Password-free login method, device, computer equipment, and storage medium

Abstract

The present application belongs to the field of Internet technology, and relates to a password-free login method, comprising receiving an access request sent by a remote cloud platform, the access request including at least the first password, the first password being calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window; calculating a second password based on the shared key, a second timestamp, and the time window; comparing the first password and the second password, and if the two are consistent, receiving access to the remote cloud platform. The present application also provides a password-free login device, a computer device, and a storage medium. The password-free login solution provided by the present application allows the remote cloud platform to generate a dynamic password through a shared key, a timestamp, and a time window to log in to the target platform without a password, access or operate the data of the target platform, so as to reduce the user switching back and forth between different systems. The implementation is simple, and the dynamic password for the password-free login of the present application is sensitive and has a high security factor.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a password-free login method, apparatus, computer equipment, and storage medium. Background Art

[0002] As a business grows, its applications or management platforms increase. Initially, each application or management platform has different responsibilities and user groups, and different login information and methods. This results in data isolation between the platforms or applications, making it impossible to log in to Platform B using the login account and password for Platform A. As the business expands or changes, users may need to be able to log in to Platform A and directly access or operate Platform B for greater convenience.

[0003] In the existing technology, the account data of platform A and platform B are generally merged to achieve single sign-on between the two platforms. In this way, if an account is logged in to platform A, it will automatically log in when accessing platform B. However, this solution has shortcomings, mainly manifested in the following two aspects:

[0004] (1) If the account table structure and password storage method between the two platforms are inconsistent, it will be difficult to merge the accounts.

[0005] (2) Single sign-on is complex, time-consuming and labor-intensive to implement. Summary of the Invention

[0006] The purpose of the embodiments of the present application is to propose a password-free login method, apparatus, computer equipment and storage medium to solve the problems of difficulty in merging two platform accounts and complex login in the prior art.

[0007] In order to solve the above technical problems, the present application provides a password-free login method, which is applied to the target platform and adopts the following technical solutions:

[0008] Receiving an access request sent by a remote cloud platform, the access request including at least the first password, where the first password is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window;

[0009] Calculate a second password based on the shared key, the second timestamp, and the time window;

[0010] comparing the first password and the second password;

[0011] If the first password and the second password are consistent, access to the remote cloud platform is accepted.

[0012] Furthermore, before receiving the access request sent by the remote cloud platform, the method further includes:

[0013] Receiving the shared key generated by the remote cloud platform; or

[0014] Generate the shared key and synchronize the shared key to the remote cloud platform; or

[0015] Obtain the shared key.

[0016] Furthermore, before calculating the second password according to the shared key, the second timestamp, and the time window, the method further includes:

[0017] Determining whether the time of receiving the first password exceeds the time window;

[0018] If it exceeds, a timeout message is sent to the remote cloud platform, and the access request sent by the remote cloud platform is received again.

[0019] Furthermore, the receiving an access request sent by the remote cloud platform, the access request including at least the first password, the first password being calculated by the remote cloud platform based on the shared key, the first timestamp, and the time window, includes:

[0020] Receive an access request sent by a remote cloud platform, where the access request includes at least the first password, where the first password is obtained by encrypting the shared key of the remote cloud platform to obtain an encryption key; generate a first dynamic password based on the encryption key, a first timestamp and the time window; and encrypt the first dynamic password.

[0021] Furthermore, the calculating the second password according to the shared key, the second timestamp, and the time window includes:

[0022] Encrypting the shared key to obtain an encryption key;

[0023] generating a second dynamic password according to the encryption key, the second timestamp and the time window;

[0024] The second dynamic password is encrypted to obtain the second password.

[0025] Furthermore, before receiving the access request sent by the remote cloud platform, the method further includes:

[0026] Enable the access permission function and send an access permission notification to the remote cloud platform.

[0027] Furthermore, after comparing the first password and the second password, the method further includes:

[0028] If the first password and the second password are inconsistent, access to the remote cloud platform is denied.

[0029] In order to solve the above technical problems, the embodiment of the present application further provides a password-free login device, which adopts the following technical solution:

[0030] a receiving module, configured to receive an access request sent by a remote cloud platform, wherein the access request includes at least the first password, where the first password is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window;

[0031] a calculation module, configured to calculate a second password according to the shared key, the second timestamp, and the time window;

[0032] a comparison module, configured to compare the first password and the second password;

[0033] The receiving module is further configured to receive access from the remote cloud platform when the comparison result of the comparison module is consistent.

[0034] Furthermore, the receiving module is further configured to receive the shared key generated by the remote cloud platform; or

[0035] The device further includes a generating module for generating the shared key and synchronizing the shared key to the remote cloud platform; or

[0036] The device further includes an acquisition module, configured to acquire the shared key.

[0037] Furthermore, the device further includes a judgment module and a sending module;

[0038] The judging module is configured to judge whether the time of receiving the first password exceeds the time window;

[0039] The sending module is used to send a timeout message to the remote cloud platform when the judgment result of the judgment module is exceeded;

[0040] The receiving module is further configured to re-receive the access request sent by the remote cloud platform.

[0041] Furthermore, the calculation module includes an encryption unit, a generation unit, and an acquisition unit;

[0042] The encryption unit is used to encrypt the shared key to obtain an encryption key;

[0043] The generating unit is configured to generate a second dynamic password according to the encryption key, the second timestamp and the time window;

[0044] The obtaining unit is configured to encrypt the second dynamic password to obtain the second password.

[0045] Furthermore, the device further comprises an opening module;

[0046] The enabling module is used to enable the access permission function;

[0047] The sending module is further configured to send an access permission notification to the remote cloud platform.

[0048] Furthermore, the device also includes a rejection module, which is used to reject access to the remote cloud platform when the first password and the second password are inconsistent.

[0049] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0050] A computer device is provided, comprising one or more processors; and a memory for storing one or more programs, so that the one or more processors implement any of the above-mentioned password-free login methods.

[0051] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0052] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements any one of the above-mentioned password-free login methods.

[0053] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0054] The password-free login solution provided in this application allows the remote cloud platform to generate a dynamic password through a shared key, timestamp, and time window to log in to the target platform without password, access or operate the data of the target platform, so as to reduce the user's switching back and forth between different systems. The implementation method is simple, and the dynamic password for the password-free login in this application is sensitive and has a high security factor. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0056] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0057] Figure 2 A flowchart of an embodiment of a password-free login method according to the present application;

[0058] Figure 3 This is a schematic structural diagram of an embodiment of a password-free login device according to the present application;

[0059] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0061] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0062] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0063] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. Network 104 is a medium for providing communication links between terminal devices 101, 102, 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0064] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0065] Terminal devices 101, 102, and 103 can be various electronic devices with display screens and support web browsing, including but not limited to smartphones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV), laptop computers, desktop computers, etc.

[0066] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0067] It should be noted that the password-free login method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the password-free login device is generally set in the server.

[0068] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0069] Continue to refer Figure 2 , shows a flow chart of an embodiment of a password-free login method according to the present application. The password-free login method comprises the following steps:

[0070] Step 201: Receive an access request sent by a remote cloud platform, where the access request includes at least the first password, which is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window.

[0071] In this embodiment, after logging in, the remote cloud platform sends a remote access request to the target platform. If the target platform allows remote access, the remote cloud platform obtains the target platform's shared key and calculates a dynamic password based on the shared key and the TOTP algorithm, thereby obtaining a first password. The remote cloud platform then uses the first password to access the target platform.

[0072] In actual use, the timestamp is the number of seconds that have elapsed from midnight on January 1, 1970, UTC / GMT to the current time. In this embodiment, the first timestamp is the timestamp of the current time when the remote cloud platform calculates the first password. The time window is the number of seconds of the time window, which is a value preset in advance by the target platform and the remote cloud platform. In this embodiment, the time window size is set to 30 seconds, indicating that a window of time error is allowed.

[0073] Step 202: Calculate a second password based on the shared key, the second timestamp, and the time window.

[0074] In this embodiment, after receiving the request, the target platform verifies whether the current device on the target platform has authorized password-free login. If authorized, it uses the locally stored shared key and the same rules used by the remote cloud platform to calculate the first password to calculate the current dynamic password, thereby obtaining the second password. In this embodiment, the second timestamp is the timestamp of the current time when the target platform calculates the second password.

[0075] Step 203: Compare the first password and the second password;

[0076] Step 204: If the first password and the second password are consistent, access to the remote cloud platform is accepted.

[0077] In this embodiment, if the dynamic password calculated by the target platform is consistent with the dynamic password carried by the remote cloud platform during remote access, the remote cloud platform is allowed to log in without a password.

[0078] This application receives an access request sent by a remote cloud platform, and the access request includes at least the first password, which is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window; the second password is calculated based on the shared key, the second timestamp, and the time window; the first password and the second password are compared, and if the first password and the second password are consistent, the access to the remote cloud platform is received. The password-free login solution provided by this application does not require the remote cloud platform to know the login account, password, and other information of the target platform, but generates a dynamic password through a shared key, a timestamp, and a time window to log in to the target platform without password, access or operate the data of the target platform, so that the user only needs to log in to one of the services to directly access other trusted services, so as to reduce the user's switching back and forth between different systems. The implementation method is simple, and the dynamic password for the password-free login of this application is sensitive and has a high security factor.

[0079] In some optional implementations of this embodiment, before receiving the access request sent by the remote cloud platform in step 201, the electronic device may further perform the following steps:

[0080] Receiving the shared key generated by the remote cloud platform; or

[0081] Generate the shared key and synchronize the shared key to the remote cloud platform; or

[0082] Obtain the shared key.

[0083] In actual use, the remote cloud platform and the target platform each save the shared key required for password-free login. The shared key can be generated by either the remote cloud platform or the target platform and synchronized to the other party, or saved locally by both parties after an agreement is reached and obtained directly from the local when used.

[0084] In some optional implementations of this embodiment, before calculating the second password according to the shared key, the second timestamp, and the time window in step 202, the electronic device may further perform the following steps:

[0085] Determining whether the time of receiving the first password exceeds the time window;

[0086] If it exceeds, a timeout message is sent to the remote cloud platform, and the access request sent by the remote cloud platform is received again.

[0087] In practice, if the time difference between the remote cloud platform and the target platform exceeds a time window, or if the time window is later than the current time, the generated dynamic password will become invalid. If the dynamic password is not refreshed, the target platform will deny password-free access, further ensuring the security of password-free login. In theory, the smaller the time window, the more secure the generated dynamic password.

[0088] In some optional implementations of this embodiment, step 201 receives an access request sent by a remote cloud platform, where the access request includes at least the first password, where the first password is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window. The electronic device may further perform the following steps:

[0089] Receive an access request sent by a remote cloud platform, where the access request includes at least the first password, where the first password is obtained by encrypting the shared key of the remote cloud platform to obtain an encryption key; generate a first dynamic password based on the encryption key, a first timestamp and the time window; and encrypt the first dynamic password.

[0090] In some optional implementations of this embodiment, in step 202, the second password is calculated based on the shared key, the second timestamp, and the time window. The electronic device may further perform the following steps:

[0091] Encrypting the shared key to obtain an encryption key;

[0092] generating a second dynamic password according to the encryption key, the second timestamp and the time window;

[0093] The second dynamic password is encrypted to obtain the second password.

[0094] In this embodiment, the first password is calculated based on the TOTP algorithm (Time-based One-time Password algorithm). The TOTP algorithm is an algorithm that calculates a one-time password from a shared secret key and the current time. It has been adopted as the Internet Engineering Task Force standard RFC 6238, is the cornerstone of the Initiative for Open Authentication (OATH), and is used in many two-factor authentication systems. The TOTP algorithm uses a cryptographic hash function to combine a secret key with the current timestamp to generate a one-time password. The TOTP algorithm formula is as follows:

[0095] TOTP(K,T)=HMAC-SHA-1(K,T / X)

[0096] Among them, HMAC-SHA-1 is a secure hash encryption algorithm, which can be replaced with HMAC-SHA-256 or HMAC-SHA-512. You can select a suitable encryption algorithm according to the actual application scenario. HMAC-SHA-1 is used in the embodiment of this application.

[0097] Parameter K represents the shared key, parameter T represents the timestamp of the current time, that is, the number of seconds from 00:00 on January 1, 1970 UTC / GMT time to the current time, and X represents the time window size (in seconds).

[0098] Due to network delay or time error between the remote cloud platform and the target platform, the target platform fails to verify the one-time password. Therefore, the time error between the remote cloud platform and the target platform is accommodated by adjusting the time window size and the allowed error of the time window.

[0099] According to this solution, the remote cloud platform and the target platform share a shared secret key. The remote cloud platform uses the HMAC-SHA-1 encryption algorithm to calculate a temporary password based on the shared secret key and the current time. The remote cloud platform then sends a password-free login request with this password to the target platform. Upon receiving the request, the target platform calculates a temporary password using the same method and compares it with the temporary password sent by the remote cloud platform. If they match, password-free login is allowed; otherwise, it is rejected. The temporary password is one-time and cannot be reused.

[0100] Specifically, the method for generating the first password includes:

[0101] (1) Encrypt the shared key of the remote cloud platform according to a certain rule to obtain an encrypted key. The encryption algorithm of the encryption rule can refer to the MD5 encryption algorithm, the SHA series encryption algorithm, the symmetric encryption algorithm, the asymmetric encryption algorithm, etc., or a combination of two or more of these encryption algorithms.

[0102] (2) Set the time window size to 30 seconds (i.e., the time error range between the remote cloud platform and the target platform is allowed to be 30 seconds, which is configurable).

[0103] (3) Using the encrypted key in (1) and the current system time, a dynamic password for the current time window is generated according to the TOTP algorithm.

[0104] The encryption algorithm is HMAC-SHA-1.

[0105] (4) The generated dynamic password is a six-digit number. If it is less than six digits, it will be padded with 0 in front of the number. The length of the dynamic password is configurable.

[0106] (5) Encrypt the generated dynamic password according to certain rules to obtain a dynamic password, namely the first password.

[0107] It should be noted that the second password is calculated by the target platform using the same calculation method as the first password.

[0108] In some optional implementations of this embodiment, before receiving the access request sent by the remote cloud platform in step 201, the electronic device may specifically perform the following steps:

[0109] Enable the access permission function and send an access permission notification to the remote cloud platform.

[0110] Specifically, log in to the target platform and click to enable the remote access function. The target platform requests the remote cloud platform to notify the remote cloud platform that the current target platform allows remote access.

[0111] In addition, the remote cloud platform also needs to verify whether the current target platform is in the cloud. If it is in the cloud, it generates a shared key and stores it in the cache, marking the success of opening remote access to the target platform, and returns the shared key to the remote cloud platform. Otherwise, opening remote access fails.

[0112] In some optional implementations, after comparing the first password and the second password in step 203, the electronic device may specifically perform the following steps:

[0113] If the first password and the second password are inconsistent, access to the remote cloud platform is denied.

[0114] In this embodiment, password-free login can be canceled by deleting the shared key on either the remote cloud platform or the target platform. Both the remote cloud platform and the target platform must properly store the shared key to prevent leakage. Furthermore, this application can also adjust the security of password-free login by adjusting the randomness, length, and time window of the shared key.

[0115] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0116] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0117] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a password-free login device. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0118] like Figure 3 As shown, the password-free login device 300 of this embodiment includes: a receiving module 301, a calculation module 302 and a comparison module 303.

[0119] A receiving module 301 is configured to receive an access request sent by a remote cloud platform, wherein the access request includes at least the first password, where the first password is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window;

[0120] A calculation module 302 is configured to calculate a second password based on the shared key, the second timestamp, and the time window;

[0121] A comparison module 303 is configured to compare the first password and the second password;

[0122] The receiving module 301 is further configured to receive access from the remote cloud platform when the comparison result of the comparison module 303 is consistent.

[0123] The present application receives an access request sent by a remote cloud platform through a receiving module 301, wherein the access request includes at least the first password, which is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window; a calculation module 302 calculates a second password based on the shared key, a second timestamp, and the time window; a comparison module 303 compares the first password and the second password; and the receiving module 301 receives access to the remote cloud platform when the comparison result of the comparison module 303 is consistent. The password-free login solution provided by the present application allows the remote cloud platform to generate a dynamic password through a shared key and a timestamp to log in to the target platform without a password, access or operate the data of the target platform, so as to reduce the user's switching back and forth between different systems. The implementation is simple, and the dynamic password for the password-free login of the present application is sensitive and has a high security factor.

[0124] In some optional implementations of this embodiment, the receiving module 301 is further configured to receive the shared key generated by the remote cloud platform; or

[0125] The device further includes a generating module 304 for generating the shared key and synchronizing the shared key to the remote cloud platform; or

[0126] The apparatus further includes an acquisition module 305 configured to acquire the shared key.

[0127] In actual use, the remote cloud platform and the target platform each save the shared key required for password-free login. The shared key can be generated by either the remote cloud platform or the target platform and synchronized to the other party, or saved locally by both parties after reaching an agreement.

[0128] In some optional implementations of this embodiment, the apparatus 300 further includes a determination module 306 and a sending module 307;

[0129] The judging module 306 is configured to judge whether the time of receiving the first password exceeds the time window;

[0130] The sending module 307 is configured to send a timeout message to the remote cloud platform when the judgment result of the judging module 306 is exceeded;

[0131] The receiving module 301 is further configured to re-receive the access request sent by the remote cloud platform.

[0132] In practice, if the time difference between the remote cloud platform and the target platform exceeds a time window, or if the time window is later than the current time, the generated dynamic password will become invalid. If the dynamic password is not refreshed, the target platform will deny password-free access, further ensuring the security of password-free login. In theory, the smaller the time window, the more secure the generated dynamic password.

[0133] In some optional implementations of this embodiment, the calculation module 302 includes an encryption unit 3021, a generation unit 3022, and an acquisition unit 3023;

[0134] The encryption unit 3021 is used to encrypt the shared key to obtain an encryption key;

[0135] The generating unit 3022 is configured to generate a second dynamic password according to the encryption key, the second timestamp and the time window;

[0136] The obtaining unit 3023 is configured to encrypt the second dynamic password to obtain the second password.

[0137] Specifically, in this embodiment, the first password is calculated based on the TOTP algorithm (Time-based One-time Password algorithm). The TOTP algorithm is an algorithm that calculates a one-time password from a shared secret key and the current time. It has been adopted as the Internet Engineering Task Force standard RFC 6238, is the cornerstone of the Initiative for Open Authentication (OATH), and is used in many two-factor authentication systems. The TOTP algorithm uses a cryptographic hash function to combine a secret key with the current timestamp to generate a one-time password. The TOTP algorithm formula is as follows:

[0138] TOTP(K,T)=HMAC-SHA-1(K,T / X)

[0139] Among them, HMAC-SHA-1 is a secure hash encryption algorithm, which can be replaced with HMAC-SHA-256 or HMAC-SHA-512. You can select a suitable encryption algorithm according to the actual application scenario. HMAC-SHA-1 is used in the embodiment of this application.

[0140] Parameter K represents the shared key, parameter T represents the timestamp of the current time, that is, the number of seconds from 00:00 on January 1, 1970 UTC / GMT time to the current time, and X represents the time window size (in seconds).

[0141] Due to network delay or time error between the remote cloud platform and the target platform, the target platform fails to verify the one-time password. Therefore, the time error between the remote cloud platform and the target platform is accommodated by adjusting the time window size and the allowed error of the time window.

[0142] According to this solution, the remote cloud platform and the target platform share a shared secret key. The remote cloud platform uses the HMAC-SHA-1 encryption algorithm to calculate a temporary password based on the shared secret key and the current time. The remote cloud platform then sends a password-free login request with this password to the target platform. Upon receiving the request, the target platform calculates a temporary password using the same method and compares it with the temporary password sent by the remote cloud platform. If they match, password-free login is allowed; otherwise, it is rejected. The temporary password is one-time and cannot be reused.

[0143] Specifically, the method for generating the second password includes:

[0144] (1) Encrypt the shared key of the remote cloud platform according to a certain rule to obtain an encrypted key. The encryption algorithm of the encryption rule can refer to the MD5 encryption algorithm, the SHA series encryption algorithm, the symmetric encryption algorithm, the asymmetric encryption algorithm, etc., or a combination of two or more of these encryption algorithms.

[0145] (2) Set the time window size to 30 seconds (i.e., the time error range between the remote cloud platform and the target platform is allowed to be 30 seconds, which is configurable).

[0146] (3) Using the encrypted key in (1) and the current system time, a dynamic password for the current time window is generated according to the TOTP algorithm.

[0147] The encryption algorithm is HMAC-SHA-1.

[0148] (4) The generated dynamic password is a six-digit number. If it is less than six digits, it will be padded with 0 in front of the number. The length of the dynamic password is configurable.

[0149] (5) Encrypt the generated dynamic password according to certain rules to obtain a dynamic password, i.e., the second password.

[0150] It should be noted that the first password is calculated by the remote cloud platform, and the calculation method is the same as the calculation method of the second password.

[0151] In some optional implementations of this embodiment, the apparatus 300 further includes an opening module 308;

[0152] The enabling module 308 is used to enable the access permission function;

[0153] The sending module 307 is further configured to send an access permission notification to the remote cloud platform.

[0154] Specifically, log in to the target platform and click to enable the remote access function. The target platform requests the remote cloud platform to notify the remote cloud platform that the current target platform allows remote access.

[0155] In addition, the remote cloud platform also needs to verify whether the current target platform is in the cloud. If it is in the cloud, it generates a shared key and stores it in the cache, marking the success of opening remote access to the target platform, and returns the shared key to the remote cloud platform. Otherwise, opening remote access fails.

[0156] In some optional implementations of this embodiment, the apparatus 300 further includes a rejection module 309 configured to reject access to the remote cloud platform when the first password and the second password are inconsistent.

[0157] Specifically, password-free login can be disabled by deleting the shared key on either the remote cloud platform or the target platform. Both the remote cloud platform and the target platform must properly store the shared key to prevent leakage. Furthermore, this application can adjust the security of password-free login by adjusting the randomness, length, and time window of the shared key.

[0158] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0159] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0160] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0161] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 6, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (SMC), a secure digital (SD) card, a flash memory card, etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as the program code of the password-free login method. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0162] In some embodiments, the processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to execute program code stored in the memory 41 or process data, such as executing the program code for the password-free login method.

[0163] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0164] The present application also provides another embodiment, namely, providing a computer-readable storage medium, which stores a backup program between communication devices, and the backup program between communication devices can be executed by at least one processor to enable the at least one processor to perform the steps of the above-mentioned password-free login method.

[0165] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0166] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.

Claims

1. A password-free login method, applied to a target platform, characterized in that: The steps include: Receiving an access request sent by a remote cloud platform, wherein, before receiving the access request sent by the remote cloud platform, the method further includes: Enable the access permission function and send an access permission notification to the remote cloud platform; The access request includes at least a first password, which is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window. Specifically, the remote cloud platform performs a first encryption on the shared key to obtain an encryption key; generates a first dynamic password based on the encryption key, the first timestamp, and the time window; and performs a second encryption on the first dynamic password to obtain the first password. Verify whether the current device on the target platform has been authorized for password-free login; If authorized, a second password is calculated based on the shared key, the second timestamp, and the time window. Specifically, a second dynamic password is generated based on the encryption key, the second timestamp, and the time window; the second dynamic password is encrypted using the second encryption method used by the remote cloud platform to obtain the second password. Before calculating the second password based on the shared key, the second timestamp, and the time window, the method further includes: Determining whether the time of receiving the first password exceeds the time window; If exceeded, a timeout message is sent to the remote cloud platform, and the access request sent by the remote cloud platform is received again; Comparing the first password and the second password to see if they are consistent; If the first password and the second password are consistent, access to the remote cloud platform is accepted.

2. The password-free login method according to claim 1, characterized in that: Before receiving the access request sent by the remote cloud platform, the method further includes: Receiving the shared key generated by the remote cloud platform; or Generate the shared key and synchronize the shared key to the remote cloud platform; or Obtain the shared key.

3. The password-free login method according to claim 1, wherein: After comparing the first password and the second password, the method further includes: If the first password and the second password are inconsistent, access to the remote cloud platform is denied.

4. A password-free login device, characterized in that: The password-free login device is used to implement the steps of the password-free login method according to any one of claims 1 to 3, and the password-free login device includes: a receiving module, configured to receive an access request sent by a remote cloud platform, wherein the access request includes at least the first password, where the first password is calculated by the remote cloud platform based on a shared key, a first timestamp, and a time window; a calculation module, configured to calculate a second password according to the shared key, the second timestamp, and the time window; a comparison module, configured to compare the first password and the second password; The receiving module is further configured to receive access from the remote cloud platform when the comparison result of the comparison module is consistent.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the password-free login method according to any one of claims 1 to 3 when executing the computer program.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the password-free login method according to any one of claims 1 to 3.

Images