CN108599944A - A kind of identifying code short message transparent encryption method based on handset identities - Google Patents

Abstract

The invention discloses the identifying code short message transparent encryption methods based on handset identities, and the method comprising the steps of, and user is sent by website or APP and obtains identifying code request first；It accesses after server acquisition user's request of quotient, generates random verification code；The server triggers module request trusted party PKG of quotient is accessed, operation will be encrypted to generating ground identifying code；User mobile phone is sent to short message mode for encrypted identifying code, mobile phone terminal trigger module asks PKG, PKG certification users to return to corresponding user by safe lane according to user identifier identity text string generation private key, and by private key；User mobile phone opens short message application, and trigger module will be stored in encrypted identifying code short message in mobile phone and be decrypted automatically；User fills in the verification code information of decryption on webpage, or directly replicates, pastes in APP applications；On webpage or APP applies the identifying code filled in the middle to be proved to be successful, then verifies digital content after deleting decryption immediately.The identifying code short message transparent encryption method based on handset identities with technology in realization, have the advantages that safety and efficient, good user experience with it is at low cost.

Description

A method for transparent encryption of verification code text messages based on mobile phone identity

technical field

The invention relates to a mobile phone identity-based verification code short message transparent encryption method and technology, belonging to the field of information security.

Background technique

Mobile phone verification code SMS is to transmit the verification code information to the user's mobile phone by sending a text message. At present, large websites all use the mobile phone verification code SMS function; the mobile phone verification code is used to protect the transaction security and verify the correctness of the user. Some verification code access providers provide mobile phone SMS verification code services. Each website sends a request to the access provider's server through the interface, and the server sends random numbers or letters to the mobile phone, and the access provider's server uniformly performs verification code verification.

Mobile phone verification code text messages have become a part of our lives, and while providing us with convenience, there are also certain security risks. Nowadays, almost everyone's mobile phone number is bound to various accounts, such as Alipay, WeChat and various bank cards and other important accounts, which are closely related to personal funds and properties. However, these accounts are bound to mobile phone numbers, and the main function is nothing more than secondary verification through SMS. In addition, using SMS verification code verification to register members greatly reduces the data of illegal registration and bad registration. Recently, a voice verification code has appeared, but compared with SMS verification codes, the user experience of voice verification codes is not very good, and users need to memorize them; when filling in the verification code on the mobile APP, the verification code text message can be directly copied and pasted. The mobile phone verification code text message verification method has the advantages of low cost, simplicity and convenience, so this method is widely used, and the mobile phone verification code text message will not fade away from the stage of history in the future. But at the same time, people are also worried about its safety.

What kind of threat is SMS verification facing?

Scenario 1: In the era of smartphones, the biggest threat to SMS verification is the Trojan link on the smartphone platform, allowing users to download and install the Trojan without knowing it. When the Trojan is installed in the phone, it will Reset the user's application account password related to property, and intercept the SMS verification code to reset the user's account. And this kind of Trojan horse has already formed a very complete industrial chain because of its simple writing and implementation, so Trojan horses have become the biggest threat to mobile phone SMS verification codes.

In the second case, the user's mobile phone is monitored by using a pseudo base station through radio monitoring. In this way, by listening to short messages in the air, including GSM monitoring, to obtain the content of short messages and then carry out theft activities, this method can complement each other with SMS Trojan horses, and can also commit crimes alone.

Scenario 3: Get a mobile phone number identical to the user’s by making up the card or cloning the card to receive the user’s verification code text message, reset the user’s various accounts, and then steal property. Since all mobile phone numbers now require real-name registration, this type of threat is much less harmful than the previous two cases.

The idea of identity-based encryption system was proposed by Shamir in 1984. Since then, identity-based encryption system has been widely developed and applied. The identity-based cryptosystem is also a public key cryptosystem, but this system directly uses the user's unique identity (user mailbox, etc.) as the public key instead of using a bunch of meaningless numbers as the public key. Compared with traditional PKI technology, digital certificates are not used, which makes user use and background management very simple, and has a wide range of application scenarios.

Transparent encryption and decryption technology is a technology for protecting important information. During the protection process, it is transparent to user terminals and will not change user habits. When important information or documents are saved on the hard disk of the device, they are encrypted, called ciphertext, and this system automatically encrypts those unencrypted information or documents; while in the memory, when opening or editing, the system automatically decrypts , called plaintext.

Due to the current mobile phone text message verification code encryption method and technology, the verification code operation is used, or the obfuscated encryption algorithm is used to strengthen the verification code operation, and manual operation is required to decrypt or unharden the verification code; these reasons affect mobile devices. The user experience is better, and some methods do not achieve user identity authentication and other deficiencies when implementing verification code SMS encryption and decryption.

Contents of the invention

The technical problem to be solved by the present invention is: to solve the threat of safety problems encountered in the application of the existing mobile phone verification code text messages: mobile phone Trojans and radio monitoring, and the current mobile phone verification code text message encryption and decryption method does not do user identity authentication and user experience is not good Waiting for the question.

The technical solution of the present invention is: a method for transparently encrypting short messages with verification codes based on mobile phone identity, including the following steps: Step 1: first, the user sends a request for obtaining the verification code through the website or APP; Step 2: the server of the access provider obtains the user request After that, generate a random verification code and save the verification code in the database; Step 3: In the trigger module of the access provider server, request the system public parameters from the trusted center PKG, and then use the system public parameters returned by the trusted center PKG Convert and calculate the public key in combination with the user identification string, and finally use the public key to encrypt the generated verification code; Step 4: Send the encrypted verification code to the user's mobile phone as a text message, and the trigger module on the mobile phone detects When sending a text message, initiate a request to the trusted center PKG to verify the identity. The trusted center PKG converts the user identification string, calculates the private key based on the system reserved parameters, and returns the private key to the corresponding user through a secure channel; step 5 : The user opens the SMS application, automatically invokes the trigger module on the mobile phone, and the trigger module uses the obtained private key to automatically decrypt the encrypted verification code; Step 6: The user fills in the real information of the verification code on the web page, or directly copies and pastes it to In the APP application; Step 7: If the verification code filled in on the webpage or in the APP application is successfully verified, the content of the decrypted verification code will be deleted immediately. The cryptosystem encryption algorithm of the identity in step 3 and the cryptosystem decryption algorithm of the identity in step 5 are the encryption algorithm and decryption algorithm of the cryptosystem scheme based on the identity; the cryptosystem scheme of the identity is established by the system (Setup), private key extraction (KeyGen ), encryption (Encrypt) and decryption (Decrypt) four algorithms.

The trusted center PKG in steps 3 and 4 is an identity-based cryptosystem scheme system establishment algorithm (Setup) and key extraction algorithm (KeyGen); the system establishment algorithm is to generate system parameters, and the key extraction algorithm is to generate User private key. The trusted center PKG provides system public parameters for the encryption process and user private key and system public parameters for the decryption process.

Beneficial effects of the present invention: the present invention relates to a method and technology for transparently encrypting verification code short messages based on mobile phone identity. This method and technology encrypts the verification code generated by the server, and then transmits the encrypted verification code to the mobile phone of the user in the form of a short message. Automatic decryption is performed in the application on the user's mobile phone, allowing the user to directly copy and paste the decryption verification code to fill in. For the Trojan horse, the verification code text message content has been encrypted, so that the content of the verification code cannot be recognized, resulting in the failure of the Trojan horse attack. To deal with radio monitoring, it mainly includes GSM monitoring, including monitoring air short messages, and directly obtains the content of the short message, so as to obtain the content of the verification code. Since the verification code has been encrypted before sending, it is transmitted in cipher text during the transmission process, even if the verification code text message is intercepted, the attacker cannot know the content of the verification code, and it is meaningless. For SIM card replacement and cloning attacks, apply for a victim’s same mobile phone number to receive verification code text messages, because the verification code is encrypted, and decryption requires the private key for user authentication, and the attacker cannot obtain the authentication private key. key to ensure the security of the verification code.

The scheme uses an identity-based cryptographic system. Compared with the traditional PKI technology, digital certificates are not used, and the user is convenient to use and the background management is simple, and the security and efficiency are high, and the cost is low. For the verification code SMS decryption operation, the user opens the SMS application, and uses the transparent implementation technology to automatically decrypt the encrypted verification code text message stored in the mobile phone. This method ensures the security of the verification code information and has a good user experience. experience.

Description of drawings

Fig. 1 is a kind of mobile phone identity-based verification code short message transparent encryption method and technical flow chart of the present invention;

Fig. 2 is a diagram of the operation process of the identity-based cryptosystem scheme of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

A method and technology for transparent encryption of verification code text messages based on mobile phone identity. An identity-based cryptographic system is designed to encrypt and transparently implement mobile phone verification code text messages, as shown in Figure 1.

The identity-based cryptosystem scheme consists of four steps: system establishment (Setup), private key extraction (KeyGen), encryption (Encrypt) and decryption (Decrypt). Figure 2 shows.

The user fills in his mobile phone number on the website or APP, clicks the "Get Verification Code" button, and the user sends a request to obtain the verification code. After obtaining the user request, the access provider server generates a random verification code and stores the verification code in the database. In the trigger module of the access provider server, request the system public parameters to the trusted center PKG, then use the system public parameters returned by the trusted center PKG combined with the user identification string phone number to convert and calculate the public key, and finally use the public key Encrypt the generated verification code with the key pair; in the encryption algorithm (Encrypt) operation, input a k-bit verification code information M, user phone number identification identity string ID, random number r and system public parameters (PK, PK and The dot product of MSK) to output the verification code ciphertext data; the system public parameters required for the encryption process come from the calculation result of the system establishment algorithm (Setup) of the trusted center PKG (Private Key Generator), and the user's phone number identifies the identity string phone The number ID, random number r and the dot product of PK and MSK are used to calculate the user's encryption public key. The encrypted verification code is sent to the user's mobile phone as a text message. When the trigger module on the mobile phone detects the text message, it initiates a request to the trusted center PKG to verify the identity. After the verification is successful, the trusted center PKG sends the user's identity string phone number ID calculates the user's private key through the private key extraction algorithm (KeyGen), and returns the private key to the corresponding user through a secure channel. In the PKG operation, two algorithm operations are performed: system establishment (Setup) and private key extraction (KeyGen). The system establishes an algorithm (Setup), inputs a security parameter S, and outputs the system public parameter PK and master key MSK after calculation; the system parameter PK is announced to the outside world, and the master key MSK is kept secret, called system reserved parameters. Private key extraction algorithm (KeyGen), input user identification identity string phone number ID and master key MSK, calculate and output user private key. In the decryption algorithm (Decrypt) operation, the user opens the SMS application on the mobile phone and automatically invokes the trigger module on the mobile phone. The trigger module uses the user's private key to automatically decrypt the encrypted verification code SMS stored in the mobile phone. After decryption, the authenticity of the verification code is information presented to the user. In the decryption implementation operation, the embodiment of transparency technology is to modify the entry point of the system function library, so that the system operation points to a new custom application program, find that the Open function symbol in this application program exists in the dynamic link library, and when the Open function operation is performed , decrypt the encrypted verification code text message into the mobile phone memory, and return the verification code text message identifier in the memory; the public system parameter PK and the random number r required by the decryption algorithm. The user can fill in the real information of the decrypted verification code on the webpage, or directly copy and paste it into the APP for verification. If the verification code filled in on the webpage or in the APP is successfully verified, the content of the decrypted verification code will be deleted immediately.

The present invention has been described in detail above in conjunction with specific embodiments, which are not intended to limit the invention. Without departing from the principles of the present invention, those skilled in the art can make many modifications and improvements, which should also belong to the protection scope of the present invention.

Claims (3)

1. a kind of identifying code short message transparent encryption method based on handset identities, it is characterised in that：Include the following steps：Step 1： User is sent by website or APP and obtains identifying code request first；Step 2：The server of access quotient obtains user and asks it Afterwards, random verification code is generated, and identifying code is stored in database；Step 3：In the trigger module of access quotient's server In, parameter is disclosed to trusted party PKG Request Systems, combines and uses followed by the system public parameter that trusted party PKG is returned Family identity character string is converted, public key is calculated, and operation finally is encrypted to the identifying code of generation using public key； Step 4：User mobile phone is sent to short message mode for encrypted identifying code, the trigger module of mobile phone terminal detects short message When, request is initiated to trusted party PKG, verifies identity, trusted party PKG converts user identifier identity character string, ties Collaboration system retention parameter calculates private key, and private key is returned to corresponding user by safe lane；Step 5：User opens short Letter application, the trigger module at automatic calling mobile phone end, trigger module are carried out automatic to encrypted identifying code using acquisition private key Decryption；Step 6：User fills in the real information of identifying code on webpage, or directly replicates, pastes in APP applications；Step Rapid 7：On webpage or APP applies the identifying code filled in the middle to be proved to be successful, then verifies digital content after deleting decryption immediately.

2. a kind of identifying code short message transparent encryption method based on handset identities according to claim 1, it is characterised in that： The cipher system Encryption Algorithm of identity and the cipher system decipherment algorithm of step 5 identity are identity-baseds in the step 3 Cipher system scheme Encryption Algorithm and decipherment algorithm；The cipher system scheme of identity is established by system, private key extraction, encrypts and solve Close four Algorithm constitutions.

3. a kind of identifying code short message transparent encryption method based on handset identities according to claim 1, it is characterised in that： The step 3 and the trusted party PKG in step 4 are that Identity- based cryptography scheme system is established algorithm and carried with key Take algorithm；It is to generate system public parameter, and key-extraction algorithm is to generate private key for user, trusted party that system, which establishes algorithm, PKG is to provide system public parameter in ciphering process and is to provide private key for user and system public parameter in decrypting process.