A login authentication method and device

Abstract

The application provides a login authentication method and device. The method is applied to a terminal device, and first, a key acquisition request is sent to a device management server based on an obtained communication token in response to a received password-free login starting instruction. Then, an authentication key returned by the device management server based on the key acquisition request is received and stored. Next, a login authentication request sent by the device management server based on a first authentication token is received and responded to. The first authentication token is obtained by the device management server by processing the authentication key according to preset processing conditions. Finally, a login authentication result is generated according to the first authentication token and a second authentication token. The method uses the first authentication token and the second authentication token generated by the device management server and the terminal device respectively to perform login authentication, avoids complex password input authentication operations, and improves login efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a login authentication method and device. BACKGROUND

[0002] In order to facilitate the management of devices, a management platform capable of managing terminal devices on a large scale is currently established. The management platform can be connected to a large number of terminal devices, and through the management platform, account management, firmware upgrade, device monitoring, intelligent alarm, statistical analysis and other management operations can be performed on the terminal devices.

[0003] When a management personnel manages the terminal devices through the management platform, it is inevitable to log in to the managed terminal devices. However, since a password needs to be input each time the terminal device is logged in, and as more and more terminal devices are introduced into the management platform, the device passwords that the management personnel needs to remember are also increasing, which is prone to cause the device password to be unmatched with the pre-logged terminal device, thereby resulting in a complex authentication operation and low login efficiency in the current login authentication process.

[0004] Therefore, there is a technical problem of complex authentication operation and low login efficiency in the current login authentication process, which needs to be improved. SUMMARY

[0005] The present application provides a login authentication method and device for alleviating the technical problem of complex authentication operation and low login efficiency in the current login authentication process.

[0006] In order to solve the above technical problem, the present application provides the following technical solutions:

[0007] The present application provides a login authentication method applied to a terminal device, which comprises the following steps:

[0008] In response to a received password-free login start instruction, a communication token is obtained, and a key acquisition request is sent to a device management server based on the communication token;

[0009] An authentication key returned by the device management server based on the key acquisition request is received and stored; wherein the authentication key is generated based on a preset key generation algorithm after the device management server authenticates the key acquisition request;

[0010] A login authentication request sent by the device management server based on a first authentication token is received; wherein the first authentication token is obtained by processing the authentication key according to a preset processing condition by the device management server;

[0011] In response to the login authentication request, the authentication key is processed according to the preset processing condition to obtain a second authentication token;

[0012] According to the first authentication token and the second authentication token, a login authentication result is generated.

[0013] Meanwhile, the application further provides a login authentication method, applied to a device management server, the method comprising:

[0014] receiving a key acquisition request sent by a terminal device based on a communication token;

[0015] authenticating the key acquisition request, and after the key acquisition request authentication passes, generating and sending an authentication key to the terminal device based on a preset key generation algorithm;

[0016] processing the authentication key according to a preset processing condition to obtain a first authentication token;

[0017] sending a login authentication request to the terminal device based on the first authentication token.

[0018] In addition, the application further provides a login authentication method, applied to a device management system, the device management system comprising a device management server and at least one terminal device, the method comprising:

[0019] the terminal device, in response to a received password-free login start instruction, acquires a communication token, and sends a key acquisition request to the device management server based on the communication token;

[0020] the device management server receives the key acquisition request, authenticates the key acquisition request, and after the key acquisition request authentication passes, generates and sends an authentication key to the terminal device based on a preset key generation algorithm, processes the authentication key according to a preset processing condition to obtain a first authentication token, and sends a login authentication request to the terminal device based on the first authentication token;

[0021] the terminal device receives and stores the authentication key, receives and responds to the login authentication request, processes the authentication key according to the preset processing condition to obtain a second authentication token, and generates a login authentication result according to the first authentication token and the second authentication token.

[0022] Correspondingly, the application further provides a login authentication device, applied to a terminal device, the device comprising:

[0023] a key request sending module, configured to, in response to a received password-free login start instruction, acquire a communication token, and send a key acquisition request to a device management server based on the communication token;

[0024] The key receiving module is configured to receive and store an authentication key returned by the device management server based on the key acquisition request; wherein the authentication key is generated by the device management server based on a preset key generation algorithm after the device management server authenticates the key acquisition request successfully;

[0025] The authentication request receiving module is configured to receive a login authentication request sent by the device management server based on a first authentication token; wherein the first authentication token is obtained by processing the authentication key by the device management server according to a preset processing condition;

[0026] The authentication request response module is configured to respond to the login authentication request, process the authentication key according to the preset processing condition, and obtain a second authentication token;

[0027] The authentication result generating module is configured to generate a login authentication result according to the first authentication token and the second authentication token.

[0028] Correspondingly, the application further provides a login authentication device applied to a device management server, which comprises:

[0029] The key request receiving module is configured to receive a key acquisition request sent by a terminal device based on a communication token;

[0030] The key sending module is configured to authenticate the key acquisition request, and generate and send an authentication key to the terminal device based on a preset key generation algorithm after the key acquisition request is authenticated successfully;

[0031] The authentication token generating module is configured to process the authentication key according to a preset processing condition, and obtain a first authentication token;

[0032] The authentication request sending module is configured to send a login authentication request to the terminal device based on the first authentication token.

[0033] Meanwhile, the application provides an electronic device comprising a processor and a memory, wherein the memory is configured to store a computer program, and the processor is configured to run the computer program in the memory to execute the steps in the above login authentication method.

[0034] In addition, the application further provides a computer readable storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the steps in the above login authentication method.

[0035] Beneficial effects: the application provides a login authentication method and device, through which the entire login authentication process does not need the administrator to remember the device password, avoiding the complicated password input authentication link, realizing the purpose of quick login of the terminal device by the device management server, improving the login efficiency, and the entire authentication process is built-in, greatly protecting the security of login. BRIEF DESCRIPTION OF DRAWINGS

[0036] The technical solutions and other beneficial effects of the application will be apparent through the following detailed description of the specific embodiments of the application combined with the drawings.

[0037] Figure 1 is a networking schematic diagram of the device management system provided by the embodiments of the application.

[0038] Figure 2 is a flowchart of the login authentication method provided by the embodiments of the application.

[0039] Figure 3 is another flowchart of the login authentication method provided by the embodiments of the application.

[0040] Figure 4 is an interaction diagram of the login authentication method provided by the embodiments of the application.

[0041] Figure 5 is a flowchart of the token authentication method provided by the embodiments of the application.

[0042] Figure 6 is a structural schematic diagram of the login authentication device provided by the embodiments of the application.

[0043] Figure 7 is another structural schematic diagram of the login authentication device provided by the embodiments of the application.

[0044] Figure 8 is a structural schematic diagram of the electronic device provided by the embodiments of the application. DETAILED DESCRIPTION

[0045] The technical solutions and other beneficial effects of the application will be apparent through the following detailed description of the specific embodiments of the application combined with the drawings.

[0046] The terms "comprising" and "having" and any variations thereof in the specification and claims of the application are intended to cover a non-exclusive inclusion; the division of modules appearing in the application is only a logical division, and in actual application, there can be another division manner, for example, multiple modules can be combined or integrated in another system, or some features can be ignored or not executed.

[0047] In the application, the password-free login starting instruction is an instruction sent by the administrator through the terminal device, which can be triggered by the administrator through the password-free login switch of the terminal device, or triggered by the administrator through a specific code.

[0048] In the application, the communication token refers to an identity authentication identifier used by the terminal device to log in to the device management server. Specifically, the terminal device carries the communication token when logging in to the device management server, and the device management server checks the validity of the communication token. If valid, the terminal device can communicate with the device management server, and if invalid (for example, the communication token is incorrect or expired), the device management server refuses to communicate with the terminal device.

[0049] In the application, the key acquisition request can be a request sent by the terminal device to the device management server through the Https protocol. The use of the Https protocol for transmission can effectively resist man-in-the-middle attacks, message monitoring attacks, and message tampering attacks.

[0050] In the application, the preset key generation algorithm can be a universally unique identifier algorithm (UUID algorithm), and the authentication key can be a globally unique identifier generated based on the UUID algorithm.

[0051] In the application, the preset processing condition includes a double-factor algorithm, a splicing condition, an encryption algorithm, and a result conversion condition.

[0052] In the application, the login authentication result includes matching of the first authentication token and the second authentication token, authentication passing, and login success; and the first authentication token and the second authentication token do not match, authentication does not pass, and login fails.

[0053] The application provides a login authentication method and device.

[0054] Please refer to Figure 1 , Figure 1 The application provides a device management system networking schematic diagram, as shown in Figure 1 The device management system at least includes a terminal device 101 and a device management server 102, wherein:

[0055] The terminal device 101 and the device management server 102 can be communicatively connected through an IP network to realize information interaction. In addition, the link type of the communication connection can include wired, wireless communication link or optical cable, etc., which is not limited in the present application.

[0056] The terminal device 101 can be an IP multimedia video phone, a smart video terminal device, a converged communication platform, etc.

[0057] The device management server 102 can be a stand-alone server, or a server network or a server cluster composed of servers. For example, the server described in the present application includes but is not limited to a computer, a network host, a database server and an application server, or a cloud server composed of multiple servers, wherein the cloud server is composed of a large number of computers or network servers based on cloud computing. The device management server 102 can be regarded as a comprehensive service platform for large-scale management of terminal devices 101, which can be connected to a large number of terminal devices 101, support cloud deployment of terminal devices 101, account management, firmware upgrade, device monitoring, intelligent alarm and statistical analysis, and can manage terminal devices 101 individually or in batches, support data collection of terminal devices to the cloud, etc.

[0058] The present application provides a device management system, which includes a device management server and at least one terminal device. Specifically, the terminal device first responds to the received password-free login start instruction to obtain a communication token, and sends a key acquisition request to the device management server based on the communication token. Then, the device management server receives the key acquisition request, authenticates the key acquisition request, generates and sends an authentication key to the terminal device based on a preset key generation algorithm after the authentication of the key acquisition request is passed, and processes the authentication key according to a preset processing condition to obtain a first authentication token, and sends a login authentication request to the terminal device based on the first authentication token. Then, the terminal device receives and stores the authentication key from the device management server, and receives and responds to the login authentication request sent by the device management server, processes the authentication key according to the preset processing condition to obtain a second authentication token. Finally, the terminal device generates a login authentication result according to the first authentication token and the second authentication token. If the first authentication token and the second authentication token match, the authentication is passed, the device management server successfully logs in the terminal device, and can obtain the management right of the terminal device to manage the terminal device. If the first authentication token and the second authentication token do not match, the authentication is not passed, the device management server fails to log in the terminal device, and cannot manage the terminal device.

[0059] In the above login authentication process, the terminal device obtains the authentication key by sending a key acquisition request to the device management server, the device management server and the terminal device save the authentication key at the same time, and process the authentication key according to the same preset processing condition, respectively obtain the first authentication token and the second authentication token, and verify the first authentication token and the second authentication token through the terminal device instead of manually inputting the password. The entire login authentication process does not require the administrator to remember the device password, avoiding the complex password input authentication link. The device management server realizes one-key security and easy login of the managed terminal device through the password-free authentication mechanism, greatly facilitates the administrator to easily manage and solve the device problem, saves time and labor cost. Compared with the conventional account password login, the present application does not need to obtain the account password every time, and the authorization is permanently valid once opened. Moreover, the ordinary account password is easy to be leaked, and the present application greatly guarantees the security of login by embedding the verification process.

[0060] It should be noted that, Figure 1 The networking diagram shown is only an example, and the servers, terminals, devices and scenarios described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems as the system evolves and new business scenarios appear. The following will be described in detail. It should be noted that the description order of the following embodiments does not limit the preferred order of the embodiments.

[0061] In summary, the networking diagram of the device management system is shown in the above, Figure 2 The login authentication method provided by the embodiments of the present application is a process schematic diagram, which is applied to a terminal device. As shown in Figure 2 The login authentication method provided by the embodiments of the present application is a process schematic diagram, which is applied to a terminal device. As shown in Figure 2 The login authentication method provided by the embodiments of the present application is a process schematic diagram, which is applied to a terminal device. As shown in

[0062] S201: In response to the received password-free login start instruction, obtain a communication token, and send a key acquisition request to the device management server based on the communication token.

[0063] In an embodiment, the communication token is issued by the device management server according to the relevant attribute information of the terminal device, and the specific steps include: in response to the received password-free login start instruction, obtaining the certificate information, device identifier and device password of the terminal device; wherein the device identifier and device password are assigned to the terminal device by the device management server; sending a token acquisition request to the device management server according to the certificate information, device identifier and device password; receiving the communication token returned by the device management server based on the token acquisition request; and sending a key acquisition request to the device management server based on the communication token. Wherein the password-free login start instruction is an instruction issued by the administrator through the terminal device, which can be triggered by the administrator by touching the password-free login switch of the terminal device, or by the administrator through a specific code; the certificate information of the terminal device is stored locally, which includes a public key, and the device identifier (Client_id, also known as client id) and device password (Client_secret, also known as client password) are assigned by the device management server according to the device information.

[0064] Specifically, the terminal device carries the local certificate information and the device identifier (Client_id, also known as client id) and device password (Client_secret, also known as client password) assigned by the device management server to obtain the communication token (Token) used for each request authentication from the device management server. After the device management server authenticates the device identifier (Client_id) and device password (Client_secret), it returns the communication token (Token) to the terminal device, and the terminal device sends a request to the device management server in the future, all carrying the communication token (Token) to pass the authentication of the device management server. Therefore, when the terminal device requests to obtain the authentication key (Secret_key) from the device management server, it sends a key acquisition request to the device management server by carrying the communication token (Token); wherein the key acquisition request is sent based on the Https protocol, and the transmission using the Https protocol can effectively resist man-in-the-middle attacks, message monitoring attacks and message tampering attacks, etc., and can avoid the problem of authentication key leakage.

[0065] S202: receiving and storing the authentication key returned by the device management server based on the key acquisition request; wherein the authentication key is generated by the device management server based on a preset key generation algorithm after the key acquisition request is authenticated.

[0066] The device management server, after receiving the key acquisition request sent by the terminal device, first needs to perform permission authentication on the key acquisition request. After the permission authentication passes, the device management server generates an authentication key (i.e., Secret_key) based on a preset key generation algorithm and sends the authentication key to the terminal device. The terminal device saves the received authentication key (i.e., Secret_key) in a database. The detailed steps of the device management server processing the key acquisition request will be described below and will not be repeated here.

[0067] In an embodiment, after receiving the authentication key returned by the device management server, the terminal device also needs to copy the user permissions of the local account that has enabled the password-free login. The specific steps include: creating a password-free default user in the local user list of the terminal device and adding user information of the password-free default user in the database of the terminal device; acquiring and copying the device operation permissions of the administrator account to the user information of the password-free default user; wherein the administrator account is an account that has enabled password-free login. The user information can include user name, creation time, validity period, and operation permissions, etc.

[0068] Specifically, the terminal device first adds a password-free default user (remote user) in the local user list and adds user information (such as user name, creation time, validity period, and operation permissions, etc.) of the password-free default user (remote user) in the database of the terminal device. Then, the terminal device reads the operation permissions in the user information of the administrator account (admin) that has enabled password-free login from the local database and copies the operation permissions of the administrator account (admin) to the user information in the database corresponding to the password-free default user (remote user). In other words, the password-free default user (remote user) is a mirror of the administrator account (admin). Through the copying operation, the password-free default user (remote user) has all the operation permissions of the administrator account (admin). After the device management server successfully logs in to the terminal device, the device management server can directly manage the terminal device according to the operation permissions of the password-free default user. The password-free default user (remote user) is the device management server that pre-logs in the terminal device.

[0069] S203: receiving a login authentication request sent by the device management server based on the first authentication token; wherein the first authentication token is obtained by the device management server processing the authentication key according to a preset processing condition.

[0070] The device management server, after receiving the key acquisition request sent by the terminal device, needs to generate a first authentication token (i.e., TokenA) by using the authentication key (i.e., Secret_key) in addition to returning the authentication key (i.e., Secret_key), and send a login authentication request carrying the first authentication token (i.e., TokenA) to the terminal device, so as to request a login operation. The login authentication request is sent based on the Https protocol.

[0071] It should be noted that the specific steps of generating the first authentication token by the device management server will be described below, and will not be described here.

[0072] S204: In response to the login authentication request, the authentication key is processed according to a preset processing condition to obtain a second authentication token.

[0073] In an embodiment, the preset processing condition includes a double-factor algorithm, a splicing condition, an encryption algorithm, and a result conversion condition, and the specific steps of processing the authentication key according to the preset processing condition include: in response to the login authentication request, obtaining a first time factor of the terminal device; performing double-factor calculation on the first time factor and the authentication key according to the double-factor algorithm in the preset processing condition to obtain a first calculation result; splicing the authentication key and the first calculation result according to the splicing condition in the preset processing condition to obtain a first splicing result; encrypting the first splicing result according to the encryption algorithm in the preset processing condition to obtain a first encryption result; and converting the first encryption result according to the result conversion condition in the preset processing condition to obtain the second authentication token. The first time factor is a time variable calculated according to a window period and a current timestamp of the terminal device. It should be noted that the current timestamp of the terminal device is the time in the Universal Time Coordinated (UTC time).

[0074] Specifically, the time window of the double factor in the double-factor algorithm is set to 10 minutes, the device end sets the check window size to 3 windows, and the maximum allowed time offset can be set to 30 minutes. Then, the first time factor and the authentication key (i.e., Secret_key) are double-factor calculated to obtain a 6-digit number (i.e., the first calculation result). Then, the 6-digit number (i.e., the first calculation result) is spliced with the authentication key (i.e., Secret_key) to obtain a first splicing result (i.e., fcode_secret_key). Then, the first splicing result (i.e., fcode_secret_key) is encrypted by the SHA256 encryption algorithm to obtain a first encryption result. Finally, the first encryption result is converted to lowercase by the result conversion condition to obtain a second authentication token (i.e., TokenB).

[0075] It should be noted that the device management server and the clock of the terminal device (i.e. UTC time) need to be consistent.

[0076] S205: generating a login authentication result according to the first authentication token and the second authentication token.

[0077] The terminal device generates a login authentication result of the device management server logging into the terminal device by comparing whether the first authentication token (i.e. TokenA) sent by the device management server and the second authentication token (i.e. TokenB) generated locally match. If they match, the login authentication result is: login success, at this time, the terminal device allows the device management server to log in and accept the management of the device management server; if they do not match, the login authentication result is: login failure.

[0078] In the present application, the terminal device obtains the authentication key by sending a key acquisition request to the device management server, and verifies the first authentication token and the second authentication token generated based on the authentication key instead of manually inputting a password, so that the entire login authentication process does not require the administrator to remember the device password, avoiding the complex password input authentication link. Compared with the conventional account password login, the present application does not need to obtain the account password every time it logs in, and once the authorization is opened, it is permanently valid. Moreover, the ordinary account password is easy to leak, and the present application greatly guarantees the security of login by embedding the verification process.

[0079] Please refer to Figure 3 , Figure 3 is another flowchart of the login authentication method provided by the embodiment of the present application, as shown in Figure 3 The embodiment of the present application provides a login authentication method, which is embodied on the device management server side and includes at least the following steps:

[0080] S301: receiving a key acquisition request sent by the terminal device based on a communication token.

[0081] In one embodiment, before receiving the key acquisition request sent by the terminal device, a communication token needs to be issued to the terminal device, so that the terminal device can send a request to the device management server, and the specific steps include: configuring and sending the device identifier and the device password of the terminal device to the terminal device; receiving a token acquisition request sent by the terminal device based on the certificate information, the device identifier and the device password; in response to the token acquisition request, determining and sending a communication token to the terminal device according to the certificate information, the device identifier and the device password.

[0082] The device management server can be regarded as a comprehensive service platform for managing terminal devices on a large scale. A management personnel can manage the terminal devices by operating the device management server. Therefore, the management personnel can configure the device identifier and the device password of the terminal device for pre-registration / pre-management by operating the device management server, send the device identifier and the device password to the terminal device for storage after the configuration is completed, and verify the public key, the device identifier and the device password in the certificate information sent by the terminal device after receiving the token acquisition request sent by the terminal device carrying the certificate information, the device identifier (Client_id, i.e., client id) and the device password (Client_secret, i.e., client password). If the verification is passed, the communication token (i.e., Token) is returned to the terminal device. The terminal device saves the communication token (i.e., Token) locally. In the subsequent request, the communication token (i.e., Token) is carried. The device management server checks the communication token (i.e., Token) carried in the subsequent request. If the communication token (i.e., Token) is valid, the request is passed. If the communication token (i.e., Token) is invalid, the request is rejected.

[0083] S302: The key acquisition request is authenticated. After the key acquisition request is authenticated, an authentication key is generated based on a preset key generation algorithm and sent to the terminal device.

[0084] The key acquisition request can be sent based on the Https protocol. According to the step in S301, the terminal device has acquired the communication token (i.e., Token) and sent the key acquisition request carrying the communication token (i.e., Token) to the device management server. At this time, the device management server needs to first authenticate the authority of the key acquisition request, that is, to authenticate the authority by verifying the communication token (i.e., Token). After the device management server authenticates that the key acquisition request has the authority, an authentication key (i.e., Secret_key) is generated based on a preset key generation algorithm, and the authentication key (i.e., Secret_key) is sent to the terminal device. The preset key generation algorithm can be a universally unique identifier algorithm (UUID algorithm), and the authentication key (i.e., Secret_key) can be a globally unique identifier generated based on the UUID algorithm.

[0085] S303: The authentication key is processed according to a preset processing condition to obtain a first authentication token.

[0086] It should be noted that the preset processing condition set in the device management server is consistent with the preset processing condition set in the terminal device. In addition, the clocks (i.e., UTC time) of the two are consistent.

[0087] In an embodiment, the preset processing condition includes a two-factor algorithm, a splicing condition, an encryption algorithm, and a result conversion condition, and the specific steps of processing the authentication key according to the preset processing condition include: obtaining a second time factor of the device management server; performing two-factor calculation on the second time factor and the authentication key according to the two-factor algorithm in the preset processing condition to obtain a second calculation result; splicing the authentication key and the second calculation result according to the splicing condition in the preset processing condition to obtain a second splicing result; encrypting the second splicing result according to the encryption algorithm in the preset processing condition to obtain a second encryption result; and converting the second encryption result according to the result conversion condition in the preset processing condition to obtain a first authentication token. The second time factor is a time variable calculated according to a window period and a current timestamp of the device management server.

[0088] Specifically, the time window of the two factors in the two-factor algorithm is set to 10 minutes, the device end sets the check window size to 3 windows, so the maximum time offset allowed is 30 minutes, the device management server performs two-factor calculation on the second time factor and the authentication key (i.e. Secret_key), and a number will be obtained after calculation. If the number is less than 6 digits, 0 is added in front of the number until a 6-digit number is obtained (for example, the two-factor calculation result is 6555, and 0 is added in front of the number to make it 006555), and the 6-digit number is the second calculation result. Then, the 6-digit number (i.e. the second calculation result) is spliced with the authentication key (i.e. Secret_key) to obtain the second splicing result (i.e. fcode_secret_key’), and then the second splicing result (i.e. fcode_secret_key’) is encrypted by the SHA256 encryption algorithm to obtain the second encryption result. Finally, the second encryption result is converted to lowercase by the result conversion condition to obtain the first authentication token (i.e. TokenA).

[0089] S304: Send a login authentication request to the terminal device based on the first authentication token.

[0090] The device management server sends a login authentication request to the device carrying the first authentication token (i.e. TokenA) to request a login operation, so that the terminal device authenticates the first authentication token (i.e. TokenA). The login authentication request can be sent based on the Https protocol, and the transmission using the Https protocol can effectively resist man-in-the-middle attacks, message listening attacks, and message tampering attacks, effectively ensuring the security of the device management server logging into the terminal device. At the same time, the first authentication token is sent to the terminal device for authentication to realize a password-free authentication mechanism, so that the device management server can realize one-key security and easy login to the managed terminal device.

[0091] Specifically, asFigure 4 As shown, Figure 4 An interaction diagram of a login authentication method provided by an embodiment of the present application, the method comprising at least the following steps:

[0092] S401: The device management server 102 configures and sends a device identifier and a device password of a terminal device to the terminal device 101.

[0093] The device management server can be regarded as a comprehensive service platform for managing terminal devices on a large scale. A manager can configure a device identifier and a device password of a terminal device to be pre-logged / pre-managed by operating the device management server, and send the device identifier and the device password to the terminal device for storage after the configuration is completed.

[0094] S402: The terminal device 101 acquires certificate information, a device identifier, and a device password in response to a received password-free login start instruction.

[0095] The password-free login start instruction is an instruction issued by the manager through the terminal device. The instruction can be triggered by the manager touching a password-free login switch of the terminal device, or triggered by the manager through a specific code.

[0096] S403: The terminal device 101 sends a token acquisition request to the device management server 102 according to the certificate information, the device identifier, and the device password.

[0097] The terminal device carries local certificate information, a device identifier (Client_id, i.e., client id) and a device password (Client_secret, i.e., client password) allocated by the device management server to send a token acquisition request to the device management server, to request to acquire a communication token (i.e., Token) used for each authentication.

[0098] S404: The device management server 102 receives and responds to the token acquisition request sent by the terminal device 101, determines and sends a communication token to the terminal device 101 according to the certificate information, the device identifier, and the device password.

[0099] After receiving the token acquisition request sent by the terminal device, the device management server first verifies whether the public key in the certificate information, the device identifier, and the device password sent by the terminal device are correct, and returns the communication token (i.e., Token) to the terminal device after the verification is passed.

[0100] S405: The terminal device 101 receives and sends a key acquisition request based on the communication token sent by the device management server 102.

[0101] The terminal device receives the communication token (i.e., Token) sent by the device management server and saves the communication token (i.e., Token) locally. When subsequently initiating a request (e.g., a key acquisition request) to the device management server, the communication token (i.e., Token) is carried for permission verification, wherein the key acquisition request is sent based on the Https protocol, and transmission using the Https protocol can effectively resist man-in-the-middle attacks, message monitoring attacks, and message tampering attacks, and can avoid the problem of authentication key leakage.

[0102] S406: The device management server 102 receives and authenticates the key acquisition request sent by the terminal device 101, and after the key acquisition request authentication passes, generates and sends an authentication key to the terminal device 101 based on a preset key generation algorithm.

[0103] After the device management server receives the key acquisition request sent by the terminal device, the communication token (i.e., Token) carried in the key acquisition request is first subjected to permission authentication. If the permission authentication passes, an authentication key (i.e., Secret_key) is generated based on a preset key generation algorithm, and the authentication key (i.e., Secret_key) is sent to the terminal device. If the permission authentication does not pass, the request is rejected. The preset key generation algorithm can be a universally unique identifier algorithm (UUID algorithm), and the authentication key (i.e., Secret_key) can be a globally unique identifier generated based on the UUID algorithm.

[0104] S407: The terminal device 101 receives and stores the authentication key sent by the device management server 102.

[0105] The terminal device saves the received authentication key (i.e., Secret_key) to a database.

[0106] S408: The terminal device 101 creates a password-free default user in the local user list and adds user information of the password-free default user in the database; and acquires and copies device operation permissions of an administrator account to the user information of the password-free default user.

[0107] The administrator account is an account in the terminal device that has enabled password-free login; the password-free default user is a device management server that has pre-logged into the terminal device. By copying the device operation permissions of the administrator account to the password-free default account, the password-free default user has all the device operation permissions of the administrator account, and after the device management server successfully logs into the terminal device, the terminal device can be directly managed according to the operation permissions of the password-free default user.

[0108] S409: The device management server 102 processes the authentication key according to a preset processing condition to obtain a first authentication token.

[0109] The device management server uses the authentication key (Secret_key) and the second time factor of the device management server to perform a two-factor calculation, which yields a 6-digit number (the second calculation result). This 6-digit number (the second calculation result) is then concatenated with the authentication key (Secret_key) to obtain the second concatenation result (fcode_secret_key'). The second concatenation result (fcode_secret_key') is then encrypted using SHA256 to obtain the second encrypted result. Finally, the second encrypted result is converted to lowercase using a result conversion condition to obtain the first authentication token (TokenA).

[0110] S410: Device management server 102 sends a login authentication request to terminal device 101 based on the first authentication token.

[0111] The device management server sends a login authentication request to the device with the first authentication token (TokenA) to request a login operation, so that the terminal device can authenticate the first authentication token (TokenA).

[0112] S411: Terminal device 101 receives and responds to the login authentication request sent by device management server 102, processes the authentication key according to preset processing conditions, and obtains a second authentication token.

[0113] The terminal device performs a two-factor calculation using the authentication key (i.e., Secret_key) and the terminal device's first time factor. The result is a 6-digit number (i.e., the first calculation result). This 6-digit number (i.e., the first calculation result) is then concatenated with the authentication key (i.e., Secret_key) to obtain the first concatenation result (i.e., fcode_secret_key). The first concatenation result (i.e., fcode_secret_key) is then encrypted using SHA256 to obtain the first encrypted result. Finally, the first encrypted result is converted to lowercase using a result conversion condition to obtain the second authentication token (i.e., TokenB).

[0114] It should be noted that the preset processing conditions set in the device management server are consistent with those set in the terminal device. In addition, their clocks (i.e., UTC time) are also consistent.

[0115] S412: Terminal device 101 generates login authentication result based on the first authentication token and the second authentication token.

[0116] like Figure 5 As shown, Figure 5 This is a flowchart illustrating the token authentication method provided in an embodiment of this application. The method specifically includes the following steps:

[0117] S501: Start.

[0118] S502: Verify whether the first authentication token and the second authentication token match.

[0119] The terminal device generates a login authentication result of the device management server logging into the terminal device by comparing whether the first authentication token (i.e., TokenA) sent by the device management server and the second authentication token (i.e., TokenB) locally generated match.

[0120] If yes, step S503 is performed.

[0121] If no, step S504 is performed.

[0122] S503: Login succeeds.

[0123] The terminal device allows the device management server to log in and accept the management of the device management server.

[0124] S504: Login fails.

[0125] The terminal device refuses the login of the management server.

[0126] S505: End.

[0127] The present application avoids the complex authentication process of manually inputting a password in the current login authentication by using the first authentication token generated by the device management server based on an authentication key and the second authentication token generated by the terminal device in the same way based on the authentication key, realizes one-key password-free login, greatly facilitates the management personnel to easily manage and solve device problems, and ensures the security of login by performing the entire authentication process internally.

[0128] Based on the content of the above embodiment, the present embodiment provides a login authentication device, which can be arranged in a terminal device and can also be arranged in a device management server. The login authentication device is used to execute the terminal device-side login authentication method provided in the above method embodiment. Specifically, please refer to Figure 6 The device includes:

[0129] A key request sending module 601, configured to acquire a communication token in response to a received password-free login starting instruction, and send a key acquisition request to a device management server based on the communication token.

[0130] A key receiving module 602, configured to receive and store an authentication key returned by the device management server based on the key acquisition request; wherein the authentication key is generated by the device management server based on a preset key generation algorithm after the device management server authenticates the key acquisition request.

[0131] The authentication request receiving module 603 is configured to receive a login authentication request sent by the device management server based on a first authentication token; wherein the first authentication token is obtained by processing the authentication key according to a preset processing condition by the device management server;

[0132] The authentication request response module 604 is configured to respond to the login authentication request, process the authentication key according to the preset processing condition, and obtain a second authentication token;

[0133] The authentication result generating module 605 is configured to generate a login authentication result according to the first authentication token and the second authentication token.

[0134] In an embodiment, the key request sending module 601 comprises:

[0135] The start instruction response module is configured to respond to the received password-free login start instruction, obtain the certificate information, the device identifier, and the device password of the terminal device; wherein the device identifier and the device password are assigned to the terminal device by the device management server;

[0136] The token acquisition instruction sending module is configured to send a token acquisition request to the device management server according to the certificate information, the device identifier, and the device password;

[0137] The communication token receiving module is configured to receive a communication token returned by the device management server based on the token acquisition request;

[0138] The request sending sub-module is configured to send a key acquisition request to the device management server based on the communication token.

[0139] In an embodiment, the login authentication device further comprises:

[0140] The default user creating module is configured to create a password-free default user in a local user list of the terminal device, and add user information of the password-free default user in a database of the terminal device;

[0141] The permission copying module is configured to obtain and copy device operation permissions of an administrator account to the user information of the password-free default user; wherein the administrator account is an account that has enabled password-free login.

[0142] In an embodiment, the authentication request response module 604 comprises:

[0143] The first factor obtaining module is configured to respond to the login authentication request, and obtain a first time factor of the terminal device;

[0144] The first calculation module is configured to perform double-factor calculation on the first time factor and the authentication key according to a double-factor algorithm in the preset processing condition, to obtain a first calculation result.

[0145] The first splicing module is configured to splice the authentication key and the first calculation result according to a splicing condition in the preset processing condition, to obtain a first splicing result.

[0146] The first encryption module is configured to encrypt the first splicing result according to an encryption algorithm in the preset processing condition, to obtain a first encryption result.

[0147] The first conversion module is configured to convert the first encryption result according to a result conversion condition in the preset processing condition, to obtain a second authentication token.

[0148] The login authentication device provided in the embodiments of the present application can be used to execute the technical solutions of the terminal device side of the foregoing method embodiments, and has similar implementation principles and technical effects, which will not be described herein.

[0149] Different from the prior art, the login authentication device provided in the present application is provided with an authentication request receiving module, an authentication request response module, and an authentication result generating module, and the login authentication result is generated based on the first authentication token and the second authentication token, which replaces manual password input. The entire login authentication process does not require the administrator to remember the device password, avoids the complex password input authentication link, achieves the purpose of quick login of the terminal device by the device management server, improves the login efficiency, and the entire authentication process is performed internally, which greatly protects the security of login.

[0150] In addition, on the basis of the method described in the foregoing embodiments, the embodiments of the present application further provide another login authentication device, which is arranged in a device management server and is used to execute the login authentication method of the device management server side provided in the foregoing method embodiments. Please refer to Figure 7 The device can include:

[0151] The key request receiving module 701 is configured to receive a key acquisition request sent by a terminal device based on a communication token.

[0152] The key sending module 702 is configured to authenticate the key acquisition request, and after the authentication of the key acquisition request is passed, generate an authentication key based on a preset key generation algorithm and send the authentication key to the terminal device.

[0153] The authentication token generating module 703 is configured to process the authentication key according to a preset processing condition, to obtain a first authentication token.

[0154] The authentication request sending module 704 is configured to send a login authentication request to the terminal device based on the first authentication token.

[0155] In an embodiment, the login authentication apparatus further comprises:

[0156] The information configuration module is configured to configure and send a device identifier and a device password of the terminal device to the terminal device.

[0157] The token acquisition request receiving module is configured to receive a token acquisition request sent by the terminal device based on the certificate information, the device identifier and the device password.

[0158] The communication token sending module is configured to determine and send a communication token to the terminal device according to the certificate information, the device identifier and the device password in response to the token acquisition request.

[0159] In an embodiment, the authentication token generation module 703 comprises:

[0160] The second factor acquisition module is configured to acquire a second time factor of the device management server.

[0161] The second calculation module is configured to perform double-factor calculation on the second time factor and the authentication key according to a double-factor algorithm in the preset processing condition to obtain a second calculation result.

[0162] The second splicing module is configured to splice the authentication key and the second calculation result according to a splicing condition in the preset processing condition to obtain a second splicing result.

[0163] The second encryption module is configured to encrypt the second splicing result according to an encryption algorithm in the preset processing condition to obtain a second encryption result.

[0164] The second conversion module is configured to convert the second encryption result according to a result conversion condition in the preset processing condition to obtain the first authentication token.

[0165] The login authentication apparatus of the embodiments of the present application can be used to execute the technical solutions of the foregoing method embodiments on the device management server side, and the implementation principles and technical effects are similar, which will not be described herein.

[0166] Different from the prior art, the login authentication apparatus provided by the present application sets a key sending module and an authentication token generation module, generates and sends an authentication key to a terminal device based on a preset key production cost algorithm through the key sending module, generates a first authentication token through the authentication token generation module, avoids a complex password input link, and greatly protects the security of login.

[0167] Correspondingly, the embodiment of the present application further provides an electronic device, such as Figure 8 As shown in the figure, the electronic device can include a processor 801 with one or more processing cores, a wireless (WiFi, Wireless Fidelity) module 802, a memory 803 with one or more computer readable storage media, an audio circuit 804, a display unit 805, an input unit 806, a power supply 807, and a radio frequency (RF, Radio Frequency) circuit 808, and the like. Those skilled in the art can understand that Figure 8 The structure of the electronic device shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than the figure, or combine certain components, or different component arrangements. Among them:

[0168] The processor 801 is the control center of the electronic device, which connects all parts of the electronic device through various interfaces and lines, executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 803 and calling data stored in the memory 803, thereby overall monitoring the electronic device. In an embodiment, the processor 801 can include one or more processing cores; preferably, the processor 801 can integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application programs, etc., and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 801.

[0169] WiFi belongs to short-range wireless transmission technology, and the electronic device can help users send and receive emails, browse web pages and access streaming media through the wireless module 802, etc., which provides users with wireless broadband Internet access. Although Figure 8 The wireless module 802 is shown, but it can be understood that it does not belong to the necessary components of the terminal, and can be omitted according to needs without changing the essence of the invention.

[0170] The memory 803 can be used to store software programs and modules, and the processor 801 executes various functions and data processing by running the computer programs and modules stored in the memory 803. The memory 803 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), and the like; the data storage area can store data created according to the use of the terminal (such as audio data, a phone book, etc.), and the like. In addition, the memory 803 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. Accordingly, the memory 803 can also include a memory controller to provide access to the memory 803 for the processor 801 and the input unit 806.

[0171] The audio circuit 804 includes a speaker that can provide an audio interface between the user and the electronic device. The audio circuit 804 can convert the received audio data into an electrical signal and transmit it to the speaker for conversion into a sound signal output by the speaker; on the other hand, the speaker collects a sound signal and converts it into an electrical signal, which is received by the audio circuit 804 and converted into audio data, which is output to the processor 801 for processing and then transmitted to another electronic device, such as another electronic device, via the radio frequency circuit 808, or output to the memory 803 for further processing. The audio circuit 804 can also include an earphone jack to provide communication between an external earphone and the electronic device.

[0172] The display unit 805 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the terminal, which can be composed of graphics, text, icons, video and any combination thereof. The display unit 805 can include a display panel, which in one embodiment can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, a touch-sensitive surface can cover the display panel, which transmits to the processor 801 when the touch-sensitive surface detects a touch operation on or near it to determine the type of touch event, and then the processor 801 provides corresponding visual output on the display panel according to the type of touch event. Although in the above embodiment, the touch-sensitive surface and the display panel are realized as two independent components to realize input and output functions, in some embodiments, the touch-sensitive surface and the display panel can be integrated to realize input and output functions. Figure 8

[0173] ​The input unit 806 can be used to receive input of digital or character information, and generate a keyboard, mouse, joystick, optical, or trackball signal input related to user settings and function control. Specifically, in one specific embodiment, the input unit 806 can include a touch-sensitive surface and other input devices. The touch-sensitive surface, also known as a touch display or touchpad, can collect touch operations of a user thereon or adjacent thereto (such as operations of a user using a finger, a stylus, or any suitable object or accessory on or adjacent to the touch-sensitive surface), and drive corresponding connection devices according to a pre-set program. In an embodiment, the touch-sensitive surface can include two parts of a touch detection device and a touch controller. Among them, the touch detection device detects the touch position of the user and detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch coordinates, and sends it to the processor 801, and can receive commands from the processor 801 and execute them. In addition, the touch-sensitive surface can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface, the input unit 806 can also include other input devices. Specifically, the other input devices can include one or more of a physical keyboard, function keys (such as volume control keys, on-off keys, etc.), trackballs, mice, joysticks, etc.

[0174] The electronic device also includes a power supply 807 (such as a battery) for powering the various components, and is preferably logically connected to the processor 801 through a power management system, so that the power management system can realize functions such as management of charging, discharging, and power consumption management. The power supply 807 can also include one or more direct or alternating current power sources, recharging systems, power failure detection circuits, power converters or inverters, power status indicators, and any other components.

[0175] The radio frequency circuit 808 can be used for receiving and sending signals in the process of information or communication, in particular, receiving the downlink information of the base station and handing it over to one or more processors 801 for processing; in addition, sending the data related to the uplink to the base station. Generally, the radio frequency circuit 808 includes but is not limited to an antenna, at least one amplifier, a tuner, one or more oscillators, a subscriber identity module (SIM) card, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the radio frequency circuit 808 can also communicate with the network and other devices through wireless communication. Wireless communication can use any communication standard or protocol, including but not limited to global system for mobile communication (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), long term evolution (LTE), email, short messaging service (SMS), etc.

[0176] Although not shown, the electronic device can also include a camera, a Bluetooth module, etc., which will not be described here. In particular, in the present embodiment, the processor 801 in the electronic device will load the executable file corresponding to the process of one or more application programs into the memory 803 according to the following instructions, and run the application program stored in the memory 803 by the processor 801, set the electronic device on the terminal side, and thus realize the following functions:

[0177] In response to the received password-free login starting instruction, a communication token is obtained, and a key acquisition request is sent to the device management server based on the communication token;

[0178] The authentication key returned by the device management server based on the key acquisition request is received and stored; wherein the authentication key is generated based on a preset key generation algorithm after the device management server authenticates the key acquisition request;

[0179] A login authentication request sent by the device management server based on the first authentication token is received; wherein the first authentication token is obtained by processing the authentication key according to a preset processing condition by the device management server;

[0180] In response to the login authentication request, the authentication key is processed according to the preset processing condition to obtain a second authentication token.

[0181] According to the first authentication token and the second authentication token, a login authentication result is generated.

[0182] The electronic device is arranged on the device management server side, so that the following functions can be realized:

[0183] A key acquisition request sent by the terminal device based on the communication token is received;

[0184] The key acquisition request is authenticated, and after the key acquisition request authentication passes, an authentication key is generated based on a preset key generation algorithm and sent to the terminal device;

[0185] The authentication key is processed according to a preset processing condition to obtain a first authentication token;

[0186] A login authentication request is sent to the terminal device based on the first authentication token.

[0187] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by instructions controlling related hardware, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0188] To this end, the embodiments of the present application provide a computer readable storage medium, which stores a plurality of instructions capable of being loaded by a processor to realize the functions of the above login authentication method.

[0189] The computer readable storage medium can include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0190] The above describes the login authentication method, device, electronic device and computer readable storage medium provided by the embodiments of the present application in detail. The principles and implementation manners of the present application are described by applying specific examples. The above embodiment descriptions are only used to help understand the method and its core idea of the present application. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A login authentication method characterized by, The method applied to a terminal device comprises: In response to a received password-free login starting instruction, a communication token is obtained, and a key acquisition request is sent to a device management server based on the communication token; A received authentication key returned by the device management server based on the key acquisition request is stored; wherein the authentication key is generated based on a preset key generation algorithm after the device management server authenticates the key acquisition request; A login authentication request sent by the device management server based on a first authentication token is received; wherein the first authentication token is obtained by processing the authentication key according to a preset processing condition by the device management server; In response to the login authentication request, the authentication key is processed according to the preset processing condition to obtain a second authentication token; A login authentication result is generated according to the first authentication token and the second authentication token; After the step of receiving and storing the authentication key returned by the device management server based on the key acquisition request, the method further comprises: A password-free default user is created in a local user list of the terminal device, and user information of the password-free default user is added in a database of the terminal device; Device operation permissions of an administrator account are obtained and copied to the user information of the password-free default user; wherein the administrator account is an account that has enabled password-free login; The step of responding to the login authentication request and processing the authentication key according to the preset processing condition to obtain a second authentication token comprises: In response to the login authentication request, a first time factor of the terminal device is obtained, wherein the first time factor is a time variable calculated according to a window period and a current timestamp of the terminal device; A first calculation result is obtained by performing double-factor calculation on the first time factor and the authentication key according to a double-factor algorithm in the preset processing condition; A first splicing result is obtained by splicing the authentication key and the first calculation result according to a splicing condition in the preset processing condition; A first encryption result is obtained by encrypting the first splicing result according to an encryption algorithm in the preset processing condition; A second authentication token is obtained by converting the first encryption result according to a result conversion condition in the preset processing condition.

2. The login authentication method according to claim 1, characterized by, The step of responding to a received password-free login starting instruction, obtaining a communication token, and sending a key acquisition request to a device management server based on the communication token comprises: In response to a received password-free login starting instruction, certificate information, a device identifier, and a device password of the terminal device are obtained; wherein the device identifier and the device password are allocated to the terminal device by a device management server; A token acquisition request is sent to the device management server according to the certificate information, the device identifier, and the device password; A received communication token returned by the device management server based on the token acquisition request; A key acquisition request is sent to the device management server based on the communication token.

3. A login authentication method characterized by, The method applied to a device management server comprises: A key acquisition request sent by a terminal device based on a communication token is received; authenticating the key acquisition request, and generating and sending an authentication key to the terminal device based on a preset key generation algorithm after the key acquisition request authentication is passed; processing the authentication key based on preset processing conditions to obtain a first authentication token; sending a login authentication request to the terminal device based on the first authentication token; creating a password-free default user in a local user list of the terminal device and adding user information of the password-free default user in a database of the terminal device; obtaining and copying device operation permissions of an administrator account to the user information of the password-free default user, wherein the administrator account is an account that has enabled password-free login; the step of processing the authentication key based on preset processing conditions to obtain a first authentication token comprises: obtaining a second time factor of the device management server, wherein the second time factor is a time variable calculated based on a window period and a current timestamp of the device management server; performing double-factor calculation on the second time factor and the authentication key based on a double-factor algorithm in the preset processing conditions to obtain a second calculation result; splicing the authentication key and the second calculation result based on a splicing condition in the preset processing conditions to obtain a second splicing result; encrypting the second splicing result based on an encryption algorithm in the preset processing conditions to obtain a second encryption result; converting the second encryption result based on a result conversion condition in the preset processing conditions to obtain the first authentication token.

4. The login authentication method according to claim 3, characterized by, Before the step of receiving the key acquisition request sent by the terminal device based on the communication token, the method further comprises: configuring and sending a device identifier and a device password of the terminal device to the terminal device; receiving a token acquisition request sent by the terminal device based on certificate information, the device identifier and the device password; in response to the token acquisition request, determining and sending a communication token to the terminal device based on the certificate information, the device identifier and the device password.

5. A login authentication method characterized by, The method is applied to a device management system, and the device management system comprises a device management server and at least one terminal device, and the method comprises: the terminal device acquires a communication token in response to a received password-free login start instruction, and sends a key acquisition request to the device management server based on the communication token; the device management server receives the key acquisition request, authenticates the key acquisition request, generates and sends an authentication key to the terminal device based on a preset key generation algorithm after the key acquisition request authentication is passed, processes the authentication key based on preset processing conditions to obtain a first authentication token, and sends a login authentication request to the terminal device based on the first authentication token; the terminal device receives and stores the authentication key, receives and responds to the login authentication request, processes the authentication key based on the preset processing conditions to obtain a second authentication token, and generates a login authentication result based on the first authentication token and the second authentication token; create a password-free default user in a local user list of the terminal device, and add user information of the password-free default user in a database of the terminal device; copy device operation permissions of an administrator account to the user information of the password-free default user, wherein the administrator account is an account that has enabled password-free login; the step of responding to the login authentication request and processing the authentication key according to the preset processing condition to obtain a second authentication token, comprising: in response to the login authentication request, obtaining a first time factor of the terminal device, wherein the first time factor is a time variable calculated according to a window period and a current timestamp of the terminal device; performing double-factor calculation on the first time factor and the authentication key according to a double-factor algorithm in the preset processing condition to obtain a first calculation result; splicing the authentication key and the first calculation result according to a splicing condition in the preset processing condition to obtain a first splicing result; encrypting the first splicing result according to an encryption algorithm in the preset processing condition to obtain a first encryption result; converting the first encryption result according to a result conversion condition in the preset processing condition to obtain a second authentication token.

6. A login authentication apparatus characterized by comprising: The device is applied to a terminal device and comprises: a key request sending module configured to, in response to a received password-free login start instruction, obtain a communication token, and send a key acquisition request to a device management server based on the communication token; a key receiving module configured to receive and store an authentication key returned by the device management server based on the key acquisition request; wherein the authentication key is generated by the device management server based on a preset key generation algorithm after the device management server authenticates the key acquisition request; an authentication request receiving module configured to receive a login authentication request sent by the device management server based on a first authentication token; wherein the first authentication token is obtained by the device management server by processing the authentication key according to a preset processing condition; an authentication request response module configured to, in response to the login authentication request, process the authentication key according to the preset processing condition to obtain a second authentication token; an authentication result generating module configured to generate a login authentication result according to the first authentication token and the second authentication token; a default user creating module configured to create a password-free default user in a local user list of the terminal device, and add user information of the password-free default user in a database of the terminal device; a permission copying module configured to copy device operation permissions of an administrator account to the user information of the password-free default user, wherein the administrator account is an account that has enabled password-free login; The authentication request response module is further configured to, in response to the login authentication request, obtain a first time factor of the terminal device, wherein the first time factor is a time variable calculated according to a window period and a current timestamp of the terminal device; perform double-factor calculation on the first time factor and the authentication key according to a double-factor algorithm in the preset processing condition to obtain a first calculation result; splice the authentication key and the first calculation result according to a splicing condition in the preset processing condition to obtain a first splicing result; encrypt the first splicing result according to an encryption algorithm in the preset processing condition to obtain a first encryption result; and convert the first encryption result according to a result conversion condition in the preset processing condition to obtain a second authentication token.

7. A login authentication apparatus characterized by comprising: The device management server comprises: A key request receiving module configured to receive a key acquisition request sent by a terminal device based on a communication token; A key sending module configured to authenticate the key acquisition request, and, after the key acquisition request is authenticated, generate an authentication key based on a preset key generation algorithm and send the authentication key to the terminal device; An authentication token generation module configured to process the authentication key according to a preset processing condition to obtain a first authentication token; An authentication request sending module configured to send a login authentication request to the terminal device based on the first authentication token; A default user creation module configured to create a password-free default user in a local user list of the terminal device and add user information of the password-free default user in a database of the terminal device; A permission copying module configured to obtain and copy device operation permissions of an administrator account to the user information of the password-free default user, wherein the administrator account is an account that has enabled password-free login; The authentication token generation module is further configured to obtain a second time factor of the device management server, wherein the second time factor is a time variable calculated according to a window period and a current timestamp of the device management server; perform double-factor calculation on the second time factor and the authentication key according to a double-factor algorithm in the preset processing condition to obtain a second calculation result; splice the authentication key and the second calculation result according to a splicing condition in the preset processing condition to obtain a second splicing result; encrypt the second splicing result according to an encryption algorithm in the preset processing condition to obtain a second encryption result; and convert the second encryption result according to a result conversion condition in the preset processing condition to obtain the first authentication token.

Images