Multifactor authentication method and system based on mobile terminal

Abstract

The invention provides a multifactor authentication method and system based on a mobile terminal. The method comprises that an application server receives an authentication request and user information transmitted from a user terminal and forwards the user information to an authentication server; the authentication server verifies the user information and sends a verification code filling message to the user terminal if the verification succeeds; the application server sends a verification code acquiring request to the authentication server after receiving the verification code acquiring request, the authentication server generates a verification code, encrypts the verification code into a cryptograph by using a random secret key, and sends the cryptograph to a mobile terminal server and sends the secret key to the application server; the user terminal acquires the secret key on the application server and the mobile terminal acquires the cryptograph on the mobile terminal server and the secret key of the user terminal, and decrypts the cryptograph to obtain the verification code; the user terminal inputs the verification code and sends the verification code to the authentication server; and the authentication server verifies the verification code input by a user and login succeeds if the verification code is correct.

Description

technical field [0001] The invention belongs to the technical field of communication, and in particular relates to a multi-factor authentication method based on a mobile terminal. Background technique [0002] For the application system of the enterprise, being able to verify the identity of the login person is an important basis to ensure that the enterprise information is not leaked. Identity verification is one of the most important lines of defense for enterprise application system data security, and it is also the line of defense most easily attacked by hackers. With the in-depth development of Internet e-commerce, more and more software adopts multi-factor authentication technology, requiring users to provide another identity information in addition to the common user name and password to pass the verification. Another type of identity verification information here refers to other information that can verify the identity of the login person through reserved informatio...

AI Technical Summary

Problems solved by technology

Although this technology has been streamlined on the device and uses the mobile phone that most people have as the terminal for device verification, but for the application system of the enterprise, every time you log in to your own system, you need to send a message to the registrant through the operator. SMS verification code, sending SMS through the operator will inevitably increase the cost of SMS, and the application system login is very frequent, and the identity of the login person can be verified only through the SMS verification code, and its safety factor in identity verification is not high. Very high, and the SMS sent by the operator is not encrypted, if it is intercepted midway, there is also the possibility of information leakage

Images