Password authentication method, device and communication method for terminal equipment to initiate a call

Abstract

The embodiment of the present application belongs to the field of information communication, and relates to a password authentication method, including configuring a server to receive a TURN password request sent by a terminal device, and generating a first TURN password according to the TURN password request and sending it to the terminal device; the TURN server receives a TURN allocation request sent by the terminal device and a first authentication summary value calculated by the terminal device using the first TURN password, user name and random number Nonce value; the TURN server generates a second TURN password according to the TURN allocation request, and obtains a second authentication summary value using the second TURN password, user name and Nonce value; the TURN server compares the first authentication summary value and the second authentication summary value, and the authentication is passed if the two are equal. The present application also provides a password authentication device and a communication method for a terminal device to initiate a call. The present application can effectively solve a large number of user account information maintenance problems, avoid a large amount of database maintenance work, and is safe and reliable.

Description

Technical Field

[0001] The present application relates to the field of information communication technology, and in particular to a password authentication method, device and a communication method for initiating a call by a terminal device. Background Art

[0002] As the industry pays more and more attention to the security of Voice over Internet Protocol (VOIP), secure and reliable TURN services are widely used, but public TURN services need to face an exponentially growing number of users.

[0003] In the prior art, a TURN server (TURN server) generally uses static account information stored in a database. As the number of users increases and the need to regularly update account passwords increases, the workload of database maintenance is very large and unsafe. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a password authentication method, apparatus and communication method for initiating a call by a terminal device, so as to solve the problem in the prior art that the maintenance of TURN server account and password information is labor-intensive and unsafe.

[0005] In order to solve the above technical problems, the present application embodiment provides a password authentication method, which adopts the following technical solution:

[0006] The configuration server receives a TURN password request sent by the terminal device, wherein the TURN password request includes at least a user name;

[0007] The configuration server generates a first TURN password according to the TURN password request and sends it to the terminal device;

[0008] The TURN server receives a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name, and a random number Nonce value, wherein the TURN allocation request includes at least the user name;

[0009] The TURN server generates a second TURN password according to the TURN allocation request, and calculates a second authentication summary value using the second TURN password, the user name and the Nonce value;

[0010] The TURN server compares the first authentication digest value and the second authentication digest value, and when the two are equal, the authentication is successful.

[0011] Further, the configuration server generates a first TURN password according to the TURN password request and sends the first TURN password to the terminal device specifically includes:

[0012] The configuration server generates the first TURN password according to the user name in the TURN password request, in combination with a shared key and the current UTC time, and sends it to the terminal device.

[0013] Further, the configuration server generates the first TURN password according to the user name in the TURN password request, in combination with the shared key and the current UTC time, including:

[0014] Calculate and obtain the first hash value based on the shared key and the current UTC time;

[0015] Randomly intercept a preset number of bytes from the first hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0016] Calculate and obtain a first value according to the preset number of bytes randomly intercepted and the user name;

[0017] Calculate a SHA256 hash value of the first value to obtain the first TURN password.

[0018] Further, the TURN server generates the second TURN password according to the TURN allocation request, specifically including:

[0019] The TURN server generates the second TURN password according to the user name in the TURN allocation request, in combination with a shared key and a current UTC time.

[0020] Further, the TURN server generates the second TURN password according to the user name in the TURN allocation request, in combination with the shared key and the current UTC time, including:

[0021] Calculate and obtain a second hash value based on the shared key and the current UTC time;

[0022] Randomly intercept a preset number of bytes from the second hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0023] Calculate and obtain a second value according to the preset number of bytes randomly intercepted and the user name;

[0024] Calculate a SHA256 hash value of the second value to obtain the second TURN password.

[0025] Furthermore, after the configuration server receives the TURN password request sent by the terminal device, the method further includes:

[0026] The configuration server randomly generates a user account according to the user name, and sends the user account to the terminal device;

[0027] Correspondingly, the TURN server receives the TURN allocation request sent by the terminal device and the first authentication digest value calculated by the terminal device using the first TURN password, the user name and the random number Nonce value, wherein the TURN allocation request at least includes the user name specifically including:

[0028] The TURN server receives a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request includes at least the user account.

[0029] In order to solve the above technical problems, the embodiment of the present application also provides a password authentication device, which adopts the following technical solution:

[0030] The configuration server is configured to receive a TURN password request sent by a terminal device, wherein the TURN password request includes at least a user name; generate a first TURN password according to the TURN password request and send the first TURN password to the terminal device;

[0031] A TURN server is used to receive a TURN allocation request sent by the terminal device and a first authentication summary value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request at least includes the user name; generate a second TURN password according to the TURN allocation request, and use the second TURN password, the user name and the Nonce value to calculate a second authentication summary value; compare the first authentication summary value and the second authentication summary value, and when the two are equal, the authentication is passed.

[0032] Further, the configuration server includes a first receiving module, a first generating module and a sending module;

[0033] The first receiving module is used to receive a TURN password request sent by a terminal device, wherein the TURN password request includes at least a user name;

[0034] The first generating module is used to generate a first TURN password according to the TURN password request;

[0035] The sending module is used to send the first TURN password to the terminal device.

[0036] Furthermore, the first generating module is specifically configured to generate the first TURN password according to the user name in the TURN password request, in combination with a shared key and a current UTC time, and send the generated first TURN password to the terminal device.

[0037] Further, the first generating module includes a first calculating unit and a first intercepting unit;

[0038] The first calculation unit is used to calculate and obtain a first hash value according to the shared key and the current UTC time;

[0039] The first interception unit is used to randomly intercept a preset number of bytes from the first hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0040] The first calculation unit is further used to calculate a first numerical value based on the preset number of bytes randomly intercepted and the user name; calculate a SHA256 hash value of the first numerical value to obtain the first TURN password.

[0041] Further, the TURN server includes a second receiving module, a second generating module and an authentication module;

[0042] The second receiving module is used to receive a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request at least includes the user name;

[0043] The second generating module is used to generate a second TURN password according to the TURN allocation request, and calculate a second authentication summary value using the second TURN password, the user name and the Nonce value;

[0044] The authentication module is used to compare the first authentication summary value and the second authentication summary value. When the two are equal, the authentication is successful.

[0045] Furthermore, the second generating module is specifically configured to generate the second TURN password according to the user name in the TURN allocation request, in combination with a shared key and a current UTC time.

[0046] Further, the second generating module includes a second calculating unit and a second intercepting unit;

[0047] The second calculation unit is used to calculate and obtain a second hash value according to the shared key and the current UTC time;

[0048] The second interception unit is used to randomly intercept a preset number of bytes from the second hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0049] The second calculation unit is further used to calculate a second value based on the preset number of bytes randomly intercepted and the user name; calculate a SHA256 hash value of the second value to obtain the second TURN password.

[0050] Furthermore, the first generating module is also used to randomly generate a user account according to the user name.

[0051] The present application also provides a communication method for a terminal device to initiate a call, which adopts the following technical solution:

[0052] The first terminal device and the second terminal device respectively send a TURN password request to the configuration server, so that the configuration server generates a first TURN password according to the TURN password request, wherein the TURN password request includes at least a user name;

[0053] The first terminal device and the second terminal device respectively receive the first TURN password sent by the configuration server;

[0054] The first terminal device and the second terminal device respectively send a TURN allocation request and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and the random number Nonce value to the TURN server, wherein the TURN allocation request at least includes the user name, so that the TURN server generates a second TURN password according to the TURN allocation request, and calculates a second authentication digest value using the second TURN password, the user name and the Nonce value, so that the TURN server compares the first authentication digest value with the second authentication digest value, and when the two are equal, the first terminal device and the second terminal device are authenticated;

[0055] When the first terminal device and the second terminal device are respectively authenticated, a Session Initiation Protocol SIP communication is established between the first terminal device and the second terminal device.

[0056] Furthermore, the method further comprises:

[0057] The first terminal device initiates a call to the second terminal device via the SIP server;

[0058] The second terminal responds to the call and communicates with the first terminal device.

[0059] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0060] A computer device is provided, comprising one or more processors; and a memory for storing one or more programs, so that the one or more processors implement any one of the password authentication methods described above.

[0061] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0062] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements any one of the password authentication methods described above.

[0063] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0064] This application receives a TURN password request sent by a terminal device through a configuration server, wherein the TURN password request includes at least a user name; the configuration server generates a first TURN password based on the TURN password request and sends it to the terminal device; the TURN server receives a TURN allocation request sent by the terminal device and a first authentication summary value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request includes at least the user name; the TURN server generates a second TURN password based on the TURN allocation request, and uses the second TURN password, the user name and the Nonce value to calculate a second authentication summary value; the TURN server compares the first authentication summary value and the second authentication summary value, and when the two are equal, the authentication is passed. This application can effectively solve a large number of user account information maintenance problems, avoid a large amount of database maintenance work, and is safe and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0066] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0067] Figure 2is a flow chart of an embodiment of a password authentication method according to the present application;

[0068] Figure 3 is a schematic diagram of the structure of an embodiment of a password authentication device according to the present application;

[0069] Figure 4 is a flow chart of an embodiment of a communication method for initiating a call by a terminal device according to the present application;

[0070] Figure 5 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0071] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0072] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0073] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0074] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0075] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0076] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0077] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0078] It should be noted that the password authentication method provided in the embodiment of the present application is generally executed by a server.

[0079] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0080] Continue to refer Figure 2 , shows a flow chart of an embodiment of a password authentication method according to the present application. The password authentication method comprises the following steps:

[0081] Step 201: The configuration server receives a TURN password request sent by a terminal device, wherein the TURN password request includes at least a user name.

[0082] In this embodiment, the user name is a user name provided by the terminal device.

[0083] Step 202: The configuration server generates a first TURN password according to the TURN password request and sends it to the terminal device.

[0084] In this embodiment, the configuration server dynamically generates the first TURN password according to the user name provided by the terminal device.

[0085] Step 203: The TURN server receives a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name, and a random number Nonce value, wherein the TURN allocation request includes at least the user name.

[0086] Step 204: The TURN server generates a second TURN password according to the TURN allocation request, and calculates a second authentication digest value using the second TURN password, the user name, and the Nonce value.

[0087] In this embodiment, the TURN server dynamically generates a second TURN password according to the user name provided by the terminal device.

[0088] Step 205: The TURN server compares the first authentication digest value and the second authentication digest value. When the two are equal, the authentication is successful.

[0089] In this embodiment, the calculation method of the first TURN password and the second TURN password are the same, and the values ​​are the same. The difference is:

[0090] The first TURN password is calculated by the "configuration server" based on the username in the configuration request from the "end device", combined with the current UTC time and the shared key. The "end device" then uses the first TURN password to calculate the authentication information in the TURN allocation request;

[0091] The second TURN password is calculated by the "Turn server" based on the username in the TURN allocation request from the "terminal device", combined with the current UTC time and the shared key. The TURN server then uses the second password to perform security verification on the TURN allocation request from the "terminal device", where the specific method of security verification MESSAGE-INTEGRITY follows the standard RFC8656.

[0092] This application receives a TURN password request sent by a terminal device through a configuration server, wherein the TURN password request includes at least a user name; the configuration server generates a first TURN password based on the TURN password request and sends it to the terminal device; the TURN server receives a TURN allocation request sent by the terminal device and a first authentication summary value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request includes at least the user name; the TURN server generates a second TURN password based on the TURN allocation request, and uses the second TURN password, the user name and the Nonce value to calculate a second authentication summary value; the TURN server compares the first authentication summary value and the second authentication summary value, and when the two are equal, the authentication is passed. This application can effectively solve a large number of user account information maintenance problems, avoid a large amount of database maintenance work, and is safe and reliable.

[0093] In some optional implementations of this embodiment, the above step 202 configures the server to generate a first TURN password according to the TURN password request and sends it to the terminal device, and the above electronic device may further perform the following steps:

[0094] The configuration server generates the first TURN password according to the user name in the TURN password request, in combination with a shared key and the current UTC time, and sends it to the terminal device.

[0095] In this embodiment, the configuration server uses a two-factor password generation algorithm to dynamically generate a TURN account password, postpones the key generation time to the time point requested by the user, and temporarily calculates the user account information based on the current UTC time (utc timestamp) combined with the user's username. Among them, UTC time (utc) is also known as world unified time, world standard time, and international coordinated time. In this embodiment of the application, the utc timestamp is the number of days from midnight on January 1, 1970 to the current time.

[0096] In some optional implementations of this embodiment, the above steps configure the server to generate the first TURN password according to the user name in the TURN password request, combined with the shared key and the current UTC time, and the above electronic device may further perform the following steps:

[0097] Calculate and obtain the first hash value based on the shared key and the current UTC time;

[0098] Randomly intercept a preset number of bytes from the first hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0099] Calculate and obtain a first value according to the preset number of bytes randomly intercepted and the user name;

[0100] Calculate a SHA256 hash value of the first value to obtain the first TURN password.

[0101] In this embodiment, the shared key is a private shared key that is fixedly configured on the TURN server and the configuration server when the TURN service environment is deployed, and the utc timestamp uses the preset number of days before and after the current utc day to generate the TURN password. Specifically, it can be calculated by the following formula:

[0102] A1 = hmac_sha1 (shared key, utc timestamp); this is a 20-byte data

[0103] B1=4 random bytes are intercepted from A1, wherein the 4 random bytes are the preset days of UTC time;

[0104] C1=user account+B1;

[0105] First TURN password = sha256(C1).

[0106] In some optional implementations of this embodiment, in step 204, the TURN server generates a second TURN password according to the TURN allocation request, and the electronic device may further perform the following steps:

[0107] The TURN server generates the second TURN password according to the user name in the TURN allocation request, in combination with a shared key and a current UTC time.

[0108] In actual use, the TURN server uses a two-factor password generation algorithm to dynamically generate the TURN account password, postpones the key generation time to the time point requested by the user, and temporarily calculates the user account information based on the current UTC time combined with the user's username. It should be noted that the current UTC time here is the same as the current UTC time when the configuration server generates the first TURN password.

[0109] In some optional implementations of this embodiment, the TURN server generates the second TURN password according to the user name in the TURN allocation request, combined with the shared key and the current UTC time, and the electronic device can specifically perform the following steps:

[0110] Calculate and obtain a second hash value based on the shared key and the current UTC time;

[0111] Randomly intercept a preset number of bytes from the second hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0112] Calculate and obtain a second value according to the preset number of bytes randomly intercepted and the user name;

[0113] Calculate a SHA256 hash value of the second value to obtain the second TURN password.

[0114] In this embodiment, the shared key is a private shared key that is fixedly configured on the TURN server and the configuration server when the TURN service environment is deployed, and the utc timestamp uses the preset number of days before and after the current utc day to generate the TURN password. Specifically, it can be calculated by the following formula:

[0115] A2 = hmac_sha1 (shared key, utc timestamp); this is a 20-byte data

[0116] B2=4 random bytes are intercepted from A2, wherein the 4 random bytes are the preset days of UTC time;

[0117] C2=user account+B2;

[0118] Second TURN password = sha256(C2).

[0119] In some optional implementations of this embodiment, after the configuration server receives the TURN password request sent by the terminal device in step 201, the electronic device may further perform the following steps:

[0120] The configuration server randomly generates a user account according to the user name, and sends the user account to the terminal device;

[0121] In this embodiment, since the user account is a random number, the security of the account is further guaranteed.

[0122] In some optional implementations of this embodiment, in step 203, the TURN server receives a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name, and a random number Nonce value, wherein the TURN allocation request includes at least the user name, and the electronic device may further perform the following steps:

[0123] The TURN server receives a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request includes at least the user account.

[0124] In actual use, after the TURN server authenticates the terminal device, the terminal device can establish mutual communication with at least one other terminal device.

[0125] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0126] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0127] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a password authentication device, and the device embodiment is similar to Figure 2 The method embodiments shown correspond.

[0128] like Figure 3 As shown, the password authentication device 300 described in this embodiment includes: a configuration server 301 and a TURN server 302. Among them:

[0129] The configuration server 301 is configured to receive a TURN password request sent by a terminal device, wherein the TURN password request includes at least a user name; generate a first TURN password according to the TURN password request and send the first TURN password to the terminal device;

[0130] The TURN server 302 is used to receive a TURN allocation request sent by the terminal device and a first authentication summary value calculated by the terminal device using the first TURN password, the user name and the random number Nonce value, wherein the TURN allocation request at least includes the user name; generate a second TURN password according to the TURN allocation request, and use the second TURN password, the user name and the Nonce value to calculate a second authentication summary value; compare the first authentication summary value and the second authentication summary value, and when the two are equal, the authentication is passed.

[0131] This application receives a TURN password request sent by a terminal device through a configuration server 301, wherein the TURN password request includes at least a user name; based on the TURN password request, generates a first TURN password and sends it to the terminal device; TURN server 302 receives a TURN allocation request sent by the terminal device and a first authentication summary value calculated by the terminal device using the first TURN password, the user name, and a random number Nonce value, wherein the TURN allocation request includes at least the user name; based on the TURN allocation request, generates a second TURN password, and uses the second TURN password, the user name, and the Nonce value to calculate a second authentication summary value; compares the first authentication summary value and the second authentication summary value, and when the two are equal, the authentication is passed. This application can effectively solve a large number of user account information maintenance problems, avoid a large amount of database maintenance work, and is safe and reliable.

[0132] In some optional implementations of this embodiment, the configuration server 301 includes a first receiving module 3011, a first generating module 3012 and a sending module 3013;

[0133] The first receiving module 3011 is used to receive a TURN password request sent by a terminal device, wherein the TURN password request includes at least a user name;

[0134] The first generating module 3012 is used to generate a first TURN password according to the TURN password request;

[0135] The sending module 3013 is used to send the first TURN password to the terminal device.

[0136] In some optional implementations of this embodiment, the first generating module 3012 is specifically configured to generate the first TURN password according to the user name in the TURN password request, in combination with a shared key and the current UTC time, and send the generated first TURN password to the terminal device.

[0137] In this embodiment, the configuration server uses a two-factor password generation algorithm to dynamically generate a TURN account password, postpones the key generation time to the time point requested by the user, and temporarily calculates the user account information based on the current UTC time (utc timestamp) combined with the user's username. Among them, UTC time (utc) is also known as world unified time, world standard time, and international coordinated time. In this embodiment of the application, the utc timestamp is the number of days from midnight on January 1, 1970 to the current time.

[0138] In some optional implementations of this embodiment, the first generating module 3012 includes a first calculating unit 30121 and a first intercepting unit 30122;

[0139] The first calculation unit 30121 is used to calculate and obtain a first hash value according to the shared key and the current UTC time;

[0140] The first interception unit 30122 is used to randomly intercept a preset number of bytes from the first hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0141] The first calculation unit 30121 is further used to calculate a first numerical value based on the preset number of bytes randomly intercepted and the user name; calculate a SHA256 hash value of the first numerical value to obtain the first TURN password.

[0142] In this embodiment, the shared key is a private shared key that is fixedly configured on the TURN server and the configuration server when the TURN service environment is deployed, and the utc timestamp uses the preset number of days before and after the current utc day to generate the TURN password. Specifically, it can be calculated by the following formula:

[0143] A1 = hmac_sha1 (shared key, utc timestamp); this is a 20-byte data

[0144] B1=4 random bytes are intercepted from A1, wherein the 4 random bytes are the preset days of UTC time;

[0145] C1=user account+B1;

[0146] First TURN password = sha256(C1).

[0147] In some optional implementations of this embodiment, the TURN server 302 includes a second receiving module 3021, a second generating module 3022 and an authentication module 3023;

[0148] The second receiving module 3021 is used to receive a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request at least includes the user name;

[0149] The second generating module 3022 is used to generate a second TURN password according to the TURN allocation request, and calculate a second authentication summary value using the second TURN password, the user name and the Nonce value;

[0150] The authentication module 3023 is used to compare the first authentication summary value and the second authentication summary value. When the two are equal, the authentication is successful.

[0151] In some optional implementations of this embodiment, the second generating module 3022 is specifically configured to generate the second TURN password according to the user name in the TURN allocation request, in combination with a shared key and a current UTC time.

[0152] In actual use, the TURN server uses a two-factor password generation algorithm to dynamically generate the TURN account password, postpones the key generation time to the time point requested by the user, and performs a temporary calculation based on the current UTC time and the user's username to obtain the user account information.

[0153] In some optional implementations of this embodiment, the second generating module 3022 includes a second calculating unit 30221 and a second intercepting unit 30222;

[0154] The second calculation unit 30221 is used to calculate and obtain a second hash value according to the shared key and the current UTC time;

[0155] The second interception unit 30222 is used to randomly intercept a preset number of bytes from the second hash value, wherein the preset number of bytes is a preset number of days of the current UTC time;

[0156] The second calculation unit 30221 is further used to calculate a second value based on the preset number of bytes randomly intercepted and the user name; calculate a SHA256 hash value of the second value to obtain the second TURN password.

[0157] In this embodiment, the shared key is a private shared key that is fixedly configured on the TURN server and the configuration server when the TURN service environment is deployed, and the utc timestamp uses the preset number of days before and after the current utc day to generate the TURN password. Specifically, the second TURN password can be calculated by the following formula:

[0158] A2 = hmac_sha1 (shared key, utc timestamp); this is a 20-byte data

[0159] B2=4 random bytes are intercepted from A2, wherein the 4 random bytes are the preset days of UTC time;

[0160] C2=user account+B2;

[0161] Second TURN password = sha256(C2).

[0162] In some optional implementations of this embodiment, the first generating module 3012 is further configured to randomly generate a user account according to the user name.

[0163] In this embodiment, since the user account is a random number, the security of the account is further guaranteed.

[0164] Further references Figure 4 , as a response to the above Figure 2 The present application provides an embodiment of a communication method for a terminal device to initiate a call. Figure 2 The communication method for initiating a call by a terminal device comprises the following steps:

[0165] Step 401: The first terminal device and the second terminal device respectively send a TURN password request to a configuration server, so that the configuration server generates a first TURN password according to the TURN password request, wherein the TURN password request includes at least a user name;

[0166] Step 402: The first terminal device and the second terminal device respectively receive the first TURN password sent by the configuration server;

[0167] Step 403: the first terminal device and the second terminal device respectively send a TURN allocation request and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and the random number Nonce value to the TURN server, wherein the TURN allocation request at least includes the user name, so that the TURN server generates a second TURN password according to the TURN allocation request, and calculates a second authentication digest value using the second TURN password, the user name and the Nonce value, so that the TURN server compares the first authentication digest value with the second authentication digest value, and when the two are equal, the first terminal device and the second terminal device are authenticated;

[0168] Step 404: When the first terminal device and the second terminal device are respectively authenticated, a Session Initiation Protocol (SIP) communication is established between the first terminal device and the second terminal device.

[0169] In some optional implementations of this embodiment, in the above step 404, when the first terminal device and the second terminal device are respectively authenticated, after establishing a session initiation protocol SIP communication between the first terminal device and the second terminal device, the above electronic device may further perform the following steps:

[0170] The first terminal device initiates a call to the second terminal device via the SIP server;

[0171] The second terminal responds to the call and communicates with the first terminal device.

[0172] To solve the above technical problems, the present application also provides a computer device. Figure 5 , Figure 5 This is a basic structural block diagram of the computer device in this embodiment.

[0173] The computer device 5 includes a memory 51, a processor 52, and a network interface 53 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 5 with components 51-53, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0174] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0175] The memory 51 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 51 can be an internal storage unit of the computer device 5, such as a hard disk or memory of the computer device 5. In other embodiments, the memory 51 can also be an external storage device of the computer device 5, such as a plug-in hard disk equipped on the computer device 5, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. Of course, the memory 51 can also include both the internal storage unit of the computer device 5 and its external storage device. In this embodiment, the memory 51 is generally used to store the operating system and various application software installed on the computer device 5, such as the program code of the password authentication method, etc. In addition, the memory 51 can also be used to temporarily store various types of data that have been output or are to be output.

[0176] The processor 52 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 52 is generally used to control the overall operation of the computer device 5. In this embodiment, the processor 42 is used to run the program code stored in the memory 41 or process data, such as running the program code of the password authentication method.

[0177] The network interface 53 may include a wireless network interface or a wired network interface. The network interface 53 is generally used to establish a communication connection between the computer device 5 and other electronic devices.

[0178] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores a backup program between communication devices, and the backup program between communication devices can be executed by at least one processor so that the at least one processor performs the steps of the password authentication method as described above.

[0179] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0180] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A password authentication method, characterized in that: The steps include: The configuration server receives a TURN password request sent by the terminal device, wherein the TURN password request includes at least a user name; The configuration server generates a first TURN password according to the TURN password request and sends it to the terminal device; The TURN server receives a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name, and a random number Nonce value, wherein the TURN allocation request includes at least the user name; The TURN server generates a second TURN password according to the TURN allocation request, and calculates a second authentication summary value using the second TURN password, the user name and the Nonce value; The TURN server compares the first authentication digest value and the second authentication digest value, and when the two are equal, the authentication is successful; The configuration server generating, according to the TURN password request, a first TURN password and sending it to the terminal device specifically includes: The configuration server generates the first TURN password according to the user name in the TURN password request, combined with the shared key and the current UTC time, and sends it to the terminal device; The configuration server generates the first TURN password according to the user name in the TURN password request, in combination with a shared key and the current UTC time, including: Calculate and obtain the first hash value based on the shared key and the current UTC time; Randomly intercept a preset number of bytes from the first hash value, wherein the preset number of bytes is a preset number of days of the current UTC time; Calculate and obtain a first value according to the preset number of bytes randomly intercepted and the user name; Calculate the SHA256 hash value of the first value to obtain the first TURN password; The TURN server generating the second TURN password according to the TURN allocation request specifically includes: The TURN server generates the second TURN password according to the user name in the TURN allocation request, in combination with a shared key and the current UTC time; The TURN server generates the second TURN password according to the user name in the TURN allocation request, in combination with a shared key and the current UTC time, including: Calculate and obtain a second hash value based on the shared key and the current UTC time; Randomly intercept a preset number of bytes from the second hash value, wherein the preset number of bytes is a preset number of days of the current UTC time; Calculate and obtain a second value according to the preset number of bytes randomly intercepted and the user name; Calculate a SHA256 hash value of the second value to obtain the second TURN password.

2. The password authentication method according to claim 1, characterized in that: After the configuration server receives the TURN password request sent by the terminal device, the method further includes: The configuration server randomly generates a user account according to the user name, and sends the user account to the terminal device; Correspondingly, the TURN server receives the TURN allocation request sent by the terminal device and the first authentication digest value calculated by the terminal device using the first TURN password, the user name and the random number Nonce value, wherein the TURN allocation request at least includes the user name specifically including: The TURN server receives a TURN allocation request sent by the terminal device and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request includes at least the user account.

3. A password authentication device, characterized in that: The password authentication device implements the password authentication method according to claim 1 or 2 when it is running, and the password authentication device includes: The configuration server is configured to receive a TURN password request sent by a terminal device, wherein the TURN password request includes at least a user name; generate a first TURN password according to the TURN password request and send the first TURN password to the terminal device; A TURN server is used to receive a TURN allocation request sent by the terminal device and a first authentication summary value calculated by the terminal device using the first TURN password, the user name and a random number Nonce value, wherein the TURN allocation request at least includes the user name; generate a second TURN password according to the TURN allocation request, and use the second TURN password, the user name and the Nonce value to calculate a second authentication summary value; compare the first authentication summary value and the second authentication summary value, and when the two are equal, the authentication is passed.

4. The password authentication device according to claim 3, characterized in that: The configuration server includes a first receiving module, a first generating module and a sending module; The first receiving module is used to receive a TURN password request sent by a terminal device, wherein the TURN password request includes at least a user name; The first generating module is used to generate a first TURN password according to the TURN password request; The sending module is used to send the first TURN password to the terminal device.

5. A communication method for a terminal device to initiate a call, characterized in that: The communication method as claimed in claim 1 or 2, wherein the communication method further comprises the following steps: The first terminal device and the second terminal device respectively send a TURN password request to the configuration server, so that the configuration server generates a first TURN password according to the TURN password request, wherein the TURN password request includes at least a user name; The first terminal device and the second terminal device respectively receive the first TURN password sent by the configuration server; The first terminal device and the second terminal device respectively send a TURN allocation request and a first authentication digest value calculated by the terminal device using the first TURN password, the user name and the random number Nonce value to the TURN server, wherein the TURN allocation request at least includes the user name, so that the TURN server generates a second TURN password according to the TURN allocation request, and calculates a second authentication digest value using the second TURN password, the user name and the Nonce value, so that the TURN server compares the first authentication digest value with the second authentication digest value, and when the two are equal, the first terminal device and the second terminal device are authenticated; When the first terminal device and the second terminal device are respectively authenticated, a Session Initiation Protocol SIP communication is established between the first terminal device and the second terminal device.

6. The communication method for initiating a call by a terminal device according to claim 5, characterized in that: The method further comprises: The first terminal device initiates a call to the second terminal device via the SIP server; The second terminal responds to the call and communicates with the first terminal device.

Images