+

WO2018108123A1 - Procédé, dispositif, et système d'authentification d'identité - Google Patents

Procédé, dispositif, et système d'authentification d'identité Download PDF

Info

Publication number
WO2018108123A1
WO2018108123A1 PCT/CN2017/116140 CN2017116140W WO2018108123A1 WO 2018108123 A1 WO2018108123 A1 WO 2018108123A1 CN 2017116140 W CN2017116140 W CN 2017116140W WO 2018108123 A1 WO2018108123 A1 WO 2018108123A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
seed
token
terminal
server
Prior art date
Application number
PCT/CN2017/116140
Other languages
English (en)
Chinese (zh)
Inventor
袁丽娜
郝允允
李轶峰
陈云云
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018108123A1 publication Critical patent/WO2018108123A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token

Definitions

  • the present invention relates to the field of identity verification, and in particular, to an identity verification method, apparatus and system.
  • binding Taobao security center for Taobao account In order to protect account security, users need to set password protection measures in multiple account systems, such as binding Taobao security center for Taobao account, QQ security center for QQ account, etc., which leads to the need for users to use multiple applications at the same time. Binding multiple security centers is cumbersome.
  • the embodiments of the present invention provide an identity verification method, apparatus, and system, and a storage medium.
  • the embodiment of the present invention is specifically implemented by the following technical solutions:
  • an authentication method comprising:
  • the first terminal obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server;
  • the verification server obtains the message number;
  • the second terminal obtains the message number from the first terminal; acquires a verification message corresponding to the message number from the verification server according to the message number; and responds to the confirmation instruction of the verification message, according to the second verification seed Generating a token and transmitting the token and the message number to the verification server;
  • the verification server queries the first verification seed according to the message number obtained from the second terminal; obtains a verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result to the first terminal;
  • the first terminal acquires a verification result from the verification server.
  • an authentication method is applied to a first terminal, where the method includes:
  • the verification result is obtained by the verification server by verifying whether the first verification seed has a legal correspondence with the token; the token is generated by the second terminal according to the second verification seed.
  • an authentication method is applied to a second terminal, where the method includes:
  • a fourth aspect is an authentication device, the device comprising one or more processors and one or more non-volatile storage media, the one or more non-volatile storage media storing one or more computers Readable instructions configured to be executed by the one or more processors to implement the following steps:
  • the verification result is obtained by the verification server by verifying whether the first verification seed has a legal correspondence with the token; the token is generated by the second terminal according to the second verification seed.
  • an authentication device comprising one or more processors and one or more non-volatile storage media, the one or more non-volatile storage media storing one or more computers
  • Readable instructions configured to be executed by the one or more processors to implement the following steps:
  • Detecting a user instruction the user instruction including a confirmation instruction
  • a sixth aspect is an identity verification system, where the system includes a first client, a second client, and an authentication server;
  • the first client includes the above device
  • the second client includes the above described device.
  • a non-transitory computer readable storage medium storing computer readable instructions, the computer readable instructions being executable by at least one processor.
  • FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a verification server cluster according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of an identity binding method according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for obtaining a first verification seed according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of naming a seed obtained by a user according to an embodiment of the present invention.
  • FIG. 7 is a flowchart of a token generation algorithm according to an embodiment of the present invention.
  • FIG. 8 is a flowchart of a token verification algorithm according to an embodiment of the present invention.
  • FIG. 9 is a flowchart of another token verification algorithm according to an embodiment of the present invention.
  • FIG. 10 is a flowchart of a time correction method according to an embodiment of the present invention.
  • FIG. 11 is a flowchart of an identity verification method according to an embodiment of the present invention.
  • FIG. 12 is a schematic diagram of an interface for inputting a token according to an embodiment of the present invention.
  • FIG. 13 is a schematic diagram of an interface of a user selection token according to an embodiment of the present invention.
  • FIG. 14 is a flowchart of another identity verification method according to an embodiment of the present invention.
  • FIG. 15 is a schematic diagram of a page for generating a second verification barcode according to an embodiment of the present invention.
  • 16 is a schematic diagram of an interface for displaying a verification message according to an embodiment of the present invention.
  • FIG. 17 is a flowchart of another identity verification method according to an embodiment of the present invention.
  • FIG. 18 is a block diagram of an identity verification apparatus according to an embodiment of the present invention.
  • 19 is a block diagram of related modules for performing a binding process according to an embodiment of the present invention.
  • FIG. 20 is a block diagram of another identity verification apparatus according to an embodiment of the present invention.
  • FIG. 21 is a block diagram of a token generating module according to an embodiment of the present invention.
  • FIG. 22 is a block diagram of a module related to time correction according to an embodiment of the present invention.
  • FIG. 23 is a schematic diagram of a terminal according to an embodiment of the present invention.
  • FIG. 24 is a schematic structural diagram of a server according to an embodiment of the present invention.
  • FIG. 25 is a schematic diagram of an identity verification system according to an embodiment of the present invention.
  • the secret security issue consists of questions selected by the user and corresponding answers.
  • the security issue is not very convenient, and is often used as a secondary authentication method, such as to retrieve passwords and set other secrets.
  • the secret security problem uses a static password, which is easy to cause security risks.
  • the security card can be regarded as a two-dimensional matrix, each matrix contains a series of numbers, and each security card has a unique identifier, which is between the value of the matrix and the identifier of each user. A correspondence.
  • the user queries the security card information according to the server prompt, and manually enters the security information according to the server requirements to complete the verification process.
  • the secret security card uses a static password, so there is a risk of screen captures and files being stolen, and it is not easy to carry.
  • Secure Mailbox Similar to the secret security issue, the security mailbox is not very convenient, and is often used as a secondary authentication method, such as to retrieve passwords and set other secrets. Mailbox cracking is difficult and can cause security risks.
  • Secret security mobile phone The security of the mobile phone is better. It mainly verifies the identity by verifying the SMS verification code sent to the mobile phone, and is widely used in sensitive operations such as registration, consumption, transfer, and confidentiality. However, the secret mobile phone uses SMS downlink verification, which will result in operating costs paid to the operator, and the confidential mobile phone has the risk of loss and replacement.
  • Digital certificate A digitally signed document containing public key owner information and public key, which is mainly used for website authentication and is not universal to a large user group.
  • Face verification A biometric technology based on human facial feature information for identity verification. Personal identification is performed by verifying the face, but face verification involves sensitive privacy information of the user, and thus its use environment is limited.
  • Fingerprint verification refers to the line created by the unevenness of the skin on the front side of the finger end of a person. The lines are regularly arranged to form different patterns. The identification is performed by comparing the detailed feature points of different fingerprints. It is widely used to open mobile phones, open APP, consumer and other fields. Similar to face verification, fingerprint verification involves sensitive privacy information of users, and therefore its use environment is limited.
  • Iris Verification The iris is an annular portion between the black pupil and the white sclera that includes a number of interlaced spots, filaments, crowns, stripes, crypts, and the like. After the iris is formed in the fetal development stage, it will remain unchanged throughout the life course. Iris verification has high hardware requirements and is generally used in locations that require a high degree of confidentiality. And iris verification involves sensitive privacy information of users, so its use environment is limited.
  • the secret security policy, the secret security card and the security email are static passwords, which are easy to cause security risks.
  • the digital certificate, face verification, fingerprint verification and iris verification use environment are limited, and it is not easy to promote and apply.
  • the mobile phone has the problem of operating cost and the risk of loss of the mobile phone. Therefore, the embodiment of the present invention provides a low risk and a suitable application based on the token mode. An authentication method and a corresponding device that are widely distributed, low in cost, and free from the risk of loss of the mobile phone.
  • the token used in the embodiment of the present invention is a software token, and the software token can be obtained according to a seed for authenticating a user identity and a preset token generation algorithm.
  • the embodiment of the present invention may provide one or more authentication methods for the user, including but not limited to dynamic password verification, scan code verification, and one-click login.
  • FIG. 1 shows a schematic diagram of an implementation environment provided by an embodiment of the present invention.
  • the implementation environment includes a first terminal 120, an authentication server 140, and a second terminal 160.
  • the first client 120 runs a first client.
  • the first terminal 120 can be a mobile phone, a tablet computer, a television set, a laptop portable computer, and a desktop computer. It can also be a server, a server cluster composed of several servers, or a cloud computing service center.
  • the verification server 140 can be an authentication server, a server cluster composed of several servers, or a cloud computing service center.
  • a second client is running in the second terminal 160.
  • the second terminal 160 can be a cell phone, a tablet, a laptop portable computer, a desktop computer, and the like.
  • the verification server 140 can establish a communication connection with the first terminal 120 and the second terminal 160 through the communication network, respectively.
  • the network can be either a wireless network or a wired network.
  • the first client may be any client that has a user interface (UI) interface, needs to verify the identity of the user who uses the first client, and can communicate with the authentication server 140.
  • the first client can be a video service class server or client, a cable television server or client, a security service server or client, an instant messaging server or client, a mail service server or client, a game service server, or a client. , payment service server or client, e-commerce service server or client, and so on.
  • the second client may be any client that has a user interface (UI) interface, needs to log in to the first client, and can communicate with the authentication server 140.
  • the second client can be a mobile client, a tablet client, a multimedia client, and the like.
  • the terminal device when a client running in the terminal device is used to implement the function of the first client side in the method example of the present invention, the terminal device is used as the first terminal; when the client running in the terminal device is used to implement When the function of the second client side is used in the method example of the present invention, the terminal device acts as the second terminal.
  • the verification server 140 when the verification server 140 is a cluster architecture, the verification server 140 may include a communication server 142, a seed management server 144, an authentication server 146, and a verification message management server 148.
  • the communication server 142 is configured to provide communication services with the first client and the second client, and provides communication services between the three servers of the seed management server 144, the authentication server 146, and the authentication message management server 148.
  • the seed management server 144, the authentication server 146, and the verification message management server 148 can also communicate freely through the intranet.
  • the seed management server 144 is configured to issue a seed to the first client and perform management of the seed of the authentication server.
  • the authentication server 146 is configured to verify the identity of the second client that needs to log in to the first client.
  • the verification message management server 148 is configured to manage the verification message sent by the first client.
  • a communication connection can be established between the above various servers through a communication network.
  • the network can be either a wireless network or a wired network.
  • FIG. 3 is a flowchart of an identity binding method provided by an embodiment of the present invention. This method can be applied to the implementation environment shown in FIG.
  • the method ie, the identity binding process
  • the method can include the following steps.
  • Step 301 The second client issues a binding instruction to the first client in response to the user operation.
  • FIG. 4 shows the user interface of the second client in the identity binding process.
  • the second client may issue a binding instruction to the first client by acquiring a uniform resource locator of the first client.
  • Step 302 The first client acquires an account of the user in response to the binding instruction.
  • the user account may be applied to the first client in advance by the user, and in step 302, the user inputs a pre-applied account to the first client, where the first client You can get the user's account.
  • the first client before the identity binding process starts, the first client is requested to apply for an account and a corresponding password is set; the first client performs relevant legality verification on the account and the password; After the verification is passed, the first client records the correspondence between the account and the password, and prompts the user to enter the identity binding process by using an interface display or a voice prompt, and directly obtains the user's account in step 302.
  • step 303 the first client obtains the first verification seed.
  • FIG. 5 shows a flow chart of a method for obtaining a first verification seed.
  • the method includes:
  • Step 3031 Acquire an unused seed set, and the unused seeds are all from an authentication server.
  • the first client obtains a batch of seeds from the verification server in advance, and manages the acquired seeds. Specifically, the seed is sent by the verification server to the first client through a secure channel.
  • the seed forms a binding relationship (correspondence relationship) with other users' accounts after being acquired, the seed is a used seed, and if the seed does not form a binding relationship (correspondence relationship) with any account after being acquired, The seed is an unused seed. All unused seeds constitute an unused seed collection.
  • Step 3032 Select one seed in the unused seed set as the first verification seed.
  • the first client may select one of the unused seeds as the first verification seed according to a preset seed selection algorithm, or randomly select one of the unused seed sets as the first verification seed.
  • Step 304 The first client generates a verification seed, where the verification seed is a seed corresponding to the first verification seed and obtainable by the second client.
  • the first client generates the same seed as the first verification seed and uses the seed as a verification seed.
  • the method of making the verification seed obtained by the second client includes, but is not limited to, the following method:
  • the first client directly sends the verification seed to the second client;
  • the first client generates a first verification barcode according to the verification seed.
  • the first verification barcode is a two-dimensional code or barcode that can be scanned by the second client.
  • the verification seed is taken and the token is obtained in step 305, which is a dynamic password.
  • the first client generates a first verification barcode according to the verification seed and other optional information.
  • the first verification barcode is a two-dimensional code or barcode that can be scanned by the second client.
  • the optional information may be a user account and/or a verification seed generation time.
  • the first verification barcode may be generated in an encrypted manner according to a preset encryption algorithm, and correspondingly, the second verification is performed by the second client by using a preset decryption algorithm.
  • the barcode is decrypted.
  • Step 305 The second client obtains a verification seed, generates a token according to the verification seed, and enables the token to be acquired by the first client.
  • the seed obtained by the second client is the verification seed, and generates a token according to a preset token generation algorithm and the seed.
  • the method of making the token obtained by the first client includes, but is not limited to, the following method:
  • the second client directly sends the token to the first client
  • the second client generates a binding verification code according to the token.
  • the binding verification code is a two-dimensional code or barcode that can be scanned by the first client.
  • Step 306 The first client sends the first verification seed and the token to the verification server.
  • step 307 the verification server obtains the verification result.
  • the verification server may verify, according to a preset token verification algorithm, whether the first verification seed has a legal correspondence with the token, thereby obtaining a verification result.
  • the token verification algorithm and the token generation algorithm are related algorithms, and can be obtained by the verification server and the second client through negotiation.
  • Step 308 the verification server sends the verification result to the first client.
  • Step 309 The first client determines whether the verification is passed. If the verification succeeds, the first client stores the first verification seed, and the corresponding relationship between the first verification seed and the second client.
  • the seed obtained by the second client in step 305 is the verification seed generated by the first client. Specifically, the seed obtained by the second client is the same as the first verification seed.
  • the second client stores the obtained seed corresponding to the first verification seed, and the obtained seed is the second verification seed. Further, corresponding to the case of (2) (3) of step 304, in order to facilitate the second client to store the obtained seed, the second client may further verify whether the acquired first verification barcode contains a user account. If yes, the correspondence between the user account and the obtained seed (ie, the correspondence between the first client and the seed) is stored after the identity binding is successful; if not, the user is allowed to The resulting seeds are named and the correspondence between the nomenclature and the obtained seeds is stored. Please refer to FIG. 6, which shows a schematic diagram named by the user for the obtained seed, and the binding number is the obtained seed.
  • the first client may also notify the user that the identity binding process is successfully executed by using an interface display or a voice output.
  • the embodiment of the invention provides a method for performing identity binding before the identity verification, and the method enables the first client to obtain the binding relationship between the legal user and the seed, which is a prerequisite for subsequent use of the token for identity verification.
  • the identity binding method has no limitation on the first client, and therefore can be adapted to provide an identity binding service for multiple first clients.
  • the seed provided by the embodiment of the present invention may be any positive integer.
  • FIG. 7, illustrates a token generation algorithm, which is provided by a second client side according to an embodiment of the present invention.
  • the token generation algorithm can include:
  • step S1 a seed for generating a token is obtained.
  • step S2 the local current system time is obtained.
  • step S3 the token is obtained according to a preset hash algorithm.
  • the time parameter corresponding to the current system time may be obtained according to the current system time. For example, if there is a time parameter every 60s, the current system time only needs to be accurate to obtain the time parameter, and 60s is a time parameter, and the dynamic password corresponding to the same seed is changed every 60s;
  • the seed and the time parameter are actual parameters of the hash algorithm.
  • the token in the embodiment of the present invention is composed of six digits.
  • FIG. 8 illustrates a token verification algorithm.
  • the server side token verification algorithm provided by the embodiment of the present invention may include:
  • Step S110 Acquire a seed to be verified and a token to be verified.
  • Step S120 Acquire a local current system time.
  • Step S130 obtaining a target token according to a preset hash algorithm.
  • the time parameter corresponding to the current system time may be obtained according to the current system time. For example, if there is a time parameter every 60s, the current system time only needs to be accurate to obtain the time parameter, and 60s is a time parameter, and the dynamic password corresponding to the same seed is changed every 60s;
  • the seed and the time parameter are actual parameters of the hash algorithm.
  • the hash algorithm is the same as the hash algorithm in step S3.
  • Step S140 determining whether the target token is the same as the token to be verified.
  • step S150 if yes, the verification is passed.
  • the target token is the same as the token to be verified, and the seed to be verified is the same as the seed that generates the token to be verified, that is, the seed to be verified has a legal correspondence with the token to be verified. Relationship, therefore, verification passed.
  • Step S160 if no, the verification fails.
  • the above token generation algorithm and token verification algorithm both depend on the current system time of the hardware executing the algorithm, because Therefore, the above token verification algorithm has a small probability that the verification result may be unreliable.
  • a time parameter as an example, if the value of the second unit of the current system time of the token obtained by the second client in S3 is 59, and the obtained token is transmitted to the verification server for 2 seconds, then When the verification server verifies the token, the second unit of the current system time of the verification server is 01, and the time parameter obtained when the S130 is executed by the second client is inconsistent, which inevitably causes the verification to fail.
  • This verification failure is only caused by the time problem and has nothing to do with the seed. It can be seen that the verification result is unreliable. In this case, the verification can only be re-verified, thus wasting the processing resources of the client and the server.
  • FIG. 9 illustrates another token verification algorithm.
  • Another server-side token verification algorithm provided by the embodiment of the present invention includes:
  • Step S210 Acquire a seed to be verified and a token to be verified.
  • Step S220 Acquire a local current system time.
  • Step S230 obtaining a first target token and a second target token according to a preset hash algorithm.
  • the time parameter corresponding to the current system time may be obtained according to the current system time. For example, if there is a time parameter every 60s, the current system time only needs to be accurate to obtain the time parameter, and 60s is a time parameter, and the dynamic password corresponding to the same seed is changed every 60s;
  • the first target token is obtained by using the seed and the time parameter as actual parameters of the hash algorithm, and the last time parameter of the seed and the time parameter is used as the actual of the hash algorithm.
  • the parameter gets the second target token.
  • the hash algorithm is the same as the hash algorithm in step S3.
  • Step S240 determining whether the first target token is the same as the token to be verified.
  • step S250 if yes, the verification is passed.
  • Step S260 if no, determining whether the second target token is the same as the token to be verified.
  • step S270 if yes, the verification is passed.
  • Step S280 if no, the verification fails.
  • This token verification algorithm can largely avoid the situation where the verification result is unreliable, thereby avoiding waste of processing resources of the client and the server caused by re-authentication.
  • the verification may be performed according to the verification.
  • the current system time of the server performs time verification on the second client to avoid unreliable verification results due to the synchronization between the current system time of the verification server and the current system time of the second client.
  • correction methods there are four types of correction methods:
  • the verification server actively pushes the first time to the second client periodically or irregularly, and the first time is the current system time when the verification server is pushed.
  • the verification server actively pushes the first time to the first client periodically or irregularly, the first time is Verifying the current system time of the server at the time of push; then the first time is actively pushed by the first client to the second client.
  • the verification server sends the first time to the first client, where the first time is the current system time when the verification server is transmitting; and then at the first client During the interaction with the second client, the first time is actively sent by the first client to the second client.
  • the verification server sends the first time to the second client, where the first time is the current system time when the verification server is transmitting.
  • FIG. 10 illustrates a time correction method of the second client, including:
  • Step T1 acquiring a first time from the verification server; the first time is a current system time of the verification server;
  • Step T2 acquiring a local second time; the second time is a current local system time at the moment of acquiring the first time;
  • Step T3 calculating a difference between the first time and the second time
  • step T4 the difference is stored.
  • step S3 a time correction value is first obtained from the current system time acquired in step S2 and the difference value stored in step T4, and then the time parameter is obtained from the time correction value.
  • the embodiment of the invention provides a time correction method, which can prevent the verification result from being unreliable due to the unsynchronization between the current system time of the verification server and the current system time of the second client, thereby further improving the reliability of the verification result and avoiding The waste of processing resources of the client and server caused by the verification.
  • the token generation algorithm and the token verification algorithm used in the embodiments of the present invention have other forms.
  • the token can be used to complete the legal relationship between the seed and the token. The verification can be done, and will not be described here.
  • the embodiment Based on the token generation algorithm and the token verification algorithm having the corresponding relationship, the embodiment provides an identity verification method based on the successful execution of the identity binding process.
  • the authentication method may be implemented by using a token, a swipe, or a one-click login.
  • the authentication method has no limitation on the first client and the second client, and therefore, may be in multiple
  • the identity of the user is verified before a sensitive operation such as a payment class. It can also be used to verify the identity of the user before modifying the password. The user information is lost and the identity of the user is verified when the application is reported to the first client. Further, the authentication method can also be applied to one or more first clients.
  • FIG. 11 illustrates an authentication method, including:
  • Step 401 The first client acquires an account in response to the identity verification instruction.
  • the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie.
  • the first client also shows the user an interface for inputting a token.
  • the first client is used as a security center, and can be used to input a token generated by the second verification seed corresponding to the security center.
  • the first client may also be based on the self.
  • the user data is stored to verify the identity of the user, that is, the account verification is performed to verify the legality of the account.
  • the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present invention can be used in combination with other identity verification methods.
  • Step 402 The first client queries, according to the account, a first verification seed corresponding to the account.
  • the first client stores the corresponding relationship between the account and the first verification seed, and accordingly, the corresponding first verification seed can be obtained according to the account.
  • Step 403 The second client generates a token according to the second verification seed and enables the token to be obtained by the first client.
  • the second client generates a token according to the locally stored second verification seed and token generation algorithm. If the second client only stores one seed, the seed is a second verification seed; the token is obtained according to the second verification seed; if the second client stores multiple seeds, the user selects One is used as the second verification seed and generates a token.
  • the user inputs the token to the first client, and the input page is FIG. 12 .
  • a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed.
  • FIG. 13 shows an interface for a user to select a token.
  • the second client in the binding process can store multiple correspondences, that is, the correspondence between the seed and the first client corresponding to the seed, and the first seed is taken as an example, which corresponds to the webpage mailbox, and is generated.
  • the token is 787246; for example, the second seed corresponds to the security center, and the generated token is 896332. After the user selects the token and presses the OK button, the token can be sent to the first client.
  • Step 404 The first client obtains the token and transmits the first verification seed and the token to an authentication server.
  • step 405 the verification server obtains the verification result.
  • the verification server may verify, according to the token verification algorithm, whether the first verification seed has a legal correspondence with the token, thereby obtaining a verification result.
  • the token verification algorithm of the server and the second client token generation algorithm have an algorithm corresponding to the algorithm, and may be obtained by the verification server and the second client through negotiation.
  • Step 406 The verification server sends the verification result to the first client.
  • Step 407 The first client determines whether the verification is passed, and if the verification passes, the identity verification passes.
  • the second verification seed stored by the second client in step 403 is the same as the first verification seed corresponding to the account of the user in the first client.
  • step 408 if the verification fails, the identity verification fails.
  • the identity verification method provided by the embodiment of the present invention can be applied to multiple applications, and each application (the first client) does not affect each other, thereby solving the problem that if the user uses multiple applications at the same time in the prior art, the binding needs to be multiple. Security center, cumbersome operation.
  • the verification server does not store the correspondence between the account in the first client and the first verification seed, and is only responsible for generating the seed and verifying the correspondence between the seed and the token, so that the application is not involved.
  • Sensitive data of a client fully guarantees the data security of the first client.
  • the authentication server provides an authentication service for the first client without requiring the first client to disclose its data privacy to the authentication server.
  • FIG. 14 illustrates another authentication method, including:
  • Step 501 The first client acquires an account in response to the identity verification instruction.
  • the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie.
  • the first client may also verify the identity of the user according to the stored user data, that is, perform account verification to verify the validity of the account. For example, the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present invention can be used in combination with other identity verification methods.
  • Step 502 The first client queries, according to the account, a first verification seed corresponding to the account.
  • the first client stores the corresponding relationship between the account and the first verification seed, and accordingly, the corresponding first verification seed can be obtained according to the account.
  • Step 503 The first client generates a verification message according to the account.
  • the verification message may include a verification message generation time and the account number.
  • the content of the verification message may be “XXX time, XXX account performs XXX operation, please confirm whether it is operated by itself”.
  • Step 504 The first client sends the first verification seed and the verification message to the verification server.
  • Step 505 The verification server acquires the first verification seed and the verification message, and generates a corresponding message number.
  • the server also needs to maintain the verification message, such as adding, inserting, and deleting the verification message.
  • the verification server stores the first verification seed and the verification message, and generates a message number according to a preset message number generation algorithm, where the message number corresponds to the verification message, and the message number There is also a one-to-one correspondence with the first verification seed.
  • the message number generation algorithm may be generated in the order of receiving the verification message, or may be generated according to the time when the verification message is received, or may be based on the time and verification of receiving the verification message.
  • the sender identifier of the message (the identifier of the first client, which carries the identifier during communication with the authentication server) is generated.
  • Step 506 The verification server sends the message number to the first client.
  • Step 507 The first client acquires the message number and enables the second client to obtain the message number.
  • FIG. 15 shows a generation page of the second verification barcode.
  • the first client generates a second verification barcode according to the message number
  • the second client obtains a message number by scanning and parsing the second verification barcode
  • the second verification barcode may be a two-dimensional code or a barcode.
  • the message number may also be directly sent by the first client to the second client.
  • Step 508 The second client acquires the verification message corresponding to the message number from the verification server according to the message number.
  • the verification message is displayed by the second client, please refer to FIG. 16, which shows the second client.
  • the interface that displays the verification message. If the user is the person and wants to continue the authentication, click "I am operating", that is, send a confirmation command to the second client; otherwise, click "reject", then the second client directly informs the verification server that the authentication process ends. Correspondingly, the authentication server notifies the first client that the authentication failed, and the authentication process ends.
  • Step 509 The second client generates a token according to the second verification seed in response to the confirmation instruction, and transmits the token and the message number to the verification server.
  • the second client generates a token according to the locally stored second verification seed and token generation algorithm. If the second client only stores one seed, the seed is a second verification seed; the token is obtained according to the second verification seed; if the second client stores multiple seeds, the user selects One is used as the second verification seed and generates a token. In another embodiment, a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed.
  • step 510 the verification server obtains the verification result.
  • the verification server queries the first verification seed according to the message number obtained from the second client, and verifies whether the first verification seed has a legal correspondence relationship with the token according to the token verification algorithm, thereby obtaining a verification result.
  • the token verification algorithm of the server and the token generation algorithm of the second client are algorithms corresponding to each other, and may be obtained by the verification server and the second client through negotiation.
  • Step 511 The verification server sends the verification result to the first client.
  • step 512 the first client determines whether the verification is passed, and if the verification passes, the identity verification passes.
  • the second verification seed stored by the second client in step 509 is the same as the first verification seed corresponding to the account of the user in the first client.
  • step 513 if the verification fails, the identity verification fails.
  • This embodiment provides another authentication method different from the method of inputting a token, which enriches the authentication method and avoids the user manually inputting the token, which makes the identity verification more convenient.
  • FIG. 17, illustrates another authentication method, including:
  • Step 601 The first client acquires an account in response to the identity verification instruction.
  • the account number may be input by the user, or may be obtained by the first client by relying on the record of the browser cookie.
  • the first client may also verify the identity of the user according to the stored user data, that is, perform account verification to verify the validity of the account. For example, the first client may require the user to input a password corresponding to the account. If the password is correct, the account verification is passed before the following authentication step can be performed. It can be seen that the identity verification mode provided by the embodiment of the present invention can be used in combination with other identity verification methods.
  • Step 602 The first client queries, according to the account, a first verification seed corresponding to the account.
  • the first client stores the corresponding relationship between the account and the first verification seed, and accordingly, the corresponding first verification seed can be obtained according to the account.
  • Step 603 The first client generates a verification message according to the account.
  • the verification message may include a verification message generation time and the account number.
  • the content of the verification message may be “XXX time, XXX account performs XXX operation, please confirm whether it is operated by itself”.
  • Step 604 The first client sends the first verification seed and the verification message to the verification server, and requests a server push operation from the verification server.
  • Step 605 The verification server acquires the first verification seed and the verification message, and generates a corresponding message number.
  • the server also needs to maintain the verification message, such as adding, inserting, and deleting the verification message.
  • the verification server stores the first verification seed and the verification message, and generates a message number according to a preset message number generation algorithm, where the message number corresponds to the verification message, and the message number There is also a one-to-one correspondence with the first verification seed.
  • the message number generation algorithm may be generated in the order of receiving the verification message, or may be generated according to the time when the verification message is received, or may be based on the time and verification of receiving the verification message.
  • the sender identifier of the message (the identifier of the first client, which carries the identifier during communication with the authentication server) is generated.
  • Step 606 The verification server pushes the message number and the verification message to the second client in response to the request of the server push operation.
  • HTTP hypertext transfer protocol
  • Step 607 The second client acquires the message number and the verification message.
  • the verification message is displayed by the second client, please refer to FIG. 16, which shows an interface of the second client displaying the verification message. If the user is the person and wants to continue the authentication, click "I am operating", that is, send a confirmation command to the second client; otherwise, click "reject", then the second client directly informs the verification server that the authentication process ends. Correspondingly, the authentication server notifies the first client that the authentication failed, and the authentication process ends.
  • Step 608 The second client generates a token according to the second verification seed in response to the confirmation instruction, and transmits the token and the message number to the verification server.
  • the second client generates a token according to the locally stored second verification seed and token generation algorithm. If the second client only stores one seed, the seed is a second verification seed; the token is obtained according to the second verification seed; if the second client stores multiple seeds, the user selects One is used as the second verification seed and generates a token. In another embodiment, a token may also be generated for each seed, and the user selects the corresponding token according to the selected second verification seed.
  • step 609 the verification server obtains the verification result.
  • the verification server queries the first verification seed according to the message number obtained from the second client, and verifies whether the first verification seed has a legal correspondence relationship with the token according to the token verification algorithm, thereby obtaining a verification result.
  • the algorithm that the server token verification algorithm and the second client token generation algorithm have a corresponding relationship may be obtained by the verification server and the second client through negotiation.
  • Step 610 The verification server sends the verification result to the first client.
  • step 611 the first client determines whether the verification is passed, and if the verification passes, the identity verification passes.
  • the second verification seed stored by the second client in step 608 is the same as the first verification seed corresponding to the account of the user in the first client.
  • step 612 if the verification fails, the identity verification fails.
  • the identity verification method provided in this embodiment is a one-key login verification method, that is, the user only needs to send a confirmation instruction to the second client, and does not need to perform other operations.
  • the method in this embodiment is more convenient.
  • the identity verification method if the user uses the mobile phone to perform the function of the second client, after the mobile phone is lost, the user may apply to the first client to use the new mobile phone for identity binding or verification, as long as the new one
  • the mobile phone can perform the functions of the second client. It can be seen that the identity binding method and the identity verification method provided by the embodiments of the present invention have the advantages of being not affected by the loss of the mobile phone and having low operation cost compared with the currently used secret security mobile phone authentication method; Compared with other common authentication methods, it has the significant advantages of high safety factor, low cost and wide application range.
  • FIG. 18 shows a block diagram of an identity verification apparatus, which can implement the functions of the first client in the above method example, and the functions can be implemented by hardware or by corresponding software implementation by hardware.
  • the device can include:
  • the account obtaining module 701 is configured to obtain an account. Steps 302, 401, 501, and 601 can be performed to perform the method embodiments.
  • the first verification seed query module 702 is configured to query, according to the account, a first verification seed corresponding to the account. It can be used to perform steps 402, 502, and 602 of the method embodiments.
  • the verification message generating module 703 is configured to generate an authentication message according to the account. It can be used to perform steps 503 and 603 of the method embodiment.
  • the verification message sending module 704 is configured to send the first verification seed and the verification message to the verification server. It can be used to perform steps 504 and 604 of the method embodiment.
  • the verification result obtaining module 705 is configured to obtain the verification result. It can be used to perform steps 308, 406, 511, and 610 of the method embodiments.
  • FIG. 19 shows a block diagram of related modules included in the apparatus for performing a binding process:
  • the first verification seed obtaining module 706 is configured to obtain a first verification seed. It can be used to perform step 303 of the method embodiment.
  • the seed generation module 707 is configured to generate a seed corresponding to the first verification seed. It can be used to perform step 304 of the method embodiment.
  • the token obtaining module 708 is configured to acquire a token generated by the second client. Steps that can be used to perform method embodiments Steps 305 and 403.
  • the combination sending module 709 is configured to send the first verification seed and the token to the verification server. It can be used to perform steps 306 and 404 of the method embodiment.
  • the first verification seed storage module 710 is configured to: after the verification result obtaining module 705 obtains the verification result, if the verification is passed, storing the first verification seed, and the corresponding relationship between the first verification seed and the second client. It can be used to perform step 309 of the method embodiment.
  • the token acquisition module 708 and the combined transmission module 709 can also be used in the identity verification process.
  • the device may further include:
  • a seed sending module configured to send the seed to the second client. It can be used to perform step 305 of the method embodiment.
  • the device may further include:
  • the first verification barcode generating module is configured to generate a first verification barcode according to the seed. It can be used to perform step 305 of the method embodiment.
  • the device may further include:
  • the message number obtaining module is configured to obtain a message number corresponding to the verification message sent by the verification server. It can be used to perform step 506 of the method embodiment.
  • the device may further include:
  • a message number sending module configured to send the message number. It can be used to perform step 507 of the method embodiment.
  • the device may further include:
  • the second verification barcode generating module is configured to generate a second verification barcode according to the message number. It can be used to perform step 507 of the method embodiment.
  • the device may further include:
  • a request module for requesting a server push operation from an authentication server It can be used to perform step 604 of the method embodiment.
  • the first verification seed obtaining module 706 includes:
  • a collection obtaining unit configured to acquire an unused seed set, where the unused seeds are all from an authentication server
  • a selecting unit configured to randomly select one seed in the unused seed set as the first verification seed.
  • FIG. 20 illustrates an identity verification apparatus, which may be used to implement the functions of the second client in the above method example, and the functions may be implemented by hardware, or may be implemented by hardware.
  • the device can include:
  • the message obtaining module 801 is configured to obtain a message number and a verification message. It can be used to perform steps 507, 508, and 607 of the method embodiments.
  • the display module 802 is configured to display a verification message.
  • the user instruction monitoring module 803 is configured to detect a user instruction, and the user instruction includes a confirmation instruction.
  • the second verification seed obtaining module 804 is configured to obtain a second verification seed. It can be used to perform steps 403, 509 and 608 of the method embodiment.
  • the token generation module 805 is configured to generate a token. It can be used to perform steps 305, 403, 509 and 608 of the method embodiment.
  • the transmission module 806 is configured to transmit the message number and the token to the verification server. It can be used to perform steps 509 and 608 of the method embodiment.
  • the device may further include:
  • Verify the seed acquisition module to get the verification seed It can be used to perform step 305 of the method embodiment.
  • a second verification seed storage module configured to store the second verification seed. It can be used to perform step 309 of the method embodiment.
  • the device may further include:
  • a combined storage module configured to store a correspondence between the second verification seed and the first client. It can be used to perform step 309 of the method embodiment.
  • FIG. 21 shows a block diagram of a token generation module, which includes:
  • the time parameter obtaining unit 8051 is configured to obtain a time parameter according to the current system time. It can be used to perform steps S2 and S3 of the method embodiment.
  • the token calculation unit 8052 is configured to calculate a token according to a preset hash algorithm. It can be used to perform step S3 of the method embodiment.
  • FIG. 22 shows a block diagram of a module related to time correction, including:
  • the first time obtaining module 811 is configured to acquire the first time from the verification server. It can be used to perform step T1 of the method embodiment.
  • the second time acquisition module 812 is configured to acquire the local second time. It can be used to perform step T2 of the method embodiment.
  • the difference calculation module 813 is configured to calculate a difference between the first time and the second time. It can be used to perform step T3 of the method embodiment.
  • the difference storage module 814 is configured to store the difference. It can be used to perform step T4 of the method embodiment.
  • the time parameter obtaining unit 8051 includes:
  • the time correction value calculation module is configured to calculate a time correction value according to the current system time and the difference.
  • the time parameter acquisition module is configured to obtain a time parameter according to the time correction value.
  • the message obtaining module 801 may further include:
  • a message number obtaining unit configured to obtain a message number from the first client
  • a verification message obtaining unit configured to acquire the verification message from the verification server according to the message number.
  • the message number obtaining unit may further include:
  • a second verification barcode acquisition module configured to acquire a second verification barcode
  • a parsing module configured to parse the second verification barcode to obtain a message number.
  • the message obtaining module 801 may further include:
  • a direct acquisition unit for directly acquiring a message number and a verification message pushed by the verification server.
  • An exemplary embodiment of the present invention further provides an identity verification system. As shown in FIG. 25, the system includes a first client 901, a second client 902, and an authentication server 903.
  • the first client 901 obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server.
  • 903 Obtain a message number from the verification server 903;
  • the second client 902 obtains the message number from the first client 901; acquires a verification message corresponding to the message number from the verification server 903 according to the message number; in response to the confirmation instruction to the verification message, Generating a token according to the second verification seed, and transmitting the token and the message number to the verification server 903;
  • the verification server 903 queries the first verification seed according to the message number obtained from the second client 902; obtains a verification result by verifying whether the first verification seed has a legal correspondence relationship with the token, and sends the verification result To the first client 901;
  • the first client 901 acquires a verification result from the verification server 903.
  • the first client 901 and the second client 902 may be the identity verification device described above.
  • an exemplary embodiment of the present invention further provides an identity verification system, where the system includes a first client 901, a second client 902, and an authentication server 903;
  • the first client 901 obtains an account in response to the identity verification instruction; queries the first verification seed corresponding to the account according to the account; obtains a token generated by the second client 902; and the first verification seed and the The token is transmitted to the verification server 903 and the verification result is obtained;
  • the second client 902 generates a token according to the second verification seed and enables the token to be obtained by the first client 901;
  • the verification server 903 obtains the verification result by verifying whether the first verification seed has a legal correspondence with the token, and sends the verification result to the first client 901.
  • the first client 901 and the second client 902 may be the identity verification device described above.
  • an exemplary embodiment of the present invention further provides an identity verification system, where the system includes a first client 901, a second client 902, and an authentication server 903;
  • the first client 901 obtains an account in response to the identity verification instruction, queries a first verification seed corresponding to the account according to the account, generates a verification message, and sends the first verification seed and the verification message to the verification server. 903, and requesting a server push operation from the verification server 903;
  • the verification server 903 generates a message number corresponding to the first verification seed and the verification message, and pushes the message number and the verification message to the second client 902;
  • the second client 902 generates a token according to the second verification seed in response to the confirmation instruction of the verification message, and transmits the token and the message number to the verification server 903;
  • the verification server 903 queries the first verification seed according to the message number obtained from the second client 902; obtains a verification result by verifying whether the first verification seed has a legal correspondence relationship with the token, and sends the verification result To the first client 901;
  • the first client 901 acquires a verification result from the verification server 903.
  • the first client 901 and the second client 902 may be the identity verification device described above.
  • FIG. 23 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the terminal is configured to implement the functions of the first client or the second client in the identity verification method provided in the foregoing embodiment.
  • the terminal may include an RF (Radio Frequency) circuit 110, a memory 121 including one or more computer readable storage media, an input unit 130, a display unit 142, a sensor 150, an audio circuit 163, and a WiFi (wireless fidelity,
  • the Wireless Fidelity module 170 includes a processor 180 having one or more processing cores, and a power supply 190 and the like. It will be understood by those skilled in the art that the terminal structure shown in FIG. 23 does not constitute a limitation to the terminal, and may include more or less components than those illustrated, or some components may be combined, or different component arrangements. among them:
  • the RF circuit 110 can be used for transmitting and receiving information or during a call, and receiving and transmitting signals. Specifically, after receiving downlink information of the base station, the downlink information is processed by one or more processors 180. In addition, the data related to the uplink is sent to the base station. .
  • the RF circuit 110 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier). , duplexer, etc.
  • RF circuitry 110 can also communicate with the network and other devices via wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access). , Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), e-mail, SMS (Short Messaging Service), and the like.
  • GSM Global System of Mobile communication
  • GPRS General Packet Radio Service
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • e-mail Short Messaging Service
  • the memory 121 can be used to store software programs and modules, and the processor 180 executes various functional applications and data processing by running software programs and modules stored in the memory 121.
  • the memory 121 may mainly include a storage program area and an storage data area, wherein the storage program area may store an operating system, an application required for the function, and the like; the storage data area may store data or the like created according to the use of the terminal.
  • the memory 121 may include a high speed random access memory, and may also include a nonvolatile memory such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. Accordingly, the memory 121 may also include a memory controller to provide access to the memory 121 by the processor 180 and the input unit 130.
  • the input unit 130 can be configured to receive input numeric or character information and to generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function controls.
  • input unit 130 can include touch-sensitive surface 131 as well as other input devices 132.
  • Touch-sensitive surface 131 also referred to as a touch display or trackpad, can collect touch operations on or near the user (such as a user using a finger, stylus, etc., on any suitable object or accessory on touch-sensitive surface 131 or The operation near the touch-sensitive surface 131) and driving the corresponding connecting device according to a preset program.
  • the touch-sensitive surface 131 can include two portions of a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • the processor 180 is provided and can receive commands from the processor 180 and execute them.
  • resistive, capacitive, infrared, and Various types such as surface acoustic waves implement the touch-sensitive surface 131.
  • the input unit 130 can also include other input devices 132.
  • other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • Display unit 142 can be used to display information entered by the user or information provided to the user as well as various graphical user interfaces of the terminal, which can be composed of graphics, text, icons, video, and any combination thereof.
  • the display unit 142 may include a display panel 141.
  • the display panel 141 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like.
  • the touch-sensitive surface 131 may cover the display panel 141, and when the touch-sensitive surface 131 detects a touch operation thereon or nearby, it is transmitted to the processor 180 to determine the type of the touch event, and then the processor 180 according to the touch event The type provides a corresponding visual output on display panel 141.
  • touch-sensitive surface 131 and display panel 141 are implemented as two separate components to implement input and input functions, in some embodiments, touch-sensitive surface 131 can be integrated with display panel 141 for input. And output function.
  • the terminal may also include at least one type of sensor 150, such as a light sensor, a motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 141 according to the brightness of the ambient light, and the proximity sensor may close the display panel 141 when the terminal moves to the ear. And / or backlight.
  • the gravity acceleration sensor can detect the magnitude of acceleration in each direction (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity.
  • attitude of the terminal such as horizontal and vertical screen switching, related Game, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for the terminal can also be configured with gyroscopes, barometers, hygrometers, thermometers, infrared sensors and other sensors, here No longer.
  • An audio circuit 163, a speaker 161, and a microphone 162 can provide an audio interface between the user and the terminal.
  • the audio circuit 163 can transmit the converted electrical data of the received audio data to the speaker 161, and convert it into a sound signal output by the speaker 161; on the other hand, the microphone 162 converts the collected sound signal into an electrical signal, and the audio circuit 163 After receiving, it is converted into audio data, and then processed by the audio data output processor 180, transmitted to the terminal, for example, via the RF circuit 110, or outputted to the memory 121 for further processing.
  • the audio circuit 163 may also include an earbud jack to provide communication of the peripheral earphones with the terminal.
  • WiFi is a short-range wireless transmission technology
  • the terminal can help users to send and receive emails, browse web pages, and access streaming media through the WiFi module 170, which provides wireless broadband Internet access for users.
  • FIG. 23 shows the WiFi module 170, it can be understood that it does not belong to the essential configuration of the terminal, and may be omitted as needed within the scope of not changing the essence of the invention.
  • the processor 180 is a control center of the terminal, which connects various parts of the entire terminal using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 121, and calling data stored in the memory 121. Performing various functions and processing data of the terminal to perform overall monitoring on the terminal.
  • the processor 180 may include one or more processing cores; preferably, the processor 180 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like.
  • the modem processor primarily handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 180.
  • the terminal further includes a power source 190 (such as a battery) for supplying power to each component.
  • a power source 190 such as a battery
  • the power source can be logically connected to the processor 180 through the power management system to manage functions such as charging, discharging, and power management through the power management system.
  • Power supply 190 may also include any one or more of a DC or AC power source, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and the like.
  • the terminal may further include a camera, a Bluetooth module, and the like, and details are not described herein again.
  • the display unit of the terminal is a touch screen display
  • the terminal further includes a memory, and one or more programs, wherein one or more programs are stored in the memory and configured to be processed by one or more
  • the program executes one or more programs that include instructions for executing the authentication method of the first client or the second client described above.
  • FIG. 24 is a schematic structural diagram of a server according to an embodiment of the present invention.
  • the server is used to implement the authentication method of the server provided in the above embodiment. Specifically:
  • the server 1200 includes a central processing unit (CPU) 1201, a system memory 1204 including a random access memory (RAM) 1202 and a read only memory (ROM) 1203, and a system bus 1205 that connects the system memory 1204 and the central processing unit 1201.
  • the server 1200 also includes a basic input/output system (I/O system) 1206 that facilitates transfer of information between various devices within the computer, and mass storage for storing the operating system 1213, applications 1214, and other program modules 1215.
  • I/O system basic input/output system
  • the basic input/output system 1206 includes a display 1208 for displaying information and an input device 1209 such as a mouse, keyboard, etc. for user input of information.
  • the display 1208 and the input device 1209 are both connected to the central processing unit 1201 via an input-output controller 1210 that is coupled to the system bus 1205.
  • the basic input/output system 1206 can also include an input output controller 1210 for receiving and processing input from a plurality of other devices, such as a keyboard, mouse, or electronic stylus.
  • input-output controller 1210 also provides output to a display screen, printer, or other type of output device.
  • the mass storage device 1207 is connected to the central processing unit 1201 by a mass storage controller (not shown) connected to the system bus 1205.
  • the mass storage device 1207 and its associated computer readable medium provide non-volatile storage for the server 1200. That is, the mass storage device 1207 can include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.
  • the computer readable medium can include computer storage media and communication media.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.
  • Computer storage media include RAM, ROM, EPROM, EEPROM, flash memory or other solid state storage technologies, CD-ROM, DVD or other optical storage, tape cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices.
  • RAM random access memory
  • ROM read only memory
  • EPROM Erasable programmable read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • the server 1200 may also be operated by a remote computer connected to the network through a network such as the Internet. That is, the server 1200 can be connected to the network 1212 through the network interface unit 1211 connected to the system bus 1205, or can also be connected to other types using the network interface unit 1211. Network or remote computer system (not shown).
  • the memory also includes one or more programs, the one or more programs being stored in a memory and configured to be executed by one or more processors.
  • the one or more programs described above include instructions for executing the method of the server described above.
  • a non-transitory computer readable storage medium comprising instructions, such as a memory comprising instructions executable by a processor of a terminal to perform various steps in the above method embodiments, or The above instructions are executed by the processor of the server to complete the steps of the background server side in the above method embodiment.
  • the non-transitory computer readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.
  • the embodiments of the present invention can be combined with the existing identity verification methods by using the identity verification method, apparatus, and system provided by the embodiments of the present invention.
  • the user can first pass the identity verification of the first client and generate a token by using the second client that is held by the user. After the token is verified by the token of the verification server, the identity verification can be formally passed, compared to the ordinary identity. Verification, higher security.
  • the authentication server can provide a service for authenticating the user token for multiple first clients, and its function is equivalent to the security center. If the user uses multiple applications, it is no longer necessary to bind multiple security centers, thereby simplifying user operations.
  • a plurality as referred to herein means two or more.
  • "and/or” describing the association relationship of the associated objects, indicating that there may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately.
  • the character "/" generally indicates that the contextual object is an "or" relationship.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

Les modes de réalisation de la présente invention concernent un procédé, un dispositif, et un système d'authentification d'identité. Le procédé comprend les étapes suivantes : un premier client obtient un numéro de compte en réponse à une instruction d'authentification d'identité ; interroge un premier germe d'authentification correspondant au numéro de compte ; génère un message d'authentification ; envoie le premier germe d'authentification et le message d'authentification à un serveur d'authentification ; et acquiert un numéro de message à partir du serveur d'authentification. Un second terminal obtient le numéro de message, du premier terminal ; acquiert un message d'authentification correspondant au numéro de message, du serveur de vérification, d'après le numéro de message ; et génère un jeton d'après un second germe d'authentification en réponse à une instruction d'accusé de réception du message d'authentification, et transmet le jeton et le numéro de message au serveur d'authentification. Le serveur d'authentification : interroge le premier germe d'authentification d'après le numéro de message obtenu du second terminal ; acquiert un résultat de vérification en vérifiant si le premier germe d'authentification et le jeton ont une relation de correspondance légale ; et envoie le résultat de vérification au premier terminal. Le premier terminal acquiert le résultat d'authentification à partir du serveur d'authentification.
PCT/CN2017/116140 2016-12-15 2017-12-14 Procédé, dispositif, et système d'authentification d'identité WO2018108123A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611160732.2A CN108234124B (zh) 2016-12-15 2016-12-15 身份验证方法、装置与系统
CN201611160732.2 2016-12-15

Publications (1)

Publication Number Publication Date
WO2018108123A1 true WO2018108123A1 (fr) 2018-06-21

Family

ID=62558031

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/116140 WO2018108123A1 (fr) 2016-12-15 2017-12-14 Procédé, dispositif, et système d'authentification d'identité

Country Status (2)

Country Link
CN (1) CN108234124B (fr)
WO (1) WO2018108123A1 (fr)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108920917A (zh) * 2018-06-27 2018-11-30 努比亚技术有限公司 登录端切换方法、移动终端及计算机可读存储介质
CN110751129A (zh) * 2019-10-30 2020-02-04 深圳市丰巢科技有限公司 一种快递业务的身份验证方法、装置、设备和存储介质
CN111105207A (zh) * 2019-12-11 2020-05-05 深圳供电局有限公司 随机式输电线路现场作业方法与系统
US11677555B2 (en) 2018-10-25 2023-06-13 Advanced New Technologies Co., Ltd. Identity authentication, number saving and sending, and number binding method, apparatus and device

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109376818A (zh) * 2018-10-09 2019-02-22 杭州收盈科技有限公司 一种基于离线动态二维码的加密对时方法
CN111126533B (zh) * 2020-01-08 2023-06-23 牛津(海南)区块链研究院有限公司 基于动态口令的身份认证方法、装置和动态令牌
CN114553445A (zh) * 2020-11-10 2022-05-27 腾讯科技（深圳）有限公司 设备方法、装置、电子设备及可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101582886A (zh) * 2009-04-02 2009-11-18 北京飞天诚信科技有限公司 基于动态口令进行身份认证的方法和系统
US20140006775A1 (en) * 2012-06-28 2014-01-02 International Business Machines Corporation Message originator token verification
CN103546430A (zh) * 2012-07-11 2014-01-29 网易（杭州）网络有限公司 基于移动终端的身份验证方法、移动终端、服务器及系统
WO2015179681A1 (fr) * 2014-05-21 2015-11-26 Square, Inc. Achat par courrier électronique vérifié
CN105119722A (zh) * 2015-08-07 2015-12-02 杭州朗和科技有限公司 一种身份验证方法、设备及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101345620A (zh) * 2007-07-10 2009-01-14 吕秀娥 一种网上在线令牌的互联网用户帐号密码保护方法
CN103297403B (zh) * 2012-03-01 2018-11-30 盛趣信息技术（上海）有限公司 一种实现动态密码认证的方法和系统
US9130753B1 (en) * 2013-03-14 2015-09-08 Emc Corporation Authentication using security device with electronic interface
CN112134708A (zh) * 2014-04-15 2020-12-25 创新先进技术有限公司 一种授权方法、请求授权的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101582886A (zh) * 2009-04-02 2009-11-18 北京飞天诚信科技有限公司 基于动态口令进行身份认证的方法和系统
US20140006775A1 (en) * 2012-06-28 2014-01-02 International Business Machines Corporation Message originator token verification
CN103546430A (zh) * 2012-07-11 2014-01-29 网易（杭州）网络有限公司 基于移动终端的身份验证方法、移动终端、服务器及系统
WO2015179681A1 (fr) * 2014-05-21 2015-11-26 Square, Inc. Achat par courrier électronique vérifié
CN105119722A (zh) * 2015-08-07 2015-12-02 杭州朗和科技有限公司 一种身份验证方法、设备及系统

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108920917A (zh) * 2018-06-27 2018-11-30 努比亚技术有限公司 登录端切换方法、移动终端及计算机可读存储介质
US11677555B2 (en) 2018-10-25 2023-06-13 Advanced New Technologies Co., Ltd. Identity authentication, number saving and sending, and number binding method, apparatus and device
CN110751129A (zh) * 2019-10-30 2020-02-04 深圳市丰巢科技有限公司 一种快递业务的身份验证方法、装置、设备和存储介质
CN110751129B (zh) * 2019-10-30 2023-05-30 深圳市丰巢科技有限公司 一种快递业务的身份验证方法、装置、设备和存储介质
CN111105207A (zh) * 2019-12-11 2020-05-05 深圳供电局有限公司 随机式输电线路现场作业方法与系统
CN111105207B (zh) * 2019-12-11 2023-03-24 深圳供电局有限公司 随机式输电线路现场作业方法与系统

Also Published As

Publication number Publication date
CN108234124B (zh) 2020-10-16
CN108234124A (zh) 2018-06-29

Similar Documents

Publication Publication Date Title
CN112733107B (zh) 一种信息验证的方法、相关装置、设备以及存储介质
US20210336780A1 (en) Key updating method, apparatus, and system
US10637668B2 (en) Authentication method, system and equipment
WO2018108123A1 (fr) Procédé, dispositif, et système d'authentification d'identité
CN111193695B (zh) 一种第三方账号登录的加密方法、装置及存储介质
CN109600223B (zh) 验证方法、激活方法、装置、设备及存储介质
WO2018177124A1 (fr) Procédé et dispositif et de traitement de service, système de partage de données et support de stockage
WO2017041599A1 (fr) Procédé de traitement de service et dispositif électronique
WO2017185711A1 (fr) Procédé, appareil et système permettant de commander un dispositif intelligent, et support d'informations
CN110399713B (zh) 一种信息认证的方法及相关装置
US12132831B2 (en) Method employed in user authentication system and information processing apparatus included in user authentication system
WO2017118437A1 (fr) Procédé, dispositif, et système de traitement de service
WO2015101273A1 (fr) Procédé de vérification de sécurité et dispositif et système associés
US9635018B2 (en) User identity verification method and system, password protection apparatus and storage medium
CN110198301B (zh) 一种服务数据获取方法、装置及设备
WO2018108062A1 (fr) Procédé et dispositif de vérification d'identité, et support de stockage
WO2017084288A1 (fr) Procédé et dispositif de vérification d'identité
CN107154935B (zh) 业务请求方法及装置
WO2016078504A1 (fr) Procédé et dispositif d'authentification d'identité
WO2017113119A1 (fr) Procédé et dispositif d'association d'application à une caractéristique biologique, et terminal mobile
CN111478849B (zh) 业务访问方法、装置和存储介质
CN110474864B (zh) 一种注册、登录移动应用程序的方法及电子设备
CN104994098A (zh) 文件传输方法以及相关装置和传输系统
CN109600340B (zh) 操作授权方法、装置、终端以及服务器
CN111404933B (zh) 鉴权方法、电子设备及鉴权服务器

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17880850

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17880850

Country of ref document: EP

Kind code of ref document: A1

点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载