Offline authentication method, device, system and storage medium

Abstract

The present disclosure is about an offline authentication method, device, system and storage medium, which relates to the field of communication technology and is used to reduce the information length of authentication information input by users in offline scenarios and improve applicability. The method includes: obtaining an authentication request sent by a second device, the authentication request is used to request a server to generate authentication information, and the authentication information is used to authenticate a first device; determining a first device to be authenticated based on the authentication request, and determining a target authentication level corresponding to the first device, wherein different first devices correspond to different authentication levels; determining a target byte length corresponding to the target authentication level based on the target authentication level, wherein different authentication levels correspond to different byte lengths of authentication information; generating target authentication information whose byte length meets the target byte length; sending the target authentication information to the second device, and the second device providing the target authentication information to the first device.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an offline authentication method, device, system and storage medium. Background Art

[0002] Authentication refers to verifying whether the user has the right to access the system. Generally, the device to be authenticated requests the server for authorization. The server verifies the authority relationship between the device to be authenticated and the requesting user. If it passes, it signs and sends it to the device to be authenticated. The device to be authenticated verifies the signature through the preset server public key. If it passes, it is considered that the server agrees to this operation, that is, the user is allowed to operate.

[0003] However, since the signature data is generally long, it is difficult to use it manually in offline scenarios. It is generally used when the server and the device to be authenticated can communicate directly. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present disclosure provides an offline authentication method, device, system and storage medium.

[0005] According to a first aspect of an embodiment of the present disclosure, there is provided an offline authentication method, which is applied to a server, and the method comprises: obtaining an authentication request sent by a second device, the authentication request being used to request the server to generate authentication information, the authentication information being used to authenticate a first device; determining a first device to be authenticated based on the authentication request, and determining a target authentication level corresponding to the first device, wherein different first devices correspond to different authentication levels; determining a target byte length corresponding to the target authentication level based on the target authentication level, wherein different authentication levels correspond to different byte lengths of authentication information; generating target authentication information having a byte length that conforms to the target byte length; and sending the target authentication information to the second device, wherein the second device provides the target authentication information to the first device.

[0006] In one embodiment, generating target authentication information whose byte length conforms to the byte length of the target authentication information includes: determining the device identification information and temporary public key of the first device; generating first authentication information based on the private key of the server, the device identification information of the first device and the temporary public key, the byte length in the first authentication information being a specified byte length; and intercepting authentication information whose byte length is the target byte length from the first authentication information as the target authentication information.

[0007] In another implementation, the authentication request includes an identification code, which is obtained by the second device scanning the identification code displayed in the display component of the first device and is used to identify the first device.

[0008] In yet another embodiment, before sending the target authentication information to the first device, the method further includes: performing identity authentication on the first device, and determining whether the authentication of the first device is successful.

[0009] According to a second aspect of an embodiment of the present disclosure, an offline authentication method is provided, which is applied to a first device, and the method includes:

[0010] Receive target authentication information input by a user, wherein the target authentication information corresponds to a target authentication level of the first device, and the byte length of the target authentication information is a target byte length, wherein different devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information; and perform authentication based on the target authentication information.

[0011] In one embodiment, the authentication based on the target authentication information includes: obtaining second authentication information, where the second authentication information is determined based on the public key of the server and the device identification information of the first device and the temporary public key of the first device; based on the target byte length, comparing the target authentication information with the corresponding target bytes in the second authentication information; in response to the target bytes of the target authentication information and the second authentication information being consistent, authentication is passed.

[0012] In another embodiment, before receiving the target authentication information input by the user, the method also includes: receiving the target operation of the user, generating an identification code based on the target operation and displaying an input interface, the identification code is used to identify the first device, and the input interface is used to receive the target authentication information input by the user.

[0013] In yet another embodiment, generating the identification code based on the target operation includes: generating a temporary public key based on the target operation; and generating the identification code based on the device identification information and the temporary public key.

[0014] According to a third aspect of an embodiment of the present disclosure, there is provided an offline authentication method, which is applied to a second device, and the method comprises: in response to obtaining device identification information of a first device, sending an authentication request to a server, the authentication request being used to request the server to generate authentication information, and the authentication information being used to authenticate the first device; wherein the first device corresponds to a target authentication level, the target authentication level corresponds to a target byte length, different first devices correspond to different authentication levels, and different authentication levels correspond to authentication information with different byte lengths; receiving the target authentication information sent by the server, and providing the target authentication information to the first device.

[0015] In one embodiment, obtaining the device identification information of the first device includes: scanning an identification code displayed in a display component of the first device, the identification code being used to identify the first device; and obtaining the device identification information and a temporary public key of the first device based on the identification code.

[0016] According to a fourth aspect of an embodiment of the present disclosure, there is provided an offline authentication device, which is applied to a server, and the device comprises: an acquisition module, which is used to acquire an authentication request sent by a second device, wherein the authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate a first device; a processing module, which is used to determine a first device to be authenticated based on the authentication request, and determine a target authentication level corresponding to the first device, wherein different first devices correspond to different authentication levels; based on the target authentication level, determine a target byte length corresponding to the target authentication level, wherein different authentication levels correspond to different byte lengths of authentication information; generate target authentication information whose byte length conforms to the target byte length; and a sending module, which is used to send the target authentication information to the second device, and the second device provides the target authentication information to the first device.

[0017] In one embodiment, the processing module is specifically used to determine the device identification information and temporary public key of the first device; generate first authentication information based on the private key of the server, the device identification information of the first device and the temporary public key of the first device, and the byte length in the first authentication information is a specified byte length; and extract authentication information with a byte length of the target byte length from the first authentication information as the target authentication information.

[0018] In another implementation, the authentication request includes an identification code, which is obtained by the second device scanning the identification code displayed in the display component of the first device and is used to identify the first device.

[0019] In yet another embodiment, the verification module is used to authenticate the identity of the first device and determine whether the verification of the first device is successful.

[0020] According to a fifth aspect of an embodiment of the present disclosure, an offline authentication device is provided, which is applied to a first device, and the device includes: a receiving module, which is used to receive target authentication information input by a user, the target authentication information corresponds to a target authentication level of the first device, and the byte length of the target authentication information is a target byte length, wherein different devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information; and a processing module, which is used to perform authentication based on the target authentication information.

[0021] In one embodiment, the processing module is specifically used to obtain second authentication information, where the second authentication information is determined based on a public key of a server and device identification information of the first device and a temporary public key; based on the target byte length, the target authentication information is compared with the corresponding target bytes in the second authentication information; in response to the target bytes of the target authentication information and the first authentication information being consistent, authentication is passed.

[0022] In another embodiment, the receiving module is used to receive the target operation of the user; the processing module is also used to generate an identification code based on the target operation and display an input interface, the identification code is used to identify the first device, and the input interface is used to receive target authentication information input by the user.

[0023] In yet another embodiment, the processing module is further configured to generate a random number based on the target operation; and generate the identification code based on the device identification information and the random number.

[0024] According to a sixth aspect of an embodiment of the present disclosure, there is provided an offline authentication apparatus, which is applied to a second device, and the apparatus comprises: a sending module, which is used to send an authentication request to a server in response to obtaining device identification information of a first device, wherein the authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device; wherein the first device corresponds to a target authentication level, the target authentication level corresponds to a target byte length, different first devices correspond to different authentication levels, and different authentication levels correspond to authentication information with different byte lengths; and a receiving module, which is used to receive the target authentication information sent by the server and provide the target authentication information to the first device.

[0025] In one implementation, the sending module is specifically used to scan an identification code displayed in a display component of the first device, where the identification code is used to identify the first device; and to obtain device identification information and a temporary public key of the first device based on the identification code.

[0026] According to a seventh aspect of an embodiment of the present disclosure, an offline authentication system is provided, the system comprising: a second device, used to obtain device identification information of a first device, and send an authentication request to a server; the server, used to determine a first device to be authenticated based on the authentication request, and determine a target authentication level corresponding to the first device; based on the target authentication level, determine a target byte length corresponding to the target authentication level; generate target authentication information whose byte length conforms to the target byte length; send the target authentication information to the second device; the second device, further used to display the target authentication information; the first device, used to receive the target authentication information input by a user, and perform authentication based on the target authentication information.

[0027] In one embodiment, the server is specifically used to determine the device identification information and temporary public key of the first device; based on the private key of the server, the device identification information of the first device and the temporary public key, generate first authentication information, the byte length in the first authentication information is a specified byte length; and intercept authentication information with a byte length of the target byte length from the first authentication information as the target authentication information.

[0028] In another embodiment, the first device is specifically used to obtain second authentication information, where the second authentication information is determined based on a public key of a server, device identification information of the first device, and a temporary public key of the first device; based on the target byte length, the target authentication information is compared with the corresponding target bytes in the second authentication information; in response to a comparison and consistency between the target bytes of the target authentication information and the target bytes of the second authentication information, authentication is passed.

[0029] In yet another embodiment, the authentication request includes an identification code, and the identification code is used to identify the first device;

[0030] The first device is further used to receive a target operation of the user; generate an identification code based on the target operation and display an input interface, wherein the input interface is used to receive target authentication information input by the user.

[0031] In yet another embodiment, the first device is specifically configured to generate a temporary public key based on the target operation, and to generate the identification code based on the device identification information and the temporary public key.

[0032] In yet another embodiment, the second device is specifically configured to scan an identification code displayed on a display component of the first device, and obtain device identification information and a temporary public key of the first device based on the identification code.

[0033] In yet another implementation manner, the server is further configured to authenticate the identity of the first device and determine whether the authentication of the first device is successful.

[0034] According to an eighth aspect of an embodiment of the present disclosure, an offline authentication device is provided, comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured to execute the offline authentication method as described in the above-mentioned first aspect, second aspect and third aspect and their implementation methods.

[0035] According to the ninth aspect of an embodiment of the present disclosure, a non-temporary computer-readable storage medium is provided. When the instructions in the storage medium are executed by a processor of a mobile terminal, the mobile terminal is enabled to execute the offline authentication method as described in the first aspect, the second aspect and the third aspect and their implementation methods.

[0036] The technical solution provided by the embodiments of the present disclosure may include the following beneficial effects: determining the first device to be authenticated based on the authentication request, and determining the target authentication level corresponding to the first device. Since different first devices correspond to different authentication levels, the byte length of the authentication information of different devices can be determined according to the authentication level, without obtaining all the bytes of the authentication information. At the same time, the target authentication information is received by the second device. The user only needs to obtain the target authentication information through the second device, and input the target bytes of the target authentication information into the first device. The first device and the server do not need to be directly connected, which reduces the length of information manually input by the user. Furthermore, the first device does not need to preset a shared secret with the authentication server. The first device and the server implement information interaction through the second device. Therefore, there is no need to worry about the cracking of a first device causing the terminals of the entire system to be cracked. Authentication can also be achieved and the security of authentication can be guaranteed in offline scenarios.

[0037] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0039] Figure 1 The diagram is an application scenario diagram of an offline authentication system according to an exemplary embodiment.

[0040] Figure 2 The present invention is a flowchart of an offline authentication system performing offline authentication according to an exemplary embodiment.

[0041] Figure 3The present invention is a flowchart of an offline authentication system performing offline authentication according to an exemplary embodiment.

[0042] Figure 4 The present invention is a flowchart of an offline authentication method according to an exemplary embodiment.

[0043] Figure 5 The figure is a flow chart showing another offline authentication method according to an exemplary embodiment.

[0044] Figure 6 The figure is a flow chart of another offline authentication method according to an exemplary embodiment.

[0045] Figure 7 The figure is a flow chart of another offline authentication method according to an exemplary embodiment.

[0046] Figure 8 The figure is a flow chart of another offline authentication method according to an exemplary embodiment.

[0047] Fig. 9 The figure is a flow chart of another offline authentication method according to an exemplary embodiment.

[0048] Fig.10 The invention is a block diagram of an offline authentication device according to an exemplary embodiment.

[0049] Fig.11 The invention is a block diagram showing another offline authentication device according to an exemplary embodiment.

[0050] Fig.12 It is a block diagram of yet another offline authentication device according to an exemplary embodiment.

[0051] Fig.13 The invention is a block diagram showing a device applied to an offline authentication method according to an exemplary embodiment.

[0052] Fig.14 It is a block diagram showing another device applied to an offline authentication method according to an exemplary embodiment. DETAILED DESCRIPTION

[0053] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present disclosure.

[0054] As described in the background technology, authentication refers to verifying whether the user has the right to access the system. Generally, the device to be authenticated requests the server for authorization. The server verifies the authority relationship between the device to be authenticated and the requesting user. If it passes, it will sign and send it to the device to be authenticated. The device to be authenticated verifies the signature through the preset server public key. If it passes, it is considered that the server agrees to the operation, that is, the user is allowed to operate. However, since the signature data length is generally long, it is difficult to apply to offline scenarios. It is generally used when the server and the device to be authenticated can communicate directly.

[0055] Among the current authentication methods, some use the default administrator password, that is, the device to be authenticated requires a specific administrator password to be entered before it can be executed. The administrator modifies the default administrator password after the device is enabled, and then the new administrator password must be used to operate. This method has limited usage scenarios, that is, when the device to be authenticated is not in the user's use stage, or the product cannot set the administrator role, this method cannot be used.

[0056] Some other methods use pre-set shared keys or pre-set shared secret algorithms. Pre-set shared keys means that the device to be authenticated pre-sets a key, and the server stores the pre-set keys of all devices to be authenticated, and then performs permission challenges and authentication based on this shared key; pre-set shared secret algorithms are also called custom derived algorithms, that is, the same algorithm is preset between the device to be authenticated and the server. The algorithm is based on specific evolution rules (such as generating a verification code once a minute). When authentication is required, the user obtains the current verification code from the server and then inputs it to the device to be authenticated. The device to be authenticated uses the same method to calculate and compare whether the input value and the calculated value are consistent. However, both are essentially shared secrets between the device to be authenticated and the server. The disadvantage of this method is that once the attacker knows the pre-set key or the custom derived algorithm, the entire system will fail or collapse. Therefore, a very high level of protection for shared secrets is required.

[0057] Based on the above problems, the present disclosure provides an offline authentication method, which can be applied to offline scenarios. The target authentication information that meets the target byte length is determined based on the authentication level of the device to be authenticated. The target authentication information is received by the scanning device. The user only needs to obtain the target authentication information through the scanning device and input the target bytes of the target authentication information into the device to be authenticated. The device to be authenticated and the server do not need to be directly connected, which reduces the length of information manually input by the user. At the same time, the device to be authenticated and the authentication server generate a shared secret through negotiation without presetting. The device to be authenticated and the server realize information interaction through the scanning device, so there is no need to worry about the cracking of a certain device to be authenticated causing the terminals of the entire system to be cracked, thereby ensuring the security of authentication.

[0058] Figure 1 is a schematic diagram of an offline authentication system according to an exemplary embodiment. Figure 1 As shown, it includes a device to be authenticated 1, a scanning device 2, a server 3 and a user.

[0059] Among them, the device to be authenticated 1 is in an offline state, and the public key of the server 3 is preset in the device to be authenticated 1. At the same time, the device to be authenticated has a display component, which can output information to the display component and can also receive user input. The scanning device 2 is connected to the server 3 and is in a networked state. The scanning device 2 has a display component and can output information to the display component. At the same time, the scanning device 2 also needs to have the function of scanning identification codes. The server 3 stores the device identification information, user information, the private key of the server 3 and the public key of the server 3 of all the devices to be authenticated 1, and makes the public key of the server 3 public. The user can obtain the information displayed in the scanning device 2, and input the information displayed in the scanning device 2 into the device to be authenticated 1.

[0060] In the disclosed embodiment, the interaction between the device to be authenticated and the server is realized by a scanning device, and authentication can also be realized in an offline scenario.

[0061] For the convenience of description in the embodiments of the present disclosure, the device to be authenticated is referred to as a first device, and the scanning device is referred to as a second device.

[0062] based on Figure 1 The offline authentication system shown in FIG. 1 specifically describes the process of offline authentication by the offline authentication system. Figure 2 As shown, Figure 2 The following is a flow chart of an offline authentication system performing offline authentication according to an exemplary embodiment, wherein:

[0063] The second device is used to obtain the device identification information ID and the temporary public key k*G of the first device, and send an authentication request to the server;

[0064] The server is used to determine the first device to be authenticated based on the authentication request, and determine the target authentication level corresponding to the first device; based on the target authentication level, determine the target byte length corresponding to the target authentication level; generate target authentication information v whose byte length meets the target byte length; and send the target authentication information v to the second device;

[0065] The second device is further used to display the target authentication information v;

[0066] The first device is used to receive target authentication information v input by a user and perform authentication based on the target authentication information v.

[0067] In the disclosed embodiment, the server determines the first device to be authenticated based on the authentication request, and determines the target authentication level corresponding to the first device. Since different first devices correspond to different authentication levels, the byte length of the authentication information of different devices can be determined according to the authentication level, without obtaining all the bytes of the authentication information. At the same time, the target authentication information is received by the second device. The user only needs to obtain the target authentication information through the second device, and input the target bytes of the target authentication information into the first device. The first device and the server do not need to be directly connected, which reduces the length of information manually input by the user. Furthermore, the first device does not need to preset a shared secret with the authentication server. The first device and the server implement information exchange through the second device. Therefore, there is no need to worry about the cracking of a first device causing the entire system's terminals to be cracked. Authentication can also be achieved and the security of authentication can be guaranteed in offline scenarios.

[0068] In some embodiments, an identification code is displayed in the first device, and the second device scans the identification code displayed in the display component of the first device, and obtains the device identification information ID and the temporary public key k*G of the first device based on the identification code.

[0069] In one implementation, the first device receives a target operation from the user, generates an identification code based on the target operation, and displays an input interface, where the input interface is used to receive target authentication information v input by the user.

[0070] Exemplarily, the first device generates a temporary public key k*G based on the target operation, and generates an identification code based on the device identification information ID and the temporary public key k*G, where k is the temporary private key of the first device and G is the base point.

[0071] In the disclosed embodiment, the second device can obtain the device identification information of the first device by scanning the identification code displayed in the display component of the first device, so that the first device and the server do not need to interact, and the server can also obtain the device identification information of the first device when the first device is offline. At the same time, the first device can resist replay attacks by using the device identification information and the identification code generated by the temporary public key randomly generated each time.

[0072] In some embodiments, the server determines the device identification information ID and temporary public key k*G of the first device; based on the server's private key d, the device identification information ID and temporary public key k*G of the first device, generates first authentication information V, and the byte length in the first authentication information V is a specified byte length; and extracts authentication information with a byte length of the target byte length from the first authentication information V as the target authentication information v.

[0073] Exemplarily, the first authentication information V is calculated by the formula V=HMAC(M, ID), where HMAC represents the HMAC algorithm, M represents the shared secret between the server and the first device, M=d*(k*G), d represents the private key of the server, (k*G) represents the temporary public key of the first device, k represents the temporary private key of the first device, G represents the base point, and ID represents the device identification information of the first device.

[0074] Furthermore, a method of extracting authentication information having a byte length equal to a target byte length from the first authentication information V is pre-agreed between the server and the first device.

[0075] In the embodiment of the present disclosure, authentication information with a byte length equal to the target byte length is intercepted from the first authentication information as the target authentication information, thereby reducing the byte length of the authentication information input by the user and improving the usability.

[0076] In some embodiments, the first device obtains the second authentication information v', which is determined based on the public key R of the server, the device identification information ID of the first device, and the temporary public key k*G of the first device; based on the target byte length, the target authentication information v and the corresponding target bytes in the second authentication information v' are compared; in response to the target bytes of the target authentication information v and the second authentication information v' being consistent, the authentication is passed.

[0077] Exemplarily, the second authentication information v' is determined based on v'=HMAC(M', ID). Wherein, v' represents the second authentication information, HMAC represents the HMAC algorithm, M'=k*R, M' represents the shared secret between the server and the first device, k represents the temporary private key generated by the first device, R represents the public key of the server, and ID represents the device identification information of the first device.

[0078] In the disclosed embodiment, the shared secret between the first device and the server is generated in real time based on the temporary private key of the first device for each authentication. The first device does not need to preset the shared secret or store other secret information, but only needs to save the public key of the server. Therefore, there is no need to worry about the cracking of a first device causing the cracking of all first devices in the system.

[0079] In order to more clearly describe the offline authentication system of the embodiment of the present disclosure, Figure 3 As shown, Figure 3A detailed flow chart of an offline authentication system for offline authentication is shown, specifically: when the first device receives a target operation from a user, the first device generates a temporary public key k*G, and the first device generates an identification code using the device identification information ID of the first device and the temporary public key k*G of the first device, and displays the identification code in the first device and an input interface, where the input interface is used to remind the user to input the target authentication information v. The user uses a code scanning device to scan the identification code displayed in the first device to obtain the device identification information ID of the first device and the temporary public key k*G of the first device, and sends the ID and K*G to the server. The server uses the ID and k*G to authenticate the first device. When the identity authentication is passed, the server calculates the first authentication information V (where d represents the private key of the server) according to the formula V=HMAC(d*(k*G), ID), and intercepts the authentication information with a byte length of the target byte length from the first authentication information V as the target authentication information v, and then sends the target authentication information v to the second device, which displays the target authentication information v. After the user obtains the target authentication information v through the second device, the target authentication information v is input into the input interface of the first device. The first device calculates the second authentication information v' according to the formula v'=HMAC(k*R, ID) (where k represents the temporary private key generated by the first device and R represents the public key of the server). The first device compares the corresponding target bytes in the target authentication information v and the second authentication information v'. When the target bytes of the target authentication information v and the second authentication information v' are consistent, the authentication is passed.

[0080] In the embodiment of the present disclosure, the first device and the server do not need to interact directly, and the authentication is completed through the second device, so that the solution of the embodiment of the present disclosure is also applicable in offline scenarios. At the same time, the user only needs to enter the byte length of the target authentication information in the first device, which greatly reduces the length of manually input information and improves practicality.

[0081] Based on the offline authentication system provided by the embodiment of the present disclosure, the embodiment of the present disclosure also provides an offline authentication method. The following embodiments will be described with the server, the first device and the second device as the execution subjects respectively.

[0082] Figure 4 is a flow chart of an offline authentication method according to an exemplary embodiment. Figure 4 As shown, the offline authentication method is used in the server and includes the following steps.

[0083] In step S11, an authentication request sent by the second device is obtained.

[0084] The authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device.

[0085] In step S12, a first device to be authenticated is determined based on the authentication request, and a target authentication level corresponding to the first device is determined.

[0086] Different first devices correspond to different authentication levels.

[0087] Optionally, the correspondence between the device and the authentication level may be pre-stored in the server, or the authentication request may carry the authentication level corresponding to the first device to be authenticated.

[0088] For example, when the correspondence between the device and the authentication level is pre-stored in the server, the first device to be authenticated is determined through the authentication request, and the server searches for the corresponding security level of the first device from the stored correspondence between the device and the authentication level. For another example, when the authentication request carries the authentication level corresponding to the first device to be authenticated, the server only needs to parse the authentication request to determine the first device and the corresponding authentication level.

[0089] In step S13, based on the target authentication level, a target byte length corresponding to the target authentication level is determined.

[0090] Among them, different authentication levels correspond to different byte lengths of authentication information.

[0091] It should be understood that the higher the authentication level, the longer the byte length of the corresponding authentication information. For example, if the authentication level of the first device A is 2, the byte length of the authentication information of the first device A is 4; if the authentication level of the first device B is 4, the byte length of the authentication information of the second device B is 8.

[0092] In step S14, target authentication information v is generated whose byte length conforms to the target byte length.

[0093] In step S15, the target authentication information v is sent to the second device, and the second device provides the target authentication information v to the first device.

[0094] The second device providing the target authentication information v to the first device may enable the user to obtain the target authentication information v through the second device, and input the target authentication information v into the first device.

[0095] In the disclosed embodiment, by obtaining the authentication request sent by the second device, the first device to be authenticated is determined based on the authentication request, and the target authentication level corresponding to the first device is determined. Since different first devices correspond to different authentication levels, the byte length of the authentication information of different devices can be determined according to the authentication level, and there is no need to obtain all the bytes of the authentication information. At the same time, the target authentication information is received by the second device. The user only needs to obtain the target authentication information through the second device and input the target bytes of the target authentication information into the first device. The first device and the server do not need to be directly connected, which reduces the length of information manually input by the user. Furthermore, the first device does not need to preset a shared secret with the authentication server. The first device and the server realize information exchange through the second device. Therefore, there is no need to worry that the cracking of a first device will lead to the cracking of the entire system's terminals. Authentication can also be achieved and the security of authentication can be guaranteed in offline scenarios.

[0096] In some embodiments, the target authentication information having a byte length that matches the byte length of the target authentication information is generated through steps S21-S23, such as Figure 5 As shown, the following steps are included:

[0097] In step S21, the device identification information ID and the temporary public key k*G of the first device are determined.

[0098] In step S22, first authentication information V is generated based on the private key d of the server, the device identification information ID of the first device and the temporary public key k*G.

[0099] The byte length in the first authentication information V is the specified byte length.

[0100] Optionally, the specified byte length is the byte length calculated by the preset algorithm. The authentication information V used for verification is calculated by sharing the secret M. Public algorithms can be used for derivation, such as the HMAC algorithm, hash digest algorithm, AES encryption algorithm, etc., or custom derived algorithms can be used. In this example, the HMAC algorithm is used as an example:

[0101] Exemplarily, the first authentication information is calculated by the formula V=HMAC(M, ID). Wherein, V represents the first authentication information, HMAC represents the HMAC algorithm, M represents the shared secret between the server and the first device, M=d*(k*G), d represents the private key of the server, (k*G) represents the temporary public key of the first device, k represents the temporary private key of the first device, G represents the base point of the elliptic curve in the asymmetric encryption algorithm, and ID represents the device identification information of the first device.

[0102] In this example, the way in which the first device and the server each calculate the shared secret is a typical process of ECDH, but the key agreement algorithm for calculating the shared secret includes but is not limited to ECDH, DH and other algorithms, and any key agreement algorithm can be used.

[0103] In step S23, authentication information with a byte length equal to the target byte length is intercepted from the first authentication information V as the target authentication information v.

[0104] The method of extracting authentication information with a byte length equal to the target byte length from the first authentication information V is pre-agreed between the server and the first device. For example, the first 6 bits are extracted from the first authentication information as the target authentication information.

[0105] In the embodiment of the present disclosure, authentication information with a byte length equal to the target byte length is intercepted from the first authentication information V as the target authentication information v, thereby reducing the byte length of the authentication information input by the user and improving the usability.

[0106] In some embodiments, the authentication request includes an identification code, which is obtained by the second device scanning the identification code displayed in the display component of the first device and is used to identify the first device.

[0107] In the embodiment of the present disclosure, the device identification information ID and the temporary public key k*G of the first device can be obtained by scanning the identification code displayed in the display component of the first device by the second device, thereby eliminating the need for the first device and the server to interact. When the first device is offline, the server can also obtain the device identification information of the first device.

[0108] In some embodiments, before sending the target authentication information v to the first device, it is necessary to authenticate the identity of the first device and determine whether the authentication of the first device is successful.

[0109] Optionally, the server pre-stores device identification information of all first devices, and obtains the device identification information of the first device to be authenticated by parsing the identification code displayed in the display component of the first device scanned by the second device, and compares the information with the device identification information pre-stored in the server. If the comparison is consistent, the identity authentication of the first device is successful.

[0110] In the embodiment of the present disclosure, the server first needs to authenticate the first device to prove that the first device meets the authentication requirements to avoid the situation where the identity of the first device does not meet the requirements.

[0111] Figure 6 is a flow chart of an offline authentication method according to an exemplary embodiment. Figure 6 As shown, the authentication method is used in the first device and includes the following steps.

[0112] In step S31, target authentication information v input by a user is received.

[0113] The target authentication information corresponds to the target authentication level of the first device, and the byte length of the target authentication information is the target byte length.

[0114] It should be understood that different devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information.

[0115] In step S32, authentication is performed based on the target authentication information v.

[0116] In the disclosed embodiment, since the byte length of the target authentication information is the target byte length, the user does not need to enter all the authentication information when entering the authentication information, but only needs to enter the target authentication information, which reduces the byte length of the authentication information entered by the user and improves ease of use. At the same time, when authentication is performed based on the target authentication information, the speed of authentication is also improved because the byte length of the target authentication information is reduced.

[0117] In some embodiments, authentication based on target authentication information is implemented through steps S41-S43, such as Figure 7 As shown, the following steps are included:

[0118] In step S41, the second authentication information v' is obtained.

[0119] The second authentication information v' is determined based on the public key of the server, the device identification information of the first device, and the temporary public key of the first device.

[0120] One implementation method is that when the target authentication information v is intercepted from the first authentication information calculated by the formula V=HMAC(M, ID). The second authentication information is determined based on v'=HMAC(M', ID). Wherein, v' represents the second authentication information, HMAC represents the HMAC algorithm, M'=k*R, M' represents the shared secret between the server and the first device, k represents the temporary private key generated by the first device, R represents the public key of the server, and ID represents the device identification information of the first device.

[0121] In step S42, based on the target byte length, the target authentication information v and the corresponding target bytes in the second authentication information v' are compared.

[0122] Exemplarily, the target byte length is 6 and is the first 6 bits of the target authentication information, then the target authentication information V and the corresponding first 6 bits of the second authentication information V' are compared.

[0123] In step S43, in response to the target bytes of the target authentication information v and the second authentication information v' being compared and consistent, the authentication is passed.

[0124] Exemplarily, if the target authentication information is 514564 and the target byte of the second authentication information is 748566, it indicates that the comparison is inconsistent and the authentication fails. If the target authentication information is 514564 and the target byte of the second authentication information is 514564, it indicates that the comparison is consistent and the authentication passes.

[0125] In the disclosed embodiment, the shared secret between the first device and the server is generated in real time based on the temporary private key of the first device for each authentication. The first device does not need to preset the shared secret or store other secret information, but only needs to save the public key of the server. Therefore, there is no need to worry about the cracking of a first device causing the cracking of all first devices in the system.

[0126] In some embodiments, such as Figure 8 As shown, before receiving the target authentication information input by the user, the method further includes the following steps:

[0127] In step S51, a target operation of the user is received.

[0128] In step S52, an identification code is generated based on the target operation and an input interface is displayed.

[0129] The identification code is used to identify the first device, and the input interface is used to receive target authentication information input by the user.

[0130] In the disclosed embodiment, a target operation of the user is received and an identification code is generated through the target operation. In an offline scenario, the server can also obtain the device identification information of the first device by scanning the identification code through the second device, thereby improving applicability.

[0131] In some embodiments, generating an identification code based on a target operation is achieved in the following manner: generating a temporary public key based on the target operation, and generating an identification code based on device identification information and the temporary public key.

[0132] In the embodiment of the present disclosure, the identification code generated by the device identification information and the random number randomly generated each time can resist replay attacks.

[0133] In the disclosed embodiment, in order to prevent the attacker from using the scheme of inputting the target authentication information multiple times in the first device to launch a brute force attack, the first device can pre-set the time interval between two authentication failures, the maximum number of times the target authentication information is allowed to be input, the process of regenerating the identification code after several authentication failures, and other measures to improve the security strength.

[0134] Fig. 9 is a flow chart of an offline authentication method according to an exemplary embodiment. Fig. 9 As shown, the authentication method is used in the second device and includes the following steps.

[0135] In step S61, in response to obtaining the device identification information ID and the temporary public key k*G of the first device, an authentication request is sent to the server.

[0136] The authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device.

[0137] Furthermore, the first device corresponds to a target authentication level, the target authentication level corresponds to a target byte length, different first devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information.

[0138] In step S62, the target authentication information v sent by the server is received, and the target authentication information v is provided to the first device.

[0139] In the disclosed embodiment, the second device sends an authentication request to the server, and the second device provides the target authentication information to the first device, so that the first device can also receive the target authentication information generated by the server in an offline state. At the same time, since the byte length of the target authentication information is determined according to the authentication level of the first device, when the user inputs the target authentication information into the first device, the length of the information manually input by the user can be reduced, thereby improving applicability.

[0140] In one implementation, the device identification information of the first device is obtained by scanning an identification code displayed in a display component of the first device, the identification code being used to identify the first device, and obtaining the device identification information and a temporary public key of the first device based on the identification code.

[0141] In the disclosed embodiment, the second device scans the identification code displayed in the first device to obtain the device identification information of the first device, thereby preventing the second device from obtaining wrong device identification information, thereby causing authentication errors.

[0142] In another implementation, the user may input the device identification information of the first device into the second device so that the second device can obtain the device identification information of the first device.

[0143] In some embodiments, in order to further improve the security of authentication, the user's identity can be verified in the second device. For example, the user can be required to log in user information, such as account number and password, biometrics, etc. in the second device so that the server can authenticate the user's identity.

[0144] Based on the same concept, the embodiment of the present disclosure also provides an authentication device.

[0145] It is understandable that the authentication device provided by the embodiment of the present disclosure includes hardware structures and / or software modules corresponding to the execution of each function in order to realize the above functions. In combination with the units and algorithm steps of each example disclosed in the embodiment of the present disclosure, the embodiment of the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present disclosure.

[0146] Fig.10 1 is a block diagram of an offline authentication device according to an exemplary embodiment, which is applied to a server. Fig.10 The device includes an acquisition module 101, a processing module 102, a sending module 103 and a verification module 104.

[0147] An acquisition module 101 is used to acquire an authentication request sent by the second device, where the authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device;

[0148] The processing module 102 is used to determine the first device to be authenticated based on the authentication request, and determine the target authentication level corresponding to the first device, wherein different first devices correspond to different authentication levels; based on the target authentication level, determine the target byte length corresponding to the target authentication level, wherein different authentication levels correspond to different byte lengths of authentication information; and generate target authentication information whose byte length meets the target byte length;

[0149] The sending module 103 is used to send the target authentication information to the second device, and the second device provides the target authentication information to the first device.

[0150] In one implementation, the processing module 102 is specifically used to determine the device identification information and temporary public key of the first device; based on the private key of the server, the device identification information of the first device and the temporary public key of the first device, generate first authentication information, the byte length in the first authentication information is a specified byte length; and intercept authentication information with a byte length of the target byte length from the first authentication information as the target authentication information.

[0151] In another implementation, the authentication request includes an identification code, which is obtained by the second device scanning the identification code displayed in the display component of the first device and is used to identify the first device.

[0152] In yet another implementation, the verification module 104 is configured to perform identity verification on the first device and determine whether the verification of the first device is successful.

[0153] Fig.11 1 is a block diagram of an offline authentication device according to an exemplary embodiment, which is applied to a first device. Fig.11 The device includes a receiving module 201 and a processing module 202.

[0154] The receiving module 201 is used to receive target authentication information input by the user, where the target authentication information corresponds to the target authentication level of the first device, and the byte length of the target authentication information is the target byte length, wherein different devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information;

[0155] The processing module 202 is used to perform authentication based on the target authentication information.

[0156] In one embodiment, the processing module 202 is specifically used to obtain second authentication information, where the second authentication information is determined based on the public key of the server and the device identification information of the first device and the temporary public key; based on the target byte length, the target authentication information is compared with the corresponding target bytes in the second authentication information; in response to the target authentication information and the target bytes of the first authentication information being consistent, the authentication is passed.

[0157] In another implementation, the receiving module 201 is used to receive a target operation of a user;

[0158] The processing module 202 is further used to generate an identification code based on the target operation and display an input interface, where the identification code is used to identify the first device and the input interface is used to receive target authentication information input by a user.

[0159] In yet another implementation, the processing module 202 is further configured to generate a random number based on the target operation; and generate an identification code based on the device identification information and the random number.

[0160] Fig.12 1 is a block diagram of an offline authentication device according to an exemplary embodiment, which is applied to a second device. Fig.12 , the device includes a sending module 301 and a receiving module 302.

[0161] A sending module is used to send an authentication request to a server in response to obtaining the device identification information of the first device, wherein the authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device; wherein the first device corresponds to a target authentication level, the target authentication level corresponds to a target byte length, different first devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information; a receiving module is used to receive the target authentication information sent by the server and provide the target authentication information to the first device.

[0162] In one implementation, the sending module 301 is specifically used to scan an identification code displayed in a display component of the first device, where the identification code is used to identify the first device; and obtain device identification information and a temporary public key of the first device based on the identification code.

[0163] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0164] Fig.13 4 is a block diagram of an apparatus 400 for an authentication method according to an exemplary embodiment. For example, the apparatus 400 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0165] Reference Fig.13 , the device 400 may include one or more of the following components: a processing component 402 , a memory 404 , a power component 406 , a multimedia component 408 , an audio component 410 , an input / output (I / O) interface 412 , a sensor component 414 , and a communication component 416 .

[0166] The processing component 402 generally controls the overall operation of the device 400, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 402 may include one or more processors 420 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 402 may include one or more modules to facilitate the interaction between the processing component 402 and other components. For example, the processing component 402 may include a multimedia module to facilitate the interaction between the multimedia component 408 and the processing component 402.

[0167] The memory 404 is configured to store various types of data to support operations on the device 400. Examples of such data include instructions for any application or method operating on the device 400, contact data, phone book data, messages, pictures, videos, etc. The memory 404 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0168] The power component 406 provides power to the various components of the device 400. The power component 406 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 400.

[0169] The multimedia component 408 includes a screen that provides an output interface between the device 400 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 408 includes a front camera and / or a rear camera. When the device 400 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0170] The audio component 410 is configured to output and / or input audio signals. For example, the audio component 410 includes a microphone (MIC), and when the device 400 is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 404 or sent via the communication component 416. In some embodiments, the audio component 410 also includes a speaker for outputting audio signals.

[0171] I / O interface 412 provides an interface between processing component 402 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0172] The sensor assembly 414 includes one or more sensors for providing various aspects of the status assessment of the device 400. For example, the sensor assembly 414 can detect the open / closed state of the device 400, the relative positioning of components, such as the display and keypad of the device 400, and the sensor assembly 414 can also detect the position change of the device 400 or a component of the device 400, the presence or absence of user contact with the device 400, the orientation or acceleration / deceleration of the device 400, and the temperature change of the device 400. The sensor assembly 414 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 414 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 414 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0173] The communication component 416 is configured to facilitate wired or wireless communication between the device 400 and other devices. The device 400 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 416 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 416 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0174] In an exemplary embodiment, the apparatus 400 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above method.

[0175] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 404 including instructions, and the instructions can be executed by a processor 420 of the device 400 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0176] Fig.14 is a block diagram of a device 500 for authentication according to an exemplary embodiment. For example, the device 500 may be provided as a server. Fig.14 The apparatus 500 includes a processing component 522, which further includes one or more processors, and a memory resource represented by a memory 532 for storing instructions executable by the processing component 522, such as an application. The application stored in the memory 532 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 522 is configured to execute instructions to perform the above-mentioned offline authentication method.

[0177] The device 500 may also include a power supply component 526 configured to perform power management of the device 500, a wired or wireless network interface 550 configured to connect the device 500 to a network, and an input / output (I / O) interface 558. The device 500 may operate based on an operating system stored in the memory 532, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0178] It is to be understood that in the present disclosure, "plurality" refers to two or more than two, and other quantifiers are similar. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. The singular forms "a", "the" and "the" are also intended to include plural forms, unless the context clearly indicates other meanings.

[0179] It is further understood that the terms "first", "second", etc. are used to describe various information, but such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other, and do not indicate a specific order or degree of importance. In fact, the expressions "first", "second", etc. can be used interchangeably. For example, without departing from the scope of the present disclosure, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information.

[0180] It can be further understood that, unless otherwise specified, “connection” includes a direct connection without other components between the two, and also includes an indirect connection with other components between the two.

[0181] It is further understood that, although the operations are described in a specific order in the drawings in the embodiments of the present disclosure, it should not be understood as requiring the operations to be performed in the specific order shown or in a serial order, or requiring the execution of all the operations shown to obtain the desired results. In certain environments, multitasking and parallel processing may be advantageous.

[0182] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modifications, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

[0183] It should be understood that the present disclosure is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the scope of the appended claims.

Claims

1. An offline authentication method, characterized in that: Applied to a server, the method comprises: Obtaining an authentication request sent by the second device, the authentication request being used to request the server to generate authentication information, the authentication information being used to authenticate the first device; Determining a first device to be authenticated based on the authentication request, and determining a target authentication level corresponding to the first device, wherein different first devices correspond to different authentication levels; Based on the target authentication level, determining a target byte length corresponding to the target authentication level, wherein different authentication levels correspond to different byte lengths of authentication information; Generate target authentication information whose byte length meets the target byte length; The target authentication information is sent to the second device, and the second device provides the target authentication information to the first device.

2. The method according to claim 1, characterized in that The generating of the target authentication information whose byte length matches the byte length of the target authentication information comprises: Determining device identification information and a temporary public key of the first device; Generate first authentication information based on the private key of the server, the device identification information of the first device and the temporary public key, wherein the byte length in the first authentication information is a specified byte length; Authentication information with a byte length equal to the target byte length is intercepted from the first authentication information as the target authentication information.

3. The method according to claim 1 or 2, characterized in that: The authentication request includes an identification code, which is obtained by the second device scanning the identification code displayed in the display component of the first device and is used to identify the first device.

4. The method according to claim 1, characterized in that Before sending the target authentication information to the first device, the method further includes: Authentication is performed on the first device, and it is determined that the authentication of the first device is successful.

5. An offline authentication method, characterized in that: Applied to a first device, the method includes: Receive target authentication information input by a user, the target authentication information corresponds to a target authentication level of the first device, and the byte length of the target authentication information is a target byte length, wherein different devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information; Authentication is performed based on the target authentication information.

6. The method according to claim 5, characterized in that The performing authentication based on the target authentication information includes: Acquire second authentication information, where the second authentication information is determined based on a public key of the server, device identification information of the first device, and a temporary public key of the first device; Based on the target byte length, comparing the target authentication information with corresponding target bytes in the second authentication information; In response to the target bytes of the target authentication information and the second authentication information being compared and consistent, the authentication is passed.

7. The method according to claim 5 or 6, characterized in that: Before receiving the target authentication information input by the user, the method further includes: receiving a target operation of the user; An identification code is generated based on the target operation and an input interface is displayed, wherein the identification code is used to identify the first device and the input interface is used to receive target authentication information input by a user.

8. The method according to claim 7, characterized in that The generating of the identification code based on the target operation comprises: generating a temporary public key based on the target operation; The identification code is generated based on the device identification information and the temporary public key.

9. An offline authentication method, characterized in that: Applied to the second device, the method includes: In response to acquiring the device identification information and the temporary public key of the first device, sending an authentication request to the server, the authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device; wherein the first device corresponds to a target authentication level, the target authentication level corresponds to a target byte length, different first devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information; Receive target authentication information sent by the server, and provide the target authentication information to the first device.

10. The method according to claim 9, characterized in that The acquiring the device identification information and the temporary public key of the first device includes: Scanning an identification code displayed in a display component of the first device, where the identification code is used to identify the first device; The device identification information and the temporary public key of the first device are obtained based on the identification code.

11. An offline authentication device, characterized in that: Applied to a server, the device comprises: An acquisition module, used to acquire an authentication request sent by the second device, wherein the authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device; A processing module, configured to determine a first device to be authenticated based on the authentication request, and determine a target authentication level corresponding to the first device, wherein different first devices correspond to different authentication levels; based on the target authentication level, determine a target byte length corresponding to the target authentication level, wherein different authentication levels correspond to different byte lengths of authentication information; and generate target authentication information whose byte length meets the target byte length; The sending module is used to send the target authentication information to the second device, and the second device provides the target authentication information to the first device.

12. The device according to claim 11, characterized in that The processing module is specifically used to determine the device identification information and temporary public key of the first device; generate first authentication information based on the private key of the server, the device identification information of the first device and the temporary public key of the first device, and the byte length in the first authentication information is a specified byte length; and intercept authentication information with a byte length of the target byte length from the first authentication information as the target authentication information.

13. The device according to claim 11 or 12, characterized in that The authentication request includes an identification code, which is obtained by the second device scanning the identification code displayed in the display component of the first device and is used to identify the first device.

14. The device according to claim 11, characterized in that The verification module is used to authenticate the identity of the first device and determine whether the verification of the first device is successful.

15. An offline authentication device, characterized in that: Applied to a first device, the apparatus comprises: A receiving module, configured to receive target authentication information input by a user, wherein the target authentication information corresponds to a target authentication level of the first device, and the byte length of the target authentication information is a target byte length, wherein different devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information; A processing module is used to perform authentication based on the target authentication information.

16. The device according to claim 15, characterized in that The processing module is specifically used to obtain second authentication information, where the second authentication information is determined based on the public key of the server and the device identification information of the first device and a temporary public key; based on the target byte length, the target authentication information is compared with the corresponding target bytes in the second authentication information; in response to the target bytes of the target authentication information and the second authentication information being consistent, the authentication is passed.

17. The device according to claim 15 or 16, characterized in that The receiving module is used to receive the target operation of the user; The processing module is further used to generate an identification code based on the target operation and display an input interface, wherein the identification code is used to identify the first device, and the input interface is used to receive target authentication information input by a user.

18. The device according to claim 17, characterized in that The processing module is further specifically configured to generate a random number based on the target operation; and generate the identification code based on the device identification information and the random number.

19. An offline authentication device, characterized in that: Applied to a second device, the apparatus comprises: A sending module, configured to send an authentication request to a server in response to acquiring the device identification information of the first device, wherein the authentication request is used to request the server to generate authentication information, and the authentication information is used to authenticate the first device; wherein the first device corresponds to a target authentication level, the target authentication level corresponds to a target byte length, different first devices correspond to different authentication levels, and different authentication levels correspond to different byte lengths of authentication information; The receiving module is used to receive the target authentication information sent by the server and provide the target authentication information to the first device.

20. The device according to claim 19, characterized in that The sending module is specifically used to scan the identification code displayed in the display component of the first device, where the identification code is used to identify the first device; and obtain the device identification information and temporary public key of the first device based on the identification code.

21. An offline authentication system, characterized in that: The system comprises: The second device is used to obtain the device identification information and temporary public key of the first device and send an authentication request to the server; The server is configured to determine a first device to be authenticated based on the authentication request, and determine a target authentication level corresponding to the first device; based on the target authentication level, determine a target byte length corresponding to the target authentication level; generate target authentication information whose byte length conforms to the target byte length; and send the target authentication information to the second device; The second device is further used to display the target authentication information; The first device is used to receive target authentication information input by a user and perform authentication based on the target authentication information.

22. The system according to claim 21, characterized in that The server is specifically used to determine the device identification information and temporary public key of the first device; based on the private key of the server, the device identification information of the first device and the temporary public key, generate first authentication information, the byte length in the first authentication information is a specified byte length; intercept authentication information with a byte length of the target byte length from the first authentication information as the target authentication information.

23. The system according to claim 22, characterized in that The first device is specifically used to obtain second authentication information, where the second authentication information is determined based on a public key of a server, device identification information of the first device, and a temporary public key of the first device; based on the target byte length, the target authentication information is compared with the corresponding target bytes in the second authentication information; in response to a comparison and consistency between the target bytes of the target authentication information and the target bytes of the second authentication information, authentication is passed.

24. The system according to any one of claims 21 to 23, characterized in that The authentication request includes an identification code, where the identification code is used to identify the first device; The first device is further used to receive a target operation of the user; generate an identification code based on the target operation and display an input interface, wherein the input interface is used to receive target authentication information input by the user.

25. The system according to claim 24, characterized in that The first device is specifically configured to generate a temporary public key based on the target operation, and to generate the identification code based on the device identification information and the temporary public key.

26. The system according to claim 25, characterized in that The second device is specifically used to scan the identification code displayed in the display component of the first device, and obtain the device identification information and temporary public key of the first device based on the identification code.

27. The system according to claim 21, characterized in that The server is further configured to authenticate the identity of the first device and determine whether the authentication of the first device is successful.

28. An offline authentication device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to: execute the offline authentication method as described in any one of claims 1-4 or 5-8 or 9-10.

29. A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of a mobile terminal, enables the mobile terminal to execute the offline authentication method as described in any one of claims 1-4 or 5-8 or 9-10.

Images