Authentication method and system for mobile users

Abstract

The invention provides a mobile user-oriented identity verification method and system, which can realize password-free registration and login, and has the advantages of convenient use, high security, low cost and the like. Among them, the mobile user identity verification method applicable to third-party applications of the Andriod or iOS system includes: completing the access registration of the third-party application on the security service platform device; completing the registration of the security service card application device to establish a user information database . When the user logs in for the first time, the security service platform proxy device SDK sends the user's mobile phone number to the security service platform device for identity verification. If the verification is passed, the security service platform device generates a unique OpenID, and then the security service platform device returns to the user for verification via the SDK. Results and OpenID to third-party applications. When the user logs in for the second time, the SDK sends the OpenID to the security service platform device for identity verification. If the verification is passed, the security service platform device returns the user verification result and the user's mobile phone number to the third-party application through the SDK.

Description

technical field [0001] The invention relates to the technical field of computers and software thereof, in particular to an authentication method and system for mobile users. Background technique [0002] With the development of Internet technology and communication technology, the login scheme of "mobile phone number + SMS verification code" is widely used in business scenarios that need to quickly confirm user identity, such as website registration / login, online payment, etc. The technical principle is as follows: First, the user logs in to the service interface (website or APP), fills in his mobile phone number, and clicks the "Get Verification Code" button. Secondly, the website or APP generates a SMS verification code according to the rules, and pushes the verification code down to the user's mobile terminal through the SMS sending interface provided by the operator. Finally, the user receives the push-down SMS and fills in the verification code on the service interface...

AI Technical Summary

Problems solved by technology

[0004] (1) Users cannot accurately verify the service system: there is no uniform standard for verifying the SMS sending number and sending content, and it is completely determined by the service provider

And usually the service system will not notify the user in advance, so in most cases, the user has no corresponding means to distinguish the authenticity of the verification SMS

In many telecommunications fraud cases today, the victim leaks the verification code to criminals without being able to identify the source of the verification SMS, causing serious problems such as account password reset, online banking mobile phone number unbinding, etc.

[0005] (2) Verification text messages are easy to be intercepted, and the content cannot be encrypted: the main function of ordinary text messages is to transmit short characters between senders and receivers. These characters uniformly adopt the UCS2 encoding scheme, which belongs to plaintext transmission

This has resulted in that once the verification SMS is intercepted, its content will be easily cracked

Images