A mobile terminal-based multi-factor authentication method and system

Abstract

The present invention provides a multi-factor authentication method and system based on a mobile terminal. The method includes: an application server receives an authentication request and user information sent by a user terminal, and forwards the user information to an authentication server; the authentication server verifies the user information; If the verification is successful, it sends a message to the user terminal to fill in the verification code; the application server sends it to the authentication server after receiving the verification code acquisition request initiated by the user terminal, and the authentication server generates a verification code and uses a random key to encrypt the verification code to generate a password. text, and send the ciphertext to the mobile terminal server, and send the key to the application server; the user terminal obtains the key on the application server; the mobile terminal obtains the ciphertext on the mobile terminal server and the key of the user terminal and compares the ciphertext Decrypt to get the verification code; the user terminal enters the verification code and sends it to the authentication server; the authentication server verifies the verification code input by the user, and if it is correct, the login is successful.

Description

technical field [0001] The invention belongs to the technical field of communication, and in particular relates to a multi-factor authentication method based on a mobile terminal. Background technique [0002] For the application system of the enterprise, being able to verify the identity of the login person is an important basis to ensure that the enterprise information is not leaked. Identity verification is one of the most important lines of defense for enterprise application system data security, and it is also the line of defense most easily attacked by hackers. With the in-depth development of Internet e-commerce, more and more software adopts multi-factor authentication technology, requiring users to provide another identity information in addition to the common user name and password to pass the verification. Another type of identity verification information here refers to other information that can verify the identity of the login person through reserved informatio...

AI Technical Summary

Problems solved by technology

Although this technology has been streamlined on the device and uses the mobile phone that most people have as the terminal for device verification, but for the application system of the enterprise, every time you log in to your own system, you need to send a message to the registrant through the operator. SMS verification code, sending SMS through the operator will inevitably increase the cost of SMS, and the application system login is very frequent, and the identity of the login person can be verified only through the SMS verification code, and its safety factor in identity verification is not high. Very high, and the SMS sent by the operator is not encrypted, if it is intercepted midway, there is also the possibility of information leakage

Images