什麼是 2FA（雙因素身份驗證）?
雙因素身份驗證（2FA）是一種安全系統，要求使用者提供兩種不同的身份驗證方式才能訪問某個系統或服務。國內普遍做簡訊驗證碼這種的用的比較少，不過在國外的網站中使用雙因素身份驗證的還是很多的。使用者透過使用驗證器掃描二維碼，就能在app上獲取登入的動態口令，進一步加強了賬戶的安全性。
主要步驟
pom.xml中增加依賴
<!-- 用於SecureKey生成 -->
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
<version>1.15</version>
</dependency>
<!-- 二維碼依賴 -->
<dependency>
<groupId>org.iherus</groupId>
<artifactId>qrext4j</artifactId>
<version>1.3.1</version>
</dependency>
使用者表中增加secretKey列
為使用者繫結secretKey欄位，用以生成二維碼及後期校驗
工具類
谷歌身份驗證器工具類
/**
* 谷歌身份驗證器工具類
*/
public class GoogleAuthenticator {
/**
* 時間前後偏移量
* 用於防止客戶端時間不精確導致生成的TOTP與伺服器端的TOTP一直不一致
* 如果為0,當前時間為 10:10:15
* 則表明在 10:10:00-10:10:30 之間生成的TOTP 能校驗透過
* 如果為1,則表明在
* 10:09:30-10:10:00
* 10:10:00-10:10:30
* 10:10:30-10:11:00 之間生成的TOTP 能校驗透過
* 以此類推
*/
private static int WINDOW_SIZE = 0;
/**
* 加密方式，HmacSHA1、HmacSHA256、HmacSHA512
*/
private static final String CRYPTO = "HmacSHA1";
/**
* 生成金鑰，每個使用者獨享一份金鑰
*
* @return
*/
public static String getSecretKey() {
SecureRandom random = new SecureRandom();
byte[] bytes = new byte[20];
random.nextBytes(bytes);
Base32 base32 = new Base32();
String secretKey = base32.encodeToString(bytes);
// make the secret key more human-readable by lower-casing and
// inserting spaces between each group of 4 characters
return secretKey.toUpperCase();
}
/**
* 生成二維碼內容
*
* @param secretKey 金鑰
* @param account 賬戶名
* @param issuer 網站地址（可不寫）
* @return
*/
public static String getQrCodeText(String secretKey, String account, String issuer) {
String normalizedBase32Key = secretKey.replace(" ", "").toUpperCase();
try {
return "otpauth://totp/"
+ URLEncoder.encode((!StringUtils.isEmpty(issuer) ? (issuer + ":") : "") + account, "UTF-8").replace("+", "%20")
+ "?secret=" + URLEncoder.encode(normalizedBase32Key, "UTF-8").replace("+", "%20")
+ (!StringUtils.isEmpty(issuer) ? ("&issuer=" + URLEncoder.encode(issuer, "UTF-8").replace("+", "%20")) : "");
} catch (UnsupportedEncodingException e) {
throw new IllegalStateException(e);
}
}
/**
* 獲取驗證碼
*
* @param secretKey
* @return
*/
public static String getCode(String secretKey) {
String normalizedBase32Key = secretKey.replace(" ", "").toUpperCase();
Base32 base32 = new Base32();
byte[] bytes = base32.decode(normalizedBase32Key);
String hexKey = Hex.encodeHexString(bytes);
long time = (System.currentTimeMillis() / 1000) / 30;
String hexTime = Long.toHexString(time);
return TOTP.generateTOTP(hexKey, hexTime, "6", CRYPTO);
}
/**
* 檢驗 code 是否正確
*
* @param secret 金鑰
* @param code code
* @param time 時間戳
* @return
*/
public static boolean checkCode(String secret, long code, long time) {
Base32 codec = new Base32();
byte[] decodedKey = codec.decode(secret);
// convert unix msec time into a 30 second "window"
// this is per the TOTP spec (see the RFC for details)
long t = (time / 1000L) / 30L;
// Window is used to check codes generated in the near past.
// You can use this value to tune how far you're willing to go.
long hash;
for (int i = -WINDOW_SIZE; i <= WINDOW_SIZE; ++i) {
try {
hash = verifyCode(decodedKey, t + i);
} catch (Exception e) {
// Yes, this is bad form - but
// the exceptions thrown would be rare and a static
// configuration problem
// e.printStackTrace();
throw new RuntimeException(e.getMessage());
}
if (hash == code) {
return true;
}
}
return false;
}
/**
* 根據時間偏移量計算
*
* @param key
* @param t
* @return
* @throws NoSuchAlgorithmException
* @throws InvalidKeyException
*/
private static long verifyCode(byte[] key, long t) throws NoSuchAlgorithmException, InvalidKeyException {
byte[] data = new byte[8];
long value = t;
for (int i = 8; i-- > 0; value >>>= 8) {
data[i] = (byte) value;
}
SecretKeySpec signKey = new SecretKeySpec(key, CRYPTO);
Mac mac = Mac.getInstance(CRYPTO);
mac.init(signKey);
byte[] hash = mac.doFinal(data);
int offset = hash[20 - 1] & 0xF;
// We're using a long because Java hasn't got unsigned int.
long truncatedHash = 0;
for (int i = 0; i < 4; ++i) {
truncatedHash <<= 8;
// We are dealing with signed bytes:
// we just keep the first byte.
truncatedHash |= (hash[offset + i] & 0xFF);
}
truncatedHash &= 0x7FFFFFFF;
truncatedHash %= 1000000;
return truncatedHash;
}
public static void main(String[] args) {
for (int i = 0; i < 100; i++) {
String secretKey = getSecretKey();
System.out.println("secretKey：" + secretKey);
String code = getCode(secretKey);
System.out.println("code：" + code);
boolean b = checkCode(secretKey, Long.parseLong(code), System.currentTimeMillis());
System.out.println("isSuccess：" + b);
}
}
}
二維碼工具類
/**
* 驗證碼生成工具類
*/
public class TOTP {
private static final int[] DIGITS_POWER = {1, 10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000};
/**
* This method uses the JCE to provide the crypto algorithm. HMAC computes a
* Hashed Message Authentication Code with the crypto hash algorithm as a
* parameter.
*
* @param crypto : the crypto algorithm (HmacSHA1, HmacSHA256, HmacSHA512)
* @param keyBytes : the bytes to use for the HMAC key
* @param text : the message or text to be authenticated
*/
private static byte[] hmac_sha(String crypto, byte[] keyBytes, byte[] text) {
try {
Mac hmac;
hmac = Mac.getInstance(crypto);
SecretKeySpec macKey = new SecretKeySpec(keyBytes, "RAW");
hmac.init(macKey);
return hmac.doFinal(text);
} catch (GeneralSecurityException gse) {
throw new UndeclaredThrowableException(gse);
}
}
/**
* This method converts a HEX string to Byte[]
*
* @param hex : the HEX string
* @return: a byte array
*/
private static byte[] hexStr2Bytes(String hex) {
// Adding one byte to get the right conversion
// Values starting with "0" can be converted
byte[] bArray = new BigInteger("10" + hex, 16).toByteArray();
// Copy all the REAL bytes, not the "first"
byte[] ret = new byte[bArray.length - 1];
System.arraycopy(bArray, 1, ret, 0, ret.length);
return ret;
}
/**
* This method generates a TOTP value for the given set of parameters.
*
* @param key : the shared secret, HEX encoded
* @param time : a value that reflects a time
* @param returnDigits : number of digits to return
* @param crypto : the crypto function to use
* @return: a numeric String in base 10 that includes
*/
public static String generateTOTP(String key, String time, String returnDigits, String crypto) {
int codeDigits = Integer.decode(returnDigits);
String result = null;
// Using the counter
// First 8 bytes are for the movingFactor
// Compliant with base RFC 4226 (HOTP)
while (time.length() < 16) {
time = "0" + time;
}
// Get the HEX in a Byte[]
byte[] msg = hexStr2Bytes(time);
byte[] k = hexStr2Bytes(key);
byte[] hash = hmac_sha(crypto, k, msg);
// put selected bytes into result int
int offset = hash[hash.length - 1] & 0xf;
int binary = ((hash[offset] & 0x7f) << 24)
| ((hash[offset + 1] & 0xff) << 16)
| ((hash[offset + 2] & 0xff) << 8) | (hash[offset + 3] & 0xff);
int otp = binary % DIGITS_POWER[codeDigits];
result = Integer.toString(otp);
while (result.length() < codeDigits) {
result = "0" + result;
}
return result;
}
}
Service
@Transactional(isolation = Isolation.REPEATABLE_READ, propagation = Propagation.REQUIRED)
@Service
public class TwoFAService {
@Autowired
private UserMapper userMapper;
/**
* 獲取SecureKey
*/
public String getSecureKey(Integer userId) {
User user = userMapper.selectUserById(userId);
return user.getSecretKey();
}
/**
* 更新secureKey
*/
public Integer updateSecureKey(Integer userId, String secureKey) {
return userMapper.updateSecureKeyById(userId, secureKey);
}
/**
* 校驗動態碼
*/
public boolean chek2FACode(User user, String twoFACode) throws Exception {
String secretKey = user.getSecretKey();
// 沒繫結裝置就先驗證透過
if(secretKey == null || secretKey.isEmpty()) {
return true;
} else {
if(twoFACode.isEmpty()) { throw new Exception("已繫結裝置，請輸入動態碼"); }
boolean checkRes = GoogleAuthenticator.checkCode(secretKey, Long.parseLong(twoFACode), System.currentTimeMillis());
if(!checkRes) {
throw new Exception("動態碼錯誤");
} else {
return true;
}
}
}
}
Controller
使用者登入中增加兩步驗證：
@Controller
@RequestMapping(value = "/mgr")
public class UserController {
@Autowired
private UserService userService;
@Autowired
private LogService logService;
@Autowired
private TwoFAService twoFAService;
/**
* @Description: 使用者登入
*/
@RequestMapping(value = "/user/login", method = RequestMethod.POST)
@ResponseBody
public GlobalResult login(String userCode, String userPwd, String twoFACode) {
try {
UsernamePasswordToken token = new UsernamePasswordToken(userCode, userPwd);
Subject subject = SecurityUtils.getSubject();
subject.login(token);
// 2FA驗證
User user = (User) subject.getPrincipal();
twoFAService.chek2FACode(user, twoFACode);
Log log = new Log();
.......
}
}
}
兩步驗證的Controler
@RestController
@RequestMapping(value = "/2fa")
public class TwoFAController {
@Autowired
private TwoFAService twoFAService;
/**
* 生成二維碼資訊物件
*/
@GetMapping("/getQrcode")
public QrCodeResponse getQrcode(@RequestParam("userId") Integer userId, @RequestParam("userCode") String userCode, HttpServletResponse response) throws Exception {
try {
String secretKey = twoFAService.getSecureKey(userId);
QrCodeResponse qrCodeResponse = new QrCodeResponse();
if(secretKey == null || secretKey.isEmpty()) {
secretKey = GoogleAuthenticator.getSecretKey();
qrCodeResponse.setBind(false);
// userMapper.updateSecureKeyById(userId, secretKey);
} else {
qrCodeResponse.setBind(true);
}
// 生成二維碼內容
String qrCodeText = GoogleAuthenticator.getQrCodeText(secretKey, userCode, "suggest-mgr");
// 以流的形式返回生成二維碼輸出
// new SimpleQrcodeGenerator().generate(qrCodeText).toStream(response.getOutputStream());
BufferedImage image = new SimpleQrcodeGenerator().generate(qrCodeText).getImage();
// 將圖片轉換為Base64字串
String base64Image = convertImageToBase64(image);
qrCodeResponse.setQrCodeText(secretKey);
qrCodeResponse.setBase64Image(base64Image);
return qrCodeResponse;
} catch (Exception e) {
// 處理異常
e.printStackTrace();
return null; // 或者返回適當的錯誤資訊
}
}
/**
* 更新SecretKey
* @param userId
* @param secretKey
*/
@GetMapping("/updateSecretKey")
public void updateSecretKey(@RequestParam("userId") Integer userId, @RequestParam("secretKey") String secretKey) {
twoFAService.updateSecureKey(userId, secretKey);
}
/**
* 獲取新的secretKey 重置用
* @param userId
* @param userCode
* @return
*/
@GetMapping("/getNewSecretKey")
public QrCodeResponse getNewSecretKey(@RequestParam("userId") Integer userId, @RequestParam("userCode") String userCode, HttpServletResponse response) throws Exception {
try {
String secretKey = secretKey = GoogleAuthenticator.getSecretKey();
QrCodeResponse qrCodeResponse = new QrCodeResponse();
qrCodeResponse.setBind(false);
// 生成二維碼內容
String qrCodeText = GoogleAuthenticator.getQrCodeText(secretKey, userCode, "xxx-site");
BufferedImage image = new SimpleQrcodeGenerator().generate(qrCodeText).getImage();
// 將圖片轉換為Base64字串
String base64Image = convertImageToBase64(image);
qrCodeResponse.setQrCodeText(secretKey);
qrCodeResponse.setBase64Image(base64Image);
// 返回包含qrCodeText和Base64編碼圖片的資訊
return qrCodeResponse;
} catch (Exception e) {
// 處理異常
e.printStackTrace();
return null; // 或者返回適當的錯誤資訊
}
}
/**
* 將圖片檔案流轉為base64
*/
private String convertImageToBase64(BufferedImage image) {
try {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ImageIO.write(image, "png", baos);
byte[] imageBytes = baos.toByteArray();
return Base64.getEncoder().encodeToString(imageBytes);
} catch (Exception e) {
// 處理異常
return "";
}
}
static public class QrCodeResponse {
private String secretKey;
private String base64Image;
private boolean isBind;
public String getSecretKey() {
return secretKey;
}
public void setSecretKeyt(String secretKey) {
this.secretKey = secretKey;
}
public String getBase64Image() {
return base64Image;
}
public void setBase64Image(String base64Image) {
this.base64Image = base64Image;
}
public boolean isBind() {
return isBind;
}
public void setBind(boolean bind) {
isBind = bind;
}
}
}
常用2FA驗證工具
- Google Authenticator: google play, apple store
- Microsoft Authenticator: google play , apple store
- AuthenticatorPro(開源)：https://github.com/jamie-mh/AuthenticatorPro