A user authentication method, device, equipment, system and storage medium

Abstract

The present invention discloses a user authentication method, apparatus, device, and storage medium. The present invention relates to the technical field of cloud computing security services. The method includes: being applied to a client, sending a first keyboard open notification message to a server; receiving first hash values corresponding to each key value on the keyboard returned by the server; generating a first hash key value combination based on the first hash values corresponding to each key value in the first sensitive information; and sending the first hash key value combination to the server. Being applied to the server, generating first hash values corresponding to each key value based on first initial salt values corresponding to each key value on the keyboard; sending the first hash values corresponding to each key value on the keyboard to the client; receiving the first hash key value combination sent by the client; and authenticating the user based on the first hash key value combination. The technical solution of the present invention enhances the security of the user password during transmission and further strengthens the uncrackability of the password on the basis of ensuring the original security performance.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of cloud computing security services, and in particular, to a user authentication method, apparatus, device, system, and storage medium. Background Art

[0002] When a user inputs some sensitive information such as a password, verification code, etc., in order to ensure that the sensitive information is not leaked or stolen, a secure keyboard can be used to improve the security of the password during transmission. Generally, a secure keyboard processes the user's sensitive information by using a single salt value plus hash encryption, and sends the processed sensitive information to the server for authentication.

[0003] However, the above method of using a single salt value plus hash encryption is that the client uses the salt value corresponding to the user name sent by the server to perform a one-time hash encryption on the entire sensitive information input by the user, and it is easy for attackers to obtain the original text of the sensitive information by technical means, resulting in poor security. Summary of the Invention

[0004] The embodiments of the present invention provide a user authentication method, apparatus, device, system, and storage medium to enhance the security of user sensitive information during the authentication process.

[0005] In a first aspect, the embodiments of the present invention provide a user authentication method, including:

[0006] When receiving a first keyboard open instruction, sending a first keyboard open notification message to the server;

[0007] Receiving first hash values respectively corresponding to each key value on the keyboard returned by the server;

[0008] Based on the currently received information, determining first hash values respectively corresponding to each key value in the first sensitive information input by the user through the keyboard, and generating a first hash key value combination based on the first hash values respectively corresponding to each key value in the first sensitive information;

[0009] Sending the first hash key value combination to the server, so that the server authenticates the user based on the first hash key value combination.

[0010] In a second aspect, the embodiments of the present invention provide a user authentication method, including:

[0011] When receiving the first keyboard open notification message sent by the client, generating first hash values respectively corresponding to each key value based on first initial salt values respectively corresponding to each key value on the keyboard;

[0012] Sending the first hash values respectively corresponding to each key value on the keyboard to the client;

[0013] Receive the first hash key value combination sent by the client; wherein, the first hash key value combination is generated by the client based on the first hash values corresponding to each key value in the first sensitive information input by the user through the keyboard;

[0014] Authenticate the user based on the first hash key value combination.

[0015] Thirdly, an embodiment of the present invention further provides a user authentication device, and the device includes:

[0016] An instruction receiving module, configured to send a first keyboard opening notification message to the server when receiving a first keyboard opening instruction;

[0017] A first hash value receiving module, configured to receive the first hash values corresponding to each key value on the keyboard returned by the server;

[0018] A first hash key value combination generating module, configured to determine the first hash values corresponding to each key value in the first sensitive information input by the user through the keyboard based on the currently received information, and generate a first hash key value combination based on the first hash values corresponding to each key value in the first sensitive information;

[0019] A first hash key value combination sending module, configured to send the first hash key value combination to the server, so that the server authenticates the user based on the first hash key value combination.

[0020] Fourthly, an embodiment of the present invention further provides a user authentication device, and the device includes:

[0021] A first hash value generating module, configured to generate the first hash values corresponding to each key value based on the first initial salt values corresponding to each key value on the keyboard when receiving a first keyboard opening notification message sent by the client;

[0022] A first hash value sending module, configured to send the first hash values corresponding to each key value on the keyboard to the client;

[0023] A first hash key value combination receiving module, configured to receive the first hash key value combination sent by the client; wherein, the first hash key value combination is generated by the client based on the first hash values corresponding to each key value in the first sensitive information input by the user through the keyboard;

[0024] A user authentication module, configured to authenticate the user based on the first hash key value combination.

[0025] Fifth aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the user authentication method described in any one of the embodiments of the present invention is implemented.

[0026] Sixth aspect, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the user authentication method described in any one of the embodiments of the present invention is implemented.

[0027] Seventh aspect, an embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed by a processor, the user authentication method described in any one of the embodiments of the present invention is implemented.

[0028] Eighth aspect, an embodiment of the present invention further provides a user authentication system, including:

[0029] A client, configured to send a first keyboard opening notification message to a server when receiving a first keyboard opening instruction; receive first hash values respectively corresponding to each key value on the keyboard returned by the server; determine first hash values respectively corresponding to each key value in first sensitive information input by the user through the keyboard based on currently received information, generate a first hash key value combination based on the first hash values respectively corresponding to each key value in the first sensitive information; and send the first hash key value combination to the server;

[0030] A server, configured to generate the first hash values respectively corresponding to each key value based on first initial salt values respectively corresponding to each key value on the keyboard when receiving the first keyboard opening notification message; send the first hash values respectively corresponding to each key value on the keyboard to the client; receive the first hash key value combination sent by the client, and authenticate the user based on the first hash key value combination.

[0031] In an embodiment of the present invention, the client can receive the first hash values respectively corresponding to the key values on the keyboard returned by the server; generate a first hash key value combination based on the first hash values respectively corresponding to the key values in the first sensitive information; and send the first hash key value combination to the server. The server can generate the first hash values respectively corresponding to the key values on the keyboard based on the first initial salt values respectively corresponding to the key values on the keyboard; send the first hash values respectively corresponding to the key values on the keyboard to the client; receive the first hash key value combination sent by the client; and authenticate the user based on the first hash key value combination. The technical solution of the present invention requires the server to generate the first hash values corresponding to the key values on the keyboard each time the user authenticates, so that the client can generate the first hash key value combination to be transmitted based on the current first hash values corresponding to each key value input by the user, realizing dynamic encryption of the first sensitive information to be transmitted in terms of keys, enhancing the security of the user's sensitive information during the authentication process, and making it difficult to restore the first sensitive information to plaintext during the transmission process, further strengthening the uncrackability of the password on the basis of ensuring the original security performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other related drawings can be obtained based on these drawings without creative efforts.

[0033] Figure 1 It is a flowchart of a user authentication method applied to a client provided in Embodiment 1 of the present invention;

[0034] Figure 2 It is a schematic diagram of generating the first hash key value provided in Embodiment 1 of the present invention;

[0035] Figure 3 It is a flowchart of the sensitive information setting stage in a user authentication method provided in Embodiment 2 of the present invention;

[0036] Figure 4 It is a flowchart of a user authentication method applied to a server provided in Embodiment 3 of the present invention;

[0037] Figure 5 It is a flowchart of the method for authenticating a user based on the first hash key value combination in the user authentication method applied to the server provided in Embodiment 4 of the present invention;

[0038] Figure 6 It is a flowchart of the sensitive information setting stage in another user authentication method provided in Embodiment 5 of the present invention;

[0039] Figure 7 It is a schematic structural diagram of a user authentication system provided in Embodiment 6 of the present invention;

[0040] Figure 8 It is a schematic diagram of the interaction process between the server and the client in the sensitive information setting stage provided in Embodiment 6 of the present invention;

[0041] Figure 9 It is a schematic diagram of the interaction process between the server and the client in the user authentication stage provided in Embodiment 6 of the present invention;

[0042] Figure 10 It is a schematic structural diagram of a user authentication device for a client provided in Embodiment 7 of the present invention;

[0043] Figure 11 It is a schematic structural diagram of a user authentication device for a server provided in Embodiment 8 of the present invention;

[0044] Figure 12 It is a schematic structural diagram of an electronic device provided in Embodiment 9 of the present invention. Detailed implementation manners

[0045] The present invention will be further described in detail below with reference to the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present invention, rather than limiting the present invention. In addition, it should be noted that for the sake of description, only parts related to the present invention rather than all structures are shown in the drawings.

[0046] It should be noted that: similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present invention, terms such as "first", "second", etc. are only used for distinguishing descriptions, and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing, etc. of data in the technical solution of the present application all comply with the relevant regulations of national laws and regulations.

[0047] Embodiment 1

[0048] Figure 1 It is a flowchart of a user authentication method provided in Embodiment 1 of the present invention. This embodiment is applicable to the situation of improving the security of user sensitive information during the authentication process. This method can be executed by the user authentication device applied to the client in the embodiments of the present invention, and the device can be implemented in software and / or hardware, such as Figure 1 As shown, the method specifically includes the following steps:

[0049] S110, when receiving a first keyboard opening instruction, send a first keyboard opening notification message to the server.

[0050] Specifically, the first sensitive information can be a password or a verification code. Taking the sensitive information as a password as an example, the user can log in and verify by entering the username and password through the web page of the client. Among them, the username can be the user's mobile phone number, the user's ID number, the nickname set by the user himself, or any other unique username representing the user. When the user needs to enter the password, the user will manually perform the operation of opening the keyboard, thereby triggering the generation of the first keyboard opening instruction, and the security keyboard JS side of the client can receive this first keyboard opening instruction. Further, when receiving the first keyboard opening instruction, a first keyboard opening notification message is sent to the server.

[0051] S120, receive the first hash values respectively corresponding to each key value on the keyboard returned by the server.

[0052] Specifically, the server can provide the client with the first hash values respectively corresponding to each key value on the keyboard. Among them, the server includes a security keyboard SDK. By using the security keyboard SDK to perform full - process advanced encryption on the data input process, data storage process, and memory data conversion process of the keyboard, it can effectively prevent attack behaviors such as data eavesdropping, keyboard hijacking, and keyboard screenshotting. For example, assuming that there are ten key values from 0 to 9 on the first keyboard to be opened, the server can randomly provide ten random strings as the first initial salt values respectively corresponding to each key value. After the security keyboard SDK generates the timestamp and the keyboard identifier (UUID), for each first initial salt value, using the timestamp and the keyboard identifier as random factors, the domestic hash algorithm (SM3) is used to encrypt the first initial salt value, and a preset number of characters are selected from the encryption result as the first hash value corresponding to the corresponding key value. Among them, the preset number can be a value greater than or equal to 4. Among them, SM3 is a standard for cryptographic hash functions, mainly used for digital signature and verification, message authentication code generation and verification, and random number generation, etc. Further, the server returns the first hash values respectively corresponding to each key value on the keyboard generated to the client, and at the same time, information such as UUID and timestamp can be sent to the client.

[0053] S130, determine the first hash values respectively corresponding to each key value in the first sensitive information input by the user through the keyboard based on the currently received information, and generate a first hash key value combination based on the first hash values respectively corresponding to each key value in the first sensitive information.

[0054] Specifically, after the client receives the first hash values respectively corresponding to each key value on the keyboard, a first keyboard is generated and displayed based on the first hash values respectively corresponding to each key value, such as Figure 2As shown in the figure, it is assumed that there are ten key values from 0 to 9 on the first keyboard to be opened, and the characters in the lower right corner of each key value correspond to the first hash value of that key value. Among them, the first hash values of the key values in the lower right corner may not be displayed on the keyboard interface of the client. The user inputs the first sensitive information through the displayed first keyboard, and determines the first hash values corresponding to the respective key values in the first sensitive information input by the user based on the first hash values corresponding to the respective key values on the keyboard. For example, the first hash values of the ten key values from 0 to 9 are already known. The first sensitive information input by the user is 123456, then the first hash values of the six key values 123456 are determined from the first hash values of the ten key values from 0 to 9. As Figure 2 shown, the first hash values of the six key values 123456 are respectively: 4be0, 5f37, 5cb1, 6677, 1a3b, and 5649. Further, a first hash key value combination is generated based on the first hash values corresponding to the respective key values in the first sensitive information as: "4be05f375cb166771a3b5649". In the embodiments of this solution, the client can receive the user name input by the user while receiving the input first sensitive information.

[0055] Based on the above embodiments, optionally, generating a first hash key value combination based on the first hash values corresponding to the respective key values in the first sensitive information may include steps A1 - A3:

[0056] Step A1, obtain a preset key value.

[0057] Specifically, a preset key value is stored in the memory of the client. Obtain this key value, and assume that this key value is S0.

[0058] Step A2, traverse the key values in the first sensitive information in the input order, obtain the first hash value of the currently traversed key value, encrypt the first hash value of the current key value and the current preset key value, and use the encrypted information to replace the current preset key value.

[0059] For example, assume that the password input by the user is "123456". First, obtain the first hash value of "1", denoted as S1. Concatenate S1 and S0 and then encrypt them using the SM3 algorithm to obtain S2, where S2 = SM3(S0 + S1). Replace and update S0 with the calculated S2 to obtain a new S0. And so on, traverse the first hash values of the remaining key values "23456".

[0060] Step A3, determine the current preset key value after the traversal is completed as the first hash key value combination.

[0061] The above steps use a hash encryption method with aftereffect to generate the first hash key-value combination. By traversing each key-value in the sensitive information, the strength of the encrypted salt value increases with the length of the sensitive information, further enhancing the security of the user's sensitive information. And it realizes that for each key value received, the key value is encrypted once, making the first sensitive information unable to be restored to plaintext during the transmission process, further enhancing the security of the first sensitive information input by the user during the transmission process.

[0062] S140. Send the first hash key-value combination to the server so that the server authenticates the user based on the first hash key-value combination.

[0063] Before sending the first hash key-value combination to the server, a one-way hash encryption algorithm, such as the Bcrypt algorithm, can be used to encrypt the first hash key-value combination. Among them, the one-way hash encryption algorithm cannot be reversely cracked, enhancing the security of the first hash key-value combination to a certain extent. Further, after the client generates the first hash key-value combination, it sends the first hash key-value combination to the server (at the same time, the user name, UUID, timestamp, etc. can be sent to the server together, and the server can use the first hash key-value combination to authenticate the user).

[0064] The technical solution of this embodiment is as follows: when receiving the first keyboard opening instruction, send a first keyboard opening notification message to the server; receive the first hash value corresponding to each key value on the keyboard returned by the server; determine the first hash value corresponding to each key value in the first sensitive information input by the user through the keyboard based on the currently received information, and generate a first hash key-value combination based on the first hash value corresponding to each key value in the first sensitive information; send the first hash key-value combination to the server so that the server authenticates the user based on the first hash key-value combination. In the technical solution of this embodiment, every time the user authenticates, the server needs to generate a first hash value once, so that the client can generate the first hash key-value combination to be transmitted based on the first hash value of each key value input by the user, realizing dynamic encryption of the first sensitive information to be transmitted in terms of each key press, which can enhance the security of the user's sensitive information during the authentication process and make it difficult for the first sensitive information to be restored to plaintext during the transmission process, further strengthening the uncrackability of the password on the basis of ensuring the original security performance.

[0065] Embodiment 2

[0066] Figure 3 It is a flowchart of the sensitive information setting stage in a user authentication method provided by Embodiment 2 of the present invention. This embodiment refines the steps before receiving the first keyboard opening instruction based on the above embodiment. As Figure 3 shown, the method of this embodiment specifically includes the following steps:

[0067] S210, when receiving the second keyboard opening instruction, send a second keyboard opening notification message to the server.

[0068] Specifically, the second sensitive information can be a password or a verification code. Taking the sensitive information as a password as an example, the user can enter the username and password through the web page of the client to perform operations such as password setting. When the user needs to enter the password, the user will manually perform the operation of opening the keyboard, thereby triggering the generation of the second keyboard opening instruction, and the security keyboard JS side of the client can receive the second keyboard opening instruction. Further, when receiving the first keyboard opening instruction, send a first keyboard opening notification message to the server.

[0069] S220, receive the second hash values respectively corresponding to the key values on the keyboard returned by the server.

[0070] Specifically, the server can provide the second hash values respectively corresponding to the key values on the keyboard to the client. By way of example, assume that there are ten key values from 0 to 9 on the second keyboard to be opened. The server can randomly generate ten random strings as the second initial salt values respectively corresponding to each key value. After the security keyboard SDK generates the timestamp and the keyboard identifier (UUID), for each second initial salt value, using the timestamp and the keyboard identifier as random factors, encrypt the second initial salt value by using the domestic hash algorithm (SM3) algorithm, and select a preset number of characters from the encryption result as the second hash value corresponding to the corresponding key value, where the preset number can be a value greater than or equal to 4. Further, the server returns the second hash values respectively corresponding to the key values on the keyboard generated to the client, and can also send information such as the UUID and the timestamp to the client at the same time.

[0071] S230, determine the second hash values respectively corresponding to the key values in the second sensitive information set by the user through the keyboard based on the currently received information, and generate a second hash key value combination based on the second hash values respectively corresponding to the key values in the second sensitive information.

[0072] Specifically, after the client receives the second hash values corresponding to the key values on the keyboard respectively, it generates and displays a second keyboard based on the second hash values corresponding to the key values respectively. The user inputs second sensitive information through the displayed second keyboard, and determines the second hash values corresponding to the key values in the second sensitive information input by the user through the keyboard based on the second hash values corresponding to the key values on the keyboard. For example, the second hash values of the ten key values from 0 to 9 are already known. If the second sensitive information input by the user is "123456", then the second hash values of these six key values, namely 123456, are determined from the second hash values of the ten key values from 0 to 9. Further, the second hash values are sequentially combined based on the second hash values corresponding to the key values in the second sensitive information to generate a second hash key value combination. In the embodiment of this solution, the client can receive the username input by the user while receiving the input second sensitive information.

[0073] Optionally, based on the above embodiments, the second hash values corresponding to the key values in the second sensitive information are sequentially concatenated according to the input order, and the concatenated string is determined as the second hash key value combination.

[0074] For example, assume that the character length of the hash value is 4 and the second sensitive information is "123456". It is determined from the previous step that the second hash value corresponding to "1" is "4be0", and the second hash values corresponding to "2", "3", "4", "5", and "6" are "5f37", "5cb1", "6677", "1a3b", and "5649" respectively. Further, the second hash key values of each key are concatenated to obtain the second hash key value combination as "4be05f375cb166771a3b5649".

[0075] Obtaining the second hash key value combination in the above manner enhances the security of the sensitive information set by the user, making it difficult for the user's sensitive information to be exposed during the process of being stored in the server database.

[0076] S240: Send the second hash key value combination to the server so that the server stores the second hash key value combination and authenticates the user by determining the consistency between the first hash key value combination and the second hash key value combination.

[0077] Before sending the second hash key value combination to the server, an asymmetric encryption algorithm, such as the SM2 algorithm, can be used to encrypt the second hash key value combination. Among them, the asymmetric encryption algorithm requires two keys, namely the public key and the private key. The public key and the private key are a pair. If the data is encrypted with the public key, only the corresponding private key can decrypt it. The asymmetric encryption algorithm does not require the two communicating parties to transmit keys in advance or have any agreement to complete secure communication, and the key management is convenient. Further, the client sends the second hash key value combination to the server, and at the same time, information such as the timestamp, UUID, and username can be sent to the server together, so that the server stores the second hash key value combination and authenticates the user by determining the consistency between the first hash key value combination and the second hash key value combination.

[0078] The technical solution of this embodiment is to send a second keyboard open notification message to the server when receiving the second keyboard open instruction; receive the second hash values respectively corresponding to each key value on the keyboard returned by the server; determine the second hash values respectively corresponding to each key value in the second sensitive information set by the user based on the currently received information, and generate a second hash key value combination based on the second hash values respectively corresponding to each key value in the second sensitive information; send the second hash key value combination to the server, so that the server stores the second hash key value combination and authenticates the user by determining the consistency between the first hash key value combination and the second hash key value combination. The technical solution of this embodiment further improves the security of the user's sensitive information by generating a second hash key value combination on the client side and sending it to the server during the sensitive information setting stage.

[0079] Embodiment III

[0080] Figure 4 It is a flowchart of a user authentication method applied to a server provided in Embodiment III of the present invention. This method can be executed by the user authentication device applied to the server in the embodiments of the present invention. The device can be implemented in software and / or hardware, such as Figure 4 As shown, the method specifically includes the following steps:

[0081] S310, when receiving the first keyboard open notification message sent by the client, generate the first hash values respectively corresponding to each key value based on the first initial salt values respectively corresponding to each key value on the keyboard.

[0082] Based on the above embodiments, optionally, generating the first hash values respectively corresponding to each key value based on the first initial salt values respectively corresponding to each key value on the keyboard may include steps B1 - B2:

[0083] Step B1: Obtain the first initial salt values respectively corresponding to each key value on the keyboard.

[0084] The first initial salt value can be a randomly generated string of a fixed length, and the strings generated each time are different.

[0085] Step B2: For each key value on the keyboard, encrypt the first initial salt value corresponding to the current key value, and obtain the first hash value corresponding to the current key value based on the encryption result.

[0086] After obtaining the first initial salt values corresponding to the current key values, encrypt the first initial salt values. Specifically, the server uses the timestamp and UUID as random factors to perform the SM3 operation on the first initial salt values, and selects a preset number of characters from the operation result as the first hash values of the current key values on the keyboard to return to the client. At the same time, the timestamp and UUID can be sent to the client together.

[0087] Using the above steps to generate the first hash values corresponding to each key value respectively, each time the user performs authentication, the server will generate a first hash value, and the hash values generated each time are different, realizing the dynamic encryption of the user's sensitive information, enhancing the security of the user inputting the first sensitive information through the first keyboard, and making the first sensitive information not easily leaked.

[0088] S320, send the first hash values corresponding to each key value on the keyboard to the client.

[0089] S330, receive the first hash key value combination sent by the client; wherein, the first hash key value combination is generated by the client based on the first hash values corresponding to each key value in the first sensitive information input by the user through the keyboard.

[0090] Specifically, after sending the first hash values corresponding to each key value on the keyboard to the client, the client can determine the first hash values corresponding to each key value in the first sensitive information through the first hash values of each key value on the keyboard, and generate the first hash key value combination based on the first hash values corresponding to each key value in the first sensitive information. As described in step 130, it will not be elaborated here. Optionally, the first sensitive information is a password or a verification code. Further, the server receives the first hash key value combination sent by the client.

[0091] S340, authenticate the user based on the first hash key value combination.

[0092] In the technical solution of this embodiment, when receiving the first keyboard opening notification message sent by the client, first hash values corresponding to the respective key values on the keyboard are generated based on the first initial salt values respectively corresponding to the respective key values on the keyboard; the first hash values corresponding to the respective key values on the keyboard are sent to the client; the first hash key value combination sent by the client is received; wherein, the first hash key value combination is generated by the client based on the first hash values respectively corresponding to the respective key values in the first sensitive information input by the user through the keyboard; the user is authenticated based on the first hash key value combination. In the technical solution of this embodiment, the server can encrypt the password input by the user multiple times, further strengthening the uncrackability of the password on the basis of ensuring the original security performance.

[0093] Embodiment 4

[0094] Figure 5 FIG. 4 is a flowchart of a method for authenticating a user based on a first hash key value combination in an application server user authentication method provided in Embodiment 4 of the present invention. This embodiment refines the steps of the server authenticating the user based on the first hash key value combination based on the above embodiments. As Figure 5 shown, the method of this embodiment specifically includes the following steps:

[0095] S410, obtain a second hash key value combination corresponding to second sensitive information set by the user and stored in advance.

[0096] In step 240, the client sends the second hash key value combination corresponding to the second sensitive information set by the user to the server, and the server receives and stores the second hash key value combination sent by the client. Further, obtain a second hash key value combination corresponding to second sensitive information set by the user and stored in advance.

[0097] S420, determine the consistency between the second hash key value combination and the first hash key value combination, and obtain an authentication result for the user according to the consistency determination result.

[0098] Based on the above embodiments, optionally, determining the consistency between the second hash key value combination and the first hash key value combination may include steps C1-C4:

[0099] Step C1: Based on the second hash values respectively corresponding to the respective key values on the stored keyboard, determine the target key values respectively corresponding to the respective second hash values included in the second hash key value combination.

[0100] Exemplarily, assume that there are ten key values from 0 to 9 on the keyboard. Currently, the server stores the second hash values respectively corresponding to each key value on the keyboard, that is, the second hash values of the ten key values from 0 to 9. Based on the stored second hash values respectively corresponding to each key value on the keyboard, the target key values respectively corresponding to each second hash value included in the second hash key value combination can be determined. Among them, the second hash key value combination is generated by the client based on the second hash values respectively corresponding to each key value in the second sensitive information, as described in step 230, which will not be elaborated here. Exemplarily, if the second sensitive information is the password "123456" set by the user, then the second hash key value combination is "4be05f375cb166771a3b5649". Currently, the server can determine the target key values respectively corresponding to each second hash value included in "4be05f375cb166771a3b5649" according to the stored second hash values of the ten key values from 0 to 9 on the keyboard. For example, the target key value corresponding to the second hash value "5649" included in "4be05f375cb166771a3b5649" is "6". By analogy, the server determines the target key values respectively corresponding to each second hash value included in the second hash key value combination based on the stored second hash values respectively corresponding to each key value on the keyboard.

[0101] Step C2: Based on the first hash values respectively corresponding to each key value on the keyboard, determine the target first hash values respectively corresponding to each target key value.

[0102] Among them, the first hash values respectively corresponding to each key value on the keyboard are as described in step 310, and are generated by the server based on the first initial salt values respectively corresponding to each key value on the keyboard. The server can determine the target first hash values respectively corresponding to each target key value based on the first hash values respectively corresponding to each key value on the keyboard. Exemplarily, each target key value is the target key value "123456" respectively corresponding to each second hash value included in the second hash key value combination determined by the server based on the stored second hash values respectively corresponding to each key value on the keyboard in step C1. Further, based on the first hash values respectively corresponding to each key value on the keyboard, determine the target first hash values respectively corresponding to each target key value (such as "123456").

[0103] Step C3: Generate a third hash key value combination based on each target first hash value;

[0104] Based on the above embodiments, optionally, generating a third hash key value combination based on each target first hash value may include steps (1)-(3):

[0105] Step (1): Obtain a preset key value;

[0106] Specifically, a preset key value is stored in the server. Obtain this key value. Assume this key value is M0, and M0 is the same as the preset key value S0 stored in the client.

[0107] Step (2): Traverse each target first hash value, encrypt the currently traversed target first hash value and the current preset key value, and replace the current preset key value with the encrypted information.

[0108] For example, assume the target key value is "123456". First, obtain the target first hash value of "1", denoted as M1. Concatenate M1 and M0 and encrypt them using the SM3 algorithm to obtain M2, where M2 = SM3(M0 + M1). Replace and update M0 with the calculated M2 to obtain a new M0. And so on, traverse the target first hash values of the remaining key values of "23456".

[0109] Step (3): Determine the current preset key value after the traversal as the third hash key value combination.

[0110] The above steps use a hash encryption method with aftereffect to generate the third hash key value combination. By traversing each key value in the sensitive information, the strength of the encrypted salt value increases with the length of the sensitive information, further enhancing the security of the user's sensitive information; and it realizes encrypting each received key value once for each key, which is convenient for comparing with the first hash key value combination to verify whether the password entered by the user is correct while ensuring the security of the user's account information.

[0111] Step C4: Compare the third hash key value combination with the first hash key value combination, and determine the consistency between the second hash key value combination and the first hash key value combination according to the comparison result.

[0112] Among them, the first hash key value combination is generated by the client based on the first hash values corresponding to each key value in the first sensitive information, as described in step 130. For example, assume the first sensitive information is the password "123456" entered by the user, and the target key value is "345678". Then in the above steps, after the server traverses the current preset key value, it is found through comparison that the third hash key value combination is inconsistent with the first hash key value combination, so the comparison result is that the second hash key value combination is inconsistent with the first hash key value combination.

[0113] Using the above steps to determine the consistency between the second hash key value combination and the first hash key value combination can effectively detect whether the account password entered by the user is correct, and effectively improve the security of the user's account.

[0114] The technical solution of this embodiment obtains the second hash key-value combination corresponding to the second sensitive information set by the user stored in advance; determines the consistency between the second hash key-value combination and the first hash key-value combination, and obtains the authentication result of the user according to the consistency determination result. The technical solution of this embodiment uses a hash encryption method with aftereffect to generate the third hash key-value combination, which strengthens the security of the user's sensitive information, further effectively verifies the user's identity information, and improves the security of the user's identity information.

[0115] Embodiment 5

[0116] Figure 6 FIG. is a flowchart of the method in the sensitive information setting stage in another user authentication method provided by Embodiment 5 of the present invention. This embodiment refines the steps of the server in the sensitive information setting stage based on the above-mentioned embodiments. As Figure 6 shown, the method of this embodiment specifically includes the following steps:

[0117] S510, receive the second keyboard open notification message sent by the client.

[0118] S520, generate the second hash value corresponding to each key value on the keyboard based on the second initial salt value corresponding to each key value on the keyboard.

[0119] Based on the above embodiments, optionally, generating the second hash value corresponding to each key value on the keyboard based on the second initial salt value corresponding to each key value on the keyboard may include steps D1-D2:

[0120] Step D1: Obtain the second initial salt value corresponding to each key value on the keyboard.

[0121] The second initial salt value can be a randomly generated string of a fixed length, and the string generated each time is different. Therefore, the first initial salt value and the second initial salt value are also different.

[0122] Step D2: For each key value on the keyboard, encrypt the second initial salt value corresponding to the current key value, and obtain the second hash value corresponding to the current key value based on the encryption result.

[0123] After obtaining the second initial salt value corresponding to each current key value, encrypt the second initial salt value. Specifically, the server uses the timestamp and UUID as random factors to perform the SM3 operation on the second initial salt value, and selects a preset number of characters from the operation result as the second hash value of each current key value on the keyboard and returns it to the client.

[0124] The second hash values corresponding to the respective key values are generated using the above steps. Each time the user sets sensitive information, the server generates a second hash value, and each generated hash value is different, realizing dynamic encryption of the user's sensitive information, enhancing the security of the second sensitive information input by the user through the second keyboard, and making it difficult for the second sensitive information to be leaked.

[0125] S530: Send the second hash values corresponding to the respective key values on the keyboard to the client.

[0126] S540: Receive and store the second hash key value combination sent by the client; wherein, the second hash key value combination is generated by the client based on the second hash values corresponding to the respective key values in the second sensitive information set by the user through the keyboard.

[0127] Specifically, after sending the second hash values corresponding to the respective key values on the keyboard to the client, the client can determine the second hash values corresponding to the respective key values in the second sensitive information through the second hash values of the respective key values on the keyboard, and generate a second hash key value combination based on the second hash values corresponding to the respective key values in the second sensitive information. As described in step 230, it will not be elaborated here. Optionally, the second sensitive information is a password or a verification code. Further, the server receives and stores the second hash key value combination sent by the client.

[0128] The technical solution of this embodiment, by receiving the second keyboard open notification message sent by the client; generating the second hash values corresponding to the respective key values on the keyboard based on the second initial salt values corresponding to the respective key values on the keyboard; sending the second hash values corresponding to the respective key values on the keyboard to the client. Receiving and storing the second hash key value combination sent by the client; wherein, the second hash key value combination is generated by the client based on the second hash values corresponding to the respective key values in the second sensitive information set by the user through the keyboard. The technical solution of this embodiment enables the server to encrypt the password multiple times when the user sets the password, effectively protecting the user's password from being leaked or stolen during transmission, and further improving the security of the user's password information.

[0129] Embodiment Six

[0130] Figure 7 FIG. is a schematic structural diagram of a user authentication system provided in Embodiment Six of the present invention. This embodiment further refines the interaction process between the server and the client based on the above embodiments. As Figure 7 shown, it includes a client 610 and a server 620, wherein the client includes; a secure keyboard JS side, and the server includes a secure keyboard server SDK, a user authentication service, and a database:

[0131] The client 610 is mainly used for: when receiving a first keyboard opening instruction, sending a first keyboard opening notification message to the server; receiving the first hash values respectively corresponding to each key value on the keyboard returned by the server; determining the first hash values respectively corresponding to each key value in the first sensitive information input by the user based on the currently received information, and generating a first hash key value combination based on the first hash values respectively corresponding to each key value in the first sensitive information; sending the first hash key value combination to the server;

[0132] The server 620 is mainly used for: when receiving the first keyboard opening notification message, generating the first hash values respectively corresponding to each key value based on the first initial salt values respectively corresponding to each key value on the keyboard; sending the first hash values respectively corresponding to each key value on the keyboard to the client; receiving the first hash key value combination sent by the client, and authenticating the user based on the first hash key value combination. In the solution of this embodiment, the interaction process between the client and the server mainly includes two stages: sensitive information setting and user authentication.

[0133] Specifically, as Figure 8 shown, the sensitive information setting stage includes:

[0134] The client receives a second keyboard opening instruction to enable the user to open the second keyboard, and sends a second keyboard opening notification message to the secure keyboard server SDK.

[0135] The server receives the second keyboard opening message. The secure keyboard server SDK generates the current keyboard identifier (UUID1) and timestamp and sends them to the user authentication service. The user authentication service generates the second initial salt values respectively corresponding to each key value and returns the second initial salt values to the secure keyboard server SDK; the secure keyboard server SDK encrypts the second initial salt values to generate the second hash values of each key value, stores the corresponding relationship between UUID1 and the second hash values of each key value, and sends the second hash values of each key value, UUID, and timestamp to the client.

[0136] The client receives the second hash values of each key value, UUID, and timestamp sent by the secure keyboard server SDK to complete the initialization of the second keyboard; the client receives the second sensitive information input by the user, replaces each key value in the second sensitive information with its corresponding second hash value, and sequentially splices the second hash values corresponding to each key value in the second sensitive information to obtain a second hash key value combination; the client asymmetrically encrypts the second hash key value combination and then sends the second hash key value combination, timestamp, UUID1, user name and other information to the secure keyboard server SDK together.

[0137] The secure keyboard server SDK receives the second hash key-value combination sent by the client, queries the stored second hash values of each key value according to the received UUID1, summarizes the second hash key-value combination, the second hash values of each key value, the timestamp and other information, and sends the summarized information to the user authentication service. The user authentication service decrypts the second hash key-value combination using the corresponding private key of the preset asymmetric encryption, performs timeliness verification based on the received timestamp, and stores the corresponding relationship between the user name, the second hash key values of each key value, and the decrypted second hash key-value combination in the database after the verification passes.

[0138] Specifically, as Figure 9 shown, the user authentication phase includes:

[0139] The client receives the first keyboard opening instruction to enable the user to open the first keyboard, and sends a first keyboard opening notification message to the secure keyboard server SDK.

[0140] The server receives the first keyboard opening message. The secure keyboard server SDK generates the current keyboard identifier (UUID2) and timestamp and sends them to the user authentication service. The user authentication service generates the first initial salt values corresponding to each key value and returns the first initial salt values to the secure keyboard server SDK; the secure keyboard server SDK encrypts the first initial salt values to generate the first hash values of each key value, stores the corresponding relationship between UUID2 and the first hash values of each key value, and sends the first hash values of each key value, UUID2, and timestamp to the client.

[0141] The client receives the first hash values of each key value, UUID2, and timestamp sent by the secure keyboard server SDK to complete the initialization of the first keyboard; the client receives the first sensitive information input by the user, and replaces each key value in the first sensitive information with its corresponding first hash value; further obtains the preset key value, traverses each key value in the first sensitive information in the input order, obtains the first hash value of the current key value traversed, encrypts the first hash value of the current key value and the current preset key value, uses the encrypted information to replace the current preset key value, and then determines the current preset key value after the traversal as the first hash key-value combination; the client performs single-item hash encryption on the first hash key-value combination and sends the first hash key-value combination, the timestamp, UUID2, the user name and other information to the user authentication service together.

[0142] The user authentication service receives the first hash key-value combination encrypted by single-item hashing. First, it decrypts the first hash key-value combination; it sends the decrypted first hash key-value combination, UUID2, timestamp, username, and other information to the secure keyboard server SDK; at the same time, the user authentication service queries the second hash key-value combination stored in the database and the second hash values of each key-value using the received username, and sends them to the secure keyboard server SDK; the secure keyboard server SDK determines the target key values corresponding to the second hash values in the second hash key-value combination according to the second hash values of each key-value, queries the stored first hash values corresponding to each key-value according to UUID2, then determines the first hash values corresponding to each target key value according to the query results, and uses the same method as generating the first hash key-value combination to generate a third hash key-value combination according to the first hash values of each target key value; the secure keyboard server SDK sends the third hash key-value combination to the user authentication service, and the user authentication service compares the first hash key-value combination with the third hash key-value combination to obtain a result. If the results are consistent, the authentication is successful; otherwise, the authentication fails. In this embodiment, the keyboard identifier UUID generated each time is different, which can overcome replay attacks.

[0143] Embodiment 7

[0144] Figure 10 FIG. 7 is a schematic structural diagram of a user authentication device for a client provided in Embodiment 7 of the present invention. This embodiment is applicable to the situation of improving the security of user passwords during transmission. The device can be implemented in software and / or hardware, and the device can be integrated in any device that provides user authentication functions, such as Figure 10 As shown, the user authentication device specifically includes:

[0145] An instruction receiving module 710, configured to send a first keyboard opening notification message to the server when receiving a first keyboard opening instruction;

[0146] A first hash value receiving module 720, configured to receive the first hash values corresponding to each key value on the keyboard returned by the server;

[0147] A first hash key-value combination generating module 730, configured to determine the first hash values corresponding to each key value in the first sensitive information input by the user through the keyboard based on the currently received information, and generate a first hash key-value combination based on the first hash values corresponding to each key value in the first sensitive information;

[0148] A first hash key-value combination sending module 740, configured to send the first hash key-value combination to the server, so that the server authenticates the user based on the first hash key-value combination.

[0149] An user authentication device provided in the seventh embodiment of the present invention, when receiving a first keyboard opening instruction, sends a first keyboard opening notification message to the server; receives first hash values respectively corresponding to each key value on the keyboard returned by the server; determines first hash values respectively corresponding to each key value in the first sensitive information input by the user through the keyboard based on the currently received information, and generates a first hash key value combination based on the first hash values respectively corresponding to each key value in the first sensitive information; sends the first hash key value combination to the server, so that the server authenticates the user based on the first hash key value combination. It can prevent the user password from being easily leaked or stolen during the transmission process, and further enhance the security of the user password.

[0150] Optionally, the first hash key value combination generation module 730 is specifically configured to:

[0151] Obtain a preset key value;

[0152] Traverse each key value in the first sensitive information in the input order, obtain the first hash value of the currently traversed key value, encrypt the first hash value of the current key value and the current preset key value, and use the encrypted information to replace the current preset key value;

[0153] Determine the current preset key value after the traversal ends as the first hash key value combination.

[0154] Optionally, the device further includes:

[0155] An instruction receiving unit, configured to, before receiving the first keyboard opening instruction, receive a second keyboard opening instruction and send a second keyboard opening notification message to the server;

[0156] A second hash value receiving unit, configured to receive second hash values respectively corresponding to each key value on the keyboard returned by the server;

[0157] A second hash key value combination generation unit, configured to determine second hash values respectively corresponding to each key value in the second sensitive information set by the user through the keyboard based on the currently received information, and generate a second hash key value combination based on the second hash values respectively corresponding to each key value in the second sensitive information;

[0158] An user authentication unit, configured to send the second hash key value combination to the server, so that the server stores the second hash key value combination and authenticates the user by determining the consistency between the first hash key value combination and the second hash key value combination.

[0159] Optionally, the second hash key value combination generation unit is specifically configured to:

[0160] Concatenate the second hash values corresponding to each key value in the second sensitive information in the input order, and determine the concatenated string as the second hash key value combination.

[0161] Optionally, the first sensitive information is a password or a verification code.

[0162] The above product can execute the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the method.

[0163] Embodiment VIII

[0164] Figure 11 FIG. is a schematic structural diagram of a user authentication device for a server provided in Embodiment VIII of the present invention. This embodiment is applicable to the situation of improving the security of the user password during transmission. The device can be implemented in software and / or hardware, and can be integrated in any device that provides the function of user authentication, such as Figure 11 As shown, the user authentication device specifically includes:

[0165] The first hash value generation module 810 is configured to generate the first hash values corresponding to the respective key values based on the first initial salt values corresponding to the respective key values on the keyboard when receiving the first keyboard open notification message sent by the client;

[0166] The first hash value sending module 820 is configured to send the first hash values corresponding to the respective key values on the keyboard to the client;

[0167] The first hash key value combination receiving module 830 is configured to receive the first hash key value combination sent by the client; wherein, the first hash key value combination is generated by the client based on the first hash values corresponding to the respective key values in the first sensitive information input by the user through the keyboard;

[0168] The user authentication module 840 is configured to authenticate the user based on the first hash key value combination.

[0169] A user authentication device provided in Embodiment VIII of the present invention generates the first hash values corresponding to the respective key values based on the first initial salt values corresponding to the respective key values on the keyboard when receiving the first keyboard open notification message sent by the client; sends the first hash values corresponding to the respective key values on the keyboard to the client; receives the first hash key value combination sent by the client; wherein, the first hash key value combination is generated by the client based on the first hash values corresponding to the respective key values in the first sensitive information input by the user through the keyboard; authenticates the user based on the first hash key value combination. The server can encrypt the user input password multiple times, further strengthening the uncrackability of the password on the basis of ensuring the original security performance.

[0170] Optionally, the first hash value generation module 810 is specifically configured to:

[0171] Obtain the first initial salt value corresponding to each key value on the keyboard;

[0172] For each key value on the keyboard, encrypt the first initial salt value corresponding to the current key value, and obtain the first hash value corresponding to the current key value based on the encryption result.

[0173] Optionally, the user authentication module 840 specifically includes:

[0174] A second hash key value combination acquisition unit, configured to obtain the second hash key value combination corresponding to the second sensitive information set by the user stored in advance;

[0175] An authentication result determination unit, configured to determine the consistency between the second hash key value combination and the first hash key value combination, and obtain the authentication result of the user according to the consistency determination result.

[0176] Optionally, the authentication result determination unit specifically includes:

[0177] A target key value determination subunit, configured to determine the target key value corresponding to each second hash value included in the second hash key value combination based on the second hash value corresponding to each key value on the stored keyboard;

[0178] A target first hash value determination subunit, configured to determine the target first hash value corresponding to each of the target key values based on the first hash value corresponding to each key value on the keyboard;

[0179] A third hash key value combination generation subunit, configured to generate a third hash key value combination based on each of the target first hash values;

[0180] A consistency determination subunit, configured to compare the third hash key value combination with the first hash key value combination, and determine the consistency between the second hash key value combination and the first hash key value combination according to the comparison result.

[0181] Optionally, the third hash key value combination generation subunit is specifically configured to:

[0182] Obtain a preset key value;

[0183] Traverse each of the target first hash values, encrypt the currently traversed target first hash value and the current preset key value, and replace the current preset key value with the encrypted information;

[0184] Determine the current preset key value after the traversal is completed as the third hash key value combination.

[0185] Optionally, the device further includes:

[0186] A message receiving unit, configured to receive a second keyboard opening notification message sent by the client before receiving the first keyboard opening notification message;

[0187] A second hash value generating unit, configured to generate second hash values corresponding to respective key values on the keyboard based on second initial salt values respectively corresponding to the respective key values on the keyboard;

[0188] A second hash value sending unit, configured to send the second hash values corresponding to the respective key values on the keyboard to the client;

[0189] A second hash key value combination storage unit, configured to receive and store a second hash key value combination sent by the client; wherein, the second hash key value combination is generated by the client based on second hash values respectively corresponding to the respective key values in second sensitive information set by a user through the keyboard.

[0190] Optionally, the second hash value generating unit is specifically configured to:

[0191] Obtain second initial salt values respectively corresponding to the respective key values on the keyboard;

[0192] For each key value on the keyboard, encrypt the second initial salt value corresponding to the current key value, and obtain a second hash value corresponding to the current key value based on the encryption result.

[0193] Optionally, the first sensitive information is a password or a verification code.

[0194] The above product can execute the method provided in any embodiment of the present invention, and has corresponding functional modules and beneficial effects for executing the method.

[0195] Embodiment Nine

[0196] Figure 12 A schematic structural diagram of an electronic device provided in Embodiment Nine of the present invention. Figure 12 A block diagram of an exemplary electronic device 12 suitable for implementing the embodiments of the present invention is shown. Figure 12 The shown electronic device 12 is only an example, and should not impose any limitation on the functions and usage scope of the embodiments of the present invention.

[0197] As Figure 12 shown, the electronic device 12 is presented in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0198] The bus 18 represents one or more of several types of bus architectures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor bus, or a local bus using any of the various bus architectures. By way of example, and not limitation, these architectures include the Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0199] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including both volatile and nonvolatile media, removable and non-removable media.

[0200] The system memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / nonvolatile computer system storage media. By way of example only, a storage system 34 can be provided for reading from and writing to a non-removable, nonvolatile magnetic medium ( Figure 12 not shown and typically called a "hard disk drive"). Although Figure 12 not shown in, a disk drive for reading from and writing to a removable nonvolatile disk (e.g., a "floppy disk"), and an optical disk drive for reading from and writing to a removable nonvolatile optical disk (e.g., a CD-ROM, DVD-ROM or other optical medium) can be provided. In these instances, each drive can be connected to the bus 18 by one or more data media interfaces. The memory 28 can include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of the embodiments of the present invention.

[0201] A program / utility 40 having a set (at least one) of program modules 42 can be stored, for example, in the memory 28, such program modules 42 including - but not limited to - an operating system, one or more application programs, other program modules, and program data, each of which examples or some combination thereof may include an implementation of a network environment. The program modules 42 generally carry out the functions and / or methods of the embodiments described herein.

[0202] The electronic device 12 can also communicate with one or more external devices 14 (such as a keyboard, a pointing device, a display 24, etc.), and can also communicate with one or more devices that enable a user to interact with the electronic device 12, and / or communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (such as a network card, a modem, etc.). Such communication can be carried out through the input / output (I / O) interface 22. In addition, in the electronic device 12 of this embodiment, the display 24 does not exist as an independent entity, but is embedded in the mirror. When the display surface of the display 24 is not displaying, the display surface of the display 24 and the mirror are visually integrated. Moreover, the electronic device 12 can also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through the network adapter 20. As shown in the figure, the network adapter 20 communicates with other modules of the electronic device 12 through the bus 18. It should be understood that although not shown in the figure, other hardware and / or software modules can be used in combination with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0203] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28. For example, it implements a user authentication method provided by an embodiment of the present invention: when receiving a first keyboard open instruction, it sends a first keyboard open notification message to the server; receives first hash values respectively corresponding to each key value on the keyboard returned by the server; determines first hash values respectively corresponding to each key value in the first sensitive information input by the user through the keyboard based on the currently received information, and generates a first hash key value combination based on the first hash values respectively corresponding to each key value in the first sensitive information; sends the first hash key value combination to the server so that the server authenticates the user based on the first hash key value combination. Alternatively, when receiving a first keyboard open notification message sent by the client, it generates first hash values respectively corresponding to each key value based on first initial salt values respectively corresponding to each key value on the keyboard; sends the first hash values respectively corresponding to each key value on the keyboard to the client; receives a first hash key value combination sent by the client; wherein, the first hash key value combination is generated by the client based on first hash values respectively corresponding to each key value in the first sensitive information input by the user through the keyboard; authenticates the user based on the first hash key value combination.

[0204] Embodiment Ten

[0205] Embodiment 10 of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, it implements a user authentication method provided by all embodiments of the present invention: when receiving a first keyboard opening instruction, sending a first keyboard opening notification message to a server; receiving first hash values respectively corresponding to each key value on the keyboard returned by the server; determining first hash values respectively corresponding to each key value in first sensitive information input by the user through the keyboard based on currently received information, and generating a first hash key value combination based on the first hash values respectively corresponding to each key value in the first sensitive information; sending the first hash key value combination to the server so that the server authenticates the user based on the first hash key value combination. Alternatively, when receiving a first keyboard opening notification message sent by a client, generating first hash values respectively corresponding to each key value based on first initial salt values respectively corresponding to each key value on the keyboard; sending the first hash values respectively corresponding to each key value on the keyboard to the client; receiving a first hash key value combination sent by the client; wherein the first hash key value combination is generated by the client based on first hash values respectively corresponding to each key value in first sensitive information input by the user through the keyboard; authenticating the user based on the first hash key value combination. One or more arbitrary combinations of computer-readable media can be adopted. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the computer-readable storage medium include: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage medium can be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, apparatus, or device.

[0206] The computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, and this computer-readable medium can send, propagate, or transmit a program for use by or in combination with an instruction execution system, apparatus, or device.

[0207] The program code contained on a computer-readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, optical fiber cable, RF, etc., or any suitable combination of the above.

[0208] Embodiment XI

[0209] The embodiment of the present invention also provides a computer program product, including a computer program, which when executed by a processor implements the user authentication method provided in any embodiment of the present application.

[0210] In the process of implementing the computer program product, the computer program code for performing the operations of the present invention can be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network - including a local area network (LAN) or a wide area network (WAN) - or can be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0211] Note that the above is only the preferred embodiment of the present invention and the applied technical principle. Those skilled in the art will understand that the present invention is not limited to the specific embodiments here, and various obvious changes, re-adjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments. Without departing from the concept of the present invention, more other equivalent embodiments can be included, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A user authentication method, characterized in that, Including: When receiving a first keyboard open instruction, send a first keyboard open notification message to the server; Receive the first hash values respectively corresponding to each key value on the keyboard returned by the server; Based on the currently received information, determine the first hash values respectively corresponding to each key value in the first sensitive information input by the user through the keyboard, and obtain a preset key value; traverse each key value in the first sensitive information in the input order, obtain the first hash value of the currently traversed key value, encrypt the first hash value of the current key value and the current preset key value, and use the encrypted information to replace the current preset key value; determine the current preset key value after the traversal is completed as the first hash key value combination; Send the first hash key value combination to the server so that the server authenticates the user based on the first hash key value combination.

2. The method according to claim 1, characterized in that, Before receiving the first keyboard open instruction, the method further includes: when receiving a second keyboard open instruction, send a second keyboard open notification message to the server; Receive the second hash values respectively corresponding to each key value on the keyboard returned by the server; Based on the currently received information, determine the second hash values respectively corresponding to each key value in the second sensitive information set by the user through the keyboard, and generate a second hash key value combination based on the second hash values respectively corresponding to each key value in the second sensitive information; Send the second hash key value combination to the server so that the server stores the second hash key value combination and authenticates the user by determining the consistency between the first hash key value combination and the second hash key value combination.

3. The method according to claim 2, wherein Generating a second hash key value combination based on the second hash values respectively corresponding to each key value in the second sensitive information includes: Concatenate the second hash values respectively corresponding to each key value in the second sensitive information in the input order in sequence, and determine the concatenated string as the second hash key value combination.

4. The method according to any one of claims 1 to 3, characterized in that, The first sensitive information is a password or a verification code.

5. A user authentication method, characterized in that, Including: When receiving the first keyboard open notification message sent by the client, generate the first hash values respectively corresponding to each key value based on the first initial salt values respectively corresponding to each key value on the keyboard; Send the first hash values respectively corresponding to each key value on the keyboard to the client; Receive the first hash key value combination sent by the client; wherein, the first hash key value combination is determined by the client according to the current preset key value after the traversal is completed, and the current preset key value is obtained by the client encrypting the first hash value of the current key value and the current preset key value and using the encrypted information; the first hash value is obtained by the client by obtaining a preset key value and traversing each key value in the first sensitive information in the input order; Authenticate the user based on the first hash key value combination.

6. The method according to claim 5, characterized in that Generating the first hash values respectively corresponding to each key value based on the first initial salt values respectively corresponding to each key value on the keyboard includes: Obtain the first initial salt values respectively corresponding to each key value on the keyboard; For each key value on the keyboard, encrypt the first initial salt value corresponding to the current key value, and obtain the first hash value corresponding to the current key value based on the encryption result.

7. The method according to claim 5, characterized in that, Authenticating the user based on the first hash key combination includes: Obtaining a second hash key combination corresponding to second sensitive information set by the user and stored in advance; Determining the consistency between the second hash key combination and the first hash key combination, and obtaining an authentication result for the user according to the consistency determination result.

8. The method according to claim 7, wherein Determining the consistency between the second hash key combination and the first hash key combination includes: Based on the second hash values respectively corresponding to the key values on the stored keyboard, determining the target key values respectively corresponding to the second hash values included in the second hash key combination; Based on the first hash values respectively corresponding to the key values on the keyboard, determining the target first hash values respectively corresponding to the target key values; Generating a third hash key combination based on the target first hash values; Comparing the third hash key combination with the first hash key combination, and determining the consistency between the second hash key combination and the first hash key combination according to the comparison result.

9. The method according to claim 8, characterized in that, Generating a third hash key combination based on the target first hash values includes: Obtaining a preset key value; Traversing the target first hash values, encrypting the currently traversed target first hash value and the current preset key value, and replacing the current preset key value with the encrypted information; Determining the current preset key value after the traversal is completed as the third hash key combination.

10. The method according to claim 7, wherein Before receiving the first keyboard open notification message sent by the client, the method further includes: Receiving a second keyboard open notification message sent by the client; Generating the second hash values respectively corresponding to the key values on the keyboard based on the second initial salt values respectively corresponding to the key values on the keyboard; Sending the second hash values respectively corresponding to the key values on the keyboard to the client; Receiving and storing the second hash key combination sent by the client; wherein, the second hash key combination is generated by the client based on the second hash values respectively corresponding to the key values in the second sensitive information set by the user through the keyboard.

11. The method according to claim 10, wherein Generating the second hash values respectively corresponding to the key values on the keyboard based on the second initial salt values respectively corresponding to the key values on the keyboard includes: Obtaining the second initial salt values respectively corresponding to the key values on the keyboard; For each key value on the keyboard, encrypting the second initial salt value corresponding to the current key value, and obtaining the second hash value corresponding to the current key value based on the encryption result.

12. The method according to any one of claims 5-11, characterized in that, The first sensitive information is a password or a verification code.

13. A user authentication device, characterized in that, including: An instruction receiving module, configured to send a first keyboard open notification message to the server when receiving a first keyboard open instruction; A first hash value receiving module, configured to receive the first hash values respectively corresponding to the key values on the keyboard returned by the server; The first hash key - value combination generation module is used to determine the first hash value corresponding to each key - value in the first sensitive information input by the user through the keyboard based on the currently received information, and obtain a preset key - value; traverse each key - value in the first sensitive information in the input order, obtain the first hash value of the currently traversed key - value, encrypt the first hash value of the current key - value and the current preset key - value, and use the encrypted information to replace the current preset key - value; determine the current preset key - value after the traversal is completed as the first hash key - value combination. The first hash key - value combination sending module is used to send the first hash key - value combination to the server, so that the server authenticates the user based on the first hash key - value combination.

14. The device according to claim 13, wherein The first hash key - value combination generation module is specifically used for: Obtain a preset key - value; Traverse each key - value in the first sensitive information in the input order, obtain the first hash value of the currently traversed key - value, encrypt the first hash value of the current key - value and the current preset key - value, and use the encrypted information to replace the current preset key - value; Determine the current preset key - value after the traversal is completed as the first hash key - value combination.

15. The device according to claim 13, characterized in that, The device further includes: The instruction receiving unit is used to, before receiving the first keyboard opening instruction, receive the second keyboard opening instruction and send a second keyboard opening notification message to the server. The second hash value receiving unit is used to receive the second hash value corresponding to each key - value on the keyboard returned by the server. The second hash key - value combination generation unit is used to determine the second hash value corresponding to each key - value in the second sensitive information set by the user through the keyboard based on the currently received information, and generate a second hash key - value combination based on the second hash values corresponding to each key - value in the second sensitive information. The user authentication unit is used to send the second hash key - value combination to the server, so that the server stores the second hash key - value combination and authenticates the user by determining the consistency between the first hash key - value combination and the second hash key - value combination.

16. The device according to claim 15, characterized in that, The second hash key - value combination generation unit is specifically used for: Concatenate the second hash values corresponding to each key - value in the second sensitive information in the input order in sequence, and determine the concatenated string as the second hash key - value combination.

17. A user authentication device, characterized in that, It includes: The first hash value generation module is used to generate the first hash value corresponding to each key - value based on the first initial salt value corresponding to each key - value on the keyboard when receiving the first keyboard opening notification message sent by the client. The first hash value sending module is used to send the first hash value corresponding to each key - value on the keyboard to the client. The first hash key - value combination receiving module is configured to receive the first hash key - value combination sent by the client; wherein, the first hash key - value combination is determined by the client according to the current preset key value after the traversal ends, and the current preset key value is obtained by the client encrypting the first hash value of the current key value and the current preset key value and using the encrypted information; the first hash value is obtained by the client by acquiring the preset key value and traversing each key value in the first sensitive information in the input order. The user authentication module is configured to authenticate the user based on the first hash key - value combination.

18. The device according to claim 17, wherein, The first hash value generating module is specifically configured to: Acquire the first initial salt value corresponding to each key value on the keyboard. For each key value on the keyboard, encrypt the first initial salt value corresponding to the current key value, and obtain the first hash value corresponding to the current key value based on the encryption result.

19. The device according to claim 17, wherein The user authentication module specifically includes: The second hash key - value combination obtaining unit is configured to obtain the second hash key - value combination corresponding to the second sensitive information set by the user and stored in advance. The authentication result determining unit is configured to determine the consistency between the second hash key - value combination and the first hash key - value combination, and obtain the authentication result of the user according to the consistency determination result.

20. The device according to claim 19, wherein The authentication result determining unit includes: The target key value determining subunit is configured to determine the target key value corresponding to each second hash value included in the second hash key - value combination based on the second hash values corresponding to each key value on the keyboard stored. The target first hash value determining subunit is configured to determine the target first hash value corresponding to each of the target key values based on the first hash values corresponding to each key value on the keyboard. The third hash key - value combination generating subunit is configured to generate a third hash key - value combination based on each of the target first hash values. The consistency determining subunit is configured to compare the third hash key - value combination with the first hash key - value combination, and determine the consistency between the second hash key - value combination and the first hash key - value combination according to the comparison result.

21. The device according to claim 20, characterized in that, The third hash key - value combination generating subunit is specifically configured to: Acquire the preset key value. Traverse each of the target first hash values, encrypt the current target first hash value and the current preset key value during the traversal, and replace the current preset key value with the encrypted information. Determine the current preset key value after the traversal ends as the third hash key - value combination.

22. The device according to claim 19, characterized in that The device further includes: The message receiving unit is configured to receive the second keyboard opening notification message sent by the client before receiving the first keyboard opening notification message. The second hash value generating unit is configured to generate the second hash value corresponding to each key value on the keyboard based on the second initial salt value corresponding to each key value on the keyboard. The second hash value sending unit is configured to send the second hash value corresponding to each key value on the keyboard to the client. A second hash key-value combination storage unit for receiving and storing the second hash key-value combination sent by the client; wherein, the second hash key-value combination is generated by the client based on the second hash values respectively corresponding to each key value in the second sensitive information set by the user through the keyboard.

23. The device according to claim 22, wherein, The second hash value generation unit is specifically configured to: Obtain the second initial salt value respectively corresponding to each key value on the keyboard; For each key value on the keyboard, encrypt the second initial salt value corresponding to the current key value, and obtain the second hash value corresponding to the current key value based on the encryption result.

24. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable on the processor. It is characterized in that when the processor executes the computer program, the user authentication method described in any one of claims 1-4 or 5-12 is implemented.

25. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, the user authentication method described in any one of claims 1-4 or 5-12 is implemented.

26. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, the user authentication method described in any one of claims 1-4 or 5-12 is implemented.

27. A user authentication system, characterized in that, It includes: A client for sending a first keyboard open notification message to the server when receiving a first keyboard open instruction; Receiving the first hash value respectively corresponding to each key value on the keyboard returned by the server; Based on the currently received information, determine the first hash value respectively corresponding to each key value in the first sensitive information input by the user through the keyboard, and obtain a preset key value; traverse each key value in the first sensitive information in the input order, obtain the first hash value of the currently traversed key value, encrypt the first hash value of the current key value and the current preset key value, and use the encrypted information to replace the current preset key value; determine the current preset key value after the traversal as the first hash key-value combination; send the first hash key-value combination to the server; A server for generating the first hash value respectively corresponding to each key value based on the first initial salt value respectively corresponding to each key value on the keyboard when receiving the first keyboard open notification message; Sending the first hash value respectively corresponding to each key value on the keyboard to the client; Receiving the first hash key-value combination sent by the client, and authenticating the user based on the first hash key-value combination.

Images