单易行；在被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从原语库选取目标认证原语发送给执行认证的节点进行身份认证，原语库中可以存在众多的认证原语，这样被认证节点每次发送的目标认证原语都是不唯一的，从而有效防止目标认证原语被破解，也不需耗费时间和资源来维护目标认证原语。被认证节点使用随机选取方式来选取目标认证原语时，由于每次发送的目标认证原语都不可预料，更有利于防止目标认证原语被破解以及减少目标认证原语维护耗费。而且被认证节点可以只在需要进行身份认证的时候选取目标认证原语并发送，且每次的目标认证原语不唯一，被认证节点不需保存认证状态。执行认证的节点接收到被认证节点发送的目标认证原语后，以生成原语语义库时提取原语库认证原语的语义的方法，提取目标认证原语的语义，作为目标语义，然后验证所述目标语义是否存在与原语语义库中。由于认证原语及目标认证原语为简单的字符语句，使用已有的语义提取方法提取语义，以及验证目标语义与原语语义库中的语义是否匹配，过程皆简单易行，资源耗费少，且整个认证过程执行认证的节点也不需保存认证状态，只针对当次接收的目标认证原语进行认证，从而使得被认证节点和执行认证的节点之间能够实现按需认证。
参见图4，为本发明实施例提供的一种分布式系统节点身份认证装置的框图，该装置应用于被认证节点，如图4所示，该装置包括如下：
认证原语选取单元U401，用于当被认证节点和执行认证的节点之间需要进行身份认证时，从原语库中选取一个目标认证原语，所述原语库为认证原语的集合，且预先建立，所述认证原语为满足被认证节点的预设语义规则的语句；
认证原语发送单元U402，用于将所述目标认证原语发送给执行认证的节点。
在一种应用场景中，被认证节点在数据访问发起的同时发起身份认证，也就是被认证节点在数据访问发起的同时需要进行身份认证。在另一种应用 场景中，被认证节点先向执行认证的节点发送数据访问请求，执行认证的节点返回身份认证请求消息，被认证节点收到所述身份认证请求消息后，向执行认证的节点发送身份认证信息，在这种情况下，被认证节点收到身份认证请求消息即为被认证节点和执行认证的节点之间需要进行身份认证。
所述原语库预先建立，其为认证原语的集合。认证原语为表征被认证节点唯一性的语句，由于无规则的语句难以提取语义，因此认证原语需符合被认证节点的预设语义规则。认证原语的预设语义规则可以为以下几类：
(1)替换类语义规则：根据预设的字符替换表，将语句中的字符用字符替换表中与该字符对应的其他字符替换。
(2)模式类语义规则：认证原语按预设的模式生成，例如在认证原语的偶数字符的后面，加入固定长度的随机字符组合。
(3)标点类语义规则：在认证原语的固定位置加入固定的标点。
预设语义规则并不仅限于上述三种，上述三种也可以两两组合或者三者组合使用。
按照预设语义规则构建认证原语，并将认证原语存储在原语库中，每个认证原语在原语库中对应一个索引，每个被认证节点与其原语库一一对应。原语库中的认证原语至少包含2条，以使认证原语的选取不唯一。原语库可以保存于被认证节点处，也可以与被认证节点分离，原语库与被认证节点分离时，被认证节点通过网络访问原语库。
当被认证节点和执行认证的节点之间需要进行身份认证时，认证原语选取单元U401从原语库中选取一个目标认证原语，选取方式可以为随机选取，也可以按照循环性规律选取。所述随机选取，可以为认证原语选取单元U401先随机生成一个索引值(所述索引值在原语库的索引值范围内)，然后选取原语库中与所述索引值对应的认证原语。认证原语选取单元U401使用随机选取方式来选取目标认证原语时，认证原语发送单U402每次发送的目标认证原语都不可预料，更有利于防止目标认证原语被破解以及减少目标认证原语维护耗费。所述按照循环性规律选取，可以为认证原语选取单元U401按照原语库的索引值排列顺序，依次选取索引值对应的认证原语，当多次进行身份认证后，认证原语选取单元U401选取的认证原语对应的索引值已达到原语库索引值排列的尾端时，在下一次身份认证的时候，认证原语选取单元U401重新从原语库的索引值排列的第一个索引值开始选取。认证原语选取 单元U401选取目标认证原语后，认证原语发送单U402将所述目标认证原语发送给执行认证的节点，以使所述执行认证的节点根据所述目标认证原语对被认证节点进行认证。
为保证被选中的目标认证原语的安全，防止目标认证原语被破坏，所述装置还可以包括认证原语加密单元，用于在认证原语发送单U402将目标认证原语发送给执行认证的节点之前，将所述目标认证原语加密。相应地，执行认证的节点在收到所述目标认证原语后，对所述目标认证原语进行解密。
本实施例所提供的装置，在被认证节点和执行认证的节点之间需要进行身份认证时，从原语库选取目标认证原语发送给执行认证的节点进行身份认证，原语库中可以存在众多的认证原语，这样被认证节点每次发送的目标认证原语都是不唯一的，从而有效防止目标认证原语被破解，也不需耗费时间和资源来维护认证凭证，且所述装置可以只在需要进行身份认证的时候选取目标认证原语并发送，且每次的目标认证原语不唯一，不需保存认证状态，从而能够实现按需认证。
参见图5，为本发明实施例还提供的一种分布式系统节点身份认证装置的框图，该装置应用于执行认证的节点，如图5所示，该装置包括如下：
认证原语接收单元U501，用于接收被认证节点发送的目标认证原语；
目标语义提取单元U502，用于提取所述目标认证原语的语义，作为目标语义；
验证单元U503，用于验证原语语义库中是否存在所述目标语义，如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败；
其中，所述原语语义库根据原语库生成，且预先建立，所述原语库为认证原语的集合，且预先建立，所述认证原语为满足被认证节点的预设语义规则的语句。
原语语义库为原语库中认证原语的语义的集合。提取原语库中每个认证原语的语义，存储于原语语义库中。所述原语语义库可以位于执行认证的节点，也可以与执行认证的节点分离，所述原语语义库与执行认证的节点分离时，执行认证的节点通过网络访问所述原语语义库。如果被认证节点和执行认证的节点是一一对应的，也就是说一个执行认证的节点只对一个被认证的节点进行认证，则该执行认证的节点访问的原语语义库中，只存储该被认证节点的原语库中认证原语的语义。如果执行认证的节点会对至少两个被认证 节点进行认证，则该执行认证的节点访问的原语语义库中，存储对应的被认证节点的原语库中认证原语的语义。在一种实施方式中，所有执行认证的节点可以共用一个原语语义库，也就是提取所有原语库中认证原语的语义，存储在一个原语语义库中。
在一种实施方式中，根据原语库生成原语语义库，包括：获取原语库的认证原语的哈希值，根据所述认证原语的哈希值构建布隆散列，以所述布隆散列为认证原语的语义的集合，存储于原语语义库中。使用哈希函数作用于原语库的认证原语，便能获取原语库的认证原语的哈希值。在获取到认证原语的哈希值后，构建布隆散列的方式可以为：将长度为m比特的布隆向量(b1,b2,…,bm)中的所有比特位初始化为0，然后将返回值在1到m间的k个相互独立的快捷HASH函数(h1,h2,…,hk)，作用于每个输入的认证原语的哈希值上，得到k个返回值(r1,r2,…,rk)，并将布隆向量中位置在r1,r2,…,rk的比特位设置为1，最后得到的整个布隆向量即布隆散列，所述布隆散列存储于原语语义库。
相应地，认证原语接收单元U501接收到目标认证原语后，目标语义提取单元U502获取所述目标认证原语的哈希值，获取所述哈希值的方法，与生成原语语义库时获取原语库中认证原语的哈希值的方法相同。目标语义提取单元U502将目标认证原语的哈希值作为目标语义，然后验证单元U503以构建布隆散列时对输入的认证原语的哈希值进行处理的方式一样，处理所述目标语义，得到返回值，然后判断所述布隆散列中对应于所述返回值的比特位是否为1，如果为1，则确定所述目标语义存在于所述布隆散列，如果为0，则确定所述目标语义不存在于所述布隆散列。如果所述目标语义存在于所述布隆散列，则原语语义库中存在所述目标语义，被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
在另一种实施方式中，根据原语库生成所述原语语义库，包括：使用学习算法提取原语库的认证原语的特征，以认证原语的特征的集合作为原语语义库。学习算法提取的认证原语的特征，可以为向量，也可以为矩阵，随学习算法的不同而不同。以支持向量算法为例，以原语库中的认证原语为输入，可以得到表征认证原语的特征的支持向量，以认证原语的支持向量的集合为原语语义库。
相应地，认证原语接收单元U501接收到目标认证原语后，目标语义提取单元U502使用相同的学习算法提取所述目标认证原语的特征，以目标认证原语的特征为目标语义，然后验证单元U503计算目标语义与原语语义库 中特征的匹配度，判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。以支持向量算法为例，目标语义提取单元U502以目标认证原语为输入，使用支持向量算法得到表征目标认证原语的特征的支持向量，以所述支持向量为目标语义，然后验证单元U503将该目标语义与原语语义库中的支持向量进行匹配，计算该目标语义与原语语义库中支持向量的匹配度，如果所述匹配度大于或者等于85％，则确定该目标语义存在于原语语义库中，被认证节点的身份认证通过，否则，如果所述匹配度小于85％，则确定该目标语义不存在于原语语义库中，被认证节点的身份认证失败，其中，“85％”为预设阈值。
原语库中的认证原语必须符合被认证节点的预设语义规则，如果认证原语接收单元U501接收到的目标认证原语不符合所述预设语义规则，则能够确定该目标认证原语是非法的，被认证节点的身份认证不能通过；如果认证原语接收单元U501接收到的目标认证原语符合所述预设语义规则，则对被认证节点的身份进行进一步验证。因此，所述装置还可以包括预检验单元和提取使能单元，所述预检验单元用于检验所述目标认证原语是否符合被认证节点的预设语义规则；所述提取使能单元，用于当所述目标认证原语符合所述预设语义规则时，使能所述目标语义提取单元。
由于检验目标认证原语是否符合预设语义规则简单易行，资源耗费很小，因此只在预检验单元得到的结果为目标认证原语符合预设语义规则的时候，提取使能单元使能目标语义提取单元U502，由目标语义提取单元U502提取所述目标认证原语的语义，可以避免对所有目标认证原语都提取语义所带来的资源耗费。
可选的，如果被认证节点发送的是经过加密的目标认证原语，则所述装置，还可以包括：
加密检验单元，用于在所述执行认证的节点接收所述目标认证原语之后，提取所述目标认证原语的语义之前，检验所述目标认证原语是否被加密；
加密方法分析模块，用于当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
解密模块，用于获取与所述加密方法对应的解密方法，并解密所述目标认证原语。
本实施例提供的装置，其中，目标语义提取单元U502以生成原语语义 库时提取原语库认证原语的语义的方法，提取目标认证原语的语义，作为目标语义，然后验证单元U503验证所述目标语义是否存在与原语语义库中，如果存在，则被认证节点的身份认证通过，否则，被认证节点身份认证失败。由于认证原语及目标认证原语为简单的字符语句，使用已有的语义提取方法提取语义，以及验证目标语义与原语语义库中的语义是否匹配，过程皆简单易行，资源耗费少，且整个认证过程执行认证的节点并不需保存认证状态，从而使得被认证节点和执行认证的节点之间能够实现按需认证。
参见图6，为本发明实施例提供的一种分布式系统节点身份认证装置的框图，该装置应用于执行认证的节点，如图6所示，该装置包括如下：
原语库建立单元U601，用于建立原语库，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
原语语义库生成单元U602，用于根据所述原语库生成原语语义库；
认证原语选取单元U603，应用于被认证节点，用于当被认证节点和执行认证的节点之间需要进行身份认证时，从原语库中选取一个目标认证原语；
认证原语发送单元U604，应用于被认证节点，用于将所述目标认证原语发送给执行认证的节点；
认证原语接收单元U605，应用于执行认证的节点，用于接收被认证节点发送的目标认证原语；
目标语义提取单元U606，应用于执行认证的节点，用于提取所述目标认证原语的语义，作为目标语义；
验证单元U607，应用于执行认证的节点，用于验证原语语义库中是否存在所述目标语义，如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
图6中的虚线表示认证原语接收单元U605，与认证原语发送单元U604通过网络进行连接。
其中，在一种应用场景中，被认证节点在数据访问发起的同时发起身份认证，被认证节点在发送数据的同时需要发送身份认证信息，在本发明中，所述身份认证信息即目标认证原语。在另一种应用场景中，被认证节点先向执行认证的节点发送数据访问请求，执行认证的节点返回身份认证请求消息，被认证节点收到所述身份认证请求消息后，向执行认证的节点发送身份 认证信息，在这种情况下，被认证节点收到身份认证请求消息即为被认证节点和执行认证的节点之间需要进行身份认证。
原语库建立单元U601预先建立原语库，先构建认证原语，然后以认证原语的集合为原语库。认证原语为表征被认证节点唯一性的语句，由于无规则的语句难以提取语义，因此认证原语需符合被认证节点的预设语义规则。认证原语的预设语义规则可以为以下几类：
(1)替换类语义规则：根据预设的字符替换表，将语句中的字符用字符替换表中与该字符对应的其他字符替换。
(2)模式类语义规则：认证原语按预设的模式生成，例如在认证原语的偶数字符的后面，加入固定长度的随机字符组合。
(3)标点类语义规则：在认证原语的固定位置加入固定的标点。
预设语义规则并不仅限于上述三种，上述三种也可以两两组合或者三者组合使用。
原语库建立单元U601按照预设语义规则构建认证原语，认证原语的集合构成库，并且原语库建立单元U601建立原语库时，为每个认证原语在原语库设置一个对应的索引。每个被认证节点与其原语库一一对应。原语库建立单元U601建立的原语库，其中的认证原语至少包含2条，以使认证原语的选取不唯一。原语库建立单元U601建立的原语库可以保存于被认证节点处，也可以保存于分布式系统的其他地方，与被认证节点分离，原语库与被认证节点分离时，被认证节点通过网络访问原语库。原语库建立单元U601建立原语库时还可以为所述原语库可以加密保存或添加访问控制机制，以防止认证原语泄漏。
原语语义库生成单元U602预先根据原语库生成原语语义库。原语语义库为原语库中认证原语的语义的集合。原语语义库生成单元U602提取原语库中每个认证原语的语义，存储于原语语义库中。原语语义库生成单元U602可以将生成的原语语义库保存于执行认证的节点，也可以保存在分布式系统的其他地方，与执行认证的节点分离，所述原语语义库与执行认证的节点分离时，执行认证的节点通过网络访问所述原语语义库。如果被认证节点和执行认证的节点是一一对应的，也就是说一个执行认证的节点只对一个被认证的节点进行认证，则原语语义库生成单元U602只提取该被认证节点的原语库中认证原语的语义。如果执行认证的节点会对至少两个被认证节点进行认证，则原语语义库生成单元U602提取对应的被认证节点的原语库中认证原 语的语义。在一种实施方式中，所有执行认证的节点可以共用一个原语语义库，原语语义库生成单元U602提取所有原语库中认证原语的语义，将所有原语库中认证原语的语义集合成一个原语语义库中。
在一种实施方式中，原语语义库生成单元U602获取原语库的认证原语的哈希值后，根据所述认证原语的哈希值构建布隆散列，以所述布隆散列为认证原语的语义的集合，存储于原语语义库中。这种实施方式中，根据原语库生成原语语义库是不可逆的过程，因此可以更好地保护认证原语的安全，攻击者将无法通过原语语义库来得到认证原语，也正因为这样，原语语义库可以公开。原语语义库生成单元U602使用哈希函数作用于原语库的认证原语，便能获取原语库的认证原语的哈希值。原语语义库生成单元U602在获取到认证原语的哈希值后，构建布隆散列的方式可以为：将长度为m比特的布隆向量(b1,b2,…,bm)中的所有比特位初始化为0，然后将返回值在1到m间的k个相互独立的快捷HASH函数(h1,h2,…,hk)，作用于每个输入的认证原语的哈希值上，得到k个返回值(r1,r2,…,rk)，并将布隆向量中位置在r1,r2,…,rk的比特位设置为1，最后得到的整个布隆向量即布隆散列，所述布隆散列存储于原语语义库。
在另一种实施方式中，原语语义库生成单元U602使用学习算法提取原语库的认证原语的特征，以认证原语的特征的集合作为原语语义库。使用学习算法提取的认证原语的特征，可以为向量，也可以为矩阵，随学习算法的不同而不同。以支持向量算法为例，原语语义库生成单元U602以原语库中的认证原语为输入，可以得到表征认证原语的特征的支持向量，以认证原语的支持向量的集合为原语语义库。利用学习算法根据原语库生成原语语义库也是不可逆的，有利于保证认证原语的安全，原语语义库也可以公开。
当被认证节点和执行认证的节点之间需要进行身份认证时，应用于被认证节点的认证原语选取单元U603从原语库中选取一个目标认证原语，选取方式可以为随机选取，也可以按照循环性规律选取。所述随机选取，可以为认证原语选取单元U603先随机生成一个索引值(所述索引值在原语库的索引值范围内)，然后选取原语库中与所述索引值对应的认证原语。所述按照循环性规律选取，可以为认证原语选取单元U603按照原语库的索引值排列顺序，依次选取索引值对应的认证原语，当多次进行身份认证后，认证原语选取单元U603选取的认证原语对应的索引值已达到原语库索引值排列的尾端时，在下一次身份认证的时候，认证原语选取单元U603重新从原语库的索引值排列的第一个索引值开始选取。
另外，为进一步保证被选中的目标认证原语的安全，防止目标认证原语被改写或被破坏，所述装置还可以包括加密单元，用于在认证原语发送单元U604将目标认证原语发送给执行认证的节点之前，将所述目标认证原语加密。加密单元加密目标认证原语的方法可以有多种，例如对认证原语进行字符错位处理。相应地，执行认证的节点在收到所述目标认证原语后，对所述目标认证原语进行解密。
应用于执行认证的节点的认证原语接收单元U605，接收到所述被认证节点发送的目标认证原语后，目标语义提取单元U606提取所述目标认证原语的语义，作为目标语义，然后验证单元U607验证所述原语语义库中是否存在所述目标语义。
如果原语语义库建立单元U602，是获取原语库的认证原语的哈希值后，根据所述认证原语的哈希值构建布隆散列，以所述布隆散列为认证原语的语义的集合，则相应地，认证原语接收单元U605接收到目标认证原语后，目标语义提取单元U606获取所述目标认证原语的哈希值，获取所述哈希值的方法，与生成原语语义库时获取原语库中认证原语的哈希值的方法相同，目标语义提取单元U606将目标认证原语的哈希值作为目标语义，然后验证单元U607以构建布隆散列时对输入的认证原语的哈希值进行处理的方式一样，处理所述目标语义，得到返回值，然后判断所述布隆散列中对应于所述返回值的比特位是否为1，如果为1，则确定所述目标语义存在于所述布隆散列，如果为0，则确定所述目标语义不存在于所述布隆散列。如果所述目标语义存在于所述布隆散列，则原语语义库中存在所述目标语义，被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
原语语义库建立单元U602，是使用学习算法提取原语库的认证原语的特征，以认证原语的特征的集合作为原语语义库。则相应地，认证原语接收单元U605接收到目标认证原语后，目标语义提取单元U606使用相同的学习算法提取所述目标认证原语的特征，以目标认证原语的特征为目标语义，然后验证单元U607计算目标语义与原语语义库中特征的匹配度，判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。以支持向量算法为例，目标语义提取单元U606以目标认证原语为输入，使用支持向量算法得到表征目标认证原语的特征的支持向量，以所述支持向量为目标语义，然后验证单元U607将该目标语义与原语语义库中的支持向量进行匹配，计算该目标语义与原语语义库中支持向量的匹配度， 如果所述匹配度大于或者等于85％，则确定该目标语义存在于原语语义库中，被认证节点的身份认证通过，否则，则确定该目标语义不存在于原语语义库中，被认证节点的身份认证失败。
原语库中的认证原语必须符合被认证节点的预设语义规则，如果认证原语接收单元U605接收到的目标认证原语不符合所述预设语义规则，则能够确定该目标认证原语是非法的，被认证节点的身份认证不能通过；如果认证原语接收单元U605接收到的目标认证原语符合所述预设语义规则，则对被认证节点的身份进行进一步验证。因此，所述装置还可以包括预检验单元和提取使能单元，所述预检验单元用于检验所述目标认证原语是否符合被认证节点的预设语义规则；所述提取使能单元，用于当所述目标认证原语符合所述预设语义规则时，使能所述目标语义提取单元。
由于检验目标认证原语是否符合预设语义规则简单易行，资源耗费很小，因此只在预检验单元得到的结果为目标认证原语符合预设语义规则的时候，提取使能单元使能目标语义提取单元U606，由目标语义提取单元U606提取所述目标认证原语的语义，可以避免对所有目标认证原语都提取语义所带来的资源耗费。
可选的，如果被认证节点发送的是经过加密的目标认证原语，则所述装置，还可以包括：
加密检验单元，用于在所述执行认证的节点接收所述目标认证原语之后，提取所述目标认证原语的语义之前，检验所述目标认证原语是否被加密；
加密方法分析模块，用于当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
解密模块，用于获取与所述加密方法对应的解密方法，并解密所述目标认证原语。
本实施例所提供的装置，认证原语的构建和原语库的建立都简单易行；在被认证节点和执行认证的节点之间需要进行身份认证时，认证原语选取单元U603从原语库选取目标认证原语发送给执行认证的节点进行身份认证，原语库中可以存在众多的认证原语，这样认证原语选取单元U604每次发送的目标认证原语都是不唯一的，从而有效防止目标认证原语被破解，也不需耗费时间和资源来维护目标认证原语，而且所述装置可以只在需要进行身份认证的时候选取目标认证原语并发送，且每次的目标认证原语不唯一，因而被认证节点不需保存认证状态。认证原语接收单元U605接收到认证原语选 取单元U604发送的目标认证原语后，认证原语提取单元U604以生成原语语义库时提取原语库认证原语的语义的方法，提取目标认证原语的语义，作为目标语义，然后验证单元U607验证所述目标语义是否存在与原语语义库中。由于认证原语及目标认证原语为简单的字符语句，使用已有的语义提取方法提取语义，以及验证目标语义与原语语义库中的语义是否匹配，过程皆简单易行，资源耗费少，且整个认证过程执行认证的节点也不需保存认证状态，从而使得被认证节点和执行认证的节点之间能够实现按需认证。
本领域的技术人员可以清楚地了解到本发明实施例中的技术可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本发明实施例中的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例或者实施例的某些部分所述的方法。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述的本发明实施方式，并不构成对本发明保护范围的限定。任何在本发明的精神和原则之内所作的修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (24)

  1. 一种分布式系统节点身份认证方法，应用于执行认证的节点，其特征在于，包括：
    接收被认证节点发送的目标认证原语；
    提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义；
    如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败；
    其中，所述原语语义库预先根据原语库生成，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则。
  2. 如权利要求1所述的分布式系统节点身份认证方法，其特征在于，
    所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：获取所述目标认证原语的哈希值，作为目标语义，并验证所述目标语义是否存在于所述原语语义库的布隆散列；
    所述布隆散列，为获取原语库的认证原语的哈希值后，根据所述认证原语的哈希值构建而成，所述原语语义库由所述布隆散列组成。
  3. 如权利要求1所述的分布式系统节点身份认证方法，其特征在于，
    所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：
    使用学习算法提取所述目标认证原语的特征，作为目标语义；
    计算所述目标语义与所述原语语义库中特征的匹配度；
    判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义；
    其中，所述原语语义库为所述原语库中认证原语的特征的集合，所述认证原语的特征通过对认证原语使用所述学习算法提取得到。
  4. 如权利要求1所述的分布式系统节点身份认证方法，其特征在于，在接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
    检验所述目标认证原语是否符合被认证节点的预设语义规则；
    当所述目标认证原语符合所述预设语义规则时，允许执行提取所述目标认证原语的语义的步骤。
  5. 如权利要求1至4任一项所述的分布式系统节点身份认证方法，其特征在于，在接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
    检验所述目标认证原语是否被加密；
    当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
    获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
  6. 一种分布式系统节点身份认证方法，其特征在于，包括：
    建立原语库，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
    根据所述原语库生成原语语义库；
    当被认证节点和执行认证的节点之间需要进行身份认证时，被认证节点从所述原语库中选取一个目标认证原语；
    被认证节点将所述目标认证原语发送给执行认证的节点；
    执行认证的节点接收所述被认证节点发送的目标认证原语；
    执行认证的节点提取所述目标认证原语的语义，作为目标语义，并验证所述原语语义库中是否存在所述目标语义；
    如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
  7. 如权利要求6所述的分布式系统节点身份认证方法，其特征在于，当被认证节点和执行认证的节点之间需要进行身份认证时，所述被认证节点从所述原语库中随机选取一个目标认证原语。
  8. 如权利要求6所述的分布式系统节点身份认证方法，其特征在于，
    所述根据所述原语库生成原语语义库，包括：获取原语库的认证原语的哈希值，并根据所述认证原语的哈希值构建布隆散列；
    所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：获取所述目标认证原语的哈希值，作为目标语义，并验证所述目标语义是否存在于所述布隆散列。
  9. 如权利要求6所述的分布式系统节点身份认证方法，其特征在于，
    所述根据所述原语库生成原语语义库，包括：使用学习算法提取原语库中认证原语的特征，以所述特征的集合为原语语义库；
    所述提取所述目标认证原语的语义，作为目标语义，并验证原语语义库中是否存在所述目标语义，包括：
    使用所述学习算法提取所述目标认证原语的特征，作为目标语义；
    计算所述目标语义与所述原语语义库中特征的匹配度；
    判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。
  10. 如权利要求6所述的分布式系统节点身份认证方法，其特征在于，在接收所述被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
    执行认证的节点检验所述目标认证原语是否符合被认证节点的预设语义规则；
    当所述目标认证原语符合所述预设语义规则时，允许执行提取所述目标认证原语的语义的步骤。
  11. 如权利要求6至10任一项所述的分布式系统节点身份认证方法，其特征在于，在将所述目标认证原语发送给执行认证的节点之前，还包括：被认证节点加密所述目标认证原语。
  12. 如权利要求11所述的分布式系统节点身份认证方法，其特征在于，在接收被认证节点发送的目标认证原语之后，提取所述目标认证原语的语义之前，还包括：
    执行认证的节点检验所述目标认证原语是否被加密；
    当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
    获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
  13. 一种分布式系统节点身份认证装置，应用于执行认证的节点，其特征在于，包括：
    认证原语接收单元，用于接收被认证节点发送的目标认证原语；
    目标语义提取单元，用于提取所述目标认证原语的语义，作为目标语义；
    验证单元，用于验证原语语义库中是否存在所述目标语义，如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败；
    其中，所述原语语义库预先根据原语库生成，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则。
  14. 如权利要求13所述的分布式系统节点身份认证装置，其特征在于，所述目标语义提取单元，具体用于：获取所述目标认证原语的哈希值，作为目标语义；
    所述验证单元，具体用于：验证所述目标语义是否存在于布隆散列；
    其中，所述布隆散列，为获取所述原语库的认证原语的哈希值后，根据所述认证原语的哈希值构建而成，所述原语语义库由所述布隆散列组成。
  15. 如权利要求13所述的分布式系统节点身份认证装置，其特征在于，所述目标语义提取单元具体用于：使用学习算法提取所述目标认证原语的特征，作为目标语义；
    所述验证单元具体用于：
    计算所述目标语义与所述原语语义库中特征的匹配度；
    判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义；
    其中，所述原语语义库为所述原语库中认证原语的特征的集合，所述认证原语的特征通过对认证原语使用所述学习算法提取得到。
  16. 如权利要求13所述的分布式系统节点身份认证装置，其特征在于，还包括：
    预检验单元，用于检验所述目标认证原语是否符合被认证节点的预设语义规则；
    提取使能单元，用于当所述目标认证原语符合所述预设语义规则时，使能所述目标语义提取单元。
  17. 如权利要求13至16任一项所述的分布式系统节点身份认证装置，其特征在于，还包括认证原语解密单元，所述认证原语解密单元包括：
    加密检验模块，用于在接收所述目标认证原语之后，提取所述目标认证原语的语义之前，检验所述目标认证原语是否被加密；
    加密方法分析模块，用于当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
    解密模块，用于获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
  18. 一种分布式系统节点身份认证装置，其特征在于，包括：
    原语库建立单元，用于建立原语库，所述原语库为认证原语的集合，所述认证原语为表征被认证节点唯一性的语句，且满足被认证节点的预设语义规则；
    原语语义库生成单元，用于根据所述原语库生成原语语义库；
    认证原语选取单元，应用于被认证节点，用于当被认证节点和执行认证的节点之间需要进行身份认证时，从原语库中选取一个目标认证原语；
    认证原语发送单元，应用于被认证节点，用于将所述目标认证原语发送给执行认证的节点；
    认证原语接收单元，应用于执行认证的节点，用于接收被认证节点发送的目标认证原语；
    目标语义提取单元，应用于执行认证的节点，用于提取所述目标认证原语的语义，作为目标语义；
    验证单元，应用于执行认证的节点，用于验证原语语义库中是否存在所述目标语义，如果所述原语语义库中存在所述目标语义，则被认证节点的身份认证通过，否则，被认证节点的身份认证失败。
  19. 如权利要求18所述的分布式系统节点身份认证装置，其特征在于， 所述认证原语选取单元，具体用于：当被认证节点和执行认证的节点之间需要进行身份认证时，从所述原语库中随机选取一个目标认证原语。
  20. 如权利要求18所述的分布式系统节点身份认证装置，其特征在于，
    所述原语语义库生成单元，具体用于获取原语库的认证原语的哈希值，根据所述认证原语的哈希值构建布隆散列，并根据所述布隆散列组成原语语义库；
    所述目标语义提取单元具体用于：获取所述目标认证原语的哈希值，作为目标语义；
    所述验证单元具体用于：验证所述目标语义是否存在于所述布隆散列。
  21. 如权利要求18所述的分布式系统节点身份认证装置，其特征在于，
    所述原语语义库生成单元，具体用于使用学习算法提取原语库中认证原语的特征，以所述特征的集合作为原语语义库；
    所述目标语义提取单元具体用于：使用所述学习算法提取所述目标认证原语的特征，作为目标语义；
    所述验证单元具体用于：
    计算所述目标语义与所述原语语义库中特征的匹配度；
    判断所述匹配度是否大于或等于预设阈值，如果所述匹配度大于或等于所述预设阈值，则所述原语语义库中存在所述目标语义，否则，所述原语语义库中不存在所述目标语义。
  22. 如权利要求18所述的分布式系统节点身份认证装置，其特征在于，还包括：
    预检验单元，应用于执行认证的节点，用于检验所述目标认证原语是否符合被认证节点的预设语义规则；
    提取使能单元，应用于执行认证的节点，用于当所述目标认证原语符合所述预设语义规则时，使能所述目标语义提取单元。
  23. 如权利要求18至22任一项所述的分布式系统节点身份认证装置，其特征在于，还包括认证原语加密单元，所述认证原语加密单元，应用于被认证节点，用于在将所述目标认证原语发送给执行认证的节点之前，将所述目标认证原语加密。
  24. 如权利要求23所述的分布式系统节点身份认证装置，其特征在于，还包括认证原语解密单元，所述认证原语解密单元，应用于执行认证的节点，包括：
    加密检验模块，用于在接收所述目标认证原语之后，提取所述目标认证原语的语义之前，检验所述目标认证原语是否被加密；
    加密方法分析模块，用于当所述目标认证原语被加密时，分析所述目标认证原语的加密方法；
    解密模块，用于获取与所述加密方法对应的解密方法，并使用所述解密方法解密所述目标认证原语。
PCT/CN2016/087704 2015-07-31 2016-06-29 分布式系统节点身份认证方法及装置 WO2017020669A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510465057.3 2015-07-31
CN201510465057.3A CN105071941B (zh) 2015-07-31 2015-07-31 分布式系统节点身份认证方法及装置

Publications (1)

Publication Number Publication Date
WO2017020669A1 true WO2017020669A1 (zh) 2017-02-09

Family

ID=54501228

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/087704 WO2017020669A1 (zh) 2015-07-31 2016-06-29 分布式系统节点身份认证方法及装置

Country Status (2)

Country Link
CN (1) CN105071941B (zh)
WO (1) WO2017020669A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108111599A (zh) * 2017-12-19 2018-06-01 深圳马可孛罗科技有限公司 一种不稳定网络环境下的数据请求方法及系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105071941B (zh) * 2015-07-31 2019-01-18 华为技术有限公司 分布式系统节点身份认证方法及装置
WO2018010146A1 (zh) 2016-07-14 2018-01-18 华为技术有限公司 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器
CN116827520B (zh) * 2023-08-30 2023-10-27 环球数科集团有限公司 一种基于web3技术的分布式身份认证系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100036783A1 (en) * 2008-08-06 2010-02-11 Rodriguez Ralph A Method of and apparatus for combining artificial intelligence (AI) concepts with event-driven security architectures and ideas
CN101848479A (zh) * 2010-04-09 2010-09-29 西安电子科技大学 无线网络安全协议仿真系统及仿真方法
CN103986725A (zh) * 2014-05-29 2014-08-13 中国农业银行股份有限公司 一种客户端、服务器端以及身份认证系统和方法
CN105071941A (zh) * 2015-07-31 2015-11-18 华为技术有限公司 分布式系统节点身份认证方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8108907B2 (en) * 2008-08-12 2012-01-31 International Business Machines Corporation Authentication of user database access
CN101695035B (zh) * 2009-10-21 2012-07-04 成都市华为赛门铁克科技有限公司 流量识别方法及装置
CN104348624B (zh) * 2013-08-09 2018-02-02 阿里巴巴集团控股有限公司 一种哈希认证可信度的方法和装置
CN104636662B (zh) * 2013-11-15 2018-07-03 华为技术有限公司 一种数据处理方法和终端设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100036783A1 (en) * 2008-08-06 2010-02-11 Rodriguez Ralph A Method of and apparatus for combining artificial intelligence (AI) concepts with event-driven security architectures and ideas
CN101848479A (zh) * 2010-04-09 2010-09-29 西安电子科技大学 无线网络安全协议仿真系统及仿真方法
CN103986725A (zh) * 2014-05-29 2014-08-13 中国农业银行股份有限公司 一种客户端、服务器端以及身份认证系统和方法
CN105071941A (zh) * 2015-07-31 2015-11-18 华为技术有限公司 分布式系统节点身份认证方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108111599A (zh) * 2017-12-19 2018-06-01 深圳马可孛罗科技有限公司 一种不稳定网络环境下的数据请求方法及系统
CN108111599B (zh) * 2017-12-19 2021-01-05 深圳马可孛罗科技有限公司 一种不稳定网络环境下的数据请求方法及系统

Also Published As

Publication number Publication date
CN105071941B (zh) 2019-01-18
CN105071941A (zh) 2015-11-18

Similar Documents

Publication Publication Date Title
AU2019204725B2 (en) Retrieving access data for blockchain networks using highly available trusted execution environments
TWI725655B (zh) 用於在可信執行環境中執行子邏輯代碼的程式執行和資料證明的方法、設備和系統
KR102493744B1 (ko) 생체 특징에 기초한 보안 검증 방법, 클라이언트 단말, 및 서버
US20220191012A1 (en) Methods For Splitting and Recovering Key, Program Product, Storage Medium, and System
US9106426B2 (en) Username based authentication and key generation
US10187373B1 (en) Hierarchical, deterministic, one-time login tokens
US9077710B1 (en) Distributed storage of password data
WO2018024056A1 (zh) 用户口令管理的方法和服务器
US20120054491A1 (en) Re-authentication in client-server communications
US10911538B2 (en) Management of and persistent storage for nodes in a secure cluster
CN104158827B (zh) 密文数据共享方法、装置、查询服务器和上传数据客户端
CN113691502B (zh) 通信方法、装置、网关服务器、客户端及存储介质
CN106060078B (zh) 应用于云平台的用户信息加密方法、注册方法及验证方法
CN108809633B (zh) 一种身份认证的方法、装置及系统
CN106130716A (zh) 基于认证信息的密钥交换系统及方法
JP2015099961A (ja) 情報配信システム、サーバ装置、情報生成装置、端末装置、情報配信方法及びプログラム
KR101739203B1 (ko) 일회용 개인키 기반 전자 서명과 동형 암호를 이용한 패스워드 기반 사용자 인증 방법
CN107359998A (zh) 一种便携式智能口令管理体制的建立与操作方法
WO2017020669A1 (zh) 分布式系统节点身份认证方法及装置
CN105721153A (zh) 基于认证信息的密钥交换系统及方法
KR102146940B1 (ko) 토큰 위변조 검증 방법
CN112800462A (zh) 一种云计算环境下机密信息的存储方法
WO2017104750A1 (ja) 認証制御システム、サーバ装置、クライアント装置、認証制御方法、認証方法、及びプログラム
Kumar et al. Multi-cryptosystem based privacy-preserving public auditing for regenerating code based cloud storage
CN103916372A (zh) 一种第三方登录信息托管方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16832157

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16832157

Country of ref document: EP

Kind code of ref document: A1