An authentication method, apparatus, device, and storage medium

Abstract

This application discloses an identity authentication method, apparatus, device, and storage medium, relating to the field of network security technology. The method includes: when a target server receives a login request from a user, obtaining the target username, target fixed password, and target dynamic password entered by the user, and verifying the target fixed password based on the target username; if the verification is successful, forwarding the target username and target dynamic password to an authentication forwarding server to determine the corresponding mobile terminal, and forwarding the target dynamic password and corresponding token number to the mobile terminal; calculating the current dynamic password using a seed value determined from the mobile terminal; if the current dynamic password matches the target dynamic password, generating an authentication successful response and forwarding it to the target server. This application distributes the management of token seed values ​​through the mobile terminal, eliminating the need to store all token seed information on the server side, thus preventing the risk of token information theft and improving the security of identity authentication.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an identity authentication method, apparatus, device, and storage medium. Background Technology

[0002] Dynamic passwords, as one of the most secure identity authentication technologies, are increasingly being adopted by various industries. Due to their ease of use and platform independence, they are widely used in online banking, online games, telecommunications operators, e-commerce, and enterprise applications. The number of companies both domestically and internationally engaged in the research and development and production of dynamic passwords is also growing. Their advantages lie in their rapid and seamless interoperability with various business systems, their stable and efficient authentication software systems that support multiple authentication modes, and their solutions that can serve businesses of different sizes.

[0003] Currently, the mainstream solution for secure authentication of server identities is a unified dynamic password authentication system. Administrators centrally bind tokens and set access policies (such as allowed access dates, times, and IP addresses). Specifically, when a dynamic token requires authentication, the dynamic password and the username to be authenticated are sent to the authentication system. The system then queries the database for the seed value of the token corresponding to the username. Next, it calculates the corresponding password based on the OATH (Operational Open-Ended Transaction) algorithm and verifies its correctness. If correct, it checks the corresponding permissions to determine if login is permitted (e.g., prohibiting login on non-working days, at night, or on holidays). Finally, it returns the authentication status, indicating whether the password authentication was correct, whether login is restricted, and whether the user has permission to log in to the server.

[0004] However, in practice, servers are usually managed by multiple departments and individuals. Centralized management cannot be managed by a single server manager anytime and anywhere. In addition, centralized management also carries the risk of centralized theft of token seed values, which means that the corresponding tokens are at risk of security vulnerabilities. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide an identity authentication method, apparatus, device, and storage medium that can eliminate the risk of token information theft and improve the security of identity authentication. The specific solution is as follows:

[0006] Firstly, this application discloses an identity authentication method, including:

[0007] When the target server receives a login request sent by a user, a prompt message will pop up on the user's terminal interface asking for the username, fixed password, and dynamic password.

[0008] The target server obtains the target username, target fixed password, and target dynamic password entered by the user in response to the prompt information, and verifies the target fixed password based on the target username.

[0009] If the verification is successful, the target username and the target dynamic password are forwarded to the authentication forwarding server so that the authentication forwarding server can determine the mobile terminal corresponding to the target username and forward the target dynamic password and the corresponding token number to the mobile terminal.

[0010] The seed value corresponding to the token number is determined from the mobile terminal, and the current dynamic password is calculated using the seed value;

[0011] The mobile terminal compares the current dynamic password with the target dynamic password to see if they match. If they match, an authentication success response is generated and forwarded to the target server by the authentication forwarding server.

[0012] Optionally, determining the mobile terminal corresponding to the target username through the authentication forwarding server includes:

[0013] The authentication forwarding server determines the mobile phone number corresponding to the target username and locates the corresponding mobile terminal based on the mobile phone number.

[0014] Optionally, before forwarding the target dynamic password and corresponding token number to the mobile terminal, the method further includes:

[0015] Based on the mobile phone number, the IP address of the server managed by the mobile terminal is determined from the authentication forwarding server, and the target server IP address is obtained;

[0016] Determine whether the IP address of the authentication forwarding server belongs to the IP address of the target server. If it does, trigger the step of forwarding the target dynamic password and the corresponding token number to the mobile terminal. If it does not, send an authentication failure message to the terminal interface.

[0017] Optionally, calculating the current dynamic password using the seed value includes:

[0018] The current dynamic password is obtained by using the seed value and calculating the password based on the OATH algorithm.

[0019] Optionally, generating the authentication successful response information and forwarding it to the target server via the authentication forwarding server includes:

[0020] Generate a response message indicating successful authentication, and generate an access permission setting dialog box on the interface of the mobile terminal, so that the administrator can set the corresponding access permissions in the dialog box to obtain the target access permissions;

[0021] The authentication forwarding server forwards the response information and the target access permissions to the target server.

[0022] Optionally, generating the access permission setting dialog box on the interface of the mobile terminal includes:

[0023] A dialog box for setting temporary login duration permissions is generated on the interface of the mobile terminal.

[0024] Optionally, the step of verifying the target fixed password based on the target username includes:

[0025] The target fixed password is verified using a pluggable authentication module in the target server and based on the target username.

[0026] Secondly, this application discloses an identity authentication device, comprising:

[0027] The pop-up notification module is used to display a prompt message on the user's terminal interface when the target server receives a login request from the user, asking the user to enter a username, fixed password, and dynamic password.

[0028] The information acquisition module is used to acquire the target username, target fixed password and target dynamic password entered by the user in response to the prompt information through the target server;

[0029] A fixed password verification module is used to verify the target fixed password based on the target username;

[0030] The first information forwarding module is used to forward the target username and the target dynamic password to the authentication forwarding server if the verification is successful.

[0031] The mobile terminal determination module is used to determine the mobile terminal corresponding to the target username through the authentication forwarding server.

[0032] The second information forwarding module is used to forward the target dynamic password and the corresponding token number to the mobile terminal;

[0033] The seed value determination module is used to determine the seed value corresponding to the token number from the mobile terminal;

[0034] The current dynamic password calculation module is used to calculate the current dynamic password using the seed value;

[0035] The comparison module is used to compare whether the current dynamic password and the target dynamic password are consistent through the mobile terminal;

[0036] The response generation and forwarding module is used to generate an authentication successful response message and forward it to the target server through the authentication forwarding server if the current dynamic password and the target dynamic password are consistent.

[0037] Thirdly, this application discloses an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the aforementioned authentication method.

[0038] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned authentication method.

[0039] As can be seen, when the target server receives a login request from a user, it displays a prompt message on the user's corresponding terminal interface asking for a username, fixed password, and dynamic password. The target server then obtains the target username, target fixed password, and target dynamic password entered by the user in response to the prompt message. It verifies the target fixed password based on the target username. If the verification is successful, the target username and target dynamic password are forwarded to an authentication forwarding server. The authentication forwarding server then identifies the mobile terminal corresponding to the target username and forwards the target dynamic password and its corresponding token number to the mobile terminal. Next, it determines the seed value corresponding to the token number from the mobile terminal and calculates the current dynamic password using the seed value. The mobile terminal then compares the current dynamic password with the target dynamic password. If they match, an authentication success response is generated and forwarded to the target server via the authentication forwarding server. This application distributes the management of token seed values ​​through mobile terminals, eliminating the need to store all token seed information on the server side, thus preventing the risk of token information theft and improving the security of identity authentication. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 This is a flowchart of an identity authentication method disclosed in this application;

[0042] Figure 2 This is a flowchart of a specific identity authentication method disclosed in this application;

[0043] Figure 3 This is a flowchart of a specific identity authentication method disclosed in this application;

[0044] Figure 4 This is a schematic diagram of the structure of an identity authentication device disclosed in this application;

[0045] Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0046] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] This application discloses an identity authentication method. See [link to relevant documentation] Figure 1 As shown, the method includes:

[0048] Step S11: When the target server receives the login request sent by the user, a prompt message will pop up on the terminal interface corresponding to the user, asking for the username, fixed password and dynamic password.

[0049] In this embodiment, when the target server to be authenticated receives a login request sent by a user, a prompt message appears on the user's corresponding terminal interface asking for a username, a fixed password (i.e., a fixed password), and a dynamic password. The target server includes, but is not limited to, database servers, FTP (File Transfer Protocol) servers, etc.; the dynamic password is generated by a dynamic token, and its specific length is determined by the type of the dynamic token. The algorithm used in generating the dynamic password includes, but is not limited to, symmetric, asymmetric, and hash algorithms, such as the Chinese cryptographic hash algorithm SM2, SM3, and SM4.

[0050] Step S12: Obtain the target username, target fixed password, and target dynamic password entered by the user in response to the prompt information through the target server, and verify the target fixed password based on the target username.

[0051] In this embodiment, after a prompt message appears on the user's terminal interface asking for a username, fixed password, and dynamic password, the user can manually enter their username, fixed password, and dynamic password according to the prompt message displayed on the current terminal interface. Then, the target server obtains the corresponding target username, target fixed password, and target dynamic password from the information entered by the user. Next, the target fixed password is verified based on the target username, that is, it is determined whether the target username and the target fixed password are consistent.

[0052] Step S13: If the verification is successful, the target username and the target dynamic password are forwarded to the authentication forwarding server so that the authentication forwarding server can determine the mobile terminal corresponding to the target username and forward the target dynamic password and the corresponding token number to the mobile terminal.

[0053] In this embodiment, if the target username and the target fixed password match, the user is initially determined to be a legitimate user. However, to further improve login security and prevent the user's fixed password from being stolen, the target dynamic password needs to be further verified to confirm the user's identity. Specifically, if the verification passes, the target username and the target dynamic password are forwarded to the authentication forwarding server. After obtaining the target username and the target dynamic password, the authentication forwarding server first determines the corresponding mobile terminal from the locally stored information based on the target username, then determines the token number corresponding to the target username, and then forwards the target dynamic password and the corresponding token number to the mobile terminal.

[0054] In one specific real-time method, determining the mobile terminal corresponding to the target username through the authentication forwarding server may specifically include: determining the mobile phone number corresponding to the target username through the authentication forwarding server, and then finding the corresponding mobile terminal based on the mobile phone number. That is, after obtaining the target username and target dynamic password forwarded by the target server, the authentication forwarding server first finds the mobile phone number corresponding to the target username, and then determines the mobile terminal where the mobile phone number is located.

[0055] Step S14: Determine the seed value corresponding to the token number from the mobile terminal, and calculate the current dynamic password using the seed value.

[0056] In this embodiment, after the mobile terminal receives the target dynamic password and the corresponding token number sent by the authentication forwarding server, it first queries the local storage of the mobile terminal to find the seed value corresponding to the token number, and then uses the seed value to generate the current dynamic password. It should be noted that the mobile terminal, as an authentication terminal, pre-stores the token seed values ​​within its management scope and the servers within its responsibility scope; furthermore, the calculation method for the current dynamic password includes, but is not limited to, the OATH algorithm.

[0057] Step S15: The mobile terminal compares the current dynamic password with the target dynamic password to see if they match. If they match, an authentication success response is generated and forwarded to the target server by the authentication forwarding server.

[0058] In this embodiment, after calculating the current dynamic password using the seed value, the mobile terminal further compares the current dynamic password with the target dynamic password and determines whether they match. If they match, it means that the user is a legitimate user and can log in to the target server normally. At this time, the mobile terminal can generate the corresponding authentication pass response information and send the response information to the authentication forwarding server, which then forwards it to the target server. When the target server receives the response information, it can agree to the user's login request so that the user can perform corresponding operations on the target server.

[0059] As can be seen, in this embodiment of the application, when the target server receives a login request sent by a user, a prompt message appears on the user's corresponding terminal interface asking for a username, fixed password, and dynamic password. Then, the target server obtains the target username, target fixed password, and target dynamic password entered by the user in response to the prompt message, and verifies the target fixed password based on the target username. If the verification is successful, the target username and the target dynamic password are forwarded to the authentication forwarding server. The authentication forwarding server then determines the mobile terminal corresponding to the target username and forwards the target dynamic password and the corresponding token number to the mobile terminal. Next, the seed value corresponding to the token number is determined from the mobile terminal, and the current dynamic password is calculated using the seed value. The mobile terminal then compares whether the current dynamic password and the target dynamic password are consistent. If they are consistent, an authentication success response message is generated and forwarded to the target server through the authentication forwarding server. This application embodiment uses mobile terminals to distribute the management of token seed values, eliminating the need to store all token seed information on the server side, thus preventing the risk of token information theft and improving the security of identity authentication.

[0060] This application discloses a specific identity authentication method. See [link to relevant documentation]. Figure 2 As shown, the method includes:

[0061] Step S21: When the target server receives the login request sent by the user, a prompt message appears on the terminal interface corresponding to the user asking for the username, fixed password and dynamic password.

[0062] Step S22: Obtain the target username, target fixed password, and target dynamic password entered by the user in response to the prompt information through the target server, and verify the target fixed password through the pluggable authentication module in the target server based on the target username.

[0063] In this embodiment, see Figure 3 As shown, the target server can specifically be a database server and an FTP server. After the database server and FTP server obtain the target username (li), target fixed password, and target dynamic password (i.e., 318467) entered by the user, they can verify whether the target username and target fixed password entered by the user are consistent through the pluggable authentication modules (PAM) in the database server and FTP server. If they are consistent, the verification is successful; if they are inconsistent, the verification fails, and an authentication failure prompt message can be directly generated on the terminal interface.

[0064] Step S23: If the verification is successful, forward the target username and the target dynamic password to the authentication forwarding server.

[0065] Step S24: Determine the mobile phone number corresponding to the target username through the authentication forwarding server, and find the corresponding mobile terminal based on the mobile phone number.

[0066] In this embodiment, see Figure 3 As shown, after the authentication forwarding server obtains the target username (li) and target dynamic password (318467) forwarded by the database server and FTP server, it can query the token number (N324) and mobile phone number (13344445555) corresponding to the target username (li) from the local machine. Then, the corresponding authenticated mobile terminal can be found through the mobile phone number (13344445555).

[0067] Step S25: Determine the IP address of the server managed by the mobile terminal from the authentication forwarding server based on the mobile phone number, and obtain the target server IP address.

[0068] In this embodiment, after locating the corresponding mobile terminal based on the mobile phone number, the IP address of the server corresponding to the mobile phone number can be further queried through the aforementioned authentication forwarding server. This server's IP address is set for servers that the mobile terminal corresponding to the mobile phone number can manage; that is, servers within the scope of the mobile terminal's own responsibility. See also... Figure 3 As shown, the IP address of the server managed by the corresponding mobile terminal (i.e., 192.168.2.3\192.168.4.32\192.176.3.5) can be found by using the mobile phone number (13344445555).

[0069] Step S26: Determine whether the IP address of the authentication forwarding server belongs to the IP address of the target server. If it does, forward the target dynamic password and the corresponding token number to the mobile terminal. If it does not, send an authentication failure message to the terminal interface.

[0070] In this embodiment, after obtaining the target server IP address by determining the IP address of the server managed by the mobile terminal from the authentication forwarding server based on the mobile phone number, the authentication forwarding server determines whether its IP address belongs to the target server IP address. If the authentication forwarding server's IP address belongs to the target server IP address, the target dynamic password and corresponding token number are forwarded to the mobile terminal. For example, when... Figure 3 If the IP address of the server corresponding to the mobile phone number (13344445555) (192.168.2.3\192.168.4.32\192.176.3.5) is the IP address of a database server or FTP server, the dynamic password (i.e., 318467) and the corresponding token number (N324) are forwarded to the mobile terminal with the mobile phone number 13344445555. Furthermore, if the IP address of the aforementioned authentication forwarding server does not belong to the target server's IP address, authentication fails, and a corresponding authentication failure message can be generated and sent to the aforementioned terminal interface.

[0071] Step S27: Determine the seed value corresponding to the token number from the mobile terminal, and use the seed value and the OATH algorithm to calculate the password to obtain the current dynamic password.

[0072] In this embodiment, after the mobile terminal obtains the target dynamic password and the corresponding token number sent by the authentication forwarding server, it first queries the local machine to see if there is a seed value corresponding to the token number. If there is, the OATH algorithm can be used to calculate the password for the seed value, and then the current dynamic password can be obtained.

[0073] Step S28: Compare the current dynamic password and the target dynamic password on the mobile terminal. If they match, generate an authentication success response and generate an access permission setting dialog box on the mobile terminal interface so that the administrator can set the corresponding access permissions in the dialog box to obtain the target access permissions.

[0074] In this embodiment, after calculating the current dynamic password, the mobile terminal compares the current dynamic password with the target dynamic password and determines whether they are the same. If they are the same, it means that the user is a legitimate user and generates an authentication success response. Then, an access permission setting dialog box is generated on the interface of the mobile terminal. In this way, the administrator using the mobile terminal can set the corresponding access permissions in the dialog box.

[0075] Specifically, generating the access permission setting dialog box on the mobile terminal interface may include: generating a dialog box for setting temporary login duration permissions on the mobile terminal interface. For example, see... Figure 3 As shown, a prompt message indicating that the dynamic password is correct and an access permission setting dialog box for the authorized login duration are generated on the mobile terminal interface. Then, the administrator of the mobile terminal sets the corresponding duration, such as 15 minutes, and then clicks the OK button.

[0076] Step S29: Forward the response information and the target access permission to the target server through the authentication forwarding server.

[0077] In this embodiment, when the manager is Figure 3 After setting the access duration permission to 15 minutes in the dialog box, the user can further forward the access to the database server and the FTP server through the aforementioned authentication forwarding server. At this time, the user can access the database server and the FTP server within 15 minutes.

[0078] For a more detailed explanation of step S23, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0079] As can be seen, this application embodiment employs two-factor authentication, which verifies both a fixed password and a dynamic password. Only after both authentications are successful is the user's identity determined to be legitimate. The dynamic password's one-time use characteristic prevents repeated password theft after recording, thus achieving a multi-authentication mechanism required by security level protection and preventing single authentication methods from being easily cracked. Furthermore, authentication is performed on the mobile terminal using the seed value of the token it manages, and after successful authentication, certain permissions are further restricted. This allows administrators to manage servers within their scope of responsibility in real time and promptly block unauthorized access, thus achieving precise permissions and minimizing privileges. Additionally, this solution can distribute the management of token seed values, eliminating the need to store all token seed information on the server side, thereby preventing the security risk of stolen purchased token information.

[0080] Accordingly, this application also discloses an identity authentication device, see [link to relevant documentation]. Figure 4 As shown, the device includes:

[0081] The prompt message pop-up module 11 is used to pop up a prompt message asking users to enter their username, fixed password and dynamic password on the terminal interface corresponding to the user when the target server receives a login request sent by the user.

[0082] Information acquisition module 12 is used to acquire the target username, target fixed password and target dynamic password entered by the user in response to the prompt information through the target server;

[0083] The fixed password verification module 13 is used to verify the target fixed password based on the target username;

[0084] The first information forwarding module 14 is used to forward the target username and the target dynamic password to the authentication forwarding server if the verification is successful.

[0085] Mobile terminal determination module 15 is used to determine the mobile terminal corresponding to the target username through the authentication forwarding server;

[0086] The second information forwarding module 16 is used to forward the target dynamic password and the corresponding token number to the mobile terminal.

[0087] Seed value determination module 17 is used to determine the seed value corresponding to the token number from the mobile terminal;

[0088] The current dynamic password calculation module 18 is used to calculate the current dynamic password using the seed value;

[0089] Comparison module 19 is used to compare whether the current dynamic password and the target dynamic password are consistent through the mobile terminal;

[0090] The response generation and forwarding module 110 is used to generate an authentication successful response message and forward it to the target server through the authentication forwarding server if the current dynamic password and the target dynamic password are consistent.

[0091] The specific workflow of each of the above modules can be found in the relevant content disclosed in the foregoing embodiments, and will not be repeated here.

[0092] As can be seen, in this embodiment, when the target server receives a login request sent by a user, a prompt message appears on the user's corresponding terminal interface asking for a username, fixed password, and dynamic password. Then, the target server obtains the target username, target fixed password, and target dynamic password entered by the user in response to the prompt message, and verifies the target fixed password based on the target username. If the verification is successful, the target username and the target dynamic password are forwarded to the authentication forwarding server. The authentication forwarding server then determines the mobile terminal corresponding to the target username and forwards the target dynamic password and the corresponding token number to the mobile terminal. Next, the seed value corresponding to the token number is determined from the mobile terminal, and the current dynamic password is calculated using the seed value. The mobile terminal then compares whether the current dynamic password and the target dynamic password are consistent. If they are consistent, an authentication success response message is generated and forwarded to the target server via the authentication forwarding server. This application embodiment uses mobile terminals to distribute the management of token seed values, eliminating the need to store all token seed information on the server side, thus preventing the risk of token information theft and improving the security of identity authentication.

[0093] In some specific embodiments, the mobile terminal determining module 15 may specifically include:

[0094] A mobile phone number determination unit is used to determine the mobile phone number corresponding to the target username through the authentication forwarding server;

[0095] The mobile terminal determination unit is used to locate the corresponding mobile terminal based on the mobile phone number.

[0096] In some specific embodiments, before the mobile terminal determining module 15, the following may be included:

[0097] The server IP address determination unit is used to determine the IP address of the server managed by the mobile terminal from the authentication forwarding server based on the mobile phone number, and obtain the target server IP address.

[0098] The judgment unit is used to determine whether the IP address of the authentication forwarding server belongs to the IP address of the target server;

[0099] A triggering unit is used to trigger the step of forwarding the target dynamic password and the corresponding token number to the mobile terminal if the IP address of the authentication forwarding server belongs to the IP address of the target server.

[0100] The prompt message sending unit is used to send an authentication failure prompt message to the terminal interface if the IP address of the authentication forwarding server does not belong to the IP address of the target server.

[0101] In some specific embodiments, the current dynamic password calculation module 18 may specifically include:

[0102] The current dynamic password calculation unit is used to calculate the current dynamic password using the seed value and based on the OATH algorithm.

[0103] In some specific embodiments, the response generation and forwarding module 110 may specifically include:

[0104] The response information generation unit is used to generate a response information indicating that authentication has been successful.

[0105] The dialog box generation unit is used to generate an access permission setting dialog box on the interface of the mobile terminal, so that the administrator can set the corresponding access permissions in the dialog box and obtain the target access permissions;

[0106] The information forwarding unit is used to forward the response information and the target access permission to the target server through the authentication forwarding server.

[0107] In some specific embodiments, the dialog box generation unit may specifically include:

[0108] The permission setting dialog box generation unit is used to generate a dialog box for setting temporary login duration permissions on the interface of the mobile terminal.

[0109] In some specific embodiments, the fixed password verification module 13 may specifically include:

[0110] A fixed password verification unit is used to verify the target fixed password through a pluggable authentication module in the target server and based on the target username.

[0111] Furthermore, embodiments of this application also disclose an electronic device, Figure 5This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0112] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the authentication method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0113] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0114] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0115] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the authentication method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0116] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed authentication method. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0117] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0118] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0119] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0120] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0121] The present application provides a detailed description of an identity authentication method, apparatus, device, and storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present application. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of the present application. Therefore, the content of this specification should not be construed as a limitation of the present application.

Claims

1. An identity authentication method, characterized by, The method comprises the following steps: When the target server acquires the login request sent by the user, prompting information of "please input the username, fixed password and dynamic password" is popped up on the terminal interface corresponding to the user; The target server acquires the target username, target fixed password and target dynamic password input by the user according to the prompting information, and verifies the target fixed password according to the target username; If the verification is passed, the target username and the target dynamic password are forwarded to the authentication forwarding server, so as to determine the mobile terminal corresponding to the target username through the authentication forwarding server, and forward the target dynamic password and the token number corresponding to the target username to the mobile terminal; The seed value corresponding to the token number is determined from the mobile terminal, and the current dynamic password is calculated by using the seed value; The mobile terminal compares the current dynamic password with the target dynamic password, and if they are consistent, a response information of authentication passing is generated and forwarded to the target server through the authentication forwarding server.

2. The identity authentication method of claim 1, wherein, The authentication forwarding server determines the mobile terminal corresponding to the target username, comprising: The authentication forwarding server determines the mobile number corresponding to the target username, and finds the corresponding mobile terminal according to the mobile number.

3. The identity authentication method of claim 2, wherein, Before the target dynamic password and the token number corresponding to the target username are forwarded to the mobile terminal, the method further comprises the following steps: The IP address of the server managed by the mobile terminal is determined from the authentication forwarding server according to the mobile number, and the target server IP address is obtained; It is judged whether the IP address of the authentication forwarding server belongs to the target server IP address, if it belongs, the step of forwarding the target dynamic password and the token number corresponding to the target username to the mobile terminal is triggered, if it does not belong, the authentication failure prompt information is sent to the terminal interface.

4. The identity authentication method of claim 1, wherein, The seed value is used to calculate the current dynamic password based on the OATH algorithm. The response information of authentication passing is generated, and an access permission setting dialog box is generated on the interface of the mobile terminal, so that the management personnel set the corresponding access permission in the dialog box, and the target access permission is obtained; 5. The identity authentication method of claim 1, wherein, The response information and the target access permission are forwarded to the target server through the authentication forwarding server. The access permission setting dialog box is generated on the interface of the mobile terminal, comprising: The temporary login duration permission setting dialog box is generated on the interface of the mobile terminal.

6. The identity authentication method of claim 5, wherein, The target fixed password is verified according to the target username through the pluggable authentication module in the target server. The method comprises the following steps:

7. The identity authentication method according to any one of claims 1 to 6, characterized in that, ​ ​ 8. An identity authentication apparatus characterized by comprising: ​ The prompt information pop-up module is configured to pop up prompt information of "please input a username, a fixed password and a dynamic password" on a terminal interface corresponding to the user when the target server acquires the login request sent by the user. The information acquisition module is configured to acquire a target username, a target fixed password and a target dynamic password input by the user in response to the prompt information through the target server. The fixed password verification module is configured to verify the target fixed password according to the target username. The first information forwarding module is configured to forward the target username and the target dynamic password to an authentication forwarding server if the verification is passed. The mobile terminal determination module is configured to determine a mobile terminal corresponding to the target username through the authentication forwarding server. The second information forwarding module is configured to forward the target dynamic password and a token number corresponding to the target username to the mobile terminal. The seed value determination module is configured to determine a seed value corresponding to the token number from the mobile terminal. The current dynamic password calculation module is configured to calculate a current dynamic password by using the seed value. The comparison module is configured to compare whether the current dynamic password and the target dynamic password are consistent through the mobile terminal. The response generation and forwarding module is configured to generate response information of "authentication passed" and forward the response information to the target server through the authentication forwarding server if the current dynamic password and the target dynamic password are consistent.

9. An electronic device, comprising: The computer program is stored in the memory and is executed by the processor to implement the identity authentication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer program is stored in the memory and is executed by the processor to implement the identity authentication method according to any one of claims 1 to 7.

Images