Authentication method and system for mobile subscribers

Abstract

The invention provides an authentication method and system for mobile subscribers, which can realize the password-free registration and login and have advantages of convenience in use, high safety and low cost. The authentication method for the mobile subscribers of a third-party application of an Andriod system or an iOS system comprises the following steps: completing access registration of a third-party application on a safety service platform apparatus; and registering a safety service card application apparatus so as to establish a user information database; and when a user logs in at a first time, transmitting, by the safety service platform proxy apparatus SDK, a mobile phone number of a user to the safety service platform apparatus to perform the authentication, if the mobile phone number of the user passes the authentication, generating, by the safety service platform apparatus, an exclusive OpenID, and returning, by the safety service platform apparatus, a user authentication result and the OpenID to the third-party application by virtue of the SDK; and when the user logs in at a second time, transmitting, by the SDK, the OpenID to the safety service platform apparatus to perform the authentication, and if the OpenId passes the authentication, returning, by the safety service platform apparatus, the user authentication result and the user mobile phone number to the third-party application by virtue of the SDK.

Description

technical field [0001] The invention relates to the technical field of computers and software thereof, in particular to an authentication method and system for mobile users. Background technique [0002] With the development of Internet technology and communication technology, the login scheme of "mobile phone number + SMS verification code" is widely used in business scenarios that need to quickly confirm user identity, such as website registration / login, online payment, etc. The technical principle is as follows: First, the user logs in to the service interface (website or APP), fills in his mobile phone number, and clicks the "Get Verification Code" button. Secondly, the website or APP generates a SMS verification code according to the rules, and pushes the verification code down to the user's mobile terminal through the SMS sending interface provided by the operator. Finally, the user receives the push-down SMS and fills in the verification code on the service interface...

AI Technical Summary

Problems solved by technology

[0004] (1) Users cannot accurately verify the service system: there is no uniform standard for verifying the SMS sending number and sending content, and it is completely determined by the service provider

And usually the service system will not notify the user in advance, so in most cases, the user has no corresponding means to distinguish the authenticity of the verification SMS

In many telecommunications fraud cases today, the victim leaks the verification code to criminals without being able to identify the source of the verification SMS, causing serious problems such as account password reset, online banking mobile phone number unbinding, etc.

[0005] (2) Verification text messages are easy to be intercepted, and the content cannot be encrypted: the main function of ordinary text messages is to transmit short characters between senders and receivers. These characters uniformly adopt the UCS2 encoding scheme, which belongs to plaintext transmission

This has resulted in that once the verification SMS is intercepted, its content will be easily cracked

Images