Authentication method, device, system, authentication module and terminal for cloud phone application

Abstract

The present disclosure relates to an authentication method, device, system, authentication module and terminal for a cloud phone application, and relates to the field of communication technology. The method disclosed in the present disclosure includes: the authentication module responds to the triggering of the function of logging into the cloud phone application, and queries the user's identification according to the biometric information input by the user; the authentication module sends a digital signature request to the user card, and the data signature request includes: the user's identification; the authentication module receives the digital signature response sent by the user card, and the digital signature response includes: the digital signature result, and the digital signature result is the result of the user card signing the user's relevant information according to the private key corresponding to the user's identification; the authentication module sends an authentication request to the cloud phone authentication platform through the cloud phone application, and the authentication request includes: the digital signature result, the terminal's identification and the user's identification, so that the cloud phone authentication platform verifies the digital signature result and determines whether the user has the authority to log in to the cloud phone application at the terminal.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an authentication method, device, system, authentication module and terminal for a cloud phone application. Background Art

[0002] A cloud phone refers to an Android app that runs on a cloud server. It runs and is stored on the cloud server rather than on the local machine. It is basically unaffected by the configuration and performance of the local machine. It extends and expands the physical phone and can be used in scenarios such as cloud mobile games and mobile office for government and enterprises.

[0003] Users can log in to the cloud phone service through different physical mobile terminals, and the same physical mobile phone can also provide cloud phone access and login services for different users. At present, for enterprise mobile management, it may be necessary to manage the use rights of its employees for cloud phones, such as which employees are allowed to log in to the enterprise's cloud phone mobile office service through which ordinary mobile phones (purchased in bulk by the enterprise for employees to log in to cloud phones) to ensure the security of cloud phone applications.

[0004] When a user logs in to a cloud phone application, he or she generally enters an account name and password or receives a text message verification code to authenticate and verify the user's access. Summary of the invention

[0005] The inventor found that the user's login to the cloud phone application through the account name and password method or the SMS verification code method is less secure and easily causes the cloud phone data leakage. In addition, this verification method can only verify the user's right to use the cloud phone, but cannot verify whether the user has the authority to use the current terminal to log in to the cloud phone. Whether the user has the authority to use the current terminal to log in to the cloud phone can only be managed by the administrator, which is prone to errors and inefficient.

[0006] A technical problem to be solved by the present disclosure is to propose a new authentication method for cloud phone applications, and automatically verify whether the user has the authority to log in to the cloud phone using the current terminal, so as to improve the security, accuracy and efficiency of authentication.

[0007] According to some embodiments of the present disclosure, a cloud phone application authentication method is provided, comprising: an authentication module in a terminal queries a user's identification according to biometric information input by the user in response to a triggering of a function for logging into the cloud phone application; the authentication module sends a digital signature request to a user card, the digital signature request includes: the user's identification; the authentication module receives a digital signature response sent by the user card, the digital signature response includes: a digital signature result, the digital signature result is a result of the user card signing relevant information of the user according to a private key corresponding to the user's identification, the relevant information of the user includes: the user's identification; the authentication module sends an authentication request to a cloud phone authentication platform through the cloud phone application, the authentication request includes: the digital signature result, the terminal's identification and the user's identification, so that the cloud phone authentication platform verifies the digital signature result and determines whether the user has the authority to log in to the cloud phone application at the terminal.

[0008] In some embodiments, the authentication module responds to the triggering of the function of logging into the cloud phone application, and queries the user's identification according to the biometric information input by the user, including: the authentication module responds to the triggering of the function of logging into the cloud phone application, and sends a user identification acquisition request to the biometric recognition module in the terminal; the authentication module receives the user identification acquisition response sent by the biometric recognition module, and when the biometric recognition is successful, the user identification acquisition response includes: the result of successful biometric recognition and the user's identification, and the result of successful biometric recognition indicates that the biometric recognition module successfully matches the biometric information input by the user with the stored biometric information, and the user's identification is obtained by searching the bound user's identification based on the biometric information.

[0009] In some embodiments, the user-related information also includes: at least one of the user card identifier and a random number; the user identifier and the corresponding private key are bound and stored in the mobile phone card.

[0010] In some embodiments, when the user's relevant information includes an identification of a user card, the authentication request includes the identification of the user card; when the user's relevant information includes a random number, the authentication request includes the random number; the method also includes: the cloud phone authentication platform authenticates the user according to the authentication request, and determines whether the user has the authority to log in to the cloud phone application at the terminal; when the authentication is successful and the user has the authority to log in to the cloud phone application at the terminal, the cloud phone authentication platform obtains the authorization information of the cloud phone application corresponding to the user according to the user's identification; the cloud phone authentication platform sends an authentication response to the cloud phone application, the authentication response includes: the authentication result, the authorization information of the cloud phone application corresponding to the user; the cloud phone application displays a corresponding interface according to the authorization information of the cloud phone application corresponding to the user.

[0011] In some embodiments, the cloud phone authentication platform authenticates the user based on the authentication request and determines whether the user has the authority to log in to the cloud phone application at the terminal, including: the cloud phone authentication platform searches for the public key corresponding to the user's identification based on the user's identification; when the public key is found, the cloud phone authentication platform uses the public key to verify the digital signature result, and when the verification is successful, obtains the relevant information of the user in the digital signature result; the cloud phone authentication platform matches the relevant information of the user in the digital signature result with the relevant information of the user in the authentication request; when the match is successful, the cloud phone authentication platform matches the terminal's identification with the terminal identification bound to the user's identification; when the match is successful, the cloud phone authentication platform determines that the user has the authority to log in to the cloud phone application at the terminal.

[0012] In some embodiments, the method also includes: the authentication module receives a biometric binding request sent by the cloud phone authentication platform, the biometric binding request includes: the user's identification, the user's identification is the identification assigned to the user by the cloud phone authentication platform after the user registers on the terminal to use the cloud phone application; the authentication module sends a biometric binding request to the biometric recognition module, the biometric binding request includes: the user's identification; the authentication module receives a biometric binding response sent by the biometric recognition module, and if the binding is successful, the biometric binding response includes: a successful binding result, indicating that the biometric recognition module successfully binds the biometric information entered by the user with the user's identification.

[0013] In some embodiments, the method also includes: the authentication module sends a key generation request to the user card, the key generation request includes: the user's identification; the authentication module receives a key generation response sent by the user card, the key generation response includes: the public key corresponding to the user's identification generated by the user card; the authentication module sends a biometric binding response and a public key corresponding to the user's identification to the cloud phone authentication platform, so that the cloud phone authentication platform binds and stores the user's identification and the corresponding public key.

[0014] In some embodiments, the method also includes: the cloud phone application obtains the terminal identification in response to the user inputting the user's identity information when registering for cloud phone use; the cloud phone application sends registration information to the cloud phone authentication platform, and the registration information includes: the user's identity information and the terminal identification; the cloud phone authentication platform determines whether the user has the authority to register at the terminal based on the user's identity information and the terminal identification; if the user has the authority to register at the terminal, the cloud phone authentication platform binds and stores the user's identification with the terminal identification, and determines the authorization information of the cloud phone application corresponding to the user to complete the user registration at the terminal to use the cloud phone application; the cloud phone authentication platform sends a biometric binding request to the authentication module.

[0015] In some embodiments, the user's identity information includes: the user's name, identity proof identifier, and the cloud phone number; the cloud phone authentication platform determines whether the user has the authority to register at the terminal based on the user's identity information and the terminal identifier, including: the cloud phone authentication platform verifies the user's identity based on the user's identity information; the cloud phone authentication platform queries the registration authority corresponding to the user's identity information to determine whether the user has the authority to register at the terminal if the user's identity authentication is passed; the cloud phone authentication platform determines whether an identifier has been assigned to the user if the user has the authority to register at the terminal, and if not, assigns the user's identifier to the user.

[0016] In some embodiments, the method also includes: after the cloud phone authentication platform binds and stores the user's identification and the corresponding public key, it sends a registration response to the cloud phone application, and the registration response includes: the registration result and the authorization information of the cloud phone application corresponding to the user; the cloud phone application displays the registration result and the authorization information of the cloud phone application corresponding to the user to the user based on the registration response.

[0017] According to some other embodiments of the present disclosure, an authentication module is provided, including: a query unit, used to query the user's identification according to the biometric information input by the user in response to the triggering of the function of logging into the cloud phone application; a first sending unit, used to send a digital signature request to the user card, the data signature request includes: the user's identification; a first receiving unit, used to receive a digital signature response sent by the user card, the digital signature response includes: a digital signature result, the digital signature result is the result of the user card signing the user's relevant information according to the private key corresponding to the user's identification, and the user's relevant information includes: the user's identification; a second sending unit, used to send an authentication request to the cloud phone authentication platform through the cloud phone application, the authentication request includes: the digital signature result, the terminal's identification and the user's identification, so that the cloud phone authentication platform verifies the digital signature result and determines whether the user has the authority to log in to the cloud phone application at the terminal.

[0018] In some embodiments, the query unit is used to send a user identification acquisition request to the biometric recognition module in the terminal in response to the triggering of the function of logging into the cloud phone application; receive the user identification acquisition response sent by the biometric recognition module, and when the biometric recognition is successful, the user identification acquisition response includes: the result of successful biometric recognition and the user's identification, and the result of successful biometric recognition indicates that the biometric recognition module successfully matches the biometric information input by the user with the stored biometric information, and the user's identification is obtained by searching the bound user's identification based on the biometric information.

[0019] In some embodiments, the user-related information also includes: at least one of the user card identifier and a random number; the user identifier and the corresponding private key are bound and stored in the mobile phone card.

[0020] In some embodiments, the module also includes: a second receiving unit, used to receive a biometric binding request sent by the cloud phone authentication platform, the biometric binding request includes: the user's identification, the user's identification is the identification assigned to the user by the cloud phone authentication platform after the user registers on the terminal to use the cloud phone application; a third sending unit, used to send a biometric binding request to the biometric recognition module, the biometric binding request includes: the user's identification; a third receiving unit, used to receive a biometric binding response sent by the biometric recognition module, when the binding is successful, the biometric binding response includes: a successful binding result, indicating that the biometric recognition module successfully binds the biometric information entered by the user with the user's identification.

[0021] In some embodiments, the first sending unit is used to send a key generation request to the user card, and the key generation request includes: the user's identification; the first receiving unit is used to receive a key generation response sent by the user card, and the key generation response includes: the public key corresponding to the user's identification generated by the user card; the second sending unit is used to send a biometric binding response and a public key corresponding to the user's identification to the cloud phone authentication platform, so that the cloud phone authentication platform binds and stores the user's identification and the corresponding public key.

[0022] According to some further embodiments of the present disclosure, a terminal is provided, comprising: an authentication module of any of the aforementioned embodiments; and a user card, for receiving a digital signature request, searching for a corresponding private key according to a user's identification, signing relevant information of the user using the private key, obtaining a digital signature result, generating a digital signature response and sending it to the authentication module.

[0023] In some embodiments, the user card is also used to receive a key generation request, generate a public key and a private key corresponding to the user, store the user's identification and the private key in correspondence, and generate a key generation response and send it to the authentication module.

[0024] In some embodiments, the terminal also includes: a biometric recognition module, which is used to receive a user identification acquisition request sent by an authentication module, receive biometric information input by a user, match the biometric information input by the user with the stored biometric information, and if the match is successful, search for the bound user's identification based on the biometric information, generate a user identification acquisition response and send it to the authentication module, the user identification acquisition response includes: the biometric recognition result and the identification of the found user.

[0025] In some embodiments, the biometric recognition module is also used to receive a biometric binding request, receive biometric information entered by a user, bind and store the biometric information entered by the user with the user's identification, generate a biometric binding response, and send it to the authentication module.

[0026] In some embodiments, the terminal also includes: a cloud phone application, which is used to receive a login function triggered by a user, trigger the authentication module to query the user's identification based on the biometric information input by the user, and receive an authentication response sent by the cloud phone authentication platform. If the authentication response includes a successful authentication result, it means that the cloud phone authentication platform has successfully verified the digital signature result and determined that the user has the authority to log in to the cloud phone application on the terminal.

[0027] In some embodiments, the cloud phone application is also used to obtain the terminal identification in response to the user registering and inputting the user's identity information when using the cloud phone; send registration information to the cloud phone authentication platform, the registration information includes: the user's identity information and the terminal identification; receive a registration response sent to the cloud phone authentication platform, the registration response includes: the registration result and the authorization information of the cloud phone application corresponding to the user; based on the registration response, display the registration result and the authorization information of the cloud phone application corresponding to the user to the user.

[0028] According to some further embodiments of the present disclosure, a cloud phone application authentication system is provided, comprising: a terminal of any of the aforementioned embodiments, and a cloud phone authentication platform, for authenticating a user based on an authentication request, and determining whether the user has the authority to log in to the cloud phone application at the terminal; when the authentication is successful and the user has the authority to log in to the cloud phone application at the terminal, obtaining the authorization information of the cloud phone application corresponding to the user based on the user's identification; and sending an authentication response to the cloud phone application, the authentication response comprising: an authentication result, and the authorization information of the cloud phone application corresponding to the user.

[0029] In some embodiments, the cloud phone authentication platform is used to search for the public key corresponding to the user's identification based on the user's identification; when the public key is found, the digital signature result is verified using the public key, and when the verification is successful, the relevant information of the user in the digital signature result is obtained; the relevant information of the user in the digital signature result is matched with the relevant information of the user in the authentication request; when the match is successful, the identification of the terminal is matched with the identification of the terminal bound to the user's identification; when the match is successful, it is determined that the user has the authority to log in to the cloud phone application at the terminal.

[0030] In some embodiments, the cloud phone authentication platform is also used to receive registration information sent by the cloud phone application, the registration information including: the user's identity information and the terminal's identifier; determining whether the user has the authority to register at the terminal based on the user's identity information and the terminal's identifier; if the user has the authority to register at the terminal, binding and storing the user's identifier and the terminal's identifier, and determining the authorization information of the cloud phone application corresponding to the user to complete the user's registration at the terminal to use the cloud phone application; and sending a biometric binding request to the authentication module.

[0031] In some embodiments, the user's identity information includes: the user's name, identity proof identifier, and cloud phone number; the cloud phone authentication platform is used to verify the user's identity based on the user's identity information; if the user's identity authentication is passed, the registration authority corresponding to the user's identity information is queried to determine whether the user has the authority to register at the terminal; if the user has the authority to register at the terminal, it is determined whether an identifier has been assigned to the user, and if not, the user's identifier is assigned to the user.

[0032] In some embodiments, the cloud phone authentication platform is used to bind and store the user's identification and the corresponding public key, and then send a registration response to the cloud phone application. The registration response includes: the registration result and the authorization information of the cloud phone application corresponding to the user.

[0033] According to some other embodiments of the present disclosure, a cloud phone application authentication device is provided, including: a processor; and a memory coupled to the processor, for storing instructions, which, when executed by the processor, causes the processor to execute a cloud phone application authentication method as described in any of the aforementioned embodiments.

[0034] According to some further embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, wherein when the program is executed by a processor, the steps of the cloud phone application authentication method of any of the aforementioned embodiments are implemented.

[0035] In the present disclosure, the user performs biometric identification on an ordinary terminal, and then the mobile phone card digitally signs the user's relevant information, and sends the digital signature result, the terminal's identification and the user's identification to the cloud phone authentication platform. The cloud phone authentication platform verifies the digital signature result and determines whether the user has the authority to log in to the cloud phone application at the terminal, thereby automatically verifying whether the user has the authority to use the current terminal to log in to the cloud phone while verifying the user's identity, thereby improving the accuracy and efficiency of authentication. The use of biometric identification and digital signature based on the security of the mobile phone card improves the security of the authentication process.

[0036] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 A flowchart illustrating a method for authenticating a cloud phone application according to some embodiments of the present disclosure is shown.

[0039] Figure 2 A flowchart illustrating a cloud phone application authentication method according to other embodiments of the present disclosure is shown.

[0040] Figure 3 A flowchart illustrating a cloud phone application authentication method according to some other embodiments of the present disclosure is shown.

[0041] Figure 4 A schematic diagram showing the structure of an authentication module according to some embodiments of the present disclosure.

[0042] Figure 5 A schematic diagram showing the structure of a terminal according to some embodiments of the present disclosure.

[0043] Figure 6 A schematic diagram showing the structure of an authentication system for a cloud phone application according to some embodiments of the present disclosure.

[0044] Figure 7 A schematic diagram showing the structure of an authentication device for a cloud phone application according to some embodiments of the present disclosure.

[0045] Figure 8 A schematic diagram showing the structure of an authentication device for a cloud phone application according to other embodiments of the present disclosure. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0047] This disclosure proposes a cloud phone application authentication method. Figure 1 to Figure 3 Give a description.

[0048] Figure 1 The following is a flow chart of some embodiments of the authentication method of the cloud phone application disclosed in the present invention. Figure 1 As shown, the method of this embodiment can be executed by an authentication module in a terminal by an authentication method, and includes: steps S102 to S108.

[0049] In step S102, in response to the triggering of the function of logging into the cloud phone application, the user's identification is queried based on the biometric information input by the user.

[0050] In some embodiments, in response to triggering a function of logging into a cloud phone application, a user identification acquisition request is sent to a biometric recognition module in the terminal; a user identification acquisition response sent by the biometric recognition module is received, and when the biometric recognition is successful, the user identification acquisition response includes: the result of successful biometric recognition and the user's identification, and the result of successful biometric recognition indicates that the biometric recognition module successfully matches the biometric information input by the user with the stored biometric information, and the user's identification is obtained by searching the bound user's identification based on the biometric information.

[0051] In step S104, a digital signature request is sent to the user card.

[0052] The digital signature request includes, for example: the user's identification.

[0053] In step S106, a digital signature response sent by the user card is received.

[0054] The digital signature response includes, for example, a digital signature result, where the digital signature result is the result of the user card signing the user's relevant information according to the private key corresponding to the user's identification. The user's relevant information includes, for example, the user's identification.

[0055] In some embodiments, the user's related information also includes: at least one of the user card identification and random number; the user identification and the corresponding private key are bound and stored in the mobile phone card. The user card identification and random number are used to improve the security of user authentication, which will be described in detail in subsequent embodiments.

[0056] In step S108, an authentication request is sent to the cloud phone authentication platform through the cloud phone application.

[0057] The authentication request includes, for example, the digital signature result, the terminal identifier, and the user identifier, so that the cloud phone authentication platform can verify the digital signature result and determine whether the user has the authority to log in to the cloud phone application at the terminal. The cloud phone authentication platform determines whether the user has the authority to log in to the cloud phone application at the terminal by matching the terminal identifier with the terminal identifier bound to the user identifier.

[0058] In the above embodiment, the user performs biometric identification on an ordinary terminal, and then the mobile phone card digitally signs the user's relevant information, and sends the digital signature result, the terminal identifier and the user identifier to the cloud phone authentication platform. The cloud phone authentication platform verifies the digital signature result and determines whether the user has the authority to log in to the cloud phone application at the terminal, thereby automatically verifying whether the user has the authority to use the current terminal to log in to the cloud phone while verifying the user's identity, thereby improving the accuracy and efficiency of authentication. The use of biometric identification and digital signature based on the security of the mobile phone card improves the security of the authentication process.

[0059] Combine the following Figure 2 Other embodiments of the authentication method for the cloud phone application of the present disclosure are described.

[0060] Figure 2 Flowcharts of other embodiments of the authentication method for cloud phone applications disclosed in the present invention. Figure 2 As shown, the method of this embodiment includes: steps S202 to S232.

[0061] In step S202, the cloud phone application receives a login function triggered by a user.

[0062] The user starts the cloud phone application (APP) on the terminal to trigger the login function.

[0063] In step S204, the cloud phone application sends trigger information to the authentication module.

[0064] In step S206, the authentication module sends a user identification acquisition request to the biometric feature recognition module in the terminal.

[0065] In step S208 , the biometric feature recognition module prompts the user to input biometric feature information, and receives the biometric feature information input by the user.

[0066] In step S210, the biometric feature recognition module matches the biometric feature information input by the user with the stored biometric feature information, and if the match is successful, searches for the identifier of the bound user according to the biometric feature information.

[0067] The biometric identification function module performs 1:N detection and matching on the biometric information input by the user based on the local biometric database, and matches the user's identification (eg user ID). The biometric identification function module performs biometric identification to verify the legitimacy of the user.

[0068] In step S212, the biometric feature recognition function module generates a user identification acquisition response and sends it to the authentication module.

[0069] The user identification acquisition response includes: the biometric identification result and the user identification found. If the biometric identification fails, or the user identification is not found, the biometric identification failure or user identification search failure information is returned. The authentication module can save the biometric identification result.

[0070] In step S214, the authentication module sends a digital signature request to the user card.

[0071] The data signature request includes, for example, the user's identification, and may also include: a biometric identification result. The user card is, for example, a SIM card.

[0072] In step S216, when the biometric identification of the user card is successful, the corresponding private key is searched according to the user's identification.

[0073] In step S218, the user card signs the user's relevant information using the private key to obtain a digital signature result.

[0074] The user's related information includes, for example, the user's ID, the random number generated by the user card, and the user card's ID, such as ICCID (Integrated Circuit Card Identity).

[0075] In step S220, the user card generates a digital signature response and sends it to the authentication module.

[0076] The digital signature response includes, for example: a digital signature result, a user's identification, a random number, and a user card identification.

[0077] In step S222, the authentication module forwards the digital signature response to the cloud phone application.

[0078] The authentication module can also send biometric recognition results to the cloud phone application.

[0079] In step S224, the cloud phone application sends an authentication request to the cloud phone authentication platform.

[0080] The authentication request includes, for example, a digital signature result, a terminal identifier and a user identifier, and may also include a random number, a user card identifier and / or a biometric identification result. The terminal identifier is, for example, IMEI (International Mobile Equipment Identity).

[0081] The cloud phone authentication platform authenticates the user according to the authentication request and determines whether the user has the authority to log in to the cloud phone application on the terminal; if the authentication is successful and the user has the authority to log in to the cloud phone application on the terminal, the cloud phone authentication platform obtains the authorization information of the cloud phone application corresponding to the user according to the user's identification. The details are as follows.

[0082] In step S226, the cloud phone authentication platform searches for the public key corresponding to the user's identification according to the user's identification. When the public key is found, the digital signature result is verified using the public key. When the verification is successful, the relevant information of the user in the digital signature result is obtained; the relevant information of the user in the digital signature result is matched with the relevant information of the user in the authentication request.

[0083] In the case where the authentication request includes the result of biometric identification, the cloud phone authentication platform will then execute subsequent processes such as searching for the public key corresponding to the user's identification based on the user's identification if the biometric identification is successful.

[0084] In step S228, if the cloud phone authentication platform matches successfully, the terminal identifier is matched with the terminal identifier bound to the user identifier; if the match is successful, it is determined that the user has the authority to log in to the cloud phone application at the terminal, and the authorization information of the cloud phone application corresponding to the user is obtained based on the user identifier.

[0085] In step S230, the cloud phone authentication platform sends an authentication response to the cloud phone application.

[0086] The authentication response includes, for example, the authentication result and the authorization information of the cloud phone application corresponding to the user. The authorization information of the cloud phone application corresponding to the user includes, for example, the functions and data of the cloud phone application that the user can use. If the authentication fails, the authentication failure result is returned to the cloud phone application.

[0087] In step S232, the cloud phone application displays a corresponding interface according to the authorization information of the cloud phone application corresponding to the user.

[0088] Combine the following Figure 3 Other embodiments of the authentication method of the cloud phone application disclosed in the present invention are described, specifically how to bind the cloud phone application and the terminal, that is, the process of the user registering the cloud phone application on the terminal.

[0089] Figure 3 Flowcharts of some embodiments of the authentication method of the cloud phone application disclosed in the present invention. Figure 3 As shown, the method of this embodiment includes: steps S302 to S328.

[0090] In step S302, the cloud phone application obtains the terminal identification in response to the user inputting the user's identity information when registering for cloud phone use.

[0091] For example, the cloud phone application receives a user triggering the registration function, sends a cloud phone registration request to the cloud phone authentication platform, and the cloud phone authentication platform returns the cloud phone registration application interface, prompting the user to enter identity information. The user's identity information includes, for example, the user's name, identity identification (for example, ID number), and cloud phone number, but is not limited to the examples given.

[0092] In step S304, the cloud phone application sends registration information to the cloud phone authentication platform.

[0093] The registration information includes, for example, user identity information and terminal identification.

[0094] In step S306, the cloud phone authentication platform determines whether the user has the authority to register at the terminal based on the user's identity information and the terminal's identification.

[0095] For example, the cloud phone authentication platform verifies the identity of the user based on the user's identity information; if the user's identity authentication is passed, the registration authority corresponding to the user's identity information is queried to determine whether the user has the authority to register at the terminal; if the user has the authority to register at the terminal, it is determined whether an identification has been assigned to the user, and if not, the user's identification is assigned to the user.

[0096] For example, the cloud phone authentication platform verifies and authenticates the user's identity information. For example, based on the cloud phone's mobile phone number, it searches for the user's name and identity identification ID that corresponds to the cloud phone's mobile phone number, and matches the searched user's name and identity identification ID with the user's name and identity identification ID in the registration information. If they are consistent, the verification is successful. After the verification is successful, the cloud phone authentication platform confirms that the user has the authority to register at the terminal (identified by the IMEI number). For example, a blacklist or whitelist is set for each user. The blacklist stores terminals that the user cannot register, and the whitelist stores terminals that the user is allowed to register. If the user has already registered through other terminals, the binding relationship between the user's identity and the terminal identity in the registration information is directly added; if the user has not registered through other terminals, a user identity is generated for the user.

[0097] In step S308, if the user has the authority to register on the terminal, the cloud phone authentication platform binds and stores the user's identification with the terminal's identification, and determines the authorization information of the cloud phone application corresponding to the user.

[0098] The cloud phone authentication platform binds the user's ID to the terminal's ID and configures the specific permissions of the user's cloud phone application, that is, determines the authorization information of the cloud phone application corresponding to the user.

[0099] In step S310, the cloud phone authentication platform sends a biometric binding request to the authentication module.

[0100] The cloud phone authentication platform can send a biometric binding request to the authentication module through the cloud phone application. The biometric binding request includes, for example, the user's identification. The user's identification is the identification assigned to the user by the cloud phone authentication platform after the user registers on the terminal to use the cloud phone application.

[0101] In step S312, the authentication module sends a biometric binding request to the biometric recognition module.

[0102] In step S314, the biometric identification module receives the biometric information entered by the user, binds and stores the biometric information entered by the user with the user's identification, generates a biometric binding response, and sends it to the authentication module.

[0103] After receiving the biometric binding request, the biometric identification module can prompt the user to enter the biometric information and collect the user's biometric information. The biometric identification function module has the function of collecting and storing the biometric information of multiple users, and the biometric information of each user is associated with the mapping established by the identifier of the corresponding user. The biometric identification function includes, for example, at least one of fingerprint, voiceprint, iris and facial features, but is not limited to the examples given. In the case of successful binding, the biometric binding response includes: a successful binding result, indicating that the biometric identification module successfully binds the biometric information entered by the user with the user's identifier.

[0104] In step S316, the authentication module sends a key generation request to the user card.

[0105] The key generation request includes, for example, the user's identification. The authentication module may send the key generation request through the OMA machine-card interface.

[0106] In step S318, the user card generates a public key and a private key corresponding to the user, and stores the user's identification and the private key in correspondence.

[0107] In step S320, the user card generates a key generation response and sends it to the authentication module.

[0108] The key generation response includes, for example, a public key corresponding to the user's identification generated by the user card.

[0109] In step S322, the authentication module sends a biometric binding response and a public key corresponding to the user's identification to the cloud phone authentication platform.

[0110] The authentication module can send a biometric binding response and a public key corresponding to the user's identification to the cloud phone authentication platform through the cloud phone application.

[0111] In step S324, the cloud phone authentication platform binds and stores the user's identification and the corresponding public key.

[0112] In step S326, the cloud phone authentication platform sends a registration response to the cloud phone application.

[0113] The registration response includes, for example, a registration result and authorization information of the cloud phone application corresponding to the user.

[0114] In step S328, the cloud phone application displays the registration result and the authorization information of the cloud phone application corresponding to the user to the user according to the registration response.

[0115] The cloud phone authentication platform sends the cloud phone usage registration results and the cloud phone application specific permission terminals for display.

[0116] The method of the above embodiment realizes the process of automatic registration of users for cloud phone use at the terminal. Through registration, the subsequent user verification process can automatically authenticate the user's authority to log in to the cloud phone application at the terminal, thereby improving the subsequent authentication efficiency.

[0117] The present disclosure also provides an authentication module which can be set in a terminal. Figure 4 Give a description.

[0118] Figure 4 FIG. 1 is a structural diagram of some embodiments of the authentication module disclosed in the present invention. Figure 4 As shown, the authentication module 40 of this embodiment includes: a query unit 410 , a first sending unit 420 , a first receiving unit 430 , and a second sending unit 440 .

[0119] The query unit 410 is used to query the user's identification according to the biometric information input by the user in response to the triggering of the function of logging into the cloud phone application.

[0120] In some embodiments, the query unit 410 is used to send a user identification acquisition request to the biometric recognition module in the terminal in response to the triggering of the function of logging into the cloud phone application; receive the user identification acquisition response sent by the biometric recognition module, and when the biometric recognition is successful, the user identification acquisition response includes: the result of successful biometric recognition and the user's identification, and the result of successful biometric recognition indicates that the biometric recognition module successfully matches the biometric information input by the user with the stored biometric information, and the user's identification is obtained by searching the bound user's identification based on the biometric information.

[0121] The first sending unit 420 is used to send a digital signature request to the user card, where the digital signature request includes: the user's identification.

[0122] In some embodiments, the first sending unit 420 is used to send a key generation request to the user card, where the key generation request includes: a user identifier.

[0123] The first receiving unit 430 is used to receive a digital signature response sent by the user card. The digital signature response includes: a digital signature result. The digital signature result is the result of the user card signing the user's relevant information according to the private key corresponding to the user's identification. The user's relevant information includes: the user's identification.

[0124] In some embodiments, the first receiving unit 430 is used to receive a key generation response sent by a user card, where the key generation response includes: a public key corresponding to the user's identifier generated by the user card.

[0125] In some embodiments, the user-related information also includes: at least one of the user card identifier and a random number; the user identifier and the corresponding private key are bound and stored in the mobile phone card.

[0126] The second sending unit 440 is used to send an authentication request to the cloud phone authentication platform through the cloud phone application. The authentication request includes: a digital signature result, a terminal identifier and a user identifier, so that the cloud phone authentication platform can verify the digital signature result and determine whether the user has the authority to log in to the cloud phone application at the terminal.

[0127] In some embodiments, the second sending unit 440 is used to send a biometric binding response and a public key corresponding to the user's identifier to the cloud phone authentication platform so that the cloud phone authentication platform binds and stores the user's identifier and the corresponding public key.

[0128] In some embodiments, the module 40 also includes: a second receiving unit 450, used to receive a biometric binding request sent by the cloud phone authentication platform, the biometric binding request includes: the user's identification, the user's identification is the identification assigned to the user by the cloud phone authentication platform after the user registers on the terminal to use the cloud phone application; a third sending unit 460, used to send a biometric binding request to the biometric recognition module, the biometric binding request includes: the user's identification; a third receiving unit 470, used to receive a biometric binding response sent by the biometric recognition module, and if the binding is successful, the biometric binding response includes: a successful binding result, indicating that the biometric recognition module successfully binds the biometric information entered by the user with the user's identification.

[0129] In some embodiments, the first sending unit 420 is used to send a key generation request to the user card, and the key generation request includes: the user's identification; the first receiving unit 430 is used to receive a key generation response sent by the user card, and the key generation response includes: the public key corresponding to the user's identification generated by the user card; the second sending unit 440 is used to send a biometric binding response and a public key corresponding to the user's identification to the cloud phone authentication platform, so that the cloud phone authentication platform binds and stores the user's identification and the corresponding public key.

[0130] The present disclosure also provides a terminal, Figure 5 Give a description.

[0131] Figure 5 FIG. 1 is a structural diagram of some embodiments of the terminal disclosed in the present invention. Figure 5 As shown, the terminal 5 of this embodiment includes: an authentication module 40; and a user card 52.

[0132] The user card 52 is used to receive a digital signature request, find the corresponding private key according to the user's identification, use the private key to sign the user's relevant information, obtain a digital signature result, generate a digital signature response and send it to the authentication module.

[0133] In some embodiments, the user card 52 is also used to receive a key generation request, generate a public key and a private key corresponding to the user, store the user's identification and the private key in correspondence, and generate a key generation response and send it to the authentication module.

[0134] In some embodiments, the terminal 5 also includes: a biometric recognition module 54, which is used to receive the user identification acquisition request sent by the authentication module 40, receive the biometric information input by the user, match the biometric information input by the user with the stored biometric information, and when the match is successful, search for the bound user's identification according to the biometric information, generate a user identification acquisition response and send it to the authentication module 40, and the user identification acquisition response includes: the biometric recognition result and the identification of the found user.

[0135] In some embodiments, the biometric recognition module 54 is also used to receive a biometric binding request, receive the biometric information entered by the user, bind and store the biometric information entered by the user with the user's identification, generate a biometric binding response, and send it to the authentication module 40.

[0136] In some embodiments, the terminal 5 also includes: a cloud phone application 56, which is used to receive a login function triggered by a user, trigger the authentication module 40 to query the user's identification based on the biometric information input by the user, and receive an authentication response sent by the cloud phone authentication platform. If the authentication response includes a successful authentication result, it means that the cloud phone authentication platform has successfully verified the digital signature result and determined that the user has the authority to log in to the cloud phone application at the terminal 5.

[0137] In some embodiments, the cloud phone application 56 is also used to obtain the identification of the terminal 5 in response to the user registering and inputting the user's identity information when using the cloud phone; send registration information to the cloud phone authentication platform, the registration information includes: the user's identity information and the identification of the terminal 5; receive a registration response sent to the cloud phone authentication platform, the registration response includes: the registration result and the authorization information of the cloud phone application corresponding to the user; based on the registration response, display the registration result and the authorization information of the cloud phone application corresponding to the user to the user.

[0138] The present disclosure also provides a cloud phone application authentication system 6, which is combined with Figure 6 Give a description.

[0139] Figure 6 The following are structural diagrams of some embodiments of the authentication system of the cloud phone application disclosed in the present invention. Figure 6 As shown, the cloud phone application authentication system 6 of this embodiment includes: a terminal 5 and a cloud phone authentication platform 62.

[0140] The cloud phone authentication platform 62 is used to authenticate the user according to the authentication request and determine whether the user has the authority to log in to the cloud phone application at the terminal 5; when the authentication is successful and the user has the authority to log in to the cloud phone application at the terminal, the authorization information of the cloud phone application corresponding to the user is obtained according to the user's identification; an authentication response is sent to the cloud phone application, and the authentication response includes: the authentication result and the authorization information of the cloud phone application corresponding to the user.

[0141] In some embodiments, the cloud phone authentication platform 62 is used to find the public key corresponding to the user's identification based on the user's identification; when the public key is found, the digital signature result is verified using the public key, and when the verification is successful, the relevant information of the user in the digital signature result is obtained; the relevant information of the user in the digital signature result is matched with the relevant information of the user in the authentication request; when the match is successful, the identification of the terminal 5 is matched with the identification of the terminal bound to the user's identification; when the match is successful, it is determined that the user has the authority to log in to the cloud phone application at the terminal.

[0142] In some embodiments, the cloud phone authentication platform 62 is also used to receive registration information sent by the cloud phone application, the registration information including: the user's identity information and the identifier of the terminal 5; based on the user's identity information and the identifier of the terminal, determine whether the user has the authority to register at the terminal 5; if the user has the authority to register at the terminal 5, bind and store the user's identifier with the identifier of the terminal 5, and determine the authorization information of the cloud phone application corresponding to the user to complete the user registration at the terminal 5 to use the cloud phone application; and send a biometric binding request to the authentication module 40.

[0143] In some embodiments, the user's identity information includes: the user's name, identity proof identifier, and the cloud phone number; the cloud phone authentication platform is used to verify the user's identity based on the user's identity information; if the user's identity authentication is passed, the registration authority corresponding to the user's identity information is queried to determine whether the user has the authority to register at the terminal 5; if the user has the authority to register at the terminal 5, it is determined whether an identifier has been assigned to the user. If not, the user's identifier is assigned to the user.

[0144] In some embodiments, the cloud phone authentication platform 62 is used to bind and store the user's identification and the corresponding public key, and then send a registration response to the cloud phone application. The registration response includes: the registration result and the authorization information of the cloud phone application corresponding to the user.

[0145] The authentication device of the cloud phone application in the embodiment of the present disclosure, such as the terminal, the cloud phone authentication platform, etc., can be implemented by various computing devices or computer systems. Figure 7 as well as Figure 8 Give a description.

[0146] Figure 7 FIG. 1 is a structural diagram of some embodiments of the authentication device disclosed in the present invention. Figure 7 As shown, the device 70 of this embodiment includes: a memory 710 and a processor 720 coupled to the memory 710, and the processor 720 is configured to execute the authentication method of the cloud phone application in any of some embodiments of the present disclosure based on the instructions stored in the memory 710.

[0147] The memory 710 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, a database, and other programs.

[0148] Figure 8 FIG. 1 is a structural diagram of some other embodiments of the authentication device for the cloud phone application disclosed in the present invention. Figure 8 As shown, the device 80 of this embodiment includes: a memory 810 and a processor 820, which are similar to the memory 710 and the processor 720 respectively. It can also include an input and output interface 830, a network interface 840, a storage interface 850, etc. These interfaces 830, 840, 850 and the memory 810 and the processor 520 can be connected, for example, via a bus 860. Among them, the input and output interface 830 provides a connection interface for input and output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 840 provides a connection interface for various networked devices, for example, it can be connected to a database server or a cloud storage server. The storage interface 850 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0149] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0150] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0151] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0152] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0153] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A cloud phone application authentication method, comprising: The authentication module in the terminal, in response to the triggering of the function of logging into the cloud phone application, queries the user's identification according to the biometric information input by the user, wherein the user's identification is the identification assigned to the user by the cloud phone authentication platform after the user registers to use the cloud phone application on the terminal; The authentication module sends a digital signature request to the user card, and the digital signature request includes: the user's identification; The authentication module receives a digital signature response sent by the user card, wherein the digital signature response includes: a digital signature result, the digital signature result is the result of the user card signing the relevant information of the user according to the private key corresponding to the identifier of the user, and the relevant information of the user includes: the identifier of the user; The authentication module sends an authentication request to the cloud phone authentication platform through the cloud phone application, wherein the authentication request includes: the digital signature result, the terminal identifier and the user identifier, so that the cloud phone authentication platform verifies the digital signature result and determines whether the user has the authority to log in to the cloud phone application at the terminal.

2. The authentication method according to claim 1, wherein: The authentication module, in response to the triggering of the function of logging into the cloud phone application, queries the user's identification according to the biometric information input by the user, including: The authentication module sends a user identification acquisition request to the biometric recognition module in the terminal in response to the triggering of the function of logging into the cloud phone application; The authentication module receives a user identification acquisition response sent by the biometric recognition module. When the biometric recognition is successful, the user identification acquisition response includes: a result of successful biometric recognition and an identification of the user. The result of successful biometric recognition indicates that the biometric recognition module successfully matches the biometric information input by the user with the stored biometric information, and the identification of the user is obtained by searching for the identification of the bound user based on the biometric information.

3. The authentication method according to claim 1, wherein: The user-related information also includes: at least one of the identification of the user card and a random number; the user identification and the corresponding private key are bound and stored in the user card.

4. The authentication method according to claim 3, wherein: In the case where the relevant information of the user includes the identifier of the user card, the authentication request includes the identifier of the user card; in the case where the relevant information of the user includes the random number, the authentication request includes the random number; The method further comprises: The cloud phone authentication platform authenticates the user according to the authentication request, and determines whether the user has the authority to log in to the cloud phone application on the terminal; The cloud phone authentication platform obtains authorization information of the cloud phone application corresponding to the user according to the user's identifier when the authentication is successful and the user has the authority to log in to the cloud phone application on the terminal; The cloud phone authentication platform sends an authentication response to the cloud phone application, the authentication response including: an authentication result, and authorization information of the cloud phone application corresponding to the user; The cloud phone application displays a corresponding interface according to the authorization information of the cloud phone application corresponding to the user.

5. The authentication method according to claim 4, wherein: The cloud phone authentication platform authenticates the user according to the authentication request, and determines whether the user has the authority to log in to the cloud phone application at the terminal, including: The cloud phone authentication platform searches for a public key corresponding to the user's identifier according to the user's identifier; When the public key is found, the cloud phone authentication platform verifies the digital signature result using the public key, and obtains the relevant information of the user in the digital signature result when the verification is successful; The cloud phone authentication platform matches the relevant information of the user in the digital signature result with the relevant information of the user in the authentication request; When the match is successful, the cloud phone authentication platform matches the terminal identifier with the terminal identifier bound to the user identifier; When the matching is successful, the cloud phone authentication platform determines that the user has the authority to log in to the cloud phone application at the terminal.

6. The authentication method according to claim 1, further comprising: The authentication module receives a biometric binding request sent by the cloud phone authentication platform, wherein the biometric binding request includes: a user's identifier; The authentication module sends a biometric binding request to the biometric identification module, wherein the biometric binding request includes: an identifier of the user; The authentication module receives a biometric binding response sent by the biometric identification module. When the binding is successful, the biometric binding response includes a successful binding result, indicating that the biometric identification module successfully binds the biometric information entered by the user with the user's identification.

7. The authentication method according to claim 6, further comprising: The authentication module sends a key generation request to the user card, wherein the key generation request includes: an identifier of the user; The authentication module receives a key generation response sent by the user card, wherein the key generation response includes: a public key corresponding to the user's identification generated by the user card; The authentication module sends the biometric binding response and the public key corresponding to the user's identifier to the cloud phone authentication platform so that the cloud phone authentication platform binds and stores the user's identifier and the corresponding public key.

8. The authentication method according to claim 6, further comprising: The cloud phone application obtains the identification of the terminal in response to the user inputting the identity information of the user when registering for cloud phone use; The cloud phone application sends registration information to the cloud phone authentication platform, the registration information including: the identity information of the user and the identifier of the terminal; The cloud phone authentication platform determines whether the user has the authority to register at the terminal according to the identity information of the user and the identification of the terminal; The cloud phone authentication platform binds and stores the user's identification with the terminal's identification, and determines the authorization information of the cloud phone application corresponding to the user, so as to complete the user's registration to use the cloud phone application at the terminal; The cloud phone authentication platform sends the biometric binding request to the authentication module.

9. The authentication method according to claim 8, wherein: The user's identity information includes: the user's name, identity identification, and cloud phone number; The cloud phone authentication platform determines whether the user has the authority to register at the terminal according to the identity information of the user and the identifier of the terminal, including: The cloud phone authentication platform verifies the identity of the user according to the identity information of the user; When the identity authentication of the user is passed, the cloud phone authentication platform queries the registration authority corresponding to the identity information of the user to determine whether the user has the authority to register at the terminal; The cloud phone authentication platform determines whether an identification has been assigned to the user if the user has the authority to register at the terminal, and if not, assigns the user's identification to the user.

10. The authentication method according to claim 8, further comprising: After the cloud phone authentication platform binds and stores the user's identification and the corresponding public key, it sends a registration response to the cloud phone application, wherein the registration response includes: a registration result and authorization information of the cloud phone application corresponding to the user; The cloud phone application displays the registration result and the authorization information of the cloud phone application corresponding to the user to the user according to the registration response.

11. An authentication device, wherein: The authentication device is arranged in the terminal, and the authentication device comprises: A query unit, configured to query the user's identification according to the biometric information input by the user in response to the triggering of the function of logging into the cloud phone application, wherein the user's identification is the identification assigned to the user by the cloud phone authentication platform after the user registers to use the cloud phone application on the terminal; A first sending unit is used to send a digital signature request to a user card, wherein the digital signature request includes: an identifier of the user; A first receiving unit is configured to receive a digital signature response sent by the user card, wherein the digital signature response includes: a digital signature result, the digital signature result is a result of the user card signing the relevant information of the user according to the private key corresponding to the identifier of the user, and the relevant information of the user includes: the identifier of the user; The second sending unit is used to send an authentication request to the cloud phone authentication platform through the cloud phone application, wherein the authentication request includes: the digital signature result, the identifier of the terminal and the identifier of the user, so that the cloud phone authentication platform verifies the digital signature result and determines whether the user has the authority to log in to the cloud phone application at the terminal.

12. The authentication device according to claim 11, wherein: The query unit is used to send a user identification acquisition request to the biometric recognition module in the terminal in response to the triggering of the function of logging into the cloud phone application; receive a user identification acquisition response sent by the biometric recognition module, and when the biometric recognition is successful, the user identification acquisition response includes: the result of successful biometric recognition and the identification of the user, and the result of successful biometric recognition indicates that the biometric recognition module successfully matches the biometric information input by the user with the stored biometric information, and the identification of the user is obtained by searching the identification of the bound user based on the biometric information.

13. The authentication device according to claim 11, wherein: The user-related information also includes: at least one of the identification of the user card and a random number; the user identification and the corresponding private key are bound and stored in the user card.

14. The authentication device according to claim 11, wherein: Also includes: A second receiving unit is configured to receive a biometric binding request sent by the cloud phone authentication platform, wherein the biometric binding request includes: a user identifier; A third sending unit is used to send a biometric binding request to the biometric identification module, wherein the biometric binding request includes: an identifier of the user; The third receiving unit is used to receive a biometric binding response sent by the biometric recognition module. When the binding is successful, the biometric binding response includes: a successful binding result, indicating that the biometric recognition module successfully binds the biometric information entered by the user with the user's identification.

15. The authentication device according to claim 14, wherein: The first sending unit is used to send a key generation request to the user card, and the key generation request includes: the identifier of the user; The first receiving unit is used to receive a key generation response sent by the user card, wherein the key generation response includes: a public key corresponding to the user identification generated by the user card; The second sending unit is used to send the biometric binding response and the public key corresponding to the user's identifier to the cloud phone authentication platform, so that the cloud phone authentication platform binds and stores the user's identifier and the corresponding public key.

16. A terminal, comprising: The authentication device according to any one of claims 11 to 15; as well as The user card is used to receive the digital signature request, search for the corresponding private key according to the user's identification, use the private key to sign the relevant information of the user, obtain the digital signature result, generate the digital signature response and send it to the authentication device.

17. The terminal according to claim 16, wherein: The user card is also used to receive a key generation request, generate a public key and a private key corresponding to the user, store the user's identification and the private key in correspondence, and generate a key generation response and send it to the authentication device.

18. The terminal according to claim 16, further comprising: The biometric identification module is used for the user identification acquisition request sent by the authentication device, receiving the biometric information input by the user, matching the biometric information input by the user with the stored biometric information, and in case of a successful match, searching for the identification of the bound user according to the biometric information, generating a user identification acquisition response and sending it to the authentication device, wherein the user identification acquisition response includes: the biometric identification result and the identification of the user found.

19. The terminal according to claim 18, wherein: The biometric feature recognition module is also used to receive the biometric feature binding request, receive the biometric feature information entered by the user, bind and store the biometric feature information entered by the user with the user's identification, generate a biometric feature binding response, and send it to the authentication device.

20. The terminal according to claim 16, further comprising: The cloud phone application is used to receive the login function triggered by the user, trigger the authentication device to query the user's identification according to the biometric information input by the user, and receive the authentication response sent by the cloud phone authentication platform. When the authentication response includes a successful authentication result, it means that the cloud phone authentication platform has successfully verified the digital signature result and determined that the user has the authority to log in to the cloud phone application at the terminal.

21. The terminal according to claim 20, wherein: The cloud phone application is also used to obtain the identification of the terminal in response to the user registering and inputting the user's identity information when using the cloud phone; send registration information to the cloud phone authentication platform, the registration information including: the user's identity information and the identification of the terminal; receive a registration response sent to the cloud phone authentication platform, the registration response including: the registration result and the authorization information of the cloud phone application corresponding to the user; based on the registration response, display the registration result and the authorization information of the cloud phone application corresponding to the user to the user.

22. A cloud phone application authentication system, comprising: The terminal according to any one of claims 16 to 21, and A cloud phone authentication platform, used to authenticate the user according to the authentication request and determine whether the user has the authority to log in to the cloud phone application at the terminal; If the authentication is successful and the user has the authority to log in to the cloud phone application on the terminal, obtaining the authorization information of the cloud phone application corresponding to the user according to the user's identifier; An authentication response is sent to the cloud phone application, wherein the authentication response includes: an authentication result and authorization information of the cloud phone application corresponding to the user.

23. The authentication system according to claim 22, wherein: The cloud phone authentication platform is used to find the public key corresponding to the user's identity according to the user's identity; When the public key is found, the digital signature result is verified using the public key, and when the verification is successful, the relevant information of the user in the digital signature result is obtained; Match the relevant information of the user in the digital signature result with the relevant information of the user in the authentication request; if the match is successful, match the identifier of the terminal with the identifier of the terminal bound to the identifier of the user; if the match is successful, determine that the user has the authority to log in to the cloud phone application at the terminal.

24. The authentication system according to claim 22, wherein: The cloud phone authentication platform is also used to receive registration information sent by the cloud phone application, the registration information including: the identity information of the user and the identifier of the terminal; determine whether the user has the authority to register at the terminal based on the identity information of the user and the identifier of the terminal; if the user has the authority to register at the terminal, bind and store the identifier of the user and the identifier of the terminal, and determine the authorization information of the cloud phone application corresponding to the user to complete the registration of the user at the terminal to use the cloud phone application; and send the biometric binding request to the authentication device.

25. The authentication system according to claim 24, wherein: The user's identity information includes: the user's name, identity identification, and cloud phone number; The cloud phone authentication platform is used to verify the identity of the user based on the user's identity information; if the user's identity authentication is passed, query the registration authority corresponding to the user's identity information to determine whether the user has the authority to register at the terminal; if the user has the authority to register at the terminal, determine whether an identification has been assigned to the user, and if not, assign the user's identification to the user.

26. The authentication system according to claim 24, wherein: The cloud phone authentication platform is used to bind and store the user's identification and the corresponding public key, and then send a registration response to the cloud phone application. The registration response includes: a registration result and authorization information of the cloud phone application corresponding to the user.

27. An authentication device for a cloud phone application, comprising: processor; as well as A memory coupled to the processor, for storing instructions, wherein when the instructions are executed by the processor, the processor executes the cloud phone application authentication method as described in any one of claims 1-10.

28. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images