WO2020155794A1 - 基于时间戳的加密及认证方法、系统和计算机设备 - Google Patents

基于时间戳的加密及认证方法、系统和计算机设备 Download PDF

Info

Publication number
WO2020155794A1
WO2020155794A1 PCT/CN2019/119482 CN2019119482W WO2020155794A1 WO 2020155794 A1 WO2020155794 A1 WO 2020155794A1 CN 2019119482 W CN2019119482 W CN 2019119482W WO 2020155794 A1 WO2020155794 A1 WO 2020155794A1
Authority
WO
WIPO (PCT)
Prior art keywords
same
timestampb
timestampa
randkeyb
randkeya
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/119482
Other languages
English (en)
French (fr)
Inventor
祝伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Technology Shenzhen Co Ltd
Original Assignee
Ping An Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Technology Shenzhen Co Ltd filed Critical Ping An Technology Shenzhen Co Ltd
Publication of WO2020155794A1 publication Critical patent/WO2020155794A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • This application relates to the technical field of security authentication, and in particular to a method, system and computer equipment for encryption and authentication based on timestamp.
  • the existing security authentication method includes the following steps: 1. The user enters the user name and password; 2. The client uses an asymmetric encryption algorithm (such as RSA, SM2) to encrypt the user's password and then transmits it to the back-end server; 3 , The server decrypts the password according to the asymmetric algorithm, and then verifies the user and password.
  • asymmetric encryption algorithm such as RSA, SM2
  • Security authentication through the above methods has the following risks: if the ciphertext of the user name and encrypted password is leaked, the user can use the ciphertext of the user name and password through the interface to directly defraud the back-end authentication.
  • the main purpose of this application is to provide a timestamp-based encryption and authentication method, system, and computer equipment, which aims to solve the current security authentication method that can use the user name and password to encrypt the ciphertext of the user name and encrypted password. Wen uses the interface to directly deceive the insecure problem of back-end authentication.
  • this application provides a timestamp-based encryption method, which includes the following steps:
  • the front-end obtains an encrypted instruction, the encrypted instruction is generated by the operation of the front-end user;
  • randKey is a random key value generated by the front end, and timestamp is the current timestamp
  • the contactUserID and the contactPassword are respectively encrypted using a public key of an asymmetric encryption algorithm to obtain encryptUserID and encryptPassword.
  • This application also provides a timestamp-based authentication method for decrypting ciphertext encrypted according to the timestamp-based encryption method, including the following steps:
  • the back end receives the encryptUserID and the encryptPassword sent by the front end;
  • timestampA is the same as the timestampB, and the randKeyA is the same as the randKeyB, then authenticate the userID and the Password, and determine whether the authentication is successful;
  • This application also provides a timestamp-based encryption and authentication system, including a front end and a back end;
  • the front end is used to obtain an encrypted instruction, and the encrypted instruction is generated by the operation of the front end user;
  • randKey is a random key value generated by the front end, and timestamp is the current timestamp
  • the back end is configured to receive the encryptUserID and the encryptPassword sent by the front end;
  • timestampA is the same as the timestampB, and the randKeyA is the same as the randKeyB, then authenticate the userID and the Password, and determine whether the authentication is successful;
  • the present application also provides a computer device, including a memory and a processor, and a computer program is stored in the memory, wherein the processor implements the above-mentioned timestamp-based encryption method and/or when the computer program is executed by the processor. Or the steps of any one of the above-mentioned timestamp-based authentication methods.
  • the present application also provides a computer-readable storage medium on which a computer program is stored.
  • the computer program is characterized in that, when the computer program is executed by a processor, the above-mentioned timestamp-based encryption method and/or the timestamp-based encryption method are implemented.
  • the above-mentioned timestamp-based encryption method and/or the timestamp-based encryption method are implemented.
  • the timestamp-based authentication method, system, computer equipment, and storage medium provided in this application generate a random key value randKey at the front end and obtain the current timestamp timestamp, and use randKey and timestamp to splice into an encryptKey, and use a separator to separate the encryptKey with UserID and password are spliced, and encrypted by asymmetric algorithm to obtain encryptUserID and encryptPassword; the back-end uses asymmetric algorithm to reversely analyze encryptUserID and encryptPassword to obtain timestampA, timestampB, randKeyA and randKeyB, and judge the random key value obtained after analysis And the timestamps respectively correspond to the same, if they correspond to the same, then the user name and password are authenticated; by cross-authenticating the random key value and timestamp hidden by encryptUserID and encryptPassword, the security of authentication is improved, so as to avoid the user name and password.
  • Figure 1 is a schematic diagram of the steps of a timestamp-based encryption method in an embodiment of the present application
  • FIG. 2 is a schematic diagram of the steps of a timestamp-based authentication method in an embodiment of the present application
  • Figure 3 is a structural block diagram of a timestamp-based encryption and authentication system in an embodiment of the present application
  • FIG. 4 is a schematic block diagram of the structure of a computer device according to an embodiment of the application.
  • an embodiment of the present application provides a timestamp-based encryption method, which includes the following steps:
  • Step S1 the front-end obtains an encrypted instruction, the aforementioned encrypted instruction is generated by the operation of the front-end user;
  • Step S2 generate a randKey, and obtain a timestamp, where randKey is a random key value generated by the front end, and timestamp is the current timestamp;
  • Step S3 splicing the aforementioned randKey and the aforementioned timestamp through the first preset separator to form an encryptKey
  • Step S4 Obtain userID and password, and join the userID and the encryptKey through a second preset separator to form a contactUserID; join the password and the encryptKey through a third preset separator to form a contactPassword; where userID is User name, password is the password;
  • Step S5 Encrypt the contactUserID and the contactPassword using the public key of an asymmetric encryption algorithm to obtain encryptUserID and encryptPassword.
  • the front-end user of the system sends an encrypted instruction to the front-end by operating the front-end.
  • the encrypted instruction can be automatically generated after the front-end user enters the account name and password, or it can be generated by clicking a specific button. It is generated after the front-end user enters the account name and password and clicks "Submit”.
  • the front end receives the encryption instruction.
  • the front-end can be the front-end part of the security authentication system or the client.
  • the front end randomly generates a UUID, that is, a random key value, and the random key value is called randKey.
  • the front end also obtains the timestamp (current timestamp).
  • the front end splices the generated randKey and the obtained timestamp through the first preset separator to form an encryptKey.
  • the first preset separator such as -, @, #, $, %, & and other characters.
  • the userID (user name) and password (password) are obtained.
  • the time of obtaining the userID and password is not the same as the time when the front-end user inputs the user name and password.
  • the first response of the front-end is to generate an encrypted instruction as described in step S1, and the user name and password in step S1 will not be used immediately.
  • the previously entered userID and password are specifically used. Specifically, the userID and encryptKey are spliced together through the second preset separator to form a contactUserID; the password and encryptKey are spliced together through the third preset separator to form a contactPassword.
  • the functions of the second preset separator and the third preset separator are the same as the above-mentioned first preset separator, and there is no necessary difference or connection.
  • the first preset separator and the second preset separator can be Both the preset separator and the third preset separator are set to "-".
  • the encryptKey obtained through the above steps is 2b162f8e38a045d78ed5606c8bdbea3a-1541057401, and the userID and encryptKey are spliced together by the second preset separator "-" to form a contactUserID of zhangsan-2b162f8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed5606c8e38a045d78ed56
  • the contactUserID is encrypted using the public key of the asymmetric encryption algorithm to obtain the encryptUserID.
  • Asymmetric encryption algorithms mainly include RSA, Elgamal, knapsack algorithm, Rabin, DH and ECC (elliptic curve encryption algorithm).
  • RSA is the most widely used asymmetric encryption algorithm. RSA was developed by Ronald Levist in 1977 ( Ron Rivest), Adi Samer (Adi Shamir) and Leonard Adleman (Leonard Adleman) proposed together that RSA is composed of the initial letters of the three of them.
  • contactUserID (zhangsan-2b162f8e38a045d78ed5606c8bdbea3a-1541057401) is encrypted, to obtain encryptUserId 919A237AA02D7383AA01AB9E64FB6664C3FC129C4C94012AA716FE07F9003FCB765AD81DAA56BA37AC4D06E3C0C9FF4DAC352DE288D437FF4BD1B68B4A322FB8456CC7161D6995847FD57FB99735F45E4B90EBECAB1192B988E30D3AC9A584CD673170B59594138A7669F5B68C8AF6A3304A4970519111D94B603986E57CAFE744FE0E7A9AFCEEA9F6D8769E5C0A6AC1CD
  • Encrypt the contactPassword using the public key of an asymmetric encryption algorithm to obtain encryptPassword.
  • EncryptPassword 74CA36C0DC2C1EB0A285726FC2D58F3038B72916B5CEE7255B1AF27F1680A1FFCAFA6E492DBA1B3264AB6E569E47DF81E5B7F82AF10F9F82B0CD5053FEB9EB04BBD5BFD159EDE9383EF39CDB5778D7127E74E6DAF3227653F162E4F13442C6E711D2478B6773D0BF625C3DF327E9F12303F8E487EB42256D73C0CF6616FA
  • the front end transmits the encryptUserID and encryptPassword obtained after encryption by the asymmetric encryption algorithm to the back end of the system for the back end to perform security authentication.
  • an embodiment of the present application also provides a timestamp-based authentication method, including the following steps:
  • Step S6 the backend receives the encryptUserID and the encryptPassword sent by the frontend;
  • Step S7 Use the private key that matches the public key of the asymmetric encryption algorithm to decrypt the encryptUserID and the encryptPassword, respectively, to obtain the userID, randKeyA, timestampA, the password, randKeyB, and timestampB;
  • Step S8 respectively determining whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same;
  • Step S9 if the timestampA is the same as the timestampB, and the randKeyA is the same as the randKeyB, then the userID and the Password are authenticated, and it is determined whether the authentication is successful;
  • Step S10 if yes, the authentication is passed
  • Step S11 if not, the authentication is not passed.
  • the back-end receives the encryptUserID and encryptPassword transmitted from the front-end, where the back-end may be the back-end server of the system.
  • step S7 use the private key that matches the public key of the above asymmetric encryption algorithm to decrypt the above encryptUserID
  • Private mode module A67DF0337FAF559163BCBA89EE597C2DB0F17CEF87F4E0F476216C44831369504876B78FEB848DFD352BB598615B81C26D1027AC8481116BE40DBA6BD34A92524412936EDA2C6D402D81119DB33F180551DB1762B5F367B0AB319290C546A12B6483F65C55B6BFF19337FDCD79DE78A815725E9AE9FDA48C0FDCEBD6AFD8F9BC1BA254F93D8B189A7C8F6D205C5715B9C82F1EAEC1AA4D7BEE8679D58A0DB8AE4ED24B5B1942EE893BF4B2343D50F5CB38D4C38544D56E1C1877B6629A53BCCEB91B994A
  • userID zhangsan
  • randKeyA 2b162f8e38a045d78ed5606c8bdbea3a
  • timestampA 1541057401.
  • encryptUserID and encryptPassword are derived from the random value randKey generated by the same front-end and the obtained timestamp timestamp, then they are decrypted by the private key that matches the public key of the asymmetric encryption algorithm, and the resulting randKeyA and randKeyB It should be the same, and the timestampA and timestampB obtained should also be the same. If any group is not equal, it means that the encryptUserID and encryptPassword are not generated by the same request, and it is likely to be fabricated. Therefore, in the above step S8, it is determined whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same.
  • step S9 if the judgment result obtained after the above judgment is that timestampA is the same as timestampB, and randKeyA is the same as randKeyB, it means that there is no problem with the encryption of UserID and Password, and encryptUserID and encryptPassword are generated by the same request. Then the userID and the Password are further authenticated, and it is judged whether the authentication is successful. As described in step S10 above, if both the userID and Password pass the authentication, the authentication is passed, thereby allowing the front-end user to enter the back-end/back-end service system to perform related operations. As mentioned in step S11 above, if either of the userID and Password fails the authentication, the authentication is not passed, and a prompt of authentication failure is returned to the front end.
  • This solution generates a random key value randKey on the front end and obtains the current timestamp timestamp, uses randKey and timestamp to splice into an encryptKey, uses a separator to splice the encryptKey with userID and password respectively, and encrypts it through an asymmetric algorithm to obtain encryptUserID and encryptPassword;
  • the back-end uses an asymmetric algorithm to reversely analyze encryptUserID and encryptPassword to obtain timestampA, timestampB, randKeyA, and randKeyB, and judge whether the random key value and timestamp obtained after parsing correspond to the same value.
  • the username and password are Perform authentication; cross-authenticate the hidden random key values and timestamps of encryptUserID and encryptPassword to improve the security of authentication, so as to avoid the leakage of the user name and encrypted password ciphertext, and the user name and password ciphertext are directly defrauded
  • the insecure authentication situation of end authentication improves the security of authentication.
  • step S8 of separately determining whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same the method further includes:
  • Step S801 Obtain a timestampServer, where the above timestampServer is the current time obtained by the backend;
  • Step S802 Calculate the absolute value m of the time difference between the aforementioned timestampServer and the aforementioned imestampA or the aforementioned timestampB;
  • Step S803 judging whether the above-mentioned absolute value m is greater than a set threshold timeThreshold;
  • Step S804 if yes, the authentication is not passed
  • Step S805 if not, generate and execute a command of "respectively judge whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same".
  • the backend obtains the current time timestampServer, and calculates the absolute value m of the time difference between the timestampServer and the timestampA or timestampB. Because here the default timestampA and timestampB are equal to the timestamp generated during the front-end encryption, so by calculating the absolute value m of the time difference between timestampServer and timestampA or timestampB, it is equivalent to calculating the absolute value of the time difference between timestampServer and timestamp.
  • step S803 it is determined whether the absolute value m is greater than the set threshold timeThreshold.
  • step S804 if the absolute value m of the time difference between timestampServer and timestampA or timestampB is greater than the set threshold timeThreshold, it is considered that the time from encryption to authentication and decryption exceeds a reasonable computer processing time, indicating that the ciphertext is possible If it is generated a long time ago, or it may be leaked, the authentication will not be passed, and a prompt of authentication failure will be directly returned to the front end, and the authentication will be ended, thereby improving the safety and effectiveness of the authentication.
  • step S805 if the absolute value m of the time difference between timestampServer and timestampA or timestampB is not greater than the set threshold timeThreshold, it is considered that the time from encryption to authentication and decryption is within a reasonable computer processing time, indicating the ciphertext If the generation time is not suspicious, generate and execute the command "respectively determine whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same", so as to enter the next step to determine whether the timestampA and the timestampB are the same And step S8 of whether the randKeyA and the randKeyB are the same.
  • step S8 of separately determining whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same the method further includes:
  • Step S806 obtain the aforementioned randKey
  • Step S807 Determine whether the above randKey is the same as the above randKeyA or the above randKeyB;
  • Step S808 if not, the authentication is not passed
  • Step S809 if yes, generate and execute a command of "respectively judging whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same".
  • step S806 the back end obtains the randKey transmitted by the front end.
  • the randKey is also transmitted to the back end, so that the back end can obtain the randKey transmitted by the front end for use in the next judgment.
  • randKey is the same as the foregoing randKeyA or the foregoing randKeyB.
  • the backend decrypts the encryptUserID and encryptPassword, it obtains userID, randKeyA, timestampA, the above password, randKeyB, and timestampB. Let us assume that randKeyA and randKeyB are the same. Therefore, the randKey obtained above can be compared with either randKeyA or randKeyB to determine whether they are the same.
  • step S808 if the comparison result of randKey and randKeyA or randKeyB is not the same, it means that the discrete value randKeyA used to generate encryptUserID or the discrete value randKeyB used to generate encryptPassword is not the original randKey generated by the front-end. There may be discrete values that are fabricated or faked. In this case, the authentication is not passed, and the prompt of authentication failure is directly returned to the front end, and the authentication is ended, thereby improving the safety and effectiveness of authentication.
  • randKeyA or randKeyB that generates encryptUserID or encryptPassword is the original randKey generated by the front end.
  • the generation and execution "judge whether the timestampA and the timestampB are the same, the randKeyA and the randKeyB Is the same" command to enter the corresponding authentication step.
  • step S8 of separately determining whether the timestampA and the timestampB are the same, and whether the randKeyA and the randKeyB are the same the method further includes:
  • Step S810 obtain the aforementioned timestamp
  • Step S811 Determine whether the timestamp is the same as the timestampA or timestampB;
  • Step S812 if not, the authentication is not passed
  • the backend obtains the timestamp transmitted by the frontend.
  • the timestamp is also transmitted to the back end, so that the back end can obtain the timestamp transmitted by the front end for use in the next judgment.
  • timestamp is the same as timestampA or timestampB.
  • the backend decrypts the encryptUserID and encryptPassword, it obtains userID, timestampA, timestampA, the above password, timestampB, and timestampB.
  • timestampA is the same as timestampB. Therefore, the timestamp obtained above can be compared with either timestampA or timestampB to determine whether they are the same.
  • step S812 if the comparison result of timestamp and timestampA or timestampB is not the same, it means that the timestamp timestampA used to generate encryptUserID or the timestamp timestampB used to generate encryptPassword is not the timestamp originally generated by the front-end. It may be a fabricated or fake time stamp. In this case, the authentication is not passed, and the prompt of authentication failure is directly returned to the front end, and the authentication is ended, thereby improving the safety and effectiveness of authentication.
  • timestampA for generating encryptUserID or timestampB for generating encryptPassword is the timestamp originally generated by the front end.
  • the generation execution "determines whether the timestampA and timestampB are the same, the timestampA and timestampB are the same. Is the same" command to enter the corresponding authentication step.
  • the method further includes:
  • Step S814 record the number of consecutive authentication failures
  • Step S815 It is judged whether the number of consecutive authentication failures mentioned above reaches a set number of times;
  • step S814 if the result of the authentication is that the authentication is not passed, that is, the authentication fails, the number of consecutive authentication failures is recorded. If any authentication succeeds, the subsequent authentication needs to recalculate the number of consecutive authentication failures. As described in step S8015, it is determined whether the number of consecutive authentication failures reaches a set number, such as 3 or 5 times. As described in step S8016 above, when the number of consecutive authentication failures reaches the set number (for example, 5 times), the authentication work in the subsequent predetermined time period (for example, 1 day) is suspended. In the case of multiple consecutive authentication failures, it may be that someone maliciously attempts to enter the system. Through this solution, the subsequent authentication work within a predetermined time period is suspended to avoid malicious attempts to enter the system and cause losses, and to improve the security of authentication.
  • a set number such as 3 or 5 times.
  • the authentication work in the subsequent predetermined time period for example, 1 day
  • the method includes:
  • step S8017 an early warning is issued to the management personnel.
  • step S8017 if the number of consecutive authentication failures reaches the set number, the subsequent authentication work within the predetermined time period will be suspended, and an early warning reminder will be sent to the manager.
  • the warning reminder can be sent to the manager by means of SMS, etc.
  • a mobile terminal or a fixed monitoring system that you carry with you to remind the management personnel that someone is trying to enter the system (requiring safety certification) illegally, so that the management personnel can know and monitor the relevant situation in time and take measures to avoid losses.
  • the method further includes:
  • Step S8018 Send an instruction to control the front end to turn on the front end camera to shoot the front end operator's portrait to the front end.
  • step S8018 if the number of consecutive authentication failures reaches the set number, then while suspending the subsequent authentication work within the predetermined period of time, send an instruction to control the front-end camera to shoot the front-end operator's portrait to the front-end, open the front-end
  • the camera takes a picture of the front-end operator. Therefore, when someone tries to enter the system illegally, the facial features of the operator are captured, and in case the system is illegally entered, causing losses, it can provide clues for finding the intruder or filing a case for investigation.
  • the front-end operator's avatar captured by shooting can be stored locally or sent to a remote monitoring system for viewing or remote monitoring at any time.
  • an embodiment of the present application also provides a timestamp-based encryption and authentication system, including a front end 10 and a back end 20;
  • the aforementioned front-end 10 is used to obtain encrypted instructions, and the aforementioned encrypted instructions are generated by operations of front-end users;
  • randKey is a random key value generated by the front end, and timestamp is the current timestamp
  • the back end 20 is configured to receive the encryptUserID and the encryptPassword sent by the front end 10;
  • the aforementioned timestampA is the same as the aforementioned timestampB, and the aforementioned randKeyA is the same as the aforementioned randKeyB, then the aforementioned userID and the aforementioned Password are authenticated, and it is determined whether the authentication is successful;
  • an embodiment of the present application also provides a computer device.
  • the computer device may be a server, and its internal structure may be as shown in FIG. 4.
  • the computer equipment includes a processor, a memory, a network interface and a database connected by a system bus. Among them, the computer designed processor is used to provide calculation and control capabilities.
  • the memory of the computer device includes a storage medium and an internal memory.
  • the storage medium may be a volatile storage medium or a non-volatile storage medium.
  • the storage medium stores an operating system, a computer program, and a database.
  • the internal memory provides an environment for the operation of the operating system and computer programs in the storage medium.
  • the database of the computer equipment is used to store the encryptedUserID, encryptPassword, randKey, timestamp and other data transmitted from the front end.
  • the network interface of the computer device is used to communicate with an external terminal through a network connection.
  • the computer program is executed by the processor to implement the above-mentioned timestamp-based encryption method or the timestamp-based authentication method.
  • FIG. 4 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied.
  • An embodiment of the present application further provides a computer-readable storage medium.
  • the computer-readable storage medium may be a volatile computer-readable storage medium or a non-volatile computer-readable storage medium.
  • a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the above-mentioned time-stamp-based encryption method or the above-mentioned time-stamp-based authentication method is implemented.
  • any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and/or volatile memory.
  • Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory.
  • Volatile memory may include random access memory (RAM) or external cache memory.
  • RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

本申请涉及安全认证的技术领域，提供了一种基于时间戳的加密及认证方法、系统、计算机设备和存储介质，通过前端利用randKey和timestamp拼接成encryptKey，将encryptKey分别与userID及password进行拼接，并经过非对称算法进行加密得到encryptUserID和encryptPassword；后端对encryptUserID和encryptPassword进行逆向解析，对隐藏的随机key值及时间戳进行交叉认证，来提高认证的安全性，从而避免因用户名和加密后的密码密文泄露，而通过用户名和密码密文直接骗取后端认证的不安全认证情况，提高认证的安全性。

Description

基于时间戳的加密及认证方法、系统和计算机设备
本申请要求于2019年1月31日提交中国专利局、申请号为201910100423.3，发明名称为“基于时间戳的加密及认证方法、系统和计算机设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及安全认证技术领域，特别涉及一种基于时间戳的加密及认证方法、系统和计算机设备。
 背景技术
现有的安全认证方法包括如下步骤：1、用户输入用户名和密码； 2、客户端采用非对称加密算法（如RSA，SM2），将用户的密码进行加密，然后传入到后端服务器； 3、服务端根据非对称算法解密密码后，然后进行用户和密码的验证。
通过以上方法进行安全认证有以下风险：如果用户名和加密后的密码密文泄露，用户可以拿用户名和密码密文通过接口来直接骗取后端认证。
 技术问题
本申请的主要目的为提供一种基于时间戳的加密及认证方法、系统和计算机设备，旨在解决目前安全认证方法在用户名和加密后的密码密文泄露的情况下，可以拿用户名和密码密文通过接口来直接骗取后端认证的不安全问题。
 技术解决方案
为实现上述目的，本申请提供了一种基于时间戳的加密方法，包括以下步骤：
前端获取加密指令，所述加密指令是由前端用户操作而产生；
产生randKey，并获取timestamp，其中，randKey是前端产生的一个随机key值，timestamp是当前时间戳；
将所述randKey和所述timestamp通过第一预置分隔符拼接起来，形成encryptKey；
获取userID和password，将所述userID和所述encryptKey通过第二预置分隔符拼接起来，形成contactUserID；将所述password与所述encryptKey通过第三预置分隔符拼接起来，形成contactPassword；其中，userID是用户名；
对所述contactUserID和所述contactPassword使用非对称加密算法的公钥分别进行加密，得到encryptUserID和encryptPassword。
本申请还提供了一种基于时间戳的认证方法，用于解密依据所述的基于时间戳的加密方法进行加密的密文，包括以下步骤：
后端接收所述前端发送的所述encryptUserID和所述encryptPassword；
使用与所述非对称加密算法的公钥相匹配的私钥对所述encryptUserID和所述encryptPassword分别进行解密，得到所述userID、randKeyA、timestampA、所述password、randKeyB和timestampB；
分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同；
若所述timestampA与所述timestampB相同，且所述randKeyA与所述randKeyB相同，则对所述userID和所述Password进行认证，并判断是否认证成功；
若是，则予以认证通过；
若否，则不予认证通过。
本申请还提供一种基于时间戳的加密及认证系统，包括前端和后端；
所述前端，用于获取加密指令，所述加密指令是由前端用户操作而产生；
产生randKey，并获取timestamp，其中，randKey是前端产生的一个随机key值，timestamp是当前时间戳；
将所述randKey和所述timestamp通过第一预置分隔符拼接起来，形成encryptKey；
获取userID和password，将所述userID和所述encryptKey通过第二预置分隔符拼接起来，形成contactUserID；将所述password与所述encryptKey通过第三预置分隔符拼接起来，形成contactPassword；其中，userID是用户名，password是密码；
对所述contactUserID和所述contactPassword使用非对称加密算法分别进行加密，得到encryptUserID和encryptPassword；
所述后端，用于接收所述前端发送的所述encryptUserID和所述encryptPassword；
使用与所述非对称加密算法的公钥相匹配的私钥对所述encryptUserID和所述encryptPassword分别进行解密，得到所述userID、randKeyA、timestampA、所述password、randKeyB和timestampB；
分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同；
若所述timestampA与所述timestampB相同，且所述randKeyA与所述randKeyB相同，则对所述userID和所述Password进行认证，并判断是否认证成功；
若是，则予以认证通过；
若否，则不予认证通过。
本申请还提供一种计算机设备，包括存储器和处理器，所述存储器中存储有计算机程序，其特征在于，所述处理器执行所述计算机程序时实现上述所述基于时间戳的加密方法和/或所述基于时间戳的认证方法中任一项所述方法的步骤。
本申请还提供一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现上述所述基于时间戳的加密方法和/或所述基于时间戳的认证方法中任一项所述的方法的步骤。
 有益效果
本申请中提供的基于时间戳的认证方法、系统、计算机设备和存储介质，通过在前端产生随机key值randKey并获取当前时间戳timestamp，利用randKey和timestamp拼接成encryptKey，利用分隔符将encryptKey分别与userID及password进行拼接，并经过非对称算法进行加密得到encryptUserID和encryptPassword；后端通过非对称算法对encryptUserID和encryptPassword进行逆向解析，获得timestampA、timestampB、randKeyA和randKeyB，判断解析后所得到的随机key值及时间戳是否分别对应相等，如果分别对应相等，再对用户名和密码进行认证；通过对encryptUserID和encryptPassword隐藏的随机key值及时间戳进行交叉认证，来提高认证的安全性，从而避免因用户名和加密后的密码密文泄露，而通过用户名和密码密文直接骗取后端认证的不安全认证情况，提高认证的安全性。
 附图说明
图1 是本申请一实施例中基于时间戳的加密方法步骤示意图；
图2是本申请一实施例中基于时间戳的认证方法步骤示意图；
图3 是本申请一实施例中基于时间戳的加密及认证系统结构框图；
图4 为本申请一实施例的计算机设备的结构示意框图。
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
 本发明的最佳实施方式
参照图1，本申请一实施例中提供了一种基于时间戳的加密方法，包括以下步骤：
步骤S1，前端获取加密指令，上述加密指令是由前端用户操作而产生；
步骤S2，产生randKey，并获取timestamp，其中，randKey是前端产生的一个随机key值，timestamp是当前时间戳；
步骤S3，将上述randKey和上述timestamp通过第一预置分隔符拼接起来，形成encryptKey；
步骤S4，获取userID和password，将上述userID和上述encryptKey通过第二预置分隔符拼接起来，形成contactUserID；将上述password与上述encryptKey通过第三预置分隔符拼接起来，形成contactPassword；其中，userID是用户名，password是密码；
步骤S5，对上述contactUserID和上述contactPassword使用非对称加密算法的公钥分别进行加密，得到encryptUserID和encryptPassword。
如上述步骤S1所述，系统的前端用户通过操作前端，向前端发出加密指令，该加密指令可以是在前端用户输入账户名和密码后自动产生，也可以是在点击某具体的按键而产生，一般是前端用户输入账户名和密码并点击“提交”后产生。前端接收该加密指令。其中，前端可以是安全认证系统的前端部分，也可以是客户端。
如上述步骤S2所述，前端接收到加密指令后，随机生成一个UUID，也即随机key值，把该随机key值称为randKey。同时，前端还获取到timestamp（当前时间戳）。然后，如上述步骤S3所述，前端将生成的randKey和获取的timestamp通过第一预置分隔符拼接起来，形成encryptKey。其中，第一预置分隔符如-、@、#、$、%、&等字符。例如，将randKey(2b162f8e38a045d78ed5606c8bdbea3a)与当前时间戳timestamp（1541057401）通过第一预置分隔符“-”进行拼接，得到encryptKey=2b162f8e38a045d78ed5606c8bdbea3a-1541057401。
如上述步骤S4所述，获取userID（用户名）和password（密码），这里获取userID和password的时间点与前端用户输入用户名和密码的时间并不是同时的。实际上，前端用户输入用户名和密码后，前端的第一个响应就是产生如步骤S1所述的加密指令，而在步骤S1中用户名和密码并不会马上被使用。在步骤S4中，先前输入的userID和password才被具体使用。具体为，将userID和encryptKey通过第二预置分隔符拼接起来，形成contactUserID；将password与encryptKey通过第三预置分隔符拼接起来，形成contactPassword。其中，第二预置分隔符、第三预置分隔符与上述第一预置分隔符的作用是相同的，并不存在必然的区别或联系，可以将第一预置分隔符、第二预置分隔符和第三预置分隔符均设置为“-”。
例如：获取到用户输入的userID为zhangsan，通过以上步骤得到encryptKey为2b162f8e38a045d78ed5606c8bdbea3a-1541057401，将userID和encryptKey通过第二预置分隔符“-”拼接起来，形成的contactUserID为zhangsan-2b162f8e38a045d78ed5606c8bdbea3a-1541057401，表示为contactUserID=zhangsan-2b162f8e38a045d78ed5606c8bdbea3a-1541057401。获取到用户输入的password为123456，将password和encryptKey通过第三预置分隔符“-”拼接起来，形成的contactPassword为123456-2b162f8e38a045d78ed5606c8bdbea3a-1541057401，表示为contactPassword=123456-2b162f8e38a045d78ed5606c8bdbea3a-1541057401。
如上述步骤S5所述，对contactUserID使用非对称加密算法的公钥进行加密，得到encryptUserID。非对称加密算法主要包括RSA、Elgamal、背包算法、Rabin、D-H和ECC（椭圆曲线加密算法），其中，RSA是使用最广泛的非对称加密算法，RSA是1977年由罗纳德·李维斯特（Ron Rivest）、阿迪·萨莫尔（Adi Shamir）和伦纳德·阿德曼（Leonard Adleman）一起提出的，RSA是由他们三人姓氏开头字母拼在一起组成的。
例如：RSA非对称加密算法的公钥
公钥指数pubExp:10001；
公钥模module:A67DF0337FAF559163BCBA89EE597C2DB0F17CEF87F4E0F476216C44831369504876B78FEB848DFD352BB598615B81C26D1027AC8481116BE40DBA6BD34A92524412936EDA2C6D402D81119DB33F180551DB1762B5F367B0AB319290C546A12B6483F65C55B6BFF19337FDCD79DE78A815725E9AE9FDA48C0FDCEBD6AFD8F9BC1BA254F93D8B189A7C8F6D205C5715B9C82F1EAEC1AA4D7BEE8679D58A0DB8AE4ED24B5B1942EE893BF4B2343D50F5CB38D4C38544D56E1C1877B6629A53BCCEB91B994A316BFE408E93359B3DDD3DDA4C96A26433C62A9E4C7332ADABDF148B6593B3F37621E921B21CF9B4D9AE9344D827C286F5671D0F3B582C5FEFCD4467。
使用上述RSA非对称加密算法的公钥，对contactUserID（zhangsan-2b162f8e38a045d78ed5606c8bdbea3a-1541057401）进行加密，得到encryptUserID为919A237AA02D7383AA01AB9E64FB6664C3FC129C4C94012AA716FE07F9003FCB765AD81DAA56BA37AC4D06E3C0C9FF4DAC352DE288D437FF4BD1B68B4A322FB8456CC7161D6995847FD57FB99735F45E4B90EBECAB1192B988E30D3AC9A584CD673170B59594138A7669F5B68C8AF6A3304A4970519111D94B603986E57CAFE744FE0E7A9AFCEEA9F6D8769E5C0A6AC1CD96B1861A26918D29A2D85C467885816FB69F4169E305B29BAA75073794C3D21878BCEE5A5C3CF0F7E51813E66BE6C5B01D9DF88AC8E93508B8164612CA59DE86856AC9466347D1B687BDC48A358D61933F6623643B4A26868DBB79CAD6DBA000ADC8DAFF9E10A43D0BD5630F5EDE1D，表示为encryptUserID=919A237AA02D7383AA01AB9E64FB6664C3FC129C4C94012AA716FE07F9003FCB765AD81DAA56BA37AC4D06E3C0C9FF4DAC352DE288D437FF4BD1B68B4A322FB8456CC7161D6995847FD57FB99735F45E4B90EBECAB1192B988E30D3AC9A584CD673170B59594138A7669F5B68C8AF6A3304A4970519111D94B603986E57CAFE744FE0E7A9AFCEEA9F6D8769E5C0A6AC1CD96B1861A26918D29A2D85C467885816FB69F4169E305B29BAA75073794C3D21878BCEE5A5C3CF0F7E51813E66BE6C5B01D9DF88AC8E93508B8164612CA59DE86856AC9466347D1B687BDC48A358D61933F6623643B4A26868DBB79CAD6DBA000ADC8DAFF9E10A43D0BD5630F5EDE1D。
对contactPassword使用非对称加密算法的公钥进行加密，得到encryptPassword。同样，使用上述RSA非对称加密算法的公钥，对contactPassword（123456-2b162f8e38a045d78ed5606c8bdbea3a-1541057401）进行加密，得到encryptPassword为74CA36C0DC2C1EB0A285726FC2D58F3038B72916B5CEE7255B1AF27F1680A1FFCAFA6E492DBA1B3264AB6E569E47DF81E5B7F82AF10F9F82B0CD5053FEB9EB04BBD5BFD159EDE9383EF39CDB5778D7127E74E6DAF3227653F162E4F13442C6E711D2478B6773D0BF625C3DF327E9F12303F8E487EB42256D73C0CF6616FA74594C988D070E1FBEB5097313F81E9D730B32AC9AFCEAD0D95EA64D497B15BB64AECD61078B341EA54031211D09233893825B48EE57DB7E0FA16A5AD3C32CE8B3A7D359676D88309166FB838C66E8F556DCA751D557C62607D5E318A629A12DF0BF07BF1C5C09FD97A0B3BDEAE9A5308D4080454511B526D77F62FFC7CCEBC6B5E4，表示为encryptPassword=74CA36C0DC2C1EB0A285726FC2D58F3038B72916B5CEE7255B1AF27F1680A1FFCAFA6E492DBA1B3264AB6E569E47DF81E5B7F82AF10F9F82B0CD5053FEB9EB04BBD5BFD159EDE9383EF39CDB5778D7127E74E6DAF3227653F162E4F13442C6E711D2478B6773D0BF625C3DF327E9F12303F8E487EB42256D73C0CF6616FA74594C988D070E1FBEB5097313F81E9D730B32AC9AFCEAD0D95EA64D497B15BB64AECD61078B341EA54031211D09233893825B48EE57DB7E0FA16A5AD3C32CE8B3A7D359676D88309166FB838C66E8F556DCA751D557C62607D5E318A629A12DF0BF07BF1C5C09FD97A0B3BDEAE9A5308D4080454511B526D77F62FFC7CCEBC6B5E4。
前端将上述通过非对称加密算法进行加密后所得的encryptUserID和encryptPassword传输到系统的后端，供后端进行安全认证。
参照图2，本申请一实施例中还提供了一种基于时间戳的认证方法，包括以下步骤：
步骤S6，后端接收所述前端发送的上述encryptUserID和上述encryptPassword；
步骤S7，使用与上述非对称加密算法的公钥相匹配的私钥对上述encryptUserID和上述encryptPassword分别进行解密，得到上述userID、randKeyA、timestampA、上述password、randKeyB和timestampB；
步骤S8，分别判断上述timestampA与上述timestampB是否相同，上述randKeyA与上述randKeyB是否相同；
步骤S9，若上述timestampA与上述timestampB相同，且上述randKeyA与上述randKeyB相同，则对上述userID和上述Password进行认证，并判断是否认证成功；
步骤S10，若是，则予以认证通过；
步骤S11，若否，则不予认证通过。
如上述步骤S6所述，后端接收前端传输过来的encryptUserID和encryptPassword，其中，后端可以是系统的后台服务器。
如上述步骤S7所述，使用与上述非对称加密算法的公钥相匹配的私钥对上述encryptUserID进行解密
私钥指数priExp:245358043478B1E7BDE620A115930AA801723EFB1823D2AD23D519053DC00F7B47C4373ABC7D3869A59F3AC8DB7D16ABB0161541EBCB295CEBEE1EDD85C54075988AA1064FADDFCC5FE14851AB193A097719A159952F5D514B98CE4CADEE421DF0996638312F6563B4E64387006F0CCE4797A3929339171CC41D448B9BE4706042D0B042D5C72D550C89699E745C5B6A3C2BC8D8175A5319D41338C67304593C826F1898BC5C153B831102476F2C7600FBD8222F43614B60CB857B7D912303E33BCCE56F661CADF55AE9F0D905AFB2FA62ECC1D32AF08A79AC9F211D29388083309C9CF23F76594D0F1A5138B1687E57DE7901967AD74FA5C104F1AFB5C0C151；
私钥模module: A67DF0337FAF559163BCBA89EE597C2DB0F17CEF87F4E0F476216C44831369504876B78FEB848DFD352BB598615B81C26D1027AC8481116BE40DBA6BD34A92524412936EDA2C6D402D81119DB33F180551DB1762B5F367B0AB319290C546A12B6483F65C55B6BFF19337FDCD79DE78A815725E9AE9FDA48C0FDCEBD6AFD8F9BC1BA254F93D8B189A7C8F6D205C5715B9C82F1EAEC1AA4D7BEE8679D58A0DB8AE4ED24B5B1942EE893BF4B2343D50F5CB38D4C38544D56E1C1877B6629A53BCCEB91B994A316BFE408E93359B3DDD3DDA4C96A26433C62A9E4C7332ADABDF148B6593B3F37621E921B21CF9B4D9AE9344D827C286F5671D0F3B582C5FEFCD4467；
解密后得到userID=zhangsan；randKeyA=2b162f8e38a045d78ed5606c8bdbea3a；timestampA= 1541057401。
使用与上述非对称加密算法的公钥相匹配的私钥对上述encryptPassword进行解密，解密后得到password=1541057401；randKeyB=2b162f8e38a045d78ed5606c8bdbea3a；timestampB=1541057401。
如果是由同一前端所生成的随机值randKey和获取的时间戳timestamp而得来的encryptUserID和encryptPassword，那么它们经过与上述非对称加密算法的公钥相匹配的私钥解密后，所得的randKeyA与randKeyB应该是相同的，所得的timestampA与timestampB也应该是相同的，如果有任一组不相等，则说明是encryptUserID和encryptPassword不是同一请求产生，很有可能是编造的。所以，在上述步骤S8中，分别判断上述timestampA与上述timestampB是否相同，上述randKeyA与上述randKeyB是否相同。
如上述步骤S9所述，如果经过经过以上判断得出的判断结果是，timestampA与timestampB相同，且randKeyA与randKeyB相同，则说明对于UserID和Password的加密没有问题，encryptUserID和encryptPassword是同一请求所产生，则进一步对userID和所述Password进行认证，并判断是否认证成功。如上述步骤S10所述，如果userID和Password，均通过认证，则予以认证通过，从而允许前端用户进入后端/后台服务系统进行相关操作。如上述步骤S11所述，如果userID和Password，任一个没有通过认证，则不予认证通过，向前端返回认证失败的提示。
本方案通过在前端产生随机key值randKey并获取当前时间戳timestamp，利用randKey和timestamp拼接成encryptKey，利用分隔符将encryptKey分别与userID及password进行拼接，并经过非对称算法进行加密得到encryptUserID和encryptPassword；后端通过非对称算法对encryptUserID和encryptPassword进行逆向解析，获得timestampA、timestampB、randKeyA和randKeyB，判断解析后所得到的随机key值及时间戳是否分别对应相等，如果分别对应相等，再对用户名和密码进行认证；通过对encryptUserID和encryptPassword隐藏的随机key值及时间戳进行交叉认证，来提高认证的安全性，从而避免因用户名和加密后的密码密文泄露，而通过用户名和密码密文直接骗取后端认证的不安全认证情况，提高认证的安全性。
在一实施例中，上述分别判断上述timestampA与上述timestampB是否相同，上述randKeyA与上述randKeyB是否相同的步骤S8之前，还包括：
步骤S801，获取timestampServer，上述timestampServer是后端获取的当前时间；
步骤S802，计算上述timestampServer与上述imestampA或上述timestampB时间差值的绝对值m；
步骤S803，判断上述绝对值m是否大于设定阈值timeThreshold；
步骤S804，若是，则不予认证通过；
步骤S805，若否，则生成执行“分别判断上述timestampA与所述timestampB是否相同，上述randKeyA与上述randKeyB是否相同”的命令。
为了进一步保证认证的安全，可以在对encryptUserID和encryptPassword解析之后，判断前端时间戳timestamp与后端当前时间timestampServer的差值是否在合理的范围内，这里姑且认为前端时间戳timestamp与解析encryptUserID所得的timestampA及解析encryptPassword所得的timestampB是相同的。
如上述步骤S801和步骤S802所述，后端获取当前时间timestampServer，计算上述timestampServer与上述timestampA或上述timestampB时间差值的绝对值m。因为这里默认timestampA和timestampB都是等于前端加密时生成的timestamp，所以，通过计算timestampServer与timestampA或timestampB任一个时间差值的绝对值m，即相当于计算了timestampServer与timestamp时间差值的绝对值，算式可表示为m=Math.abs(timestampServer-timestamp)。
如上述步骤S803所述，判断上述绝对值m是否大于设定阈值timeThreshold，设定阈值timeThreshold是是根据前端生成时间戳timstamp对用户名userID和密码Password进行加密到认证服务端对加密后的encryptUserID和encryptPassword进行解密所需要的合理的计算机处理时间，如timeThreshold=60秒。
如上述步骤S804所述，如果timestampServer与timestampA或timestampB任一个时间差值的绝对值m大于设定阈值timeThreshold，则认为从加密到认证解密的时间超过了合理的计算机处理时间，说明密文有可能是很早之前产生的，也有可能是泄露了，则不予认证通过，直接向前端返回认证失败的提示，并结束认证，从而提高认证的安全有效。
如上述步骤S805所述，如果timestampServer与timestampA或timestampB任一个时间差值的绝对值m不大于设定阈值timeThreshold，则认为从加密到认证解密的时间在合理的计算机处理时间内，说明密文的产生时间没有可疑性，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令，从而进入下一步的判断所述timestampA与所述timestampB是否相同以及所述randKeyA与所述randKeyB是否相同的步骤S8。
在一实施例中，上述分别判断上述timestampA与上述timestampB是否相同，上述randKeyA与上述randKeyB是否相同的步骤S8之前，还包括：
步骤S806，获取上述randKey；
步骤S807，判断上述randKey是否与上述randKeyA或上述randKeyB相同；
步骤S808，若否，则不予认证通过；
步骤S809，若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
为了进一步确保生成encryptUserID和encryptPassword所用的离散值是前端所产生离散值，从而保证认证的安全性，可通过判断对encryptUserID和encryptPassword解密后所得的randKeyA或randKeyB是否与前端原本所生成randKey相同的方式来认证。如上述步骤S806所述，后端获取前端传送的randKey。可以在前端传输encryptUserID和encryptPassword时，将randKey也一同传输给后端，从而后端可以获取前端传送的randKey，以备下一步的判断使用。
如上述步骤S807所述，判断上述randKey是否与上述randKeyA或上述randKeyB相同。后端对encryptUserID和encryptPassword解密之后，得到userID、randKeyA、timestampA、上述password、randKeyB和timestampB，这里姑且认为randKeyA与randKeyB相同。所以，可以将上述获取的randKey与randKeyA或randKeyB任一个进行对比，判断是否相同。
如上述步骤S808所述，如果randKey与randKeyA或randKeyB的对比结果是不相同，则说明用于生成encryptUserID的离散值randKeyA或用于生成encryptPassword的离散值randKeyB不是前端原始生成的randKey，也就说明很有可能是编造或假冒的离散值。在这种情况下，不予认证通过，直接向前端返回认证失败的提示，并结束认证，从而提高认证的安全有效。
如上述步骤S809所述，如果randKey与randKeyA或randKeyB的对比结果是相同，则说明生成encryptUserID或encryptPassword的randKeyA或randKeyB是前端原始生成的randKey。在这种情况下，认为用于生成encryptUserID的离散值randKeyA或用于生成encryptPassword的离散值randKeyB没有问题，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令，从而进入对应的认证步骤。
在一实施例中，上述分别判断上述timestampA与上述timestampB是否相同，上述randKeyA与上述randKeyB是否相同的步骤S8之前，还包括：
步骤S810，获取上述timestamp；
步骤S811，判断上述timestamp是否与上述timestampA或上述timestampB相同；
步骤S812，若否，则不予认证通过；
步骤S813，若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
为了进一步确保生成encryptUserID和encryptPassword所用的时间戳是前端所产生时间戳，从而保证认证的安全性，可通过判断对encryptUserID和encryptPassword解密后所得的timestampA或timestampB是否与前端原本所获取timestamp相同的方式来认证。如上述步骤S810所述，后端获取前端传送的timestamp。可以在前端传输encryptUserID和encryptPassword时，将timestamp也一同传输给后端，从而后端可以获取前端传送的timestamp，以备下一步的判断使用。
如上述步骤S811所述，判断timestamp是否与timestampA或timestampB相同。后端对encryptUserID和encryptPassword解密之后，得到userID、timestampA、timestampA、上述password、timestampB和timestampB，这里姑且认为timestampA与timestampB相同。所以，可以将上述获取的timestamp与timestampA或timestampB任一个进行对比，判断是否相同。
如上述步骤S812所述，如果timestamp与timestampA或timestampB的对比结果是不相同，则说明用于生成encryptUserID的时间戳timestampA或用于生成encryptPassword的时间戳timestampB不是前端原始生成的timestamp，也就说明很有可能是编造或假冒的时间戳。在这种情况下，不予认证通过，直接向前端返回认证失败的提示，并结束认证，从而提高认证的安全有效。
如上述步骤S813所述，如果timestamp与timestampA或timestampB的对比结果是相同，则说明生成encryptUserID的timestampA或生成encryptPassword的timestampB是前端原始生成的timestamp。在这种情况下，认为用于生成encryptUserID的时间戳timestampA或用于生成encryptPassword的时间戳timestampB没有问题，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述timestampA与所述timestampB是否相同”的命令，从而进入对应的认证步骤。
在一个实施例中，上述不予认证通过的步骤S11、S804、S808或S812之后，还包括：
步骤S814，记录连续认证失败的次数；
步骤S815，判断上述连续认证失败的次数是否达到设定次数；
步骤S816，若是，则暂停后续预设时间内的认证工作。
如上述步骤S814所述，如果认证的结果是不予认证通过，即认证失败，则记录连续认证失败的次数，任何一次认证成功，则后续认证需重新计算连续认证失败的次数。如上述步骤S8015所述，判断上述连续认证失败的次数是否达到设定次数，设定次数如3次或5次等。如上述步骤S8016所述，当连续认证失败的次数达到设定次数（如5次），则暂停后续预定时间段（如1天）内的认证工作。出现连续多次认证失败的情况，可能是有人恶意尝试进入系统，通过这种本方案暂停后续预定时间段内的认证工作，避免恶意尝试进入系统，而造成损失，提高认证的安全性。
在一实施例中，上述暂停后续预设时间内的认证工作的步骤S8016之后，包括：
步骤S8017，向管理人员发出预警提示。
如上述步骤S8017所述，如果连续认证失败的次数是否达到设定次数，则暂停后续预定时间段内的认证工作的同时，向管理人员发出预警提示，预警提示可以通过短信等方式发送至管理人员随身携带的移动终端或固定的监视系统，从而提醒管理人员，有人试图非法进入该（需安全认证的）系统，方便管理人员及时知晓和监视相关情况并采取措施，避免产生损失。
在一实施例中，上述暂停后续预设时间内的认证工作的步骤S8016之后，还包括：
步骤S8018，发送控制上述打开所述前端的摄像头拍摄所述前端的操作者头像的指令给所述前端。
如步骤S8018所述，如果连续认证失败的次数是否达到设定次数，则暂停后续预定时间段内的认证工作的同时，发送控制打开前端的摄像头拍摄前端的操作者头像的指令给前端，打开前端摄像头，拍摄前端操作者头像。从而，在有人试图非法进入系统时，抓取操作者面部特征，在系统万一被非法进入，造成损失的情况下，为查找侵入系统者或立案调查等提供线索。拍摄获取的前端操作者头像，可以储存在本地，也可以发送至远端监控系统，以备随时查看或远端监视。
参照图3，本申请一实施例中还提供了一种基于时间戳的加密及认证系统，包括前端10和后端20；
上述前端10，用于获取加密指令，上述加密指令是由前端用户操作而产生；
生成randKey，并获取timestamp，其中，randKey是前端产生的一个随机key值，timestamp是当前时间戳；
将上述randKey和所述timestamp通过第一预置分隔符拼接起来，形成encryptKey；
获取userID和password，将上述userID和上述encryptKey通过第二预置分隔符拼接起来，形成contactUserID；将上述password与上述encryptKey通过第三预置分隔符拼接起来，形成contactPassword；其中，userID是用户名；
对上述contactUserID和上述contactPassword使用非对称加密算法分别进行加密，得到encryptUserID和encryptPassword；
将上述encryptUserID和上述encryptPassword传输到后端；
上述后端20，用于接收上述前端10发送的上述encryptUserID和上述encryptPassword；
使用与上述非对称加密算法的公钥相匹配的私钥对上述encryptUserID和上述encryptPassword分别进行解密，得到上述userID、randKeyA、timestampA、上述password、randKeyB和timestampB，上述后端预先配置所述私钥；
分别判断上述timestampA与上述timestampB是否相同，上述randKeyA与上述randKeyB是否相同；
若上述timestampA与上述timestampB相同，且上述randKeyA与上述randKeyB相同，则对上述userID和上述Password进行认证，并判断是否认证成功；
若是，则予以认证通过；
若否，则不予认证通过。
参照图4，本申请实施例中还提供一种计算机设备，该计算机设备可以是服务器，其内部结构可以如图4所示。该计算机设备包括通过系统总线连接的处理器、存储器、网络接口和数据库。其中，该计算机设计的处理器用于提供计算和控制能力。该计算机设备的存储器包括存储介质、内存储器，所述存储介质可以是易失性存储介质，也可以是非易失性存储介质。该存储介质存储有操作系统、计算机程序和数据库。该内存储器为存储介质中的操作系统和计算机程序的运行提供环境。该计算机设备的数据库用于存储前端传输来的encryptUserID、encryptPassword、randKey、timestamp等数据。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该计算机程序被处理器执行时以实现一种上述基于时间戳的加密方法或基于时间戳的认证方法。
本领域技术人员可以理解，图4中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定。
本申请一实施例还提供一种计算机可读存储介质，该计算机可读存储介质可以是易失性计算机可读存储介质，也可以是非易失性计算机可读存储介质。计算机可读存储介质上存储有计算机程序，计算机程序被处理器执行时实现上述一种基于时间戳的加密方法或上述一种基于时间戳的认证方法。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，上述的计算机程序可存储与一存储介质中，该存储介质可以是非易性存储介质，也可以是非易失性存储介质，该计算机程序在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的和实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和/或易失性存储器。非易失性存储器可以包括只读存储器（ROM）、可编程ROM（PROM）、电可编程ROM（EPROM）、电可擦除可编程ROM（EEPROM）或闪存。易失性存储器可包括随机存取存储器（RAM）或者外部高速缓冲存储器。作为说明而非局限，RAM通过多种形式可得，诸如静态RAM（SRAM）、动态RAM（DRAM）、同步DRAM（SDRAM）、双速据率SDRAM（SSRSDRAM）、增强型SDRAM（ESDRAM）、同步链路（Synchlink）DRAM（SLDRAM）、存储器总线（Rambus）直接RAM（RDRAM）、直接存储器总线动态RAM（DRDRAM）、以及存储器总线动态RAM（RDRAM）等。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其它变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、装置、物品或者方法不仅包括那些要素，而且还包括没有明确列出的其它要素，或者是还包括为这种过程、装置、物品或者方法所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、装置、物品或者方法中还存在另外的相同要素。
以上所述仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其它相关的技术领域，均同理包括在本申请的专利保护范围内。

Claims (20)

  1. 一种基于时间戳的加密方法，其特征在于，包括以下步骤：
    前端获取加密指令，所述加密指令是由前端用户操作而产生；
    生成randKey，并获取timestamp，其中，randKey是前端产生的一个随机key值，timestamp是当前时间戳；
    将所述randKey和所述timestamp通过第一预置分隔符拼接起来，形成encryptKey；
    获取userID和password，将所述userID和所述encryptKey通过第二预置分隔符拼接起来，形成contactUserID；将所述password与所述encryptKey通过第三预置分隔符拼接起来，形成contactPassword；其中，userID是用户名，password是密码；
    对所述contactUserID和所述contactPassword使用非对称加密算法的公钥分别进行加密，得到encryptUserID和encryptPassword。
  2. 一种基于时间戳的认证方法，用于解密依据如权利要求1所述的基于时间戳的加密方法进行加密的密文，其特征在于，包括以下步骤：
    后端接收所述前端发送的所述encryptUserID和所述encryptPassword；
    使用与所述非对称加密算法的公钥相匹配的私钥对所述encryptUserID和所述encryptPassword分别进行解密，得到所述userID、randKeyA、timestampA、所述password、randKeyB和timestampB；
    分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同；
    若所述timestampA与所述timestampB相同，且所述randKeyA与所述randKeyB相同，则对所述userID和所述Password进行认证，并判断是否认证成功；
    若是，则予以认证通过；
    若否，则不予认证通过。
  3. 根据权利要求2所述的基于时间戳的认证方法，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取timestampServer，所述timestampServer是后端获取的当前时间；
    计算所述timestampServer与所述imestampA或所述timestampB时间差值的绝对值m；
    判断所述绝对值m是否大于设定阈值timeThreshold；
    若是，则不予认证通过；
    若否，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  4. 根据权利要求2所述的基于时间戳的认证方法，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取所述randKey；
    判断所述randKey是否与所述randKeyA或所述randKeyB相同；
    若否，则不予认证通过；
    若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  5. 根据权利要求2所述的基于时间戳的认证方法，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取所述timestamp；
    判断所述timestamp是否与所述timestampA或所述timestampB相同；
    若否，则不予认证通过；
    若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  6. 根据权利要求2所述的基于时间戳的认证方法，其特征在于，所述不予认证通过的步骤之后，还包括：
    记录连续认证失败的次数；
    判断所述连续认证失败的次数是否达到设定次数；
    若是，则暂停后续预设时间内的认证工作。
  7. 根据权利要求6所述的基于时间戳的认证方法，其特征在于，所述暂停后续预设时间内的认证工作的步骤之后，还包括：
    发送控制所述前端的摄像头拍摄所述前端的操作者头像的指令给所述前端。
  8. 一种基于时间戳的加密及认证系统，其特征在于，包括前端和后端；
    所述前端，用于获取加密指令，所述加密指令是由前端用户操作而产生；
    生成randKey，并获取timestamp，其中，randKey是前端产生的一个随机key值，timestamp是当前时间戳；
    将所述randKey和所述timestamp通过第一预置分隔符拼接起来，形成encryptKey；
    获取userID和password，将所述userID和所述encryptKey通过第二预置分隔符拼接起来，形成contactUserID；将所述password与所述encryptKey通过第三预置分隔符拼接起来，形成contactPassword；其中，userID是用户名；
    对所述contactUserID和所述contactPassword使用非对称加密算法分别进行加密，得到encryptUserID和encryptPassword；
    所述后端，用于接收所述前端发送的所述encryptUserID和所述encryptPassword；
    使用与所述非对称加密算法的公钥相匹配的私钥对所述encryptUserID和所述encryptPassword分别进行解密，得到所述userID、randKeyA、timestampA、所述password、randKeyB和timestampB；
    分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同；
    若所述timestampA与所述timestampB相同，且所述randKeyA与所述randKeyB相同，则对所述userID和所述Password进行认证，并判断是否认证成功；
    若是，则予以认证通过；
    若否，则不予认证通过。
  9. 一种计算机设备，包括存储器和处理器，所述存储器中存储有计算机程序，其特征在于，所述处理器执行一种基于时间戳的认证方法，该方法用于解密依据如权利要求1所述的基于时间戳的加密方法进行加密的密文，包括如下步骤：
    后端接收所述前端发送的所述encryptUserID和所述encryptPassword；
    使用与所述非对称加密算法的公钥相匹配的私钥对所述encryptUserID和所述encryptPassword分别进行解密，得到所述userID、randKeyA、timestampA、所述password、randKeyB和timestampB；
    分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同；
    若所述timestampA与所述timestampB相同，且所述randKeyA与所述randKeyB相同，则对所述userID和所述Password进行认证，并判断是否认证成功；
    若是，则予以认证通过；
    若否，则不予认证通过。
  10. 如权利要求9所述的计算机设备，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取timestampServer，所述timestampServer是后端获取的当前时间；
    计算所述timestampServer与所述imestampA或所述timestampB时间差值的绝对值m；
    判断所述绝对值m是否大于设定阈值timeThreshold；
    若是，则不予认证通过；
    若否，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  11. 如权利要求9所述的计算机设备，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取所述randKey；
    判断所述randKey是否与所述randKeyA或所述randKeyB相同；
    若否，则不予认证通过；
    若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  12. 如权利要求9所述的计算机设备，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取所述timestamp；
    判断所述timestamp是否与所述timestampA或所述timestampB相同；
    若否，则不予认证通过；
    若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  13. 如权利要求9所述的计算机设备，其特征在于，所述不予认证通过的步骤之后，还包括：
    记录连续认证失败的次数；
    判断所述连续认证失败的次数是否达到设定次数；
    若是，则暂停后续预设时间内的认证工作。
  14. 如权利要求13所述的计算机设备，其特征在于，所述暂停后续预设时间内的认证工作的步骤之后，还包括：
    发送控制所述前端的摄像头拍摄所述前端的操作者头像的指令给所述前端。
  15. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现一种基于时间戳的认证方法，该方法用于解密依据如权利要求1所述的基于时间戳的加密方法进行加密的密文，包括如下步骤：
    后端接收所述前端发送的所述encryptUserID和所述encryptPassword；
    使用与所述非对称加密算法的公钥相匹配的私钥对所述encryptUserID和所述encryptPassword分别进行解密，得到所述userID、randKeyA、timestampA、所述password、randKeyB和timestampB；
    分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同；
    若所述timestampA与所述timestampB相同，且所述randKeyA与所述randKeyB相同，则对所述userID和所述Password进行认证，并判断是否认证成功；
    若是，则予以认证通过；
    若否，则不予认证通过。
  16. 如权利要求15所述的计算机可读存储介质，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取timestampServer，所述timestampServer是后端获取的当前时间；
    计算所述timestampServer与所述imestampA或所述timestampB时间差值的绝对值m；
    判断所述绝对值m是否大于设定阈值timeThreshold；
    若是，则不予认证通过；
    若否，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  17. 如权利要求15所述的计算机可读存储介质，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取所述randKey；
    判断所述randKey是否与所述randKeyA或所述randKeyB相同；
    若否，则不予认证通过；
    若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  18. 如权利要求15所述的计算机可读存储介质，其特征在于，所述分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同的步骤之前，还包括：
    获取所述timestamp；
    判断所述timestamp是否与所述timestampA或所述timestampB相同；
    若否，则不予认证通过；
    若是，则生成执行“分别判断所述timestampA与所述timestampB是否相同，所述randKeyA与所述randKeyB是否相同”的命令。
  19. 如权利要求15所述的计算机可读存储介质，其特征在于，所述不予认证通过的步骤之后，还包括：
    记录连续认证失败的次数；
    判断所述连续认证失败的次数是否达到设定次数；
    若是，则暂停后续预设时间内的认证工作。
  20. 如权利要求19所述的计算机可读存储介质，其特征在于，所述暂停后续预设时间内的认证工作的步骤之后，还包括：
    发送控制所述前端的摄像头拍摄所述前端的操作者头像的指令给所述前端。
PCT/CN2019/119482 2019-01-31 2019-11-19 基于时间戳的加密及认证方法、系统和计算机设备 Ceased WO2020155794A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910100423.3A CN109936447B (zh) 2019-01-31 2019-01-31 基于时间戳的加密及认证方法、系统和计算机设备
CN201910100423.3 2019-01-31

Publications (1)

Publication Number Publication Date
WO2020155794A1 true WO2020155794A1 (zh) 2020-08-06

Family

ID=66985411

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/119482 Ceased WO2020155794A1 (zh) 2019-01-31 2019-11-19 基于时间戳的加密及认证方法、系统和计算机设备

Country Status (2)

Country Link
CN (1) CN109936447B (zh)
WO (1) WO2020155794A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112822155A (zh) * 2020-12-21 2021-05-18 陕西土豆数据科技有限公司 一种基于国密的航拍数据加解密方法
CN112953968A (zh) * 2021-03-30 2021-06-11 云谷技术(珠海)有限公司 一种基于安全认证的配电终端运维通信方法及装置
CN114697099A (zh) * 2022-03-24 2022-07-01 浪潮云信息技术股份公司 一种基于椭圆曲线加密算法的多方授权认证方案
CN115065503A (zh) * 2022-05-11 2022-09-16 浪潮云信息技术股份公司 一种api网关防重放攻击的方法
CN115190481A (zh) * 2022-06-01 2022-10-14 统信软件技术有限公司 数据加密方法和装置，设备准入认证方法、装置和系统
CN119254412A (zh) * 2024-09-11 2025-01-03 南京熊猫电子股份有限公司 一种基于时间的对称加密算法、系统及其存储介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109936447B (zh) * 2019-01-31 2021-10-08 平安科技（深圳）有限公司 基于时间戳的加密及认证方法、系统和计算机设备
CN112311740B (zh) * 2019-07-31 2022-06-21 深圳市云海物联科技有限公司 数据加密方法、数据解密方法、终端及存储介质
CN112488728B (zh) * 2019-08-22 2024-09-06 佛山市顺德区美的饮水机制造有限公司 用于耗材的防伪识别方法、装置和电子设备
CN111859435B (zh) * 2020-07-29 2023-06-23 北京千丁互联科技有限公司 一种数据安全处理方法及装置
CN112333154A (zh) * 2020-10-16 2021-02-05 四川九八村信息科技有限公司 一种基于动态密码进行权限控制方法及其血浆采集机
CN113015111B (zh) * 2021-02-23 2022-03-29 中国人民解放军火箭军工程大学 基于动态时间戳和国密算法的短报文加密通信方法
CN114726573A (zh) * 2022-02-28 2022-07-08 新华三技术有限公司 一种管理密码的方法、云平台和终端设备
CN116318899B (zh) * 2023-02-17 2023-10-17 深圳市创势互联科技有限公司 数据加密解密的处理方法、系统、设备及介质
CN118827031A (zh) * 2024-07-10 2024-10-22 浪潮通信技术有限公司 基于mqtt服务器插件的动态鉴权方法及系统
CN119442209A (zh) * 2024-09-09 2025-02-14 农信银资金清算中心有限责任公司 一种基于时间戳加密的单点登录访问方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105207782A (zh) * 2015-11-18 2015-12-30 上海爱数软件有限公司 一种基于restful架构的身份验证方法
CN107483415A (zh) * 2017-07-26 2017-12-15 国网江西省电力公司南昌供电分公司 一种共享用电交互系统的双向认证方法
US20180025145A1 (en) * 2015-02-10 2018-01-25 Bundesdruckerei Gmbh Computer-implemented method for controlling access
CN109936447A (zh) * 2019-01-31 2019-06-25 平安科技（深圳）有限公司 基于时间戳的加密及认证方法、系统和计算机设备

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8156333B2 (en) * 2008-05-29 2012-04-10 Red Hat, Inc. Username based authentication security
US9106426B2 (en) * 2008-11-26 2015-08-11 Red Hat, Inc. Username based authentication and key generation
CN102395006B (zh) * 2011-10-24 2013-09-11 南京大学 一种基于视频流的外网安全审查系统
CN105072132B (zh) * 2015-08-27 2019-05-14 宇龙计算机通信科技(深圳)有限公司 验证方法、验证系统和通信设备
CN106453391A (zh) * 2016-11-13 2017-02-22 北海和思科技有限公司 一种重复长数据加密传输的方法及系统
CN108737326B (zh) * 2017-04-14 2021-03-30 北京京东尚科信息技术有限公司 用于进行令牌验证的方法、系统、装置及电子设备
CN107454115B (zh) * 2017-10-10 2020-01-31 北京奇艺世纪科技有限公司 一种摘要认证方法及摘要认证系统
CN108234458A (zh) * 2017-12-21 2018-06-29 广东汇泰龙科技有限公司 一种云锁密码的加密储存及解密提取的方法、系统
CN108183907A (zh) * 2017-12-29 2018-06-19 浪潮通用软件有限公司 一种认证方法、服务器及认证系统
CN108650210A (zh) * 2018-03-14 2018-10-12 深圳市中易通安全芯科技有限公司 一种认证系统和方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180025145A1 (en) * 2015-02-10 2018-01-25 Bundesdruckerei Gmbh Computer-implemented method for controlling access
CN105207782A (zh) * 2015-11-18 2015-12-30 上海爱数软件有限公司 一种基于restful架构的身份验证方法
CN107483415A (zh) * 2017-07-26 2017-12-15 国网江西省电力公司南昌供电分公司 一种共享用电交互系统的双向认证方法
CN109936447A (zh) * 2019-01-31 2019-06-25 平安科技（深圳）有限公司 基于时间戳的加密及认证方法、系统和计算机设备

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112822155A (zh) * 2020-12-21 2021-05-18 陕西土豆数据科技有限公司 一种基于国密的航拍数据加解密方法
CN112953968A (zh) * 2021-03-30 2021-06-11 云谷技术(珠海)有限公司 一种基于安全认证的配电终端运维通信方法及装置
CN114697099A (zh) * 2022-03-24 2022-07-01 浪潮云信息技术股份公司 一种基于椭圆曲线加密算法的多方授权认证方案
CN114697099B (zh) * 2022-03-24 2024-05-17 浪潮云信息技术股份公司 一种基于椭圆曲线加密算法的多方授权认证方法
CN115065503A (zh) * 2022-05-11 2022-09-16 浪潮云信息技术股份公司 一种api网关防重放攻击的方法
CN115065503B (zh) * 2022-05-11 2024-05-31 浪潮云信息技术股份公司 一种api网关防重放攻击的方法
CN115190481A (zh) * 2022-06-01 2022-10-14 统信软件技术有限公司 数据加密方法和装置，设备准入认证方法、装置和系统
CN119254412A (zh) * 2024-09-11 2025-01-03 南京熊猫电子股份有限公司 一种基于时间的对称加密算法、系统及其存储介质

Also Published As

Publication number Publication date
CN109936447B (zh) 2021-10-08
CN109936447A (zh) 2019-06-25

Similar Documents

Publication Publication Date Title
WO2020155794A1 (zh) 基于时间戳的加密及认证方法、系统和计算机设备
KR102443857B1 (ko) 암호화키를 사용한 신뢰 실행 환경의 어드레싱 기법
KR102689195B1 (ko) 세션 식별자 동기화를 실현하는 방법 및 장치
CN112565205B (zh) 可信认证和度量方法、服务器、终端及可读存储介质
US8413221B2 (en) Methods and apparatus for delegated authentication
CN107040513B (zh) 一种可信访问认证处理方法、用户终端和服务端
CN107294937B (zh) 基于网络通信的数据传输方法、客户端及服务器
CN108111497B (zh) 摄像机与服务器相互认证方法和装置
CN112637131A (zh) 用户身份认证方法、装置、设备和存储介质
US10938555B2 (en) Method and assembly for establishing a secure communication between a first network device (initiator) and a second network device (responder)
CN111444499B (zh) 用户身份认证方法及系统
CN113204772A (zh) 数据处理方法、装置、系统、终端、服务器和存储介质
JP2008250931A (ja) 分散情報復元システム、情報利用装置、および、検証装置
KR20150079489A (ko) 실시간 통신 방법 및 시스템
EP2993859B1 (en) Secure communication method
CN110505185A (zh) 身份验证方法、设备和系统
WO2023124958A1 (zh) 密钥更新方法、服务器、客户端及存储介质
CN106790045A (zh) 一种基于云环境分布式虚拟机代理架构及数据完整性保障方法
CN105577619B (zh) 一种客户端登录方法、客户端以及系统
CN108900595B (zh) 访问云存储服务器数据的方法、装置、设备及计算介质
CN110147658B (zh) 用户信息加解密方法、系统和计算机设备
CN110912857B (zh) 移动应用间共享登录的方法、存储介质
CN113297091B (zh) SoC芯片的调试方法、装置及SoC芯片
CN114065170A (zh) 平台身份证书的获取方法、装置和服务器
CN114218542B (zh) 访客身份审核方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19913622

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19913622

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 19/01/2022)

122 Ep: pct application non-entry in european phase

Ref document number: 19913622

Country of ref document: EP

Kind code of ref document: A1