Identity authentication method, device, storage medium and identity authentication device

Abstract

The embodiments of the present application provide an identity authentication method, apparatus, storage medium and identity authentication device, which belong to the field of information security technology. The identity authentication method provided by the present application can verify the authentication information after receiving the authentication information. If the verification is successful, the client is notified to send the authentication information to at least one other verification device in the identity authentication system that has not verified the authentication information, so that multiple verification devices in the identity authentication system notify the client of successful verification after all the authentication information is verified, or if the verification is successful and other verification devices in the identity authentication system verify the authentication information, the client is notified of successful verification. Since the authentication information needs to be verified by multiple verification devices, and the client is notified of successful verification only after all the verifications of multiple verification devices are passed, the security and anti-attack capability of identity authentication can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular, to an identity authentication method, apparatus, storage medium, and identity authentication device. Background Art

[0002] As the cyber security situation becomes increasingly severe, terminal devices or information systems / platforms can easily become targets of illegal intrusion, thereby obtaining sensitive data or permissions within the target. Terminal devices or information systems / platforms generally have login identity authentication mechanisms, such as common account password authentication mechanisms, digital certificate mechanisms, etc. The identity authentication mechanism is the entrance to the device and is easily targeted by attacks / bypasses, resulting in serious consequences. On the other hand, the existing identity authentication mechanism also has weak management links and non-technical security risks, such as weak passwords and poor password storage, which also require technical means to prevent or reduce risks.

[0003] In the related technologies, one or more authentication factors are often used for identity authentication, such as using only account and password for identity authentication, or using account and password, fingerprint recognition and face recognition for identity authentication at the same time. Although the related technologies have certain security when performing identity authentication, there is still a possibility that the related devices may be attacked during identity authentication. Summary of the invention

[0004] In order to solve the existing technical problems, the embodiments of the present application provide an identity authentication method, apparatus, storage medium and identity authentication device, which can improve the security of identity authentication and improve the anti-attack capability of related devices when performing identity authentication.

[0005] To achieve the above purpose, the technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides an identity authentication method, which is applied to a verification device, wherein the verification device is located in an identity authentication system, and the identity authentication system includes multiple verification devices. The method includes:

[0007] After receiving the authentication information, verifying the authentication information, wherein the authentication information is obtained after the client responds to the user's operation;

[0008] If the verification is successful, the client is notified to send the authentication information to at least one other verification device in the identity authentication system that has not verified the authentication information, so that the multiple verification devices in the identity authentication system notify the client of successful verification after the authentication information is verified; or if the verification is successful, and other verification devices in the identity authentication system are successful in verifying the authentication information, the client is notified of successful verification.

[0009] The identity authentication method provided in the embodiment of the present application can verify the authentication information after receiving the authentication information, wherein the authentication information is obtained after the client responds to the user's operation. If the verification is successful, the client is notified to send the authentication information to at least one other verification device in the identity authentication system that has not verified the authentication information, so that multiple verification devices in the identity authentication system notify the client of successful verification after all the authentication information is verified, or if the verification is successful and other verification devices in the identity authentication system are successful in verifying the authentication information, the client is notified of successful verification. Since the authentication information sent by the client needs to be verified by multiple verification devices, and the client is notified of successful verification only when multiple verification devices are successful in verifying the authentication information, the security and anti-attack capability of identity authentication can be improved.

[0010] In an optional embodiment, the verification device is a master verification device;

[0011] After receiving the authentication information and before verifying the authentication information, the method further includes:

[0012] Notifying the client to send the authentication information to at least one other authentication device in the identity authentication system;

[0013] After confirming that the authentication information is successfully authenticated by other authentication devices in the identity authentication system, the client is notified to send the authentication information to the main authentication device again for authentication.

[0014] In this embodiment, the main verification device can notify the client to send authentication information to at least one other verification device in the identity authentication system, and after confirming that the other verification devices in the identity authentication system have successfully verified the authentication information, notify the client to send the authentication information to the main verification device again for verification. Since multiple verification devices are introduced during identity authentication, and after multiple verification devices have successfully verified the authentication information, the client still needs to send the authentication information to the main verification device again for verification, thereby increasing the types and times of identity authentication, having high security, and avoiding the risk of the main verification device being hacked or bypassed when identity authentication is performed only through the main verification device.

[0015] In an optional embodiment, the notifying client to send authentication information to the primary verification device again for verification includes:

[0016] Sending the generated authentication token to the client via other authentication devices to trigger the client to send authentication information to the main authentication device again;

[0017] After receiving the authentication information, verifying the authentication information includes:

[0018] After receiving the authentication information sent by the client again, verify the account information in the authentication information and the authentication token to be verified respectively;

[0019] After both the account information and the authentication token to be verified are verified, it is determined that the authentication information is verified.

[0020] In this embodiment, the main verification device can send the generated authentication token to the client through other verification devices to trigger the client to send authentication information to the main verification device again, and after receiving the authentication information sent by the client again, the account information in the authentication information and the authentication token to be verified are verified respectively, so that after both the account information and the authentication token to be verified are verified, it is determined that the authentication information has passed the verification. In this way, the types of identity authentication can be increased, and the security of identity authentication can be improved.

[0021] In an optional embodiment, the verification device is a slave verification device;

[0022] The notifying the client to send the authentication information to at least one other verification device in the identity verification system that has not verified the authentication information includes:

[0023] According to the verification order of the verification devices, the client is notified to send the authentication information to the next other verification device connected to itself in the identity authentication system.

[0024] In this embodiment, the slave verification device can notify the client to send the verification information to the next other verification device connected to it in the identity authentication system according to the verification order of the verification device, thereby achieving identity authentication through multiple verification devices, forming a multi-authentication guarantee, and improving security.

[0025] In an optional embodiment, after receiving the authentication information and before verifying the authentication information, the method further includes:

[0026] After receiving the authentication information sent by the other authentication device, the generated authentication token is sent to the client through the other authentication device to trigger the client to send the authentication information to the slave authentication device;

[0027] After receiving the authentication information, verifying the authentication information includes:

[0028] After receiving the authentication information sent by the client, verify the account information in the authentication information and the authentication token to be verified respectively;

[0029] After both the account information and the authentication token to be verified are verified, it is determined that the authentication information is verified.

[0030] In this embodiment, after receiving the authentication information sent by other authentication devices, the slave authentication device sends the generated authentication token to the client through other authentication devices to trigger the client to send authentication information to the slave authentication device, and after receiving the authentication information sent by the client, the slave authentication device can respectively verify the account information in the authentication information and the authentication token to be verified, so that after both the account information and the authentication token to be verified are verified, it is determined that the authentication information has passed the verification. In this way, the types of identity authentication can be increased, and the security of identity authentication can be improved.

[0031] In an optional embodiment, the verifying the authentication token to be verified in the authentication information includes:

[0032] The authentication token to be verified in the authentication information is compared with the generated authentication token. If the authentication token to be verified is consistent with the generated authentication token, it is determined that the authentication token to be verified has been verified successfully; otherwise, it is determined that the authentication token to be verified has failed to be verified.

[0033] In this embodiment, the authentication token to be verified in the authentication information can be compared with the generated authentication token. If the authentication token to be verified is consistent with the generated authentication token, it is determined that the authentication token to be verified has been verified, otherwise it is determined that the authentication token to be verified has not been verified. This ensures the correctness of the authentication token verification and further improves the security of identity authentication.

[0034] In a second aspect, an embodiment of the present application further provides an identity authentication device, which is applied to a verification device, wherein the verification device is located in an identity verification system, and the identity verification system includes multiple verification devices, including:

[0035] An information verification unit, configured to verify the authentication information after receiving the authentication information, wherein the authentication information is obtained after the client responds to the user's operation;

[0036] A verification success unit is used to notify the client to send the authentication information to at least one other verification device in the identity authentication system that has not verified the authentication information if the verification is successful, so that the multiple verification devices in the identity authentication system notify the client of successful verification after the authentication information is verified; or if the verification is successful and the other verification devices in the identity authentication system are successful in verifying the authentication information, notify the client of successful verification.

[0037] In an optional embodiment, the verification device is a master verification device; the apparatus further comprises a notification verification unit, configured to:

[0038] Notifying the client to send the authentication information to at least one other authentication device in the identity authentication system;

[0039] After confirming that the authentication information is successfully authenticated by other authentication devices in the identity authentication system, the client is notified to send the authentication information to the main authentication device again for authentication.

[0040] In an optional embodiment, the notification verification unit is specifically used to:

[0041] Sending the generated authentication token to the client via other authentication devices to trigger the client to send authentication information to the main authentication device again;

[0042] The information verification unit is specifically used for:

[0043] After receiving the authentication information sent by the client again, verify the account information in the authentication information and the authentication token to be verified respectively;

[0044] After both the account information and the authentication token to be verified are verified, it is determined that the authentication information is verified.

[0045] In an optional embodiment, the verification device is a slave verification device; and the verification success unit is specifically configured to:

[0046] According to the verification order of the verification devices, the client is notified to send the authentication information to the next other verification device connected to itself in the identity authentication system.

[0047] In an optional embodiment, the notification verification unit is further used to:

[0048] After receiving the authentication information sent by the other authentication device, the generated authentication token is sent to the client through the other authentication device to trigger the client to send the authentication information to the slave authentication device;

[0049] The information verification unit is further used for:

[0050] After receiving the authentication information sent by the client, verify the account information in the authentication information and the authentication token to be verified respectively;

[0051] After both the account information and the authentication token to be verified are verified, it is determined that the authentication information is verified.

[0052] In an optional embodiment, the notification verification unit is further used to:

[0053] The authentication token to be verified in the authentication information is compared with the generated authentication token. If the authentication token to be verified is consistent with the generated authentication token, it is determined that the authentication token to be verified has been verified successfully; otherwise, it is determined that the authentication token to be verified has failed to be verified.

[0054] In a third aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the identity authentication method of the first aspect is implemented.

[0055] In a fourth aspect, an embodiment of the present application further provides a verification device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the computer program is executed by the processor, the processor implements the identity authentication method of the first aspect.

[0056] The technical effects brought about by any one of the implementation methods in the second to fourth aspects can refer to the technical effects brought about by the corresponding implementation method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0058] Figure 1 A schematic diagram of the structure of a verification device provided in an embodiment of the present application;

[0059] Figure 2 A flowchart of an identity authentication method provided in an embodiment of the present application;

[0060] Figure 3 A schematic diagram of an interaction between a client and a verification device for identity authentication provided in an embodiment of the present application;

[0061] Figure 4 Another schematic diagram of interaction between a client and a verification device for identity authentication provided in an embodiment of the present application;

[0062] Figure 5 A schematic diagram of the structure of an identity authentication device provided in an embodiment of the present application;

[0063] Figure 6 A schematic diagram of the structure of another identity authentication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0065] It should be noted that the terms "including" and "having" and their variations involved in the documents of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0066] The technical solution provided in the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0067] The word "exemplary" used hereinafter means "serving as an example, embodiment, or illustrative". Any embodiment described as "exemplary" is not necessarily to be interpreted as superior or better than other embodiments. In the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0068] Figure 1 exemplarily shows a schematic diagram of the structure of a verification device provided in an embodiment of the present application, the verification device is located in an identity verification system, and the identity verification system includes multiple verification devices. Figure 1 As shown, the verification device provided in the embodiment of the present application includes a memory 101 , a communication module 103 and one or more processors 102 .

[0069] The memory 101 is used to store computer programs executed by the processor 102. The memory 101 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0070] The memory 101 may be a volatile memory, such as a random-access memory (RAM); the memory 101 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 101 is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 101 may be a combination of the above memories.

[0071] The processor 102 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 102 is used to implement the identity authentication method provided in the embodiment of the present application when calling the computer program stored in the memory 101 .

[0072] The communication module 103 is used to communicate with other authentication devices in the identity authentication system.

[0073] The specific connection medium between the memory 101, the communication module 103 and the processor 102 is not limited in the embodiments of the present application. Figure 1 In the embodiment, the memory 101 and the processor 102 are connected via a bus 104. The bus 104 is Figure 1 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus 104 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 1 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0074] In one embodiment, the verification device provided in the embodiment of the present application may be a server, or a terminal device or other electronic device.

[0075] In some embodiments, the flowchart of the identity authentication method performed by the above verification device can be found in Figure 2 As shown, the following steps are included:

[0076] Step S201: after receiving the authentication information, verify the authentication information.

[0077] The authentication information is obtained after the client responds to the user's operation. The authentication information can be an account password, digest, digital certificate, secret sharing, biometric identification, etc., and the authentication information can be pre-stored in the client or other external devices, or automatically calculated based on the stored secret information, etc., which is not limited in the embodiments of the present application.

[0078] Step S202, if the verification is successful, the client is notified to send the authentication information to at least one other verification device in the identity authentication system that has not verified the authentication information, so that multiple verification devices in the identity authentication system notify the client of successful verification after the authentication information is verified; or if the verification is successful, and other verification devices in the identity authentication system verify the authentication information, the client is notified of successful verification.

[0079] In one embodiment, if the verification device is a primary verification device, then after receiving the authentication information and before verifying the authentication information, the primary verification device may notify the client to send the authentication information to at least one other verification device in the identity authentication system, and after confirming that the authentication information has been verified by other verification devices in the identity authentication system, notify the client to send the authentication information to the primary verification device again for verification.

[0080] Specifically, the generated authentication token can be sent to the client through other authentication devices to trigger the client to send authentication information to the main authentication device again. After receiving the authentication information sent by the client again, the main authentication device can verify the account information and the authentication token to be verified in the authentication information respectively. After the account information and the authentication token to be verified are verified, it is determined that the authentication information has passed the verification. After it is determined that the authentication information has passed the verification, and other authentication devices in the identity authentication system have passed the authentication information verification, the client can be notified that the verification is successful.

[0081] In another embodiment, if the verification device is a slave verification device, the client can be notified to send the authentication information to the next other verification device connected to itself in the identity verification system according to the verification order of the verification device. After receiving the authentication information sent by other verification devices, the slave verification device can send the generated authentication token to the client through other verification devices to trigger the client to send authentication information to the slave verification device. After receiving the authentication information sent by the client, the slave verification device can verify the account information and the authentication token to be verified in the authentication information respectively. After the account information and the authentication token to be verified are verified, it is determined that the authentication information has passed the verification. After it is determined that the authentication information has passed the verification, and all verification devices in the identity verification system have passed the authentication information verification, the client is notified that the verification is successful.

[0082] When the verification device verifies the authentication token to be verified in the authentication information, it can compare the authentication token to be verified in the authentication information with the generated authentication token. If the authentication token to be verified is consistent with the generated authentication token, it is determined that the authentication token to be verified has been verified; otherwise, it is determined that the authentication token to be verified has failed the verification.

[0083] The authentication information received by different verification devices is different. For example, the authentication information sent by the client and received by the main verification device is authentication information related to the client logging into the main verification device, the authentication information sent by the client and received by the slave verification device is authentication information related to the client logging into the slave verification device, and so on.

[0084] The identity authentication method provided in the embodiment of the present application can verify the authentication information after receiving the authentication information, wherein the authentication information is obtained after the client responds to the user's operation. If the verification is successful, the client is notified to send the authentication information to at least one other verification device in the identity authentication system that has not verified the authentication information, so that multiple verification devices in the identity authentication system notify the client of successful verification after all the authentication information is verified, or if the verification is successful and other verification devices in the identity authentication system are successful in verifying the authentication information, the client is notified of successful verification. Since the authentication information sent by the client needs to be verified by multiple verification devices, and the client is notified of successful verification only when multiple verification devices are successful in verifying the authentication information, the security and anti-attack capability of identity authentication can be improved.

[0085] In some embodiments, if the identity authentication system includes a master authentication device and a slave authentication device, and the authentication information is an account password, the interactive flow chart of identity authentication between the client and the master authentication device and the slave authentication device can be found in Figure 3 As shown, the following steps are included:

[0086] Step S301: The client sends a first authentication request to the primary verification device, carrying the account and password for the client to log in to the primary verification device.

[0087] The client can send a first authentication request to the primary authentication device, and the first authentication request can carry the account and password of the client to log in to the primary authentication device. The client is the initiator of identity authentication, which can be a device, software or browser, etc. The primary authentication device is the target that the client attempts to log in, which can be a device, system or platform, etc.

[0088] Step S302: The primary verification device sends a re-authentication notification to the client.

[0089] After receiving the first authentication request sent by the client, the master authentication device may notify the client to perform re-authentication, and notify the client of the identifier and / or address of the slave authentication device for re-authentication.

[0090] Step S303: The client sends a second authentication request to the slave authentication device, carrying the account password of the client for logging into the slave authentication device and the identifier and / or address of the master authentication device.

[0091] After receiving the re-authentication notification sent by the primary authentication device, the client can send a second authentication request to the secondary authentication device, and the second authentication request carries the client's account password for logging into the secondary authentication device and the identification and / or address of the primary authentication device.

[0092] The slave verification device is an additional verification device introduced to authenticate the client's attempt to log in to the main verification device, which can be a device, system or platform, etc. The purpose of introducing the slave verification device is to provide additional identity authentication for the client to log in to the main verification device, thereby forming multiple authentication guarantees.

[0093] In an optional embodiment, after receiving the first authentication request sent by the client, the main verification device can verify the account password carried in the first authentication request. If the verification fails, the client is not allowed to log in to the main verification device. If the verification passes, the client is notified to re-authenticate so that the client can send a second authentication request to the slave verification device.

[0094] Step S304: The account password carried in the second authentication request is verified from the verification device, and the verification is successful.

[0095] Step S305: The slave verification device sends a third authentication request to the master verification device, carrying the account password for the slave verification device to log in to the master verification device and the client identifier and / or account identifier.

[0096] After receiving the second authentication request sent by the client, the slave verification device can verify the account password carried in the second authentication request. If the verification fails, the client is not allowed to log in to the main verification device. If the verification passes, the slave verification device can send a third authentication request to the main verification device, and the third authentication request carries the account password for the slave verification device to log in to the main verification device and the client's identifier and / or account identifier.

[0097] Step S306: The primary verification device verifies the account password carried in the third authentication request, and if the verification is successful, generates an authentication token.

[0098] Step S307: the master verification device sends an authentication token to the slave verification device.

[0099] After receiving the third authentication request sent by the slave verification device, the main verification device can verify the account password carried in the third authentication request. If the verification fails, the client is not allowed to log in to the main verification device. If the verification passes, an authentication token is generated according to the third authentication request and the authentication token is sent to the slave verification device.

[0100] Since the slave verification device initiates an authentication request to the master verification device and after the authentication is passed, the master verification device can send an authentication token to the slave verification device, thereby protecting the security of the authentication token.

[0101] Step S308: Send an authentication token from the verification device to the client.

[0102] After receiving the authentication token sent by the master authentication device, the slave authentication device may send the authentication token to the client.

[0103] Since the client initiates an authentication request to the slave verification device and after the authentication is passed, the slave verification device can send an authentication token to the client, thereby protecting the security of the authentication token.

[0104] Step S309: the client sends a fourth authentication request to the primary authentication device, carrying the account password and authentication token for the client to log in to the primary authentication device.

[0105] After receiving the authentication token sent from the authentication device, the client may send a fourth authentication request to the primary authentication device, and the fourth authentication request may carry the client's account password for logging into the primary authentication device, as well as the authentication token.

[0106] The generated authentication token can only be used once by the client that initiates the identity authentication, and has a validity period. That is, if the client does not use the generated authentication token for authentication for a long time, the authentication token will become invalid. Since the authentication token that can only be used once and has a validity period is generated for the authentication request initiated by the slave authentication device to the master authentication device, replay attacks can be prevented, thus improving the anti-attack capability.

[0107] In one embodiment, when the client sends the fourth authentication request to the primary verification device, the client may carry an authentication Token or a modified form thereof.

[0108] Step S310: The primary verification device verifies the account password and the authentication token carried in the fourth authentication request respectively, and the verification is successful.

[0109] Step S311: The primary verification device sends a verification success notification to the client.

[0110] After receiving the fourth authentication request sent by the client, the primary verification device can verify the account password and authentication token carried in the fourth authentication request respectively. If the verification fails, the client is not allowed to log in to the primary verification device. If the verification passes, a verification success notification is sent to the client, which means that the client is allowed to log in to the primary verification device.

[0111] When verifying the authentication token carried in the authentication request, the authentication token may be compared with the authentication token stored locally for the client or account. If they are inconsistent, the verification fails. If they are consistent, the verification passes.

[0112] Since the master verification device can authenticate the client by verifying the validity of the authentication token, it can be ensured that the client has completed the additional authentication with the slave verification device.

[0113] The identity authentication method provided in the embodiment of the present application can have a reliable authentication channel between the client, the master authentication device and the slave authentication device, and can ensure the confidentiality and integrity of the interactive information during the identity authentication process. In addition, the authentication information between the client, the master authentication device and the slave authentication device can be different or the same.

[0114] In addition, the identity authentication method provided in the embodiment of the present application can introduce a higher-level slave verification device to perform verification during the process of the client attempting to log in to the main verification device, thereby improving the authentication security of the main verification device with a lower security level. Moreover, the introduction of the slave verification device to perform additional identity authentication can re-plan and build the permission system and hierarchy. For example, the client's permission to the main verification device depends on the client's permission to the slave verification device. If the client does not have permission to the slave verification device, then even if it has the login credentials of the main verification device, it will ultimately not be able to log in to the main verification device. Therefore, the slave verification device can manage and control the client's permission to log in to the main verification device.

[0115] In other embodiments, if the identity authentication system includes a master authentication device and a first slave authentication device and a second slave authentication device, and the authentication information is an account password, the interactive flow chart of identity authentication between the client and the master authentication device, the first slave authentication device, and the second slave authentication device can be found in Figure 4 As shown, the following steps are included:

[0116] Step S401: The client sends a first authentication request to the primary verification device, carrying the account and password for the client to log in to the primary verification device.

[0117] The client may send a first authentication request to the primary authentication device, and the first authentication request may carry an account and password for the client to log in to the primary authentication device.

[0118] Step S402: The primary verification device sends a first re-authentication notification to the client.

[0119] After receiving the first authentication request sent by the client, the master authentication device may notify the client to perform re-authentication, and notify the client of the identifier and / or address of the first slave authentication device for re-authentication.

[0120] Step S403: the client sends a second authentication request to the first slave authentication device, carrying the account password of the client for logging into the first slave authentication device and the identifier and / or address of the master authentication device.

[0121] After receiving the first re-authentication notification sent by the master verification device, the client can send a second authentication request to the first slave verification device, and the second authentication request carries the client's account password for logging into the first slave verification device and the identification and / or address of the master verification device.

[0122] Step S404: The first slave verification device verifies the account password carried in the second authentication request, and the verification is successful.

[0123] Step S405: The first slave verification device sends a second-factor authentication notification to the client.

[0124] Step S406: The client sends a third authentication request to the second slave authentication device, carrying the account password for the client to log in to the second slave authentication device and the identifier and / or address of the first slave authentication device.

[0125] After receiving the second authentication request sent by the client, the first slave authentication device can verify the account password carried in the second authentication request. If the verification fails, the client is not allowed to log in to the main authentication device. If the verification passes, the first slave authentication device can notify the client to re-authenticate and notify the client of the identifier and / or address of the second slave authentication device for re-authentication. After receiving the second re-authentication notification sent by the first slave authentication device, the client can send a third authentication request to the second slave authentication device, and the third authentication request carries the account password for the client to log in to the second slave authentication device and the identifier and / or address of the first slave authentication device.

[0126] In an optional embodiment, after receiving the second authentication request, the first slave authentication device may not authenticate the second authentication request, and notify the client to perform re-authentication, so that the client sends a third authentication request to the second slave authentication device.

[0127] Step S407: The second slave verification device verifies the account password carried in the third authentication request, and the verification is successful.

[0128] Step S408: The second slave verification device sends a fourth authentication request to the first slave verification device, carrying the account password of the second slave verification device for logging into the first slave verification device and the client identifier and / or account identifier.

[0129] After receiving the third authentication request sent by the client, the second slave verification device can verify the account password carried in the third authentication request. If the verification fails, the client is not allowed to log in to the main verification device. If the verification passes, the second slave verification device can send a fourth authentication request to the first slave verification device, and the fourth authentication request carries the account password of the second slave verification device to log in to the first slave verification device and the client's identifier and / or account identifier.

[0130] Step S409: The first slave verification device verifies the account password carried in the fourth authentication request, and if the verification is successful, a first authentication token is generated.

[0131] Step S410: The first slave verification device sends a first authentication token to the second slave verification device.

[0132] After receiving the fourth authentication request sent by the second slave verification device, the first slave verification device can verify the account password carried in the fourth authentication request. If the verification fails, the client is not allowed to log in to the main verification device. If the verification passes, a first authentication token is generated according to the fourth authentication request, and the first authentication token is sent to the second slave verification device.

[0133] Step S411: the second slave verification device sends a first authentication token to the client.

[0134] After receiving the first authentication token sent by the first slave authentication device, the second slave authentication device may send the first authentication token to the client.

[0135] Step S412: the client sends a fifth authentication request to the first slave authentication device, carrying the account password and the first authentication token for the client to log in to the first slave authentication device.

[0136] After receiving the first authentication token sent by the second slave authentication device, the client may send a fifth authentication request to the first slave authentication device, and the fifth authentication request may carry the client's account password for logging into the first slave authentication device, and the first authentication token.

[0137] Step S413: The first slave verification device verifies the account password and the first authentication token carried in the fifth authentication request respectively, and the verification is successful.

[0138] Step S414: The first slave verification device sends a sixth authentication request to the master verification device, carrying the account password of the first slave verification device for logging into the master verification device and the client identifier and / or account identifier.

[0139] After receiving the fifth authentication request sent by the client, the first slave verification device can verify the account password and the first authentication token carried in the fifth authentication request respectively. If the verification fails, the client is not allowed to log in to the main verification device. If the verification passes, a sixth authentication request is sent to the main verification device, and the sixth authentication request can carry the account password of the first slave verification device to log in to the main verification device and the client's identifier and / or account identifier.

[0140] Step S415: The primary verification device verifies the account password carried in the sixth authentication request, and if the verification is successful, a second authentication token is generated.

[0141] Step S416: the master verification device sends a second authentication token to the first slave verification device.

[0142] After receiving the sixth authentication request sent by the first slave verification device, the main verification device can verify the account password carried in the sixth authentication request. If the verification fails, the client is not allowed to log in to the main verification device. If the verification passes, a second authentication token is generated according to the sixth authentication request, and the second authentication token is sent to the first slave verification device.

[0143] Step S417: the first slave verification device sends a second authentication token to the client.

[0144] After receiving the second authentication token sent by the master authentication device, the first slave authentication device may send the second authentication token to the client.

[0145] Step S418: The client sends a seventh authentication request to the primary authentication device, carrying the client's account password for logging into the primary authentication device and the second authentication token.

[0146] After receiving the second authentication token sent by the first slave authentication device, the client may send a seventh authentication request to the master authentication device, and the seventh authentication request may carry the client's account password for logging into the master authentication device, and the second authentication token.

[0147] Step S419: The primary verification device verifies the account password and the second authentication token carried in the seventh authentication request respectively, and the verification passes.

[0148] Step S420: The primary verification device sends a verification success notification to the client.

[0149] After receiving the seventh authentication request sent by the client, the primary verification device can verify the account password and the second authentication token carried in the seventh authentication request respectively. If the verification fails, the client is not allowed to log in to the primary verification device. If the verification passes, a verification success notification is sent to the client, which means that the client is allowed to log in to the primary verification device.

[0150] When the identity authentication system includes one master verification device and more than two slave verification devices, the interaction method for identity authentication between the client and the master verification device and multiple slave verification devices is similar to the above embodiment. When the identity authentication system includes one master verification device and two slave verification devices, the interaction method for identity authentication between the client and the master verification device, the first slave verification device, and the second slave verification device is similar, and this application will not repeat it here.

[0151] The authentication information is digest, digital certificate, secret sharing, biometric identification, etc., which is similar to the identity authentication method between the client and the main verification device and the slave verification device when the authentication information is account password. This application will not go into details here.

[0152] The identity authentication method provided in the embodiment of the present application introduces multiple authentication devices, and only when all the authentication devices have verified the authentication information, will the client be notified of a successful login, thereby increasing the types and times of identity authentication, and further improving the security and anti-attack capabilities of identity authentication. In addition, due to the introduction of multiple authentication devices, multiple authentications are formed for identity authentication, which lengthens the authentication process, thereby greatly improving the difficulty and cost of implementing brute force attacks, effectively alleviating brute force attacks, that is, effectively resisting attacks or risks such as brute force, man-in-the-middle attacks, and weak passwords, and achieving high security for identity authentication.

[0153] and Figure 2 The identity authentication method shown is based on the same inventive concept, and an identity authentication device is also provided in the embodiment of the present application. Since the device is the device corresponding to the identity authentication method of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated.

[0154] Figure 5 The structure diagram of an identity authentication device provided in an embodiment of the present application is shown. The identity authentication device is applied to a verification device. The verification device is located in an identity authentication system, and the identity authentication system includes multiple verification devices. Figure 5 As shown, the identity authentication device includes an information verification unit 501 and a verification success unit 502.

[0155] The information verification unit 501 is used to verify the authentication information after receiving the authentication information, wherein the authentication information is obtained after the client responds to the user's operation;

[0156] The verification success unit 502 is used to notify the client to send the authentication information to at least one other verification device in the identity authentication system that has not verified the authentication information if the verification is successful, so that multiple verification devices in the identity authentication system notify the client of successful verification after the authentication information is verified; or if the verification is successful and other verification devices in the identity authentication system are successful in verifying the authentication information, the client is notified of successful verification.

[0157] In an optional embodiment, the verification device is a master verification device; Figure 6 As shown, the above device may further include a notification verification unit 601, which is used to:

[0158] Notifying the client to send authentication information to at least one other authentication device in the identity authentication system;

[0159] After confirming that other verification devices in the identity authentication system have passed the verification of the authentication information, the client is notified to send the authentication information to the main verification device for verification again.

[0160] In an optional embodiment, the notification verification unit 601 is specifically configured to:

[0161] Send the generated authentication token to the client through other authentication devices to trigger the client to send authentication information to the main authentication device again;

[0162] The information verification unit 501 is specifically used for:

[0163] After receiving the authentication information sent by the client again, the account information in the authentication information and the authentication token to be verified are verified respectively;

[0164] After both the account information and the authentication token to be verified are verified, it is determined that the authentication information is verified.

[0165] In an optional embodiment, the verification device is a slave verification device; the verification success unit 502 is specifically configured to:

[0166] According to the verification order of the verification device, the client is notified to send the authentication information to the next other verification device connected to itself in the identity authentication system.

[0167] In an optional embodiment, the notification verification unit 601 is further configured to:

[0168] After receiving the authentication information sent by other authentication devices, the generated authentication token is sent to the client through the other authentication devices to trigger the client to send authentication information to the slave authentication device;

[0169] The information verification unit 501 is further used for:

[0170] After receiving the authentication information sent by the client, the account information in the authentication information and the authentication token to be verified are verified respectively;

[0171] After both the account information and the authentication token to be verified are verified, it is determined that the authentication information is verified.

[0172] In an optional embodiment, the notification verification unit 601 is further configured to:

[0173] The authentication token to be verified in the authentication information is compared with the generated authentication token. If the authentication token to be verified is consistent with the generated authentication token, it is determined that the authentication token to be verified has been verified successfully, otherwise it is determined that the authentication token to be verified has failed to be verified.

[0174] According to one aspect of the present application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions so that the computer device performs the identity authentication method in the above embodiment. The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0175] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. An identity authentication method, characterized in that: Applied in a verification device, the verification device is located in an identity verification system, the identity verification system includes a plurality of verification devices, the method includes: After receiving the authentication information sent by the client, verify the authentication information, wherein the authentication information is obtained by the client in response to the user's operation, and includes the account information and authentication token required to access the current authentication device, the authentication device includes a master authentication device and at least one slave authentication device, the authentication token is generated when the master authentication device successfully verifies the request login information sent by the slave authentication device, or when the slave authentication device successfully verifies the request login information sent by another slave authentication device, the authentication token can be used a preset number of times, and the usable time is within a preset time range, for any slave authentication device, after receiving the authentication information sent by other authentication devices, the any slave authentication device sends the generated authentication token to the client through other authentication devices, so as to trigger the client to send authentication information to the slave authentication device; If the verification is successful, and there are multiple other verification devices in the identity authentication system that have not verified the authentication information, then in accordance with the verification order of the verification devices, the client is notified to send the authentication information to the next other verification device connected to itself in the identity authentication system, so that the multiple verification devices in the identity authentication system notify the client of successful verification after the authentication information is verified; or if the account information in the authentication information and the authentication token to be verified are both verified, and other verification devices in the identity authentication system have passed the verification of the authentication information, then the client is notified of successful verification.

2. The method according to claim 1, characterized in that The authentication device is a master authentication device; After receiving the authentication information and before verifying the authentication information, the method further includes: Notifying the client to send the authentication information to at least one other authentication device in the identity authentication system; After confirming that the authentication information is successfully authenticated by other authentication devices in the identity authentication system, the client is notified to send the authentication information to the main authentication device again for authentication.

3. The method according to claim 2, characterized in that The notifying client to send authentication information to the primary verification device again for verification includes: Sending the generated authentication token to the client via other authentication devices to trigger the client to send authentication information to the main authentication device again; After receiving the authentication information, verifying the authentication information includes: After receiving the authentication information sent by the client again, verify the account information in the authentication information and the authentication token to be verified respectively; After both the account information and the authentication token to be verified are verified, it is determined that the authentication information is verified.

4. The method according to claim 3, characterized in that The verifying the authentication token to be verified in the authentication information includes: The authentication token to be verified in the authentication information is compared with the generated authentication token. If the authentication token to be verified is consistent with the generated authentication token, it is determined that the authentication token to be verified has been verified successfully; otherwise, it is determined that the authentication token to be verified has failed to be verified.

5. An identity authentication device, characterized in that: Applied to a verification device, the verification device is located in an identity verification system, and the identity verification system includes multiple verification devices, including: An information verification unit, configured to verify the authentication information after receiving the authentication information sent by the client, wherein the authentication information is obtained by the client in response to the user's operation, and includes account information and an authentication token required for accessing the current authentication device, the authentication device includes a master authentication device and at least one slave authentication device, the authentication token is generated when the master authentication device successfully verifies the request login information sent by the slave authentication device, or when the slave authentication device successfully verifies the request login information sent by another slave authentication device, the authentication token can be used a preset number of times, and the usable time is within a preset time range, and for any slave authentication device, after receiving the authentication information sent by other authentication devices, the any slave authentication device sends the generated authentication token to the client through other authentication devices to trigger the client to send authentication information to the slave authentication device; A verification success unit is used to notify the client to send the authentication information to the next other verification device connected to itself in the identity authentication system according to the verification order of the verification devices if the verification is successful and there are multiple other verification devices in the identity authentication system that have not verified the authentication information, so that the multiple verification devices in the identity authentication system notify the client of successful verification after the authentication information is verified; or if the account information in the authentication information and the authentication token to be verified are verified, and other verification devices in the identity authentication system are successful in verifying the authentication information, then notify the client of successful verification.

6. The device according to claim 5, characterized in that The verification device is a main verification device; the apparatus further comprises a notification verification unit, which is used to: Notifying the client to send the authentication information to at least one other authentication device in the identity authentication system; After confirming that the authentication information is successfully authenticated by other authentication devices in the identity authentication system, the client is notified to send the authentication information to the main authentication device again for authentication.

7. A verification device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the computer program is executed by the processor, the method according to any one of claims 1 to 4 is implemented.

8. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images