TWI891083B - Cybersecurity proxy authentication system and method - Google Patents

Abstract

The present invention relates to a cybersecurity proxy authentication method. The method comprising: implementing a multi-party multi-factor dynamic strong encryption authentication method among a user equipment, an application server, and a cybersecurity server host; and implementing the multi-party multi-factor dynamic strong encryption authentication method among the user equipment, an information security-sensitive server host, and the cybersecurity server host by using the application server as a proxy server for the information security-sensitive server host.

Description

Information and communications security agent authentication system and method

The present invention relates to a system and method for authenticating information security identities for information security-sensitive server hosts, and more particularly, to a system and method for authenticating information security identities by proxying information security-sensitive server hosts through an application server.

Multi-Factor Authentication (MFA) is a well-known multi-factor authentication mechanism that combines multiple authentication factors to enhance information security while reducing reliance on traditional passwords. Common authentication factors used in MFA include the following types.

The first type is the identification factor, the most commonly used identity authentication factor in MFA technology. This includes information known only to the user, such as passwords, PINs, and answers. The second most commonly used factor is the physical condition factor, which requires the user to present a physical device or object used for identity verification, such as a security token, smart card, or mobile phone. The third most commonly used factor is the biometric factor, which captures the user's unique biometric characteristics, such as fingerprints, irises, voice, and face, as authentication.

Therefore, compared to traditional single-factor authentication, which only verifies a single identity factor from the user, usually just an identification code such as a password or PIN, multi-factor authentication can indeed enhance information security.

FIDO2 (Fast Identity Online 2) is another widely adopted authentication method. FIDO2 consists of two main authentication components: WebAuthn and CTAP. WebAuthn (Web Authentication) is a web standard that allows websites to use multiple authentication factors, such as biometrics, PINs, and smart cards, to verify user identities without traditional passwords. CTAP (Client to Authenticator Protocol) is a communication protocol that provides a standard for web pages or applications to communicate and interact with FIDO2 devices, enabling WebAuthn operations.

However, both MFA and FIDO2 technologies have their shortcomings and areas for improvement. For example, FIDO2 implementation requires additional hardware support, such as biometric devices or USB security keys, which can increase deployment costs and system complexity. MFA technology still relies on traditional passwords for authentication, which is inconsistent with the current trend in information and communications security towards passwordless authentication.

Therefore, recognizing the shortcomings of the existing technology, the inventors, through careful experimentation and research, and with unwavering perseverance, have conceived the present "Information and Communications Security Agent Authentication System and Method," which overcomes the shortcomings of the aforementioned existing technology. The following is a brief description of this invention.

The present invention relates to a system and method for authenticating information security identities for information security-sensitive server hosts, and more particularly, to a system and method for authenticating information security identities by proxying information security-sensitive server hosts through an application server.

Accordingly, the present invention proposes an information security proxy authentication method, comprising: implementing a multi-party, multi-factor, dynamic, strong encryption authentication method between a user device, an application server, and a security server host; and using the application server as a proxy server for a security-sensitive server host to implement the multi-party, multi-factor, dynamic, strong encryption authentication method between the user device, the security-sensitive server host, and the security server host.

The present invention further provides an information security proxy authentication system comprising: a first subsystem comprising a user device, an application server, and a security server host to implement a multi-party, multi-factor, dynamic, strong encryption authentication method; and a second subsystem comprising the user device, the application server, the security server host, and a security-sensitive server host, wherein the application server acts as a proxy server for the security-sensitive server host to implement the multi-party, multi-factor, dynamic, strong encryption authentication method.

The present invention further provides an information security proxy authentication system comprising: a first subsystem comprising a user device, an application server, and a first security-sensitive server host to implement a multi-party, multi-factor, dynamic strong encryption authentication method; and a second subsystem comprising the user device, the application server, the first security-sensitive server host, and a second security-sensitive server host, wherein the application server acts as a proxy server for the first security-sensitive server host or the second security-sensitive server host to implement the multi-party, multi-factor, dynamic strong encryption authentication method.

The above invention content is intended to provide a simplified summary of the present disclosure to provide readers with a basic understanding of the present disclosure. This invention content is not intended to be a complete description of the present invention and is not intended to identify important/critical elements of the embodiments of the present invention or to define the scope of the present invention.

10: Information and Communications Security Agent Certification System

11: Internet

100: User equipment

110: First Service Programming Module

200: Application Server

210: Second Service Programming Module

300: Secure Server Host

310: Third Service Programming Module

400: Information security sensitive server host

410: Fourth Service Programming Module

420: Operating System

S1: First subsystem

S2: Second subsystem

T1: First transmission connection

T2: Second transmission link

T3: Third transmission link

T4: Fourth transmission link

T5: Fifth transmission link

501-519: Implementation steps

601-623: Implementation Steps

700: Information Security Agent Authentication Method

701-702: Implementation Steps

Figure 1 shows a schematic diagram of the system architecture of the information security proxy authentication system included in the present invention;

Figure 2 shows a timing diagram of the implementation steps of the information security agent authentication method included in the present invention during the initial authentication phase;

Figure 3 shows a timing diagram of the steps implemented in the information security proxy authentication method of the present invention during the proxy authentication phase; and

Figure 4 shows a flowchart of the implementation steps of the information security agent authentication method included in the present invention.

The present invention will be fully understood through the following examples, allowing those skilled in the art to implement it accordingly. However, the implementation of the present invention is not limited by the following examples. The drawings of the present invention do not include any limitations on size, dimensions, or scale. The size, dimensions, and scale of the present invention during actual implementation are not limited by the drawings of the present invention.

The term "preferably" used herein is non-exclusive and should be understood to mean "preferably, but not limited to." Any steps described or recited in any specification or claim may be performed in any order, not limited to the order recited in the claim. The scope of the present invention is determined solely by the appended claims and their equivalents, and not by the embodiments exemplified in the embodiments. The term "comprising" and its variations, when used herein in the specification and claim, are open-ended and non-restrictive, and do not exclude other features or steps.

Figure 1 illustrates the system architecture of the information security proxy authentication system included in the present invention. In one embodiment, the information security proxy authentication system 10 includes at least a user device 100, an application server 200, a security server host 300, and a security-sensitive server host 400. Each device establishes a transmission connection via a network 11 for communication and data transmission. The network 11 may include an external network (Internet), an intranet, or a combination of an external network and an intranet.

The user device 100 is preferably, for example, but not limited to, a desktop computer, laptop, tablet device, or smartphone. The secure server host 300 is a third-party intermediary security device built and provided by a third-party cybersecurity service provider. The secure server host 300 is preferably, for example, but not limited to, a secure intermediary server or a cloud server.

Information security sensitive server hosts (400) refer to any server host device that requires a high level of information security protection to prevent unauthorized access or malicious attacks. These servers are typically used to process or store sensitive information, such as commercial secrets, production parameters, personal information, and financial data, or to perform critical tasks, such as commanding or transmitting production instructions. The information security of these servers is paramount; once compromised or used maliciously, they could result in significant and irreversible losses.

For example, information security-sensitive server hosts 400 preferably include, but are not limited to: factory main control nodes, industrial control system security equipment, Internet of Things (IoT) devices, workstations, firewalls and intrusion detection systems, database protection devices, encryption devices, security authentication devices, information security devices, etc.

The information security-sensitive server host 400 can also be considered as a second information security-sensitive server host, an external information security-sensitive server host, or an internal information security-sensitive server host, and the security server host 300 can also be considered as a first information security-sensitive server host, an internal information security-sensitive server host, or an external information security-sensitive server host.

In one embodiment, a first service programming module 110, a second service programming module 210, a third service programming module 310, and a fourth service programming module 410 are installed in the user device 100, the application server 200, the secure server host 300, and the information security-sensitive server host 400, respectively. An operating system 420 is also installed in the information security-sensitive server host 400. The application server 200 can be considered the backend of the first service programming module 110, the first service programming module 110 can be considered the frontend of the second service programming module 210, and the application server 200 can be considered the remote application server of the first service programming module 110.

In one embodiment, the information security proxy authentication system 10 further includes a first transmission connection T1 connecting the user device 100 and the security server host 300, a second transmission connection T2 connecting the application server 200 and the security server host 300, a third transmission connection T3 connecting the user device 100 and the application server 200, a fourth transmission connection T4 connecting the user device 100 and the information security-sensitive server host 400, and a fifth transmission connection T5 connecting the information security-sensitive server host 400 and the security server host 300.

In one embodiment, the information security agent authentication system 10 further includes a first subsystem S1 and a second subsystem S2. The first subsystem S1 includes a user device 100, an application server 200, a security server host 300, a first transmission connection T1, a second transmission connection T2, and a third transmission connection T3. The second subsystem S2 includes the user device 100, a security-sensitive server host 400, a security server host 300, a first transmission connection T1, a fourth transmission connection T4, and a fifth transmission connection T5. The first subsystem S1 can also be considered an underlying system or a security system.

The information security agent authentication method included in the present invention is preferably implemented within the system architecture of the information security agent authentication system 10 through the execution of the first service programming module 110, the second service programming module 210, the third service programming module 310, and the fourth service programming module 410.

Figure 2 illustrates a timing diagram of the steps implemented during the initial authentication phase of the information security proxy authentication method included in the present invention. The information security proxy authentication method included in the present invention also includes a multi-party, multi-factor, dynamic, strong encryption authentication method implemented based on the first subsystem S1 during the initial authentication phase.

Step 501: First, the user logs in on the user device 100, for example, by entering their account number and password into the corresponding fields on the login page.

Step 502: In response to the user's login operation, the first service programming module 110 executed on the user device 100 generates, for example but not limited to, a first ephemeral decrypting key (EDK) and an initialization vector (IV) with a length of 32 bytes, either randomly or by implementing a first cryptographic algorithm.

The first cryptographic algorithm is preferably selected from the MD5 algorithm, MD4 algorithm, MD2 algorithm, SHA-1 algorithm, SHA-2 algorithm, SHA-3 algorithm, RIPEMD-160 algorithm, MDC-2 algorithm, GOST R 34.11-94 algorithm, BLAKE2 algorithm, Whirlpool algorithm, SM3 algorithm, or a combination thereof.

Step 503: After the first temporary decryption key (first EDK) is generated on the user device 100, the first service programming module 110 continues to implement a public key infrastructure (PKI) method or a second cryptographic algorithm on the user device 100 based on the first temporary decryption key to encrypt a set of identity information (ID information) to generate an electronic digital signature (eID). The second cryptographic algorithm is preferably used to generate the electronic digital signature. The identity information is preferably an identity code assigned to the first service programming module 110 by the second service programming module 210.

The second cryptographic algorithm is preferably selected from the group consisting of RSA, DSA, ECDSA, ECC, HMAC, MD5, MD4, MD2, SHA-1, SHA-2, SHA-3, RIPEMD-160, MDC-2, GOST R 34.11-94, BLAKE2, Whirlpool, SM3, and combinations thereof.

Step 504: After the electronic digital signature is generated on the user device 100, the first service programming module 110 re-implements the first cryptographic algorithm to either randomly generate a second temporary key or perform a scrambled process based on the first temporary key to generate a second temporary key (second EDK) by modifying the first temporary key. The first and second temporary decryption keys can be in any format, but are preferably symbolic strings of 32, 64, 128, or 256 binary bytes.

Step 505: After the second temporary key is generated on the user device 100, the first service programming module 110 continues to implement a third cryptographic algorithm, preferably symmetric encryption, based on the second temporary decryption key on the user device 100 to further encrypt the electronic digital signature to generate an authentication token. The third cryptographic algorithm is also called a secure encryption algorithm.

The third cryptographic algorithm is preferably selected from the group consisting of AES, DSA, HMAC, MD5, MD4, MD2, SHA-1, SHA-2, SHA-3, Blowfish, Camellia, Chacha20, Poly1305, SEED, CAST-128, DES, IDEA, RC2, RC4, RC5, SM4, TDES, and GOST 28147-89, or a combination thereof.

Step 506: Next, the first service programming module 110 publishes the generated first and second temporary decryption keys from the user device 100 to the secure server host 300.

Step 507: After receiving the first and second temporary decryption keys, the third service programming module 310 running on the secure server host 300 generates a token index based on the first and second temporary decryption keys. The token index is the minimum content or strictly smaller portion sufficient to extract the first and second temporary decryption keys.

Step 508: Next, the first service programming module 110 executed on the user device 100 requests the token index from the third service programming module 310 and retrieves the token index.

Step 509: Next, the first service programming module 110 combines the electronic digital signature, the authentication token, and the token index to form a temporary string.

Step 510: The first service programming module 110 then publishes the temporary string from the user device 100 to the application server 200.

Step 511: After receiving the temporary string, the second service programming module 210 running on the application server 200 parses the temporary string to extract the electronic digital signature, token index, and authentication token from the temporary string.

Step 512: The second service programming module 210 then transmits the obtained token index to the third service programming module 310 on the secure server host 300 in encrypted or unencrypted mode, thereby obtaining the corresponding first and second temporary decryption keys from the third service programming module 310 based on the token index.

Step 513: The second service programming module 210 retrieves the first and second temporary decryption keys from the third service programming module 310.

Step 514: Next, the second service programming module 210 implements the second cryptographic algorithm and the third cryptographic algorithm based on the first and second temporary decryption keys to decrypt the authentication token and the electronic digital signature, respectively, to obtain the identity information.

Step 515: Next, the second service programming module 210 executes a signature verification process based on the received first temporary decryption key to check whether the electronic digital signature is correctly encrypted, correctly signed, or has not been tampered with, thereby verifying the authenticity of the electronic digital signature.

In step 516, when the electronic digital signature is authentic, the second service programming module 210 decrypts the electronic digital signature based on the received first temporary decryption key to extract the identity information.

Step 517: After retrieving the identity information, the second service programming module 210 executes an identity verification process to check whether the identity information matches the record to verify the accuracy of the identity information.

Step 518: The second service programming module 210 reports the identity authentication result to the first service programming module 110. If the identity identification information is confirmed to be correct, it reports to the first service programming module 110 that the identity is correct; otherwise, it reports that the identity is not correct.

Step 519: When the first service programming module 110 confirms that the identity authentication result is consistent with the identity, it continues to execute the login process.

The first temporary decryption key is optionally generated. In some embodiments, it is possible not to generate the first temporary decryption key and not encrypt the identity information. The temporary string contains the identity information, the authentication token, and the token index.

Figure 3 illustrates a timing diagram of the steps implemented during the proxy authentication phase of the information security proxy authentication method included in the present invention. The information security proxy authentication method included in the present invention also includes a multi-party, multi-factor, dynamic, strongly encrypted proxy authentication method implemented by the second subsystem S2 during the proxy authentication phase, enabling cross-device identity authentication for users.

Step 601: First, the user performs a login operation to log into the operating system 420 of the information security-sensitive server host 400. For example, the user enters the corresponding account and password in the account and password fields on the login page provided by the Windows operating system on the information security-sensitive server host 400.

Step 602: In response to the user's login operation, the fourth service programming module 410 is activated.

Step 603: After being activated, the fourth service programming module 410 running on the information security-sensitive server host 400 temporarily locks the operating system 420.

Step 604: The fourth service programming module 410 then generates the first and second temporary decryption keys and IV in a random manner or by starting to implement the first cryptographic algorithm.

Step 605: The fourth service programming module 410 then encodes the first and second temporary decryption keys, the IV, and the IP address of the optical identifier according to the optical identifier encoding rules to generate an optical identifier. The optical identifier stores the EDK, IV, and IP address. The optical identifier may be in the form of a two-dimensional code such as a Quick Response Code (QR code).

Step 606: The fourth service programming module 410 then overlays the generated optical identifier on the top layer of the login page of the security-sensitive server host 400 for the user to scan and read.

Step 607: Next, the user opens and executes the first service programming module 110 installed on the user device 100, clicks to enter the identifier scanning interface provided by the first service programming module 110, and then uses the lens included in the user device 100 to capture an image containing the optical identifier.

Step 608: After the first service programming module 110 successfully captures the optical identifier displayed by the display networking device 500, the first service programming module 110 will first check whether the captured optical identifier complies with the optical identifier encoding rules to verify the authenticity of the optical identifier.

Step 609: When the first service programming module 110 confirms that the optical identifier is authentic, the first service programming module 110 decodes the optical identifier according to the optical identifier encoding rule to obtain the first and second temporary decryption keys and IV information stored in the optical identifier.

Step 610: The first service programming module 110 then implements a public key infrastructure (PKI) method or a second cryptographic algorithm based on the first temporary decryption key and IV information to encrypt the identity information and generate an electronic digital signature.

Step 611: The first service programming module 110 then implements a third cryptographic algorithm based on the second temporary decryption key to further encrypt the electronic digital signature to generate an authentication token.

Step 612: The first service programming module 110 then returns the authentication token and electronic digital signature to the fourth service programming module 410.

Step 613: After receiving the authentication token and electronic digital signature, the fourth service programming module 410 implements the second cryptographic algorithm and the third cryptographic algorithm based on the first and second temporary decryption keys to decrypt the authentication token and electronic digital signature, respectively, to obtain the identity information.

Step 614: The fourth service programming module 410 executes a signature verification procedure based on the first temporary decryption key to check whether the electronic digital signature is correctly encrypted, correctly signed, or has not been tampered with, thereby verifying the authenticity of the electronic digital signature.

Step 615: When the electronic digital signature is authentic, the fourth service programming module 410 further decrypts the electronic digital signature based on the second temporary decryption key to extract the identity information.

Step 616: The fourth service programming module 410 transmits the identification information and the authentication token to the second service programming module 210 running on the application server 200.

Step 617: After receiving the identity information and authentication token, the second service programming module 210 will act as a proxy for the fourth service programming module 410 to communicate and transmit data with the third service programming module 310 to perform the proxy identity verification process, including executing steps 512 to 516.

Step 618: The second service programming module 210 and the third service programming module 310 jointly execute the proxy identity verification process.

Step 619: The third service programming module 310 collaborates with the second service programming module 210 to execute the proxy identity verification process.

Step 620: The second service programming module 210 executes the proxy identity verification process.

Step 621: The second service programming module 210 reports the identity verification result to the fourth service programming module 410. If the identity identification information is confirmed to be correct, it reports to the fourth service programming module 410 that the identity is correct; otherwise, it reports that the identity is not correct.

Step 622: The fourth service programming module 410 reports the identity verification result to the operating system 420.

Step 623: When the operating system 420 confirms that the identity verification result is correct, it continues the login process.

During the proxy authentication phase, there will be no direct communication connection or data transmission between the secure server host 300 and the information security-sensitive server host 400. All two-way communication and data transmission between the two hosts will be completed through the application server 200.

In one embodiment, the application server 200 can be considered a proxy server for the information security-sensitive server host 400, or a proxy server for the security server host 300. This can prevent direct communication and data transmission between the security server host 300 and the information security-sensitive server host 400, thereby isolating the security server host 300 and the information security-sensitive server host 400.

Application server 200 provides an additional layer of isolation between secure server host 300 and sensitive server host 400 to enhance data protection and security for both. Specifically, for application server 200, both secure server host 300 and sensitive server host 400 are secure devices that have passed initial information security verification. This ensures the correct operation of secure server host 300 and sensitive server host 400, and prevents the introduction of new information security risks during cross-device multi-factor identity authentication for users.

Under the proxy of application server 200, indirect communication and data transmission are established between secure server host 300 and information-sensitive server host 400. Therefore, both secure server host 300 and information-sensitive server host 400 can more securely perform multi-party, multi-factor, dynamic, strong encryption authentication.

In one embodiment, information-sensitive server host 400 is a production control workstation in a 5G smart factory and must be isolated from other devices as much as possible. Security server host 300, an information security device, also requires a high level of information security protection and is also expected to be isolated from other devices as much as possible. Therefore, application server 200 acts as a proxy server for security server host 300 and information-sensitive server host 400, serving as a relay point for communication and data transmission between the two hosts. This allows indirect communication and data transmission between security server host 300 and information-sensitive server host 400, thereby improving the level of information security protection for both.

In one embodiment, the first service programming module 110, the second service programming module 210, the third service programming module 310, and the fourth service programming module 410 are all independently executed program entities. Although in the above description, the first service programming module 110, the second service programming module 210, the third service programming module 310, and the fourth service programming module 410 are respectively configured to execute on different devices, the first service programming module 110, the second service programming module 210, the third service programming module 310, and the fourth service programming module 410 may alternatively be configured to execute on the same device.

For example, in one embodiment, the first service programming module 110 is installed and executed on a user's mobile phone, the fourth service programming module 410 is installed and executed on a production management workstation in a 5G smart factory, and the second service programming module 210 and the third service programming module 310 are installed and executed on the same NAS server. Although the second service programming module 210 and the third service programming module 310 are installed on the same device, they are still independently executed program entities, and the NAS server and the production management workstation belong to the same local area network (LAN) or intranet.

In one embodiment, the first service programming module 110 is installed and executed on a user's mobile phone, the fourth service programming module 410 is installed and executed on a production management workstation in a 5G smart factory, and the second service programming module 210 and the third service programming module 310 are installed and executed on the same cloud server. The cloud server and the production management workstation are located on the Internet and an intranet, respectively.

Figure 4 illustrates a flowchart of the implementation steps of the information security proxy authentication method included in the present invention. In summary, the information security proxy authentication method 700 included in the present invention preferably includes, but is not limited to, the following steps: in the initial authentication phase, a multi-party, multi-factor, dynamic, strong encryption authentication method is implemented between the user device, the application server, and the security server host (step 701); and in the proxy authentication phase, the application server acts as a proxy server for the security-sensitive server host, and the multi-party, multi-factor, dynamic, strong encryption authentication method is implemented between the user device, the security-sensitive server host, and the security server host (step 702).

The above embodiments of the present invention may be arbitrarily combined or replaced with each other to derive more embodiments, but all of these remain within the scope of protection of the present invention. More embodiments of the present invention are further provided as follows:

Embodiment 1: A method for information security proxy authentication, comprising: implementing a multi-party, multi-factor, dynamic, strong encryption authentication method between a user device, an application server, and a security server host; and using the application server as a proxy server for a security-sensitive server host to implement the multi-party, multi-factor, dynamic, strong encryption authentication method between the user device, the security-sensitive server host, and the security server host.

Embodiment 2: The information security proxy authentication method of Embodiment 1, wherein the multi-party, multi-factor, dynamic, strong encryption authentication method further comprises one of the following: performing the multi-party, multi-factor, dynamic, strong encryption authentication method between the user device, the application server, and the security server host during the initial authentication phase; and performing the multi-party, multi-factor, dynamic, strong encryption authentication method between the user device, the information security-sensitive server host, and the security server host during the proxy authentication phase.

Embodiment 3: The information security agent authentication method as described in Embodiment 2, wherein the multi-party multi-factor dynamic strong encryption authentication method further comprises one of the following in the initial authentication phase: on the user device: selectively implementing a first cryptographic algorithm or randomly generating a first temporary decryption key; selectively implementing a second cryptographic algorithm based on the first temporary decryption key to encrypt the identity information and generate an electronic digital signature; based on the first temporary decryption key A second temporary decryption key is formed or randomly generated based on a portion of the first temporary decryption key; a third cryptographic algorithm is implemented based on the second temporary decryption key to generate an authentication token; the first temporary decryption key and the second temporary decryption key are published to the secure server, and a token index is retrieved from the secure server; the identity information, the electronic digital signature, the token index, and one of the authentication tokens are combined to form a temporary string; and the temporary string is transmitted to the application server.

Embodiment 4: The information security agent authentication method as described in Embodiment 3, wherein the multi-party multi-factor dynamic strong encryption authentication method further comprises one of the following in the initial authentication phase: on the application server: decrypting the temporary string to obtain the identity identification information, the electronic digital signature, the token index and the authentication token; obtaining the first temporary decryption key and the second temporary decryption key from the security server based on the token index; retrieving the first temporary decryption key and the second temporary decryption key; a second temporary decryption key; decrypting the authentication token based on the first temporary decryption key and the second temporary decryption key to obtain the electronic digital signature and the identity information; performing a signature verification procedure to verify whether the electronic digital signature is correctly signed; when the electronic digital signature is correctly signed, selectively decrypting the electronic digital signature based on the first temporary decryption key to retrieve the identity information; and performing an identity verification procedure to verify whether the identity information correctly matches the record.

Embodiment 5: The information security proxy authentication method of Embodiment 4, wherein the multi-party, multi-factor, dynamic, strong encryption authentication method further comprises one of the following during the proxy authentication phase: on the information security-sensitive server host: temporarily locking the operating system; selectively implementing the first cryptographic algorithm or randomly generating the first temporary decryption key and the second temporary decryption key; generating an optical identifier and storing the first temporary decryption key and the second temporary decryption key in the optical identifier; and displaying the optical identifier at the top.

Embodiment 6: The information security proxy authentication method of Embodiment 5, wherein the multi-party multi-factor dynamic strong encryption authentication method further comprises one of the following during the proxy authentication phase: on the user device: capturing an image containing the optical identifier; parsing the optical identifier to obtain the first temporary decryption key and the second temporary decryption key; performing the second cryptographic algorithm based on the first temporary decryption key to encrypt the identity information to generate the electronic digital signature; performing the third cryptographic algorithm based on the second temporary decryption key to encrypt the electronic digital signature to generate the authentication token; and transmitting the electronic digital signature and the authentication token back to the information security-sensitive server host.

Embodiment 7: The information security proxy authentication method of Embodiment 6, wherein the multi-party, multi-factor, dynamic, strong encryption authentication method further comprises one of the following during the proxy authentication phase: on the information security-sensitive server host: decrypting the electronic digital signature and the authentication token based on the first temporary decryption key and the second temporary decryption key; executing the signature verification process based on the first temporary decryption key to verify whether the electronic digital signature is correctly signed; if the electronic digital signature is correctly signed, decrypting the electronic digital signature based on the second temporary decryption key to retrieve the identity information; and transmitting the authentication token and the identity information to the application server.

Embodiment 8: The information security proxy authentication method of Embodiment 7, wherein the multi-party, multi-factor, dynamic, strong encryption authentication method further comprises one of the following during the proxy authentication phase: on the application server: executing a proxy identity verification process, the proxy identity verification process further comprising one of the following: obtaining the first temporary decryption key and the second temporary decryption key from the security server based on the token index; retrieving the first temporary decryption key and the second temporary decryption key; executing the signature verification process to verify whether the electronic digital signature is correctly signed; and executing the identity verification process to verify whether the identity identification information correctly matches the record.

Embodiment 9: An information security proxy authentication system comprises: a first subsystem comprising a user device, an application server, and a security server host to implement a multi-party, multi-factor, dynamic, strong encryption authentication method; and a second subsystem comprising the user device, the application server, the security server host, and a security-sensitive server host, wherein the application server acts as a proxy server for the security-sensitive server host to implement the multi-party, multi-factor, dynamic, strong encryption authentication method.

Embodiment 10: An information security proxy authentication system comprises: a first subsystem comprising a user device, an application server, and a first security-sensitive server host to implement a multi-party, multi-factor, dynamic, strong encryption authentication method; and a second subsystem comprising the user device, the application server, the first security-sensitive server host, and a second security-sensitive server host, wherein the application server acts as a proxy server for the first security-sensitive server host or the second security-sensitive server host to implement the multi-party, multi-factor, dynamic, strong encryption authentication method.

The various embodiments of the present invention may be arbitrarily combined or replaced with one another to derive more embodiments, but all of these remain within the scope of protection sought by the present invention. The scope of protection of the present invention shall be determined in accordance with the scope of the patent application for the present invention.

700: Information Security Agent Authentication Method

701-702: Implementation Steps

Claims (7)

A method for information security proxy authentication includes: implementing a multi-party, multi-factor, dynamic, strong encryption authentication method between a user device, an application server, and a security server host, including an initial authentication phase; and using the application server as a proxy server for a security-sensitive server host, implementing a proxy authentication phase between the user device, the security-sensitive server host, and the security server host. The proxy authentication phase further includes one of the following: temporarily locking an operating system on the security-sensitive server host; selectively implementing a first cryptographic algorithm or randomly generating a first temporary decryption key. and the second temporary decryption key; generating an optical identifier and storing the first temporary decryption key and the second temporary decryption key in the optical identifier; displaying the optical identifier on top; on the user device: capturing an image containing the optical identifier; parsing the optical identifier to obtain the first temporary decryption key and the second temporary decryption key; encrypting the identity information using the second cryptographic algorithm based on the first temporary decryption key to generate the electronic digital signature; encrypting the electronic digital signature using the third cryptographic algorithm based on the second temporary decryption key to generate the authentication token; and transmitting the electronic digital signature and the authentication token back to the security-sensitive server host. The information security proxy authentication method of claim 1, wherein the multi-party, multi-factor, dynamic, strong encryption authentication method further comprises one of the following: performing the multi-party, multi-factor, dynamic, strong encryption authentication method between the user device, the application server, and the security server host during the initial authentication phase; and performing the multi-party, multi-factor, dynamic, strong encryption authentication method between the user device, the information security-sensitive server host, and the security server host during the proxy authentication phase. The information security agent authentication method as described in claim 2, wherein the multi-party multi-factor dynamic strong encryption authentication method further includes one of the following in the initial authentication phase: on the user device: selectively implementing a first cryptographic algorithm or randomly generating a first temporary decryption key; selectively implementing a second cryptographic algorithm based on the first temporary decryption key to encrypt identity information to generate an electronic digital signature; based on a portion of the first temporary decryption key Forming or randomly generating a second temporary decryption key; implementing a third cryptographic algorithm based on the second temporary decryption key to generate an authentication token; publishing the first temporary decryption key and the second temporary decryption key to the secure server host and retrieving a token index from the secure server host; combining the identity information, the electronic digital signature, the token index, and one of the authentication tokens to form a temporary string; and transmitting the temporary string to the application server. The information security agent authentication method as described in claim 3, wherein the multi-party multi-factor dynamic strong encryption authentication method further includes one of the following in the initial authentication phase: on the application server: decrypting the temporary string to obtain the identity identification information, the electronic digital signature, the token index and one of the authentication tokens; obtaining the first temporary decryption key and the second temporary decryption key from the security server host based on the token index; retrieving the first temporary decryption key and the second temporary decryption key; decrypting the authentication token based on the first temporary decryption key and the second temporary decryption key to obtain the electronic digital signature and the identity information; performing a signature verification process to verify whether the electronic digital signature is correctly signed; when the electronic digital signature is correctly signed, selectively decrypting the electronic digital signature based on the first temporary decryption key to obtain the identity information; and performing an identity verification process to verify whether the identity information correctly matches the record. The information security proxy authentication method of claim 1, wherein the multi-party, multi-factor, dynamic, strong encryption authentication method further comprises, during the proxy authentication phase, one of the following: on the information security-sensitive server host: decrypting the electronic digital signature and the authentication token based on the first temporary decryption key and the second temporary decryption key; executing the signature verification process based on the first temporary decryption key to verify whether the electronic digital signature is correctly signed; if the electronic digital signature is correctly signed, decrypting the electronic digital signature based on the second temporary decryption key to retrieve the identity information; and transmitting the authentication token and the identity information to the application server. The information security proxy authentication method of claim 5, wherein the multi-party multi-factor dynamic strong encryption authentication method further comprises one of the following during the proxy authentication phase: on the application server: executing a proxy identity verification process, the proxy identity verification process further comprising one of the following: obtaining the first temporary decryption key and the second temporary decryption key from the security server host based on the token index; retrieving the first temporary decryption key and the second temporary decryption key; executing the signature verification process to verify whether the electronic digital signature is correctly signed; and executing the identity verification process to verify whether the identity identification information correctly matches the record. An information security proxy authentication system comprises: a first subsystem comprising a user device, an application server, and a security server host to implement a multi-party, multi-factor, dynamic, strong encryption authentication method including an initial authentication phase; and a second subsystem comprising the user device, the application server, the security server host, and a security-sensitive server host, wherein the application server acts as a proxy server for the security-sensitive server host to implement a proxy authentication phase of the multi-party, multi-factor, dynamic, strong encryption authentication method. The proxy authentication phase further comprises one of the following: temporarily locking an operating system on the security-sensitive server host; selectively implementing the first cryptographic algorithm or randomly The method comprises: generating the first temporary decryption key and the second temporary decryption key in a manner; generating an optical identifier and storing the first temporary decryption key and the second temporary decryption key in the optical identifier; displaying the optical identifier on top; capturing an image including the optical identifier on the user device; parsing the optical identifier to obtain the first temporary decryption key and the second temporary decryption key; a second temporary decryption key; implementing the second cryptographic algorithm based on the first temporary decryption key to encrypt the identity information to generate the electronic digital signature; implementing the third cryptographic algorithm based on the second temporary decryption key to encrypt the electronic digital signature to generate the authentication token; and returning the electronic digital signature and the authentication token to the security-sensitive server host.