User identity authentication method and device based on dynamic verification code

Abstract

The invention relates to the technical field of computers, and discloses a user identity authentication method and device based on a dynamic verification code, and the method comprises the steps: generating an encryption object in response to an identity authentication request, the encryption object comprising a random number and a random key; performing asymmetric encryption on the encrypted object based on a pre-stored user public key to generate an encrypted ciphertext; converting the encrypted ciphertext into a two-dimensional code, sending the two-dimensional code to a client for display, and activating a dynamic verification code input interface; receiving a dynamic verification code input by a user through a client, and performing encryption operation on the random number through the random key to generate a corresponding reference code; and comparing the dynamic verification code with the reference code to generate a user identity authentication result. According to the invention, safe and networking-free user identity authentication can be realized, the security and convenience of user identity authentication are improved, and the problems of insufficient security, dependence on a network or time synchronization and the like in a traditional mode are solved.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a user authentication method and apparatus based on dynamic verification codes. Background Technology

[0002] In the field of information security, identity authentication is a crucial link in ensuring system security. With the widespread use of network applications, traditional single-password authentication methods are no longer sufficient to meet the needs of high-security scenarios due to their vulnerability to cracking and misuse. Two-factor authentication technology, due to its security advantages, has gradually become the mainstream solution and is widely used in various web application systems.

[0003] Currently, two-factor authentication is mainly implemented in the following ways: one is by using hardware devices such as mobile Ukeys, but this method suffers from inconvenience and high hardware costs; another is by using dynamic codes on mobile phones for authentication, which can be further divided into online and offline scenarios. In online scenarios, the server typically pushes the dynamic code to the mobile device; however, this method relies on the stability of the network connection and carries the security risk of information being intercepted or tampered with during transmission. In offline scenarios, a common practice is for the mobile device to generate a dynamic code using a hash encryption based on a timestamp, and the server uses the same method for verification. However, this method is greatly affected by the accuracy of time synchronization, and the randomness of the timestamp itself is limited, making it predictable. In addition, some solutions require the mobile device to be directly connected to the enterprise's backend system, which not only increases the complexity of system deployment but may also lead to data privacy leaks.

[0004] In summary, existing identity authentication technologies suffer from insufficient security and overlapping applicability in practical applications. In particular, in offline environments, balancing the security and generation synchronization of dynamic verification codes has become an urgent problem to be solved.

[0005] The preceding description is intended to provide general background information and does not necessarily constitute prior art. Summary of the Invention

[0006] This application provides a user authentication method and apparatus based on dynamic verification codes, which can achieve secure user authentication without network access, improve the security and convenience of user authentication, and solve problems such as insufficient security and reliance on network or time synchronization in traditional methods.

[0007] In a first aspect, embodiments of this application provide a user authentication method based on dynamic verification codes, including:

[0008] In response to an authentication request, an encrypted object is generated, the encrypted object including a random number and a random key;

[0009] The encrypted object is asymmetrically encrypted based on the pre-stored user public key to generate encrypted ciphertext.

[0010] The encrypted ciphertext is converted into a QR code and sent to the client for display, and the dynamic verification code input interface is activated;

[0011] The system receives a dynamic verification code input by the user through the client, and performs encryption operations on the random number using the random key to generate a corresponding base code.

[0012] The user authentication result is generated by comparing the dynamic verification code and the base code.

[0013] Optionally, in some embodiments of this application, the step of generating an encrypted object in response to an authentication request includes:

[0014] Receive the authentication request sent by the client, and parse the user identifier and device environment information in the authentication request;

[0015] A secure random number generation module generates random numbers that meet preset security requirements, wherein the entropy value of the random numbers is not lower than a preset security threshold.

[0016] A random key for symmetric encryption is generated, and the random number and the random key are combined into an encryption object according to a preset format.

[0017] Optionally, in some embodiments of this application, the step of performing asymmetric encryption on the encrypted object based on a pre-stored user public key to generate encrypted ciphertext includes:

[0018] Retrieve the user's public key associated with the user identifier from the key management system, and verify the validity and timeliness of the user's public key;

[0019] An asymmetric encryption algorithm is used to encrypt the encrypted object based on a verified user public key to generate encrypted ciphertext. The encryption process includes message padding and integrity verification.

[0020] Optionally, in some embodiments of this application, the dynamic verification code is generated in the following ways:

[0021] After scanning the QR code displayed by the client with a mobile device, the encrypted text corresponding to the QR code is obtained;

[0022] The encrypted ciphertext is decrypted using the local user's private key to obtain the corresponding random number and random key;

[0023] The random number is encrypted using the random key to generate a corresponding dynamic verification code.

[0024] Optionally, in some embodiments of this application, receiving the dynamic verification code input by the user through the client, and encrypting the random number using the random key to generate a corresponding base code includes:

[0025] Receive the dynamic verification code submitted by the client, parse the dynamic verification code, and obtain the corresponding session identifier;

[0026] Retrieve a pre-stored random number and random key based on the session identifier;

[0027] The random number is encrypted using the random key to generate a corresponding base code, wherein the encryption rules are consistent with the rules for generating dynamic verification codes on mobile devices.

[0028] Optionally, in some embodiments of this application, generating a user authentication result by comparing the dynamic verification code and the base code includes:

[0029] A comparison algorithm that prevents timing attacks is used to compare the dynamic verification code and the base code input by the user bit by bit to generate a comparison result.

[0030] If the comparison result is consistent and within the preset valid time, an authentication pass result is generated; otherwise, an authentication failure result is generated.

[0031] Optionally, in some embodiments of this application, after generating the encrypted object in response to the authentication request, the method further includes:

[0032] When generating the encrypted object, a corresponding single-use token is added, and the single-use token is bound to the user device and the session identifier.

[0033] Once the QR code is scanned or the dynamic verification code is verified, the single-use valid token is automatically marked as invalid.

[0034] Optionally, in some embodiments of this application, the method further includes:

[0035] On mobile devices, the biometric identification process is triggered before the dynamic verification code is generated.

[0036] The biometric identification result is obtained by verifying the legitimacy of the current user's biometrics in a trusted execution environment;

[0037] Once the biometric identification result is verified as successful, a corresponding dynamic verification code is generated via the mobile device.

[0038] Optionally, in some embodiments of this application, the method further includes:

[0039] The server periodically generates new asymmetric key pairs and pushes them to the user's mobile device through a secure channel.

[0040] The old key pair is retained for a transition period, and its validity is automatically suspended after the transition period ends.

[0041] Secondly, embodiments of this application provide a user authentication device based on a dynamic verification code, comprising:

[0042] An encryption object module is used to generate an encryption object in response to an authentication request, wherein the encryption object includes a random number and a random key;

[0043] The encryption ciphertext module is used to perform asymmetric encryption on the encrypted object based on a pre-stored user public key to generate encrypted ciphertext.

[0044] The conversion module is used to convert the encrypted ciphertext into a QR code and send it to the client for display, and to activate the dynamic verification code input interface;

[0045] The baseline code module is used to receive the dynamic verification code input by the user through the client, and to perform encryption operation on the random number using the random key to generate the corresponding baseline code;

[0046] The comparison module is used to generate a user authentication result by comparing the dynamic verification code and the base code.

[0047] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the user authentication method based on dynamic verification code as described in the first aspect.

[0048] Fourthly, embodiments of this application provide a storage medium storing a computer program capable of being loaded by a processor and executing the user authentication method based on dynamic verification codes as described in the first aspect.

[0049] This application provides a user authentication method and apparatus based on dynamic verification codes. First, in response to an authentication request, an encrypted object containing a random number and a random key is generated to ensure the randomness and security of the initial data and avoid risks arising from predictable data. Then, based on a pre-stored user public key, the encrypted object is asymmetrically encrypted to generate encrypted ciphertext. The characteristics of asymmetric encryption ensure the confidentiality of the ciphertext during transmission, preventing information theft or tampering. Next, the encrypted ciphertext is converted into a QR code and sent to the client for display, activating the dynamic verification code input interface. The QR code format allows users to conveniently scan and obtain information via their mobile phones, while the activation of the input interface prepares for subsequent authentication steps. Finally, upon receiving the dynamic verification code input by the user through the client, the system uses the random key to encrypt the random number, generating a corresponding base code. The dynamic verification code and the base code are compared to generate an authentication result, thereby ensuring the accuracy and legitimacy of the user's identity and effectively preventing unauthorized logins. As can be seen, the user authentication scheme based on dynamic verification code provided in this application generates an encrypted object containing random numbers and keys and converts it into a QR code. The dynamic verification code is generated and compared by mobile phone and computer in offline state based on asymmetric encryption and symmetric encryption, thereby achieving high security and high randomness of user authentication in offline environment. This improves the security and convenience of user authentication and solves the problems of insufficient security and reliance on network or time synchronization in traditional methods. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is an application environment diagram of the user authentication method based on dynamic verification code provided in the embodiments of this application;

[0052] Figure 2 This is a flowchart illustrating the user authentication method based on dynamic verification codes provided in the embodiments of this application;

[0053] Figure 3 This is a schematic diagram of the process for generating dynamic verification codes provided in an embodiment of this application;

[0054] Figure 4 This is a schematic diagram of the structure of a user identity authentication device based on dynamic verification code provided in an embodiment of this application;

[0055] Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0056] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of systems and methods consistent with those detailed in the appended claims or with some aspects of this application.

[0057] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover descriptions such as non-exclusive inclusion, so that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, components, features, and elements with the same names in different embodiments of this application may have the same meaning or different meanings, the specific meaning of which must be determined by its interpretation in that specific embodiment or further in conjunction with the context of that specific embodiment.

[0058] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0059] In the following description, the use of suffixes such as "module," "part," or "unit" to denote elements is solely for the purpose of illustrative purposes and has no specific meaning in itself. Therefore, "module," "part," or "unit" may be used interchangeably.

[0060] To address the aforementioned technical problems and overcome the shortcomings of existing technologies, this application provides a user authentication method and apparatus based on dynamic verification codes. This method enables secure user authentication without requiring an internet connection, improving the security and convenience of user authentication and resolving issues such as insufficient security and reliance on network or time synchronization in traditional methods.

[0061] Figure 1 This is a diagram illustrating the application environment of a user authentication method based on dynamic verification codes in one embodiment. (Refer to...) Figure 1This user authentication method based on dynamic verification codes is applied to a dynamic verification code-based authentication system. The dynamic verification code-based authentication system includes a terminal 110 and a server 120. The terminal 110 and server 120 are connected via a network. The terminal 110 can be a desktop terminal or a mobile terminal. A mobile terminal can be at least one of a mobile phone, tablet, or laptop, etc. Any device that can act as a client can be considered a terminal. Mobile apps are not limited to applications on mobile phones or tablets; no specific restrictions are imposed here. The server 120 can be implemented using a standalone server or a server cluster consisting of multiple servers. Server 120 is configured to execute the aforementioned user authentication method based on dynamic verification codes, including: generating an encrypted object in response to an authentication request, the encrypted object including a random number and a random key; performing asymmetric encryption on the encrypted object based on a pre-stored user public key to generate encrypted ciphertext; converting the encrypted ciphertext into a QR code and sending it to the client for display, and activating the dynamic verification code input interface; receiving the dynamic verification code input by the user through the client, and performing encryption operations on the random number using the random key to generate a corresponding base code; and generating a user authentication result by comparing the dynamic verification code and the base code.

[0062] Please see Figure 2 , Figure 2 This is a flowchart illustrating a user authentication method based on dynamic verification codes according to an embodiment of this application. This embodiment mainly uses the application of the user authentication method based on dynamic verification codes to a server as an example for illustration. The user authentication method based on dynamic verification codes according to an embodiment of this application may specifically include the following steps:

[0063] S1. Respond to the authentication request by generating an encrypted object, which includes a random number and a random key;

[0064] Specifically, for step S1, after the user enters their user ID and traditional password on the web system on their computer, the system responds to the authentication request and generates an encrypted object. This encrypted object consists of a random number (R) and a random key (K). The random number (R) provides unpredictability, while the random key (K) is used to symmetrically encrypt the random number, ensuring that only authorized users can decrypt it and generate a dynamic verification code. It should be noted that the generation of the random number (R) needs to meet a high entropy requirement to ensure its unpredictability; this is typically achieved using a secure random number generation module. The random key (K) can be generated using the AES algorithm to create a 256-bit key. For example, Python's `secrets` module can be used to generate high-entropy random numbers to ensure security.

[0065] S2. Perform asymmetric encryption on the encrypted object based on the pre-stored user public key to generate encrypted ciphertext;

[0066] Specifically, in step S2, the system retrieves the user's public key associated with the user identifier from the key management system and performs asymmetric encryption on the encrypted object (R||K) to generate encrypted ciphertext. The encrypted ciphertext contains an encrypted random number and a random key. Asymmetric encryption algorithms typically use RSA, ECC, etc., to ensure that the encrypted ciphertext is not intercepted or tampered with during transmission. Message padding and integrity checks are also required during encryption to ensure data integrity and security. For example, when using the RSA algorithm to encrypt the encrypted object, the RSA-OAEP mode can be selected to enhance security. The key management system needs to ensure the validity and timeliness of the public key, which can be achieved through digital certificates or periodic key updates.

[0067] S3. Convert the encrypted ciphertext into a QR code and send it to the client for display, and activate the dynamic verification code input interface;

[0068] Specifically, in step S3, the encrypted ciphertext is converted into a QR code format and displayed on a web page on the computer. A dynamic verification code input box is also provided, awaiting the user's input of the dynamic verification code. The QR code can be generated using the QR code standard to ensure it can be recognized by widely used QR code scanning tools. The QR code can also contain additional information, such as a session identifier, for session binding during verification. For example, Google's ZXing library can be used to generate the QR code. The display of the QR code needs to consider size and clarity to ensure accurate scanning on mobile devices.

[0069] S4. Receive the dynamic verification code entered by the user through the client, and perform encryption calculation on the random number using a random key to generate the corresponding base code;

[0070] Specifically, in step S4, the user scans a QR code using a mobile app to obtain encrypted ciphertext, decrypts it using a local private key to obtain a random number (R) and a random key (K), and then uses the random key (K) to encrypt the random number (R) to generate a dynamic verification code, which is then displayed to the user. The user inputs the dynamic verification code into the web system on their computer, and the system receives and parses the dynamic verification code to generate a base code.

[0071] The generation of dynamic verification codes can utilize algorithms such as HMAC-SHA256 to ensure security and unpredictability. For example, a dynamic verification code can be the first 6 bits of an HMAC-SHA256 (R, K) sequence. Furthermore, the validity period of the dynamic verification code can be set to 60 seconds to prevent replay attacks. The mobile app needs to ensure the security of the decryption process, which can be achieved by using a Trusted Execution Environment (TEE) to prevent private key leakage.

[0072] S5. Generate user authentication results by comparing the dynamic verification code and the base code;

[0073] Specifically, in step S5, the system compares the user-input dynamic verification code with the base code. If they match and the validity period has not expired, authentication is successful; otherwise, authentication fails. The comparison algorithm needs to prevent timing attacks, and a constant-time comparison algorithm is typically used to ensure security. For example, Python's `hmac.compare_digest` function can be used for comparison. The system also needs to record the comparison results and verification time for log auditing and security analysis.

[0074] This embodiment ensures the confidentiality of encrypted ciphertext during transmission through asymmetric encryption. The combination of random numbers and random keys enhances the unpredictability of the dynamic verification code. The use of a QR code format for encrypted ciphertext allows users to easily scan it via their mobile phones. Finally, comparison with the dynamic verification code ensures the accuracy and legitimacy of the user's identity. Therefore, this embodiment can achieve efficient and secure user authentication without relying on a network connection, improving user experience and system security.

[0075] Optionally, in some embodiments, step S1, "responding to an authentication request and generating an encrypted object," may specifically include:

[0076] S11. Receive the authentication request sent by the client and parse the user identifier and device environment information in the authentication request;

[0077] Specifically, in step S11, after the user enters their user ID and traditional password on the web system on their computer, the system receives an authentication request and parses the user identifier and device environment information contained within it. The user identifier can be a username, email address, or other unique identifier. The device environment information can include device type, operating system version, browser type, etc., to enhance security. For example, device environment information can be obtained through HTTP request headers.

[0078] S12. Generate random numbers that meet preset security requirements through the secure random number generation module, and the entropy value of the random numbers is not lower than the preset security threshold;

[0079] Specifically, in step S12, a random number is generated using a secure random number generation module, ensuring that the entropy value of the random number is not lower than a preset security threshold. The random number generation module can use a hardware random number generator or a proven software random number generation algorithm. For example, Python's `secrets` module can be used to generate high-entropy random numbers, ensuring their security.

[0080] S13. Generate a random key for symmetric encryption, and combine the random number and the random key into an encrypted object according to a preset format;

[0081] Specifically, in step S13, a random key is generated for symmetric encryption, which will be used to encrypt the random number subsequently. The symmetric encryption algorithm can be AES, and the random key can be a 256-bit key. For example, the Fernet module in the cryptography library can be used to generate the random key. The generated random number and random key are combined into an encryption object according to a preset format for subsequent asymmetric encryption. The preset format can be concatenating the random number and random key in a specific order, such as R||K, where || represents the concatenation operation. Alternatively, JSON format can be used to store the random number and random key for easier subsequent processing and transmission.

[0082] This embodiment enhances the accuracy of identity authentication by parsing user identifiers and device environment information. The generated high-entropy random numbers and random keys improve the unpredictability of encrypted objects. The combined encrypted objects lay the foundation for subsequent asymmetric encryption, providing a more secure and reliable encrypted object generation mechanism for the identity authentication process, and further improving the security of identity authentication.

[0083] Optionally, in some embodiments, step S2, "performing asymmetric encryption on the encrypted object based on a pre-stored user public key to generate encrypted ciphertext," may specifically include:

[0084] S21. Retrieve the user's public key associated with the user identifier from the key management system, and verify the validity and timeliness of the user's public key;

[0085] Specifically, in step S21, after receiving an authentication request, the system retrieves the public key corresponding to the user from the key management system based on the parsed user identifier. Before using the user's public key, the system needs to verify its validity and timeliness, ensuring that the public key has not expired or been revoked. Verifying the validity and timeliness of the public key can be achieved by checking the validity period and revocation status of the digital certificate. For example, an X.509 certificate can be used to manage the public key, and the legality and timeliness of the public key can be verified through a certificate issued by a Certificate Authority (CA). The system can periodically obtain a Revocation List (CRL) from the CA server or use the Online Certificate Status Protocol (OCSP) to verify the certificate status in real time.

[0086] The key management system needs to have the ability to efficiently retrieve and manage keys, ensuring performance and security under high concurrency scenarios. For example, a distributed database or key-value store system can be used to store and retrieve keys. Furthermore, the storage of public keys must adhere to strict access control policies, ensuring that only authorized system components can access them.

[0087] S22. An asymmetric encryption algorithm is used to encrypt the encrypted object based on the verified user's public key to generate encrypted ciphertext. The encryption process includes message padding and integrity verification.

[0088] Specifically, the encrypted object is asymmetrically encrypted using a verified user public key to generate encrypted ciphertext. Encryption processing includes message padding and integrity verification to ensure the integrity and security of the encrypted data. The asymmetric encryption algorithm can be RSA, ECC, etc., with the specific choice depending on security requirements and performance considerations. For example, ECC has a shorter key length at the same security level, making it more suitable for resource-constrained environments such as mobile devices. Message padding can use PKCS#1v1.5 or OAEP mode, and integrity verification can be achieved by appending a message digest or using a signed encryption mode. For example, the RSA-OAEP mode not only provides security but also prevents common encryption attacks, such as oracle padding attacks.

[0089] This embodiment ensures the reliability and timeliness of public keys by providing a key management system and certificate verification mechanism. The selection of asymmetric encryption algorithms and encryption processing improve the anti-attack capability of encrypted ciphertext and prevent information from being intercepted or tampered with during transmission.

[0090] Optionally, such as Figure 3 As shown, in some embodiments, the method for generating the dynamic verification code in step S4 includes:

[0091] S101. After scanning the QR code displayed on the client with a mobile device, obtain the encrypted text corresponding to the QR code;

[0092] S102. Decrypt the encrypted ciphertext based on the local user's private key to obtain the corresponding random number and random key;

[0093] S103. Encrypt the random number based on the random key to generate the corresponding dynamic verification code;

[0094] Specifically, dynamic verification codes are primarily generated via mobile devices. For example, a user scans a QR code displayed on a web system on a computer using a mobile app to obtain encrypted ciphertext. This ciphertext contains an encrypted random number and a random key. The mobile app then decrypts the ciphertext using the user's locally stored private key to obtain the random number (R) and a random key (K). The storage of the private key must be secure; a Trusted Execution Environment (TEE) or Secure Element (SE) on the mobile device can be used to store the private key to prevent leakage. For example, Android devices can use the Keystore system to securely store keys. The decryption process must prevent side-channel attacks, ensuring that the execution time of the decryption algorithm does not depend on the key or data content. The decrypted random key (K) is then used to encrypt the random number (R) to generate a dynamic verification code of a certain length.

[0095] The encryption operation can use the HMAC-SHA256 algorithm to ensure the generated dynamic verification code has high security and unpredictability. For example, the first 6 bits of HMAC-SHA256(R,K) can be used as the dynamic verification code. Meanwhile, the validity period of the dynamic verification code can be set to 60 seconds to prevent replay attacks. The mobile app needs to ensure that the generated dynamic verification code is only displayed during its valid period and is automatically deleted after expiration.

[0096] This embodiment allows users to easily obtain encrypted ciphertext by scanning a QR code. The local storage of the private key and the security of the decryption process ensure that the encrypted ciphertext is not leaked. The use of encryption algorithms such as HMAC-SHA256 improves the security of dynamic verification codes and effectively prevents unauthorized users from logging in.

[0097] Optionally, in some embodiments, step S4, "receiving the dynamic verification code input by the user through the client, and encrypting the random number using a random key to generate the corresponding base code," may specifically include:

[0098] S41. Receive the dynamic verification code submitted by the client, parse the dynamic verification code, and obtain the corresponding session identifier;

[0099] Specifically, in step S41, the system receives the dynamic verification code submitted by the user to the server via a client (e.g., a web client) and parses the session identifier within it. The session identifier is used to associate the user's current login session, ensuring that the dynamic verification code is associated with a specific login attempt. The session identifier can be a session ID, a randomly generated string, or a UUID, stored on the server and bound to the user's login session. For example, a session identifier can be generated using UUID v4 and stored in the server's session management module. When parsing the session identifier, its integrity and validity must be ensured to prevent session hijacking. It is understood that the dynamic verification code generated by the mobile device in this embodiment itself has no distinctive features. After the user enters the dynamic verification code via the web client and submits it to the server for verification, the web client will also submit the user identifier from the previous successful authentication step to the backend (i.e., the server) for dynamic verification code comparison. The user identifier is the one successfully verified when the user initially used a password for initial authentication; that is, the user identifier is either retained by the web client or is the user identifier from the session after the previous successful authentication step.

[0100] S42. Retrieve the pre-stored random number and random key based on the session identifier;

[0101] Specifically, in step S42, the system retrieves the random number (R) and random key (K) associated with the session from the session management module on the server side based on the parsed session identifier. The session management module needs to ensure efficient storage and retrieval of session data. Typically, an in-memory database such as Redis can be used to store session information to ensure fast access. At the same time, session data needs to be cleaned up periodically to prevent storage space from being occupied. For example, an expiration time for session data can be set, such as 10 minutes, to ensure that only currently valid session data is retained.

[0102] S43. Perform encryption operations on random numbers based on a random key to generate a corresponding base code, wherein the encryption operation rules are consistent with the rules for generating dynamic verification codes on mobile devices;

[0103] Specifically, in step S43, the random number (R) is encrypted using the retrieved random key (K) to generate a base code. This base code will be compared with the dynamic verification code submitted by the user. The encryption operation can use the HMAC-SHA256 algorithm to ensure that the generated base code has high security and unpredictability. For example, the base code can be the first 6 bits of HMAC-SHA256(R,K). Furthermore, the generated base code needs to be consistent with the validity period of the dynamic verification code to prevent replay attacks. The system can record the generation time and validity period of the base code to ensure its validity within the validity period.

[0104] This embodiment ensures the binding of dynamic verification codes to specific login sessions by using and resolving session identifiers, preventing cross-session attacks; and ensures the consistency between the generation of the base code and the dynamic verification code by retrieving and using random numbers and random keys, thereby improving the accuracy of verification.

[0105] Optionally, in some embodiments, step S5, "generating a user authentication result by comparing the dynamic verification code and the base code," may specifically include:

[0106] S51. An algorithm designed to prevent timing attacks is used to compare the user-input dynamic verification code and the base code bit by bit, generating a comparison result.

[0107] Specifically, for step S51, a comparison algorithm designed to prevent timing attacks is employed. The user-input dynamic verification code is compared bit by bit with the system-generated baseline code, ensuring a constant comparison time to prevent attackers from deducing verification code information through time differences. This comparison algorithm can use a constant-time comparison algorithm, such as Python's `hmac.compare_digest` function. By comparing bit by bit and introducing a fixed delay during the comparison process, it ensures that the comparison will not prematurely terminate even if it fails, thus preventing timing analysis.

[0108] S52. If the comparison result is consistent and the preset valid time has not been exceeded, an authentication pass result is generated; otherwise, an authentication failure result is generated.

[0109] Specifically, for step S52, if the comparison results match and the dynamic verification code has not exceeded the preset validity period (e.g., 60 seconds), an authentication success result is generated; otherwise, an authentication failure result is generated. The validity period can be checked by recording the timestamp of the dynamic verification code's generation and comparing it during verification. For example, the system can record the current timestamp when generating the dynamic verification code and check whether the difference between the current time and the recorded timestamp is within the validity period during verification. Furthermore, to prevent replay attacks, it can be ensured that each dynamic verification code can only be used once; once verified, the verification code immediately becomes invalid.

[0110] This embodiment employs a comparison algorithm that prevents time-series attacks, thus preventing attackers from speculating on CAPTCHA information through time differences. By checking the validity period, it ensures the timeliness of dynamic CAPTCHAs, prevents replay attacks, and ensures the security and reliability of the dynamic CAPTCHA verification process.

[0111] Optionally, in some embodiments, after generating the encrypted object in response to the authentication request, the method further includes:

[0112] When generating the encrypted object, a corresponding one-time valid token is added, and the one-time valid token is bound to the user device and session identifier.

[0113] Once the QR code is scanned or the dynamic verification code is verified, the single-use valid token is automatically marked as invalid.

[0114] Specifically, when generating the encrypted object, this embodiment also generates a single-use token and binds it to the encrypted object. This token ensures that the QR code can only be used once. The single-use token can be a randomly generated string or a UUID. For example, a single-use token can be generated using UUID v4 and stored in the session management module on the server side. The generated token needs to be bound to the user's device information and session identifier (e.g., session ID) to ensure the scope and number of times the QR code can be used.

[0115] The generated single-use token is bound to the user's device fingerprint and current session identifier, ensuring that the token can only be used on a specific device and in a specific session. The user's device fingerprint can include device type, operating system version, browser type, IP address, etc. For example, the JavaScript library FingerprintJS can be used to generate a device fingerprint. The session identifier can be a randomly generated string or UUID, stored on the server side and bound to the user's login session.

[0116] Once a QR code is scanned or a dynamic verification code is verified, the single-use valid token will be automatically marked as invalid to prevent the same QR code from being used multiple times. Furthermore, the token status on the server can be updated to invalid when a QR code is scanned or a dynamic verification code is verified. For example, Redis can be used to store the token status and mark it as invalid after use. To prevent the invalid status from being tampered with, a cryptographic signature or a hash value of the token status can be used.

[0117] This embodiment ensures that the QR code can only be used once by generating and binding a single-use valid token. The binding of the device and session limits the scope of use. The mechanism of marking the invalid state further prevents the reuse of the token, enhances the security of the identity authentication process, ensures the uniqueness and non-reusability of the dynamic verification code, and effectively resists the risk of replay attacks.

[0118] Optionally, in some embodiments, the user authentication method provided in this embodiment may further include:

[0119] On mobile devices, the biometric identification process is triggered before the dynamic verification code is generated.

[0120] The biometric identification result is obtained by verifying the legitimacy of the current user's biometrics in a trusted execution environment;

[0121] Once the biometric identification result is verified as successful, a corresponding dynamic verification code is generated via the mobile device.

[0122] Specifically, before the app on the mobile device generates a dynamic verification code, a biometric identification process is triggered to ensure the current user is legitimate. Biometric identification can use technologies such as fingerprint recognition, facial recognition, or iris recognition to prevent unauthorized users from passing through biometric identification. The app on the mobile device verifies the user's biometrics within a Trusted Execution Environment (TEE) to ensure the secure processing and storage of biometric data. A Trusted Execution Environment (TEE) provides a secure environment for processing sensitive data and performing critical operations. For example, ARM's TrustZone technology can be used to implement a TEE. Biometric data (such as fingerprint templates) is stored in the TEE, and the verification process is also completed within the TEE, ensuring that the data is not leaked or tampered with.

[0123] If biometric identification passes, a dynamic verification code is generated and displayed to the user; if biometric identification fails, dynamic verification code generation is refused. Dynamic verification codes can be generated using algorithms such as HMAC-SHA256 to ensure security and unpredictability. For example, a dynamic verification code can be the first 6 bits of HMAC-SHA256(R,K). The generated dynamic verification code needs to be valid for a specified time, typically set to 60 seconds, to prevent replay attacks.

[0124] This embodiment verifies the legitimacy of biometric features to ensure that only legitimate users can generate dynamic verification codes. It uses a trusted execution environment to enhance the protection of biometric data, prevent data leakage and tampering, thereby improving the security of identity authentication and effectively preventing unauthorized users from attempting to log in.

[0125] Optionally, in some embodiments, the user authentication method provided in this embodiment may further include:

[0126] The server periodically generates new asymmetric key pairs and pushes them to the user's mobile device through a secure channel.

[0127] The old key pair is retained for a transition period, and its validity is automatically suspended after the transition period ends.

[0128] Specifically, the server periodically generates new asymmetric key pairs (public and private keys) for users to ensure key security and timeliness. Key pair generation can use RSA or ECC algorithms. For example, RSA can be used to generate 2048-bit or 4096-bit key pairs. The generated key pairs need to be stored in a key management system and associated with the user's identifier. The generation frequency can be set according to security requirements, such as monthly or quarterly. The new asymmetric key pairs are pushed to the user's mobile device via a secure communication channel (such as HTTPS, VPN, or a dedicated security protocol). The secure channel can use the TLS 1.3 protocol to ensure the security of data transmission. During the push process, the data needs to be encrypted and signed to ensure data integrity and authenticity.

[0129] After a new key pair is generated and pushed, the old key pair remains valid for a certain period to ensure that user devices can still authenticate normally before updating their key pairs. The transition period can be set according to actual needs, such as 7 days. During the transition period, both the old and new key pairs are accepted for authentication. After the transition period ends, the old key pair automatically becomes invalid. The old key pair is automatically marked as invalid after the transition period ends, ensuring that only the new key pair can be used for subsequent authentication. The system needs to periodically clean up invalid key pairs to prevent excessive management due to the large number of key pairs. For example, a scheduled task can be used to clean up invalid key pairs daily.

[0130] This embodiment ensures the timeliness and security of keys by periodically updating key pairs, uses a secure channel to prevent key pairs from being intercepted or tampered with during transmission, sets a transition period so that user equipment can still perform identity authentication normally before updating key pairs, achieves a seamless transition function, and automatically suspends the valid state of old key pairs to further prevent the abuse of old key pairs, thereby enhancing the security of the identity authentication process, reducing the risk of key leakage, and ensuring the long-term security of user identity authentication.

[0131] In a specific implementation, a random number and a random key string (used for symmetric encryption of the random number) are generated by the web system on the computer. A QR code is generated by combining this random number and the random key string, allowing the mobile device to scan it and creating the impression that both the mobile and computer devices share the same random number. For security reasons, an asymmetric key pair can be generated for the user (both downloaded to the user's phone), with the public key stored in the system backend. Before the generated random number is sent to the web frontend to display the QR code, the public key can be used to encrypt the random number (followed by a random key used for symmetric encryption or hashing). The mobile device scans the QR code to obtain the encrypted random number and the random key, then decrypts it using the private key. After decryption, the mobile app uses the random key to encrypt the random number again, generating a dynamic verification code that is displayed to the user. The user enters this dynamic code into the web system on the computer. The system backend then encrypts the random number using the pre-generated random key and compares it with the generated dynamic verification code using the same acquisition rules. The comparison result determines whether the identity verification is successful.

[0132] In summary, the user authentication method based on dynamic verification codes provided in this embodiment first generates an encrypted object containing a random number and a random key in response to the authentication request, ensuring the randomness and security of the initial data and avoiding risks caused by data predictability. Then, based on a pre-stored user public key, the encrypted object is asymmetrically encrypted to generate encrypted ciphertext. The characteristics of asymmetric encryption ensure the confidentiality of the ciphertext during transmission, preventing information theft or tampering. Next, the encrypted ciphertext is converted into a QR code and sent to the client for display, activating the dynamic verification code input interface. The QR code format allows users to conveniently scan and obtain information via their mobile phones, while the activation of the input interface prepares for subsequent authentication steps. Finally, upon receiving the dynamic verification code input by the user through the client, the system uses the random key to encrypt the random number, generating a corresponding base code. The dynamic verification code and the base code are compared to generate the authentication result, thereby ensuring the accuracy and legitimacy of the user's identity and effectively preventing unauthorized user login. As can be seen, the user authentication scheme based on dynamic verification codes provided in this embodiment generates an encrypted object containing random numbers and keys and converts it into a QR code. The mobile terminal and computer terminal generate and compare dynamic verification codes based on asymmetric and symmetric encryption in an offline state, thereby achieving high-security and high-randomness user authentication in an offline environment. This improves the security and convenience of user authentication and solves the problems of insufficient security and reliance on network or time synchronization in traditional methods.

[0133] It should be understood that, although Figure 2The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0134] To facilitate better implementation of the user authentication method based on dynamic verification codes in the embodiments of this application, the embodiments of this application also provide a user authentication device based on dynamic verification codes, which is based on the aforementioned user authentication method based on dynamic verification codes. The meanings of the terms used are the same as in the aforementioned user authentication method based on dynamic verification codes, and specific implementation details can be found in the descriptions in the method embodiments.

[0135] Please see Figure 4 , Figure 4 The diagram below illustrates the structure of a user authentication device based on a dynamic verification code, as provided in this embodiment. Specifically, this device may include an encryption object module 201, an encryption ciphertext module 202, a conversion module 203, a base code module 204, and a comparison module 205, as follows:

[0136] The encryption object module 201 is used to generate an encryption object in response to an authentication request. The encryption object includes a random number and a random key.

[0137] Encryption ciphertext module 202 is used to perform asymmetric encryption on the encrypted object based on the pre-stored user public key to generate encrypted ciphertext;

[0138] The conversion module 203 is used to convert encrypted ciphertext into a QR code and send it to the client for display, and to activate the dynamic verification code input interface;

[0139] The base code module 204 is used to receive the dynamic verification code input by the user through the client, and to perform encryption calculation on the random number using a random key to generate the corresponding base code;

[0140] The comparison module 205 is used to generate user authentication results by comparing the dynamic verification code and the base code.

[0141] Optionally, in some embodiments, the encryption object module 201 may specifically include:

[0142] The parsing unit is used to receive authentication requests sent by the client and parse the user identifier and device environment information in the authentication request.

[0143] The random number unit is used to generate random numbers that meet preset security requirements through the secure random number generation module. The entropy value of the random number is not lower than the preset security threshold.

[0144] The random key unit is used to generate a random key for symmetric encryption and to combine the random number and the random key into an encrypted object according to a preset format.

[0145] Optionally, in some embodiments, the encryption ciphertext module 202 may specifically include:

[0146] The first retrieval unit is used to retrieve the user's public key associated with the user identifier from the key management system and to verify the validity and timeliness of the user's public key;

[0147] The encryption unit is used to encrypt the encrypted object using an asymmetric encryption algorithm based on a verified user public key, generating encrypted ciphertext. The encryption process includes message padding and integrity verification.

[0148] Optionally, in some embodiments, the dynamic verification code is generated in the following ways:

[0149] After scanning the QR code displayed on the client with a mobile device, the encrypted text corresponding to the QR code can be obtained;

[0150] The encrypted ciphertext is decrypted using the local user's private key to obtain the corresponding random number and random key;

[0151] A random number is encrypted using a random key to generate a corresponding dynamic verification code.

[0152] Optionally, in some embodiments, the reference code module 204 may specifically include:

[0153] The identification unit is used to receive the dynamic verification code submitted by the client, parse the dynamic verification code, and obtain the corresponding session identifier;

[0154] The second retrieval unit is used to retrieve pre-stored random numbers and random keys based on the session identifier;

[0155] The base code unit is used to perform encryption operations on random numbers based on a random key to generate the corresponding base code. The encryption operation rules are consistent with the rules for generating dynamic verification codes on mobile devices.

[0156] Optionally, in some embodiments, the comparison module 205 may specifically include:

[0157] The comparison unit is used to compare the dynamic verification code and the base code input by the user bit by bit using a comparison algorithm that is protected against time-series attacks, and generate the comparison result.

[0158] The authentication result unit is used to generate an authentication pass result if the comparison result is consistent and the preset valid time has not been exceeded; otherwise, it generates an authentication failure result.

[0159] Optionally, in some embodiments, the user authentication device may further include a single-marking module, specifically used for:

[0160] When generating the encrypted object, a corresponding one-time valid token is added, and the one-time valid token is bound to the user device and session identifier.

[0161] Once the QR code is scanned or the dynamic verification code is verified, the single-use valid token is automatically marked as invalid.

[0162] Optionally, in some embodiments of this application, the user authentication device may further include a biometric identification module, specifically used for:

[0163] On mobile devices, the biometric identification process is triggered before the dynamic verification code is generated.

[0164] The biometric identification result is obtained by verifying the legitimacy of the current user's biometrics in a trusted execution environment;

[0165] Once the biometric identification result is verified as successful, a corresponding dynamic verification code is generated via the mobile device.

[0166] Optionally, in some embodiments of this application, the user authentication device may further include a key update module, specifically used for:

[0167] The server periodically generates new asymmetric key pairs and pushes them to the user's mobile device through a secure channel.

[0168] A transition period is maintained for the old key pair, after which its validity is automatically suspended. Specific limitations regarding the dynamic verification code-based user authentication device can be found in the above section on the limitations of the dynamic verification code-based user authentication method, and will not be repeated here. Each module in the aforementioned dynamic verification code-based user authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device, or stored in the computer device's memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0169] The user authentication device based on dynamic verification codes provided in this embodiment generates an encrypted object in response to an authentication request through an encryption object module 201. The encrypted object includes a random number and a random key. An encryption ciphertext module 202 performs asymmetric encryption on the encrypted object based on a pre-stored user public key to generate encrypted ciphertext. A conversion module 203 converts the encrypted ciphertext into a QR code and sends it to the client for display, activating the dynamic verification code input interface. A base code module 204 receives the dynamic verification code input by the user through the client and performs encryption operations on the random number using a random key to generate a corresponding base code. A comparison module 205 compares the dynamic verification code and the base code to generate the user authentication result. This embodiment generates an encrypted object containing a random number and a key and converts it into a QR code. The device then generates and compares dynamic verification codes based on asymmetric and symmetric encryption in an offline environment via a mobile phone and computer, achieving high-security and high-randomness user authentication. This improves the security and convenience of user authentication and solves problems such as insufficient security and reliance on network or time synchronization in traditional methods.

[0170] Furthermore, embodiments of this application also provide an electronic device, such as... Figure 5 As shown, it illustrates a structural schematic diagram of the electronic device involved in the embodiments of this application, specifically:

[0171] The electronic device may include components such as a processor 301 with one or more processing cores, a memory 302 with one or more computer-readable storage media, a power supply 303, and an input unit 304. Those skilled in the art will understand that... Figure 5 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0172] The processor 301 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines, and performs various functions and processes data by running or executing software programs and / or modules stored in the memory 302, and by calling data stored in the memory 302, thereby providing overall monitoring of the electronic device. Optionally, the processor 301 may include one or more processing cores; preferably, the processor 301 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 301.

[0173] The memory 302 can be used to store software programs and modules. The processor 301 executes various functional applications and user authentication methods based on dynamic verification codes by running the software programs and modules stored in the memory 302. The memory 302 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 302 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 302 may also include a memory controller to provide the processor 301 with access to the memory 302.

[0174] The electronic device also includes a power supply 303 that supplies power to various components. Preferably, the power supply 303 can be logically connected to the processor 301 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 303 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0175] The electronic device may also include an input unit 304, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0176] Although not shown, the electronic device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 301 in the electronic device loads the executable files corresponding to the processes of one or more applications into the memory 302 according to the following instructions, and the processor 301 runs the applications stored in the memory 302 to realize various functions, as follows:

[0177] The system responds to authentication requests by generating an encrypted object, which includes a random number and a random key. It then performs asymmetric encryption on the encrypted object using a pre-stored user public key to generate encrypted ciphertext. This ciphertext is converted into a QR code and sent to the client for display, activating the dynamic verification code input interface. Finally, it receives the dynamic verification code entered by the user through the client and performs encryption operations on the random number using the random key to generate a corresponding base code. By comparing the dynamic verification code and the base code, the system generates the user authentication result.

[0178] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0179] This application embodiment generates an encrypted object containing random numbers and keys and converts it into a QR code. The QR code is then generated and compared on a mobile phone and computer in an offline state based on asymmetric and symmetric encryption. This achieves high-security and high-randomness user authentication in an offline environment, thereby improving the security and convenience of user authentication and solving problems such as insufficient security and reliance on network or time synchronization in traditional methods.

[0180] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0181] Therefore, embodiments of this application provide a storage medium storing multiple instructions that can be loaded by a processor to execute steps in any of the user authentication methods based on dynamic verification codes provided in embodiments of this application. For example, the instructions can execute the following steps:

[0182] The system responds to authentication requests by generating an encrypted object, which includes a random number and a random key. It then performs asymmetric encryption on the encrypted object using a pre-stored user public key to generate encrypted ciphertext. This ciphertext is converted into a QR code and sent to the client for display, activating the dynamic verification code input interface. Finally, it receives the dynamic verification code entered by the user through the client and performs encryption operations on the random number using the random key to generate a corresponding base code. By comparing the dynamic verification code and the base code, the system generates the user authentication result.

[0183] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0184] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0185] Since the instructions stored in the storage medium can execute the steps of any of the user authentication methods based on dynamic verification codes provided in the embodiments of this application, the beneficial effects that any of the user authentication methods based on dynamic verification codes provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0186] The above provides a detailed description of a user authentication method and apparatus based on dynamic verification codes provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A user authentication method based on dynamic verification codes, characterized in that, Includes the following steps: In response to an authentication request, an encrypted object is generated, the encrypted object including a random number and a random key; The encrypted object is asymmetrically encrypted based on the pre-stored user public key to generate encrypted ciphertext. The encrypted ciphertext is converted into a QR code and sent to the client for display, and the dynamic verification code input interface is activated; The system receives a dynamic verification code input by the user through the client, and performs encryption operations on the random number using the random key to generate a corresponding base code. The user authentication result is generated by comparing the dynamic verification code and the base code.

2. The user authentication method based on dynamic verification code according to claim 1, characterized in that, The process of generating an encrypted object in response to an authentication request includes: Receive the authentication request sent by the client, and parse the user identifier and device environment information in the authentication request; A secure random number generation module generates random numbers that meet preset security requirements, wherein the entropy value of the random numbers is not lower than a preset security threshold. A random key for symmetric encryption is generated, and the random number and the random key are combined into an encryption object according to a preset format.

3. The user authentication method based on dynamic verification code according to claim 1, characterized in that, The step of performing asymmetric encryption on the encrypted object based on the pre-stored user public key to generate encrypted ciphertext includes: Retrieve the user's public key associated with the user identifier from the key management system, and verify the validity and timeliness of the user's public key; An asymmetric encryption algorithm is used to encrypt the encrypted object based on a verified user public key to generate encrypted ciphertext. The encryption process includes message padding and integrity verification.

4. The user authentication method based on dynamic verification code according to claim 1, characterized in that, The method for generating the dynamic verification code includes: After scanning the QR code displayed by the client with a mobile device, the encrypted text corresponding to the QR code is obtained; The encrypted ciphertext is decrypted using the local user's private key to obtain the corresponding random number and random key; The random number is encrypted using the random key to generate a corresponding dynamic verification code.

5. The user authentication method based on dynamic verification code according to claim 1, characterized in that, The process of receiving a dynamic verification code input by the user through the client, and encrypting the random number using the random key to generate a corresponding base code includes: Receive the dynamic verification code submitted by the client, parse the dynamic verification code, and obtain the corresponding session identifier; Retrieve a pre-stored random number and random key based on the session identifier; The random number is encrypted using the random key to generate a corresponding base code, wherein the encryption rules are consistent with the rules for generating dynamic verification codes on mobile devices.

6. The user authentication method based on dynamic verification code according to claim 1, characterized in that, The step of generating a user authentication result by comparing the dynamic verification code and the base code includes: A comparison algorithm that prevents timing attacks is used to compare the dynamic verification code and the base code input by the user bit by bit to generate a comparison result. If the comparison result is consistent and within the preset valid time, an authentication pass result is generated; otherwise, an authentication failure result is generated.

7. The user authentication method based on dynamic verification code according to claim 1, characterized in that, After generating the encrypted object in response to the authentication request, the method further includes: When generating the encrypted object, a corresponding single-use token is added, and the single-use token is bound to the user device and the session identifier. Once the QR code is scanned or the dynamic verification code is verified, the single-use valid token is automatically marked as invalid.

8. The user authentication method based on dynamic verification code according to claim 1, characterized in that, The method further includes: On mobile devices, the biometric identification process is triggered before the dynamic verification code is generated. The biometric identification result is obtained by verifying the legitimacy of the current user's biometrics in a trusted execution environment; Once the biometric identification result is verified as successful, a corresponding dynamic verification code is generated via the mobile device.

9. The user authentication method based on dynamic verification code according to claim 1, characterized in that, The method further includes: The server periodically generates new asymmetric key pairs and pushes them to the user's mobile device through a secure channel. The old key pair is retained for a transition period, and its validity is automatically suspended after the transition period ends.

10. A user authentication device based on dynamic verification codes, characterized in that, include: An encryption object module is used to generate an encryption object in response to an authentication request, wherein the encryption object includes a random number and a random key; The encryption ciphertext module is used to perform asymmetric encryption on the encrypted object based on a pre-stored user public key to generate encrypted ciphertext. The conversion module is used to convert the encrypted ciphertext into a QR code and send it to the client for display, and to activate the dynamic verification code input interface; The baseline code module is used to receive the dynamic verification code input by the user through the client, and to perform encryption operation on the random number using the random key to generate the corresponding baseline code; The comparison module is used to generate a user authentication result by comparing the dynamic verification code and the base code.

Images