Authentication method and related device

Abstract

The embodiment of the present application discloses an identity authentication method and related devices, which can be applied to cloud technology, artificial intelligence, smart transportation and other fields and related scenarios. For objects associated with the platform, its object identifier can play the role of a unique corresponding object, and the content to be signed is determined by the object identifier and the random number, which reduces the possibility that different objects are determined to have the same content to be signed. Under the premise of ensuring uniqueness, it can also have the randomness provided by the random number, which reduces the possibility of the content to be signed being speculated. The content to be signed is digitally signed to obtain a signature sequence including N characters, and a part of M characters is selected as the object authorization code of the object, which makes the object authorization code not only difficult to predict, but also even if the attacker obtains the content to be signed, it will cost a lot of money to determine the M characters as the object authorization code. Moreover, the object authorization code is only used for identity authentication, which further increases the difficulty of cracking the object authorization code.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to an identity authentication method and related devices. Background Art

[0002] Objects can obtain services provided by the platform by accessing the platform interface of the Internet platform. Before providing services to the object, the platform needs to verify the legitimacy of the object's identity.

[0003] In related technologies, an object's object identifier (OID) is used as the basis for identity verification. This OID is a unique identifier assigned by the platform to an object and is permanently used as the corresponding identifier. The generation of this OID generally follows a certain pattern and is used by the object across various platform services. This regularity and widespread use of OIDs make it easy for attackers to analyze these patterns and obtain the OID. Once an attacker obtains this OID, they can use it to attack the platform through various means, such as identity spoofing.

[0004] It can be seen from this that how to reduce the possibility of the platform being attacked while achieving identity authentication is an urgent problem that needs to be solved. Summary of the Invention

[0005] In order to solve the above technical problems, the present application provides an identity authentication method and related devices, which can have randomness while ensuring uniqueness, reduce the possibility of being speculated, and reduce the complexity of the object authorization code while meeting the identity authentication requirements, thereby improving applicability.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] In one aspect, an embodiment of the present application provides an identity authentication method, the method comprising:

[0008] Get the object identifier of the object associated with the platform;

[0009] Determine the content to be signed according to the object identifier and a random number corresponding to the object;

[0010] Digitally signing the content to be signed to obtain a signature sequence including N characters;

[0011] Determine M characters from the N characters of the signature sequence as the object authorization code of the object, and send the object authorization code to the object, M <N;

[0012] Obtaining an interface access request including an object identifier of the object and a pending authorization code;

[0013] Authentication is performed based on the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object.

[0014] On the other hand, an embodiment of the present application provides an identity authentication device, the device comprising an acquisition unit, a determination unit, a signature unit, and an identity authentication unit:

[0015] The acquisition unit is used to acquire the object identifier of the object associated with the platform;

[0016] The determining unit is configured to determine the content to be signed based on the object identifier and a random number corresponding to the object;

[0017] The signature unit is used to digitally sign the content to be signed to obtain a signature sequence including N characters;

[0018] The determining unit is further configured to determine M characters from the N characters of the signature sequence as the object authorization code of the object, and send the object authorization code to the object. <N;

[0019] The acquisition unit is further configured to acquire an interface access request including an object identifier of the object and a pending authorization code;

[0020] The identity authentication unit is configured to perform identity authentication based on the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object.

[0021] In one possible implementation, the object authorization code is a temporary authorization code that is valid only within a valid period. The determination unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine M characters from the N characters of the signature sequence as the object authorization code of the object, and return the re-determined object authorization code to the object; wherein the re-determined M characters are not exactly the same as the M characters determined when generating the invalid authorization code.

[0022] In one possible implementation, the acquisition unit is further used to trigger the determination unit to re-determine M characters from the N characters in the signature sequence as the object authorization code of the object when obtaining the authorization code update request sent by the object, and return the re-determined object authorization code to the object.

[0023] In a possible implementation, the M characters used as the object authorization code are consecutive characters among the N characters, and the determining unit is further configured to:

[0024] The first position interval of the M characters corresponding to the invalid authorization code in the N characters is moved according to the selection rule to obtain a second position interval, where both the first position interval and the second position interval identify a position range of M characters in the N characters;

[0025] The M characters in the second position interval among the N characters are used as the object authorization code of the object.

[0026] In a possible implementation, the object authorization code is a temporary authorization code that is valid only within a valid period, and the apparatus further includes a sending unit:

[0027] the sending unit is configured to send the signature sequence and a first authorization code update condition to the object, wherein the first authorization code update condition is configured to instruct the object to re-determine the corresponding object authorization code from the signature sequence based on a first update rule when the object authorization code becomes an invalid authorization code;

[0028] The determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine the object authorization code corresponding to the object from the signature sequence based on the first update rule.

[0029] In a possible implementation, the object authorization code is a temporary authorization code that is valid only within a valid period, and the apparatus further includes a sending unit:

[0030] The sending unit is configured to send a second authorization code update condition to the object, wherein the second authorization code update condition is configured to instruct the object to redetermine the object authorization code based on a second update rule for M characters corresponding to the invalid authorization code when the authorization code becomes an invalid authorization code;

[0031] The determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine the object authorization code based on a second updating rule for the M characters corresponding to the invalid authorization code.

[0032] In a possible implementation, the identity verification unit is further configured to:

[0033] If the pending authorization code does not match the object authorization code, determining that the interface access request is an illegal request, and denying access to the platform interface by the interface access request;

[0034] If the pending authorization code matches the object authorization code, it is determined that the interface access request is a legitimate request sent by the object, and the object is allowed to access the corresponding platform interface through the interface access request.

[0035] In a possible implementation, the interface access request further includes a service data packet and a pending service signature sequence obtained by the service data packet based on the pending authorization code, and the identity authentication unit is further configured to:

[0036] Digitally signing the data packet according to the object authorization code to obtain a target service signature sequence;

[0037] If the pending service signature sequence does not match the target service signature sequence, determining that the interface access request is an illegal request and the service data packet fails the integrity check, and denying access to the platform interface by the interface access request;

[0038] If the pending service signature sequence matches the target service signature sequence, it is determined that the interface access request is a legitimate request sent by the object and the service data packet passes the integrity check, and the object is allowed to access the corresponding platform interface through the interface access request.

[0039] In a possible implementation, the determining unit is further configured to concatenate the object identifier and the random number to obtain the content to be signed.

[0040] In a possible implementation, the signature unit is further configured to digitally sign the content to be signed using an information digest algorithm to obtain a signature sequence comprising N characters.

[0041] In a possible implementation, the object identifier is a merchant number, a manufacturer code, or a self-increment identifier of the object.

[0042] In another aspect, an embodiment of the present application provides a computer device, comprising a processor and a memory:

[0043] The memory is used to store program code and transmit the program code to the processor;

[0044] The processor is used to execute the identity authentication method described above according to the instructions in the program code.

[0045] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program, and the computer program is used to execute the identity authentication method described in the above aspects.

[0046] On the other hand, an embodiment of the present application provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the identity authentication method described in the above aspects.

[0047] As can be seen from the above technical solution, for objects associated with the platform, their object identifiers can serve as unique counterparts. Determining the content to be signed using the object identifier and random number not only reduces the likelihood of different objects being identified as having the same content, but also adds a random factor to the content to be signed, ensuring randomness while ensuring uniqueness, reducing the likelihood of the content being deduced. The content to be signed is digitally signed to obtain a signature sequence consisting of N characters, from which a subset of M characters is selected as the object authorization code for the object. This makes the object authorization code not only difficult to predict, but even if an attacker obtains the content to be signed, it would require significant effort to determine the M characters from the N characters that constitute the object authorization code. Furthermore, the object authorization code is only used for identity verification, further increasing the difficulty of cracking it. Furthermore, the object authorization code comprises fewer characters than the signature sequence, reducing its complexity and improving its applicability while still meeting identity verification requirements.

[0048] When an interface access request including the object identifier and pending authorization code of the object is obtained, identity authentication can be performed using the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0050] Figure 1 A schematic diagram of an identity verification scenario provided in an embodiment of the present application;

[0051] Figure 2 A flowchart of an identity verification method provided in an embodiment of the present application;

[0052] Figure 3 A system diagram of an identity authentication scenario provided in an embodiment of the present application;

[0053] Figure 4 A structural diagram of an identity verification device provided in an embodiment of the present application;

[0054] Figure 5 A structural diagram of a terminal device provided in an embodiment of the present application;

[0055] Figure 6 A structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The embodiments of the present application are described below with reference to the accompanying drawings.

[0057] In related technologies, the platform authenticates the connected object through the object's object identifier. However, the generation of object identifiers generally follows a pattern and is widely used, which means that attackers have enough data to analyze the pattern and obtain the object identifier, thereby attacking the platform based on the object identifier.

[0058] To this end, an embodiment of the present application provides an identity authentication method, in which the object authorization code used for identity authentication is not only difficult to predict and crack, but also reduces the complexity of the object authorization code and improves applicability.

[0059] The identity authentication method provided in the embodiments of the present application can be implemented by a computer device, which can be a terminal device or a server. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. Terminal devices include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, and vehicle-mounted terminals. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application.

[0060] Figure 1 A schematic diagram of an identity authentication scenario provided for an embodiment of the present application, wherein server 100 is a server corresponding to a platform, which may be a content platform, a social platform, a management platform, etc.

[0061] Server 100 can obtain object identifiers for objects associated with the platform, where the objects can be users, merchants, and so on. The specific type of object depends on the platform type and is not limited here. Object identifiers are identifiers generated and assigned by the platform for objects and generally serve to uniquely identify the corresponding object.

[0062] For an object in the platform, server 100 can determine a corresponding random number using a random algorithm and determine the content to be signed based on the object identifier and the corresponding random number. For example, if the object identifier is 123456 and the random number is fds1321, the random number can be concatenated with the object identifier to obtain the content to be signed: 123456fds1321. Determining the content to be signed using the object identifier and random number not only reduces the possibility of different objects being identified as having the same content to be signed, but also adds a random factor to the content to be signed, ensuring randomness while ensuring uniqueness, thereby reducing the possibility of the content to be signed being inferred.

[0063] Server 100 digitally signs the content to be signed, generating a signature sequence consisting of N characters. A digital signature is data appended to a data unit, or a cryptographic transformation of the data unit. This data or transformation allows the recipient of the data unit to verify the source and integrity of the data unit and protect the data from forgery by others (e.g., the recipient). This is a method for signing electronic messages. The value of N can depend on the encryption algorithm used to perform the data signing and can also be set.

[0064] The server 100 does not directly use the N-character signature sequence as the object authorization code of the object, but instead determines M characters from the signature sequence as the object authorization code of the object. This makes the object authorization code not only difficult to predict, but also requires a lot of effort to determine M characters from the N characters as the object authorization code even if the attacker obtains the content to be signed.

[0065] After determining the object authorization code, the server 100 sends the object authorization code to the object. Figure 1 The object in the scene obtains the object authorization code through the terminal device 200.

[0066] When an object needs to access the platform to obtain services, the server 100 obtains an interface access request including the object identifier and pending authorization code of the object, and performs authentication based on the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object. The server 100 can return the authentication result to the terminal device 200.

[0067] As can be seen, the object authorization code is only used for identity verification, which makes it more difficult to crack. Moreover, the number of characters included in the object authorization code is relatively small compared to the signature sequence. Under the premise of satisfying identity verification, the object authorization code is reduced in complexity and improved in applicability.

[0068] Figure 2 This is a flowchart of an identity authentication method provided in an embodiment of the present application. In this embodiment, a server is used as the aforementioned computer device for illustration. The method includes:

[0069] S201: Obtain the object identifier of the object associated with the platform.

[0070] As mentioned above, this application does not limit the types of platforms and objects. For example, in one possible implementation, the platform can be a detection platform for device providers, such as social networking or payment applications that require the use of biometric recognition devices, such as facial recognition devices or fingerprint recognition devices, in their application scenarios.

[0071] These biometric devices need to be manufactured and delivered by device manufacturers. Accordingly, the aforementioned application providers need to use a testing platform to perform quality inspections on the delivered devices. This involves running a series of tests to determine if the devices meet the standards of the corresponding application. This testing platform can be a dedicated quality inspection platform or a platform for social or payment applications. This quality inspection is performed through built-in functional portals within the application, leveraging the platform's powerful computing power. Device manufacturers, acting as merchants, will be associated with this testing platform.

[0072] An object identifier uniquely identifies an object. An object on the platform can have one or more object identifiers. For example, in the aforementioned scenario, the object identifier can include at least one of a merchant number, a manufacturer code, or an auto-incremental identifier. The merchant number can be a platform-specific identifier assigned to a merchant upon registration, the manufacturer code can be a number unique to the device manufacturer, and the auto-incremental identifier is a continuously increasing number assigned by the platform to the associated object.

[0073] In this step, for one object, the object identifier obtained by the server can be one or more, and this application does not limit this.

[0074] In a possible implementation, the object identifier is a merchant number, a manufacturer code, or a self-increment identifier of the object.

[0075] S202: Determine the content to be signed according to the object identifier and the random number corresponding to the object.

[0076] Since the object identifier can uniquely identify the object and the random number can bring a random factor, the content to be signed determined by the object identifier and the random number can be random while ensuring uniqueness, reducing the possibility of the content to be signed being speculated.

[0077] The random numbers corresponding to different objects are determined separately through random algorithms, and the random numbers may include a combination of various characters such as numbers, letters, and symbols.

[0078] However, random algorithms are not truly random, but rather pseudo-random. That is, each generated random number is necessarily unique. Therefore, adding an object identifier to uniquely identify the object when determining the content to be signed can also improve the uniqueness of the content to be signed.

[0079] This application does not limit the method of determining the content to be signed by object identification and random numbers. For example, it can be processed by splicing, mixing, etc.

[0080] In a possible implementation, the object identifier and the random number are concatenated to obtain the content to be signed.

[0081] That is, the obtained content to be signed can be in the form of [object identifier + random number] or [random number + object identifier], where "+" is used to indicate concatenation and "[]" is the content to be signed.

[0082] For example, the test platform generates a unique identifier for the device manufacturer in the system. First, the unique identifier of the manufacturer on the platform (such as merchant number, merchant ID, etc.) is obtained based on the manufacturer's identity, such as merchant number: 12345678.

[0083] A randomly generated 16-bit random number (e.g., a combination of numbers and letters) is then appended: AFDL123A20AKX912. This step increases the randomness factor, reducing the chance that an attacker can guess the content to be signed using the object identifier. The resulting string is: 12345678AFDL123A20AKX912, which is the device manufacturer's signature.

[0084] S203: Digitally sign the content to be signed to obtain a signature sequence including N characters.

[0085] This application does not limit the algorithm used to implement the digital signature. For example, in one possible implementation, the content to be signed is digitally signed using the Message-Digest Algorithm (MD5) to obtain a signature sequence including N characters.

[0086] MD5 is a widely used cryptographic hash function that can generate a 128-bit (32-bit hexadecimal) hash value to ensure the integrity and consistency of information transmission.

[0087] For example, for the aforementioned content to be signed: 12345678AFDL123A20AKX912, by performing an MD5 signature on this string, we can obtain a fixed-length (32-hexadecimal digit) signature sequence consisting of a combination of numbers and letters. This signature sequence is unique to the content to be signed and cannot be reversed. Here, taking all uppercase letters, we obtain the signature sequence corresponding to the content to be signed: 889832E84BB5F68BCB7F9953A1037A82.

[0088] S204: Determine M characters from the N characters in the signature sequence as the object authorization code of the object, and send the object authorization code to the object.

[0089] Among them, M < N, that is to say, only a part of the signature sequence will be used as the object authorization code, and M characters are selected from it as the object authorization code of the object, making the object authorization code not only difficult to predict, but also even if the attacker obtains the content to be signed, it will take a large amount of cost to determine M characters as the object authorization code from N characters.

[0090] In one example, for the aforementioned signature sequence including 32 characters (i.e., N = 32): 889832E84BB5F68BCB7F9953A1037A82, 16 characters (i.e., M = 16) can be selected as the object authorization code of the object. These 16 characters can be 16 consecutive characters in the signature sequence or hashed characters, and this application does not limit this.

[0091] After the object authorization code is determined, it will be sent to the object and is only used for the object authentication link. Since the usage scenario of the object authorization code is only for authentication, it further increases the cracking difficulty of the object authorization code. Moreover, the number of characters included in the object authorization code is relatively small compared to the signature sequence, reducing the complexity of the object authorization code and improving the applicability on the premise of meeting the authentication. For example, in some authentication scenarios, the pending authorization code in the interface access request needs to be manually input, and an authorization code with fewer characters can also reduce the input difficulty and the possibility of input errors.

[0092] It should be emphasized that this application does not limit the input method of the pending authorization code in the interface access request. It can be the aforementioned manual input by the object, or the object authorization code can be converted into forms such as a page link or a QR code and provided to the object. The object can add the pending authorization code in the interface access request by clicking the page link or scanning the QR code when the interface access request needs to be sent.

[0093] It should be noted that the aforementioned S201 - S204 belong to the preprocessing stage of the object authorization code and do not need to be implemented every time before authentication. After the object authorization codes of all objects associated with a platform are determined through S201 - S204, it can be no longer executed, or the object authorization codes of newly added objects to the platform can be determined by means of periodic execution, trigger execution, etc.

[0094] That is to say, there is no strict execution order limit between S201 - S204 and S205. The authentication of the interface access request can be executed after the object authorization codes of all objects associated with a platform are determined, or during the process of determining the object authorization codes, the authentication of the interface access requests of the objects that have obtained the object authorization codes can be carried out.

[0095] S205: Obtain an interface access request including the object identifier and the pending authorization code of the object.

[0096] After the object associated with the platform obtains the corresponding object authorization code through S204, it can carry the object authorization code for the platform to authenticate its own identity when accessing the platform to obtain services.

[0097] For the server that obtains the interface access request, which carries the object authorization code that needs to be authenticated, since the authenticity of the object authorization code is not known before obtaining the authentication result, the object authorization code to be verified in the interface access request is recorded as the pending authorization code in this step.

[0098] For example, in the aforementioned quality inspection scenario for biometric identification devices, the object authorization code obtained can be carried in the interface access request used to send the platform including the device quality parameters. The purpose of authenticating the interface access request is, on the one hand, to ensure that the device detection request comes from the manufacturer corresponding to the device model, and on the other hand, for security reasons, to prevent the detection interface from being flooded. In a broad sense, a flood attack refers to a situation where a malicious user uses tools to forge a large number of requests and sends them to the server, maliciously exhausting the server resources and making it impossible for legitimate users to obtain a server response.

[0099] However, this application can effectively prevent the impact of flooding attacks on the platform by performing identity verification before actually processing the interface access request and directly discarding or not processing the illegal interface access request.

[0100] S206: Perform identity authentication based on the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object.

[0101] Since the server can determine the object that sent the interface access request when obtaining the interface access request, it can obtain the object authorization code of the object maintained on the server based on the object identifier. This application does not limit the verification method using the pending authorization code and the object authorization code.

[0102] The authentication result can be obtained through verification, thereby identifying whether the interface access request comes from a legitimate object, that is, whether it is a legitimate request sent by the object.

[0103] As can be seen from this, for objects associated with the platform, their object identifiers can serve as unique counterparts. Determining the content to be signed using the object identifier and random number not only reduces the likelihood of different objects being identified as having the same content, but also adds a random factor to the content to be signed, ensuring randomness while ensuring uniqueness, reducing the likelihood of the content being deduced. Digitally signing the content to be signed produces a signature sequence consisting of N characters, from which M characters are selected as the object authorization code for the object. This makes the object authorization code not only difficult to predict, but even if an attacker obtains the content to be signed, it would require significant effort to determine the M characters from the N that constitute the object authorization code. Furthermore, the object authorization code is only used for identity verification, further increasing the difficulty of cracking it. Furthermore, the object authorization code comprises fewer characters than the signature sequence, reducing its complexity and improving its applicability while still meeting identity verification requirements.

[0104] In order to further increase the difficulty of the object authorization code being cracked by an attacker, a corresponding validity period can be configured for the object authorization code, so that the object authorization code is valid within the validity period and can be used for identity authentication. When the validity period is exceeded, the object authorization code will be switched to an invalid authorization code by the server and cannot be used as a basis for identity authentication, or in other words, the result of identity authentication cannot be obtained. In this case, even if the attacker successfully obtains the object authorization code, he can only attack the platform within the validity period of the object authorization code, which reduces the attack level of the platform. Furthermore, even if the attacker has the technology to obtain the object authorization code, since the object authorization code in this application is very difficult to crack, it is possible that the object authorization code has been switched to an invalid authorization code when the attacker obtains it, further improving the security of the platform.

[0105] The effective duration can be counted from the time the object authorization code is determined, or can be counted from the time the object authorization code is sent to the object. This application does not limit the length of the effective duration, for example, it can be a few days, a few weeks, etc.

[0106] Therefore, in a possible implementation, the object authorization code is a temporary authorization code that is valid only within a valid period. When the object authorization code becomes an invalid authorization code, the method further includes:

[0107] Re-determining M characters from the N characters of the signature sequence as the object authorization code of the object, wherein the re-determined M characters are different from the M characters determined when generating the invalid authorization code.

[0108] That is to say, for an object, when the object authorization code determined by the server for the last time becomes an invalid authorization code, the server can once again determine an available object authorization code for it. Since a signature sequence including N characters has been determined in the aforementioned S203, and only M characters therein are used as the object authorization code through S204, when the object authorization code is re-determined this time, characters can continue to be selected from the signature sequence, and the M characters selected this time are not exactly the same as the M characters used in the object authorization code determined last time.

[0109] This application does not limit the timing of re-determining the object authorization code. The server may start to re-determine a new object authorization code for the object when it finds that the object authorization code of an object has become an invalid authorization code, or the object itself may initiate an object authorization code update to the server.

[0110] In one possible implementation, the method further includes: the server obtaining an authorization code update request sent by the object, and then re-determining the object authorization code based on the signature sequence corresponding to the object.

[0111] In this case, the server does not need to check in real time whether the object authorization code of each object is valid, nor does it need to immediately determine a new object authorization code when the authorization code becomes invalid. It only needs to determine a new object authorization code for the object when it needs it, which reduces the consumption of system resources and improves system stability.

[0112] When determining a new object authorization code, an embodiment of the present application provides a possible implementation method, in which the M characters used as the object authorization code are consecutive characters among the N characters.

[0113] The operation of re-determining M characters from the N characters of the signature sequence as the object authorization code of the object may include the following steps:

[0114] Step 1: Move the M characters corresponding to the invalid authorization code in the first position interval of the N characters according to the selection rule to obtain a second position interval.

[0115] The first position interval and the second position interval both identify a position range of M characters among the N characters.

[0116] Step 2: Using the M characters in the second position interval among the N characters as the object authorization code of the object.

[0117] For example, if the N characters in a signature sequence are in position 1 to position N from left to right, the first position interval may represent a range of positions from position i to position i+M-1 in the signature sequence. The selection rule may be a shift in a certain direction or other selection method. For example, if the position is shifted right by one position, the second position interval may represent a range of positions from position i+1 to position i+M in the signature sequence.

[0118] Taking the aforementioned 32-character signature sequence: 889832E84BB5F68BCB7F9953A1037A82 as an example, when N=32 and M=16, the object authorization code determined for the object for the first time can be the first 16 characters: 889832E84BB5F68B, and the object authorization code re-determined for the second time can be based on the rule of shifting one bit to the right, and the resulting 16 characters are: 89832E84BB5F68BC, and so on, so that 16 object authorization codes can be determined for the object through this signature sequence.

[0119] When the validity period is one month, the signature sequence can be used for 16 months before needing to be replaced. When the validity period is one week, the signature sequence can be used for 4 months before needing to be replaced.

[0120] Furthermore, the selection rules can be configured in a more comprehensive manner based on needs and scenarios, providing greater flexibility for server authentication. If the validity period is one month, the server can shift the object authorization code result based on the current month. For example, if it is May, the object authorization code will be the 16-digit string starting from the 5th digit of the MD5 result, and so on. This automatically switches the authorization code every month.

[0121] When the signature sequence needs to be changed, a random number can be re-determined for the object, and then a new signature sequence can be re-determined for the object based on the method of S202-S203. Then, the object authorization code can be determined and returned to the object in the method of S204 based on the newly determined signature sequence.

[0122] In the scenario where the object authorization code is a temporary authorization code that is valid only within the validity period, in addition to the aforementioned solution in which the server needs to send the re-determined object authorization code to the object when the authorization code becomes an invalid authorization code, an embodiment of the present application also provides a method for re-determining the object authorization code. In this method, there is no need for the server and the object to exchange additional data, and the object can also obtain a re-determined object authorization code after the object authorization code becomes an invalid authorization code.

[0123] It should be noted that, under this determination method, the M characters of the re-determined object authorization code are not completely the same as the M characters of the invalid authorization code.

[0124] The following mainly describes two main specific implementation methods. In these two methods, the object authorization code is a temporary authorization code that is only valid within the validity period.

[0125] The first method of redetermining the object authorization code:

[0126] Step 11: Send the signature sequence and the first authorization code update condition to the object.

[0127] The first authorization code update condition is used to instruct the object to re-determine the corresponding object authorization code from the signature sequence based on the first update rule when the object authorization code becomes an invalid authorization code.

[0128] Step 12: When the object authorization code becomes an invalid authorization code, re-determine the object authorization code corresponding to the object from the signature sequence based on the first update rule.

[0129] In this determination method, when the server sends the object authorization code to the object, it can also send the signature content including N characters determined in S203 to the object, and at the same time send the first authorization code update condition to indicate which update rule to use to re-determine the object authorization code when the object needs to be re-determined.

[0130] When the currently used object authorization code becomes an invalid authorization code, the server and the object can use the same update rule, that is, the first update rule indicated in the first authorization code update condition, to re-determine the same object authorization code from the signature content, thereby achieving resynchronization of the object authorization codes on both the server and the object without the need to send a new object authorization code to the object again through the server, thereby reducing the number of times the object authorization code is exposed during use and reducing the possibility of being intercepted by attackers when sending a new object authorization code to the object.

[0131] The specific form of the first update rule is not limited in this application, as long as it can be achieved that each time a new object authorization code is re-determined, both the server and the object can obtain the same object authorization code.

[0132] For example, the first update rule may be that each time redetermined, M characters are selected from the signature content as the object authorization code according to a specified number of bits or sequence; or when the M characters are consecutive characters in the signature content, each time redetermined, M consecutive characters are selected from the signature content as the object authorization code according to a predetermined number of shift bits, etc.

[0133] The second method of redetermining the object authorization code:

[0134] Step 21: Send the second authorization code update condition to the object.

[0135] The second authorization code update condition is used to instruct the object to redetermine the object authorization code based on the second update rule for the M characters corresponding to the invalid authorization code when the authorization code becomes an invalid authorization code;

[0136] Step 22: When the object authorization code becomes an invalid authorization code, the object authorization code is re-determined based on the second update rule for the M characters corresponding to the invalid authorization code.

[0137] In this determination method, when the server sends the object authorization code to the object, it may also send a second authorization code update condition to instruct the object to which update rule to use when the object authorization code needs to be re-determined.

[0138] When the currently used object authorization code becomes an invalid authorization code, the server and the object can use the same update rule, i.e., the second update rule indicated in the second authorization code update condition, to re-determine the same object authorization code from the invalid authorization code, thereby achieving resynchronization of the object authorization codes on both the server and the object without the need for the server to send a new object authorization code to the object again, thereby reducing the number of times the object authorization code is exposed during use and reducing the possibility of being intercepted by an attacker when sending a new object authorization code to the object.

[0139] The specific form of the second update rule is not limited in this application, as long as it can be achieved that each time a new object authorization code is re-determined, both the server and the object can obtain the same object authorization code.

[0140] For example, the second update rule may be that each time the invalid authorization code is re-determined, the M characters of the invalid authorization code are rearranged according to a specified rearrangement method to obtain the object authorization code, or based on a specified data conversion method, M characters are converted into new M characters as the object authorization code, etc.

[0141] Next, with respect to S206, several main identity authentication methods provided by the embodiment of the present application are described.

[0142] The first authentication method: authentication based on authorization code matching.

[0143] If the pending authorization code does not match the object authorization code, determining that the interface access request is an illegal request, and denying access to the platform interface by the interface access request;

[0144] If the pending authorization code matches the object authorization code, it is determined that the interface access request is a legitimate request sent by the object, and the object is allowed to access the corresponding platform interface through the interface access request.

[0145] Given that the object authorization code provided by this application is difficult to crack, if an attacker cracks the object identifier used for identity authentication in the relevant technology and wants to impersonate the identity of the object to attack the platform, although the interface access request sent by the attacker to the platform can carry the object identifier of the legitimate object, the authorization code will not be the correct object authorization code for the object.

[0146] Therefore, the server can determine the corresponding object authorization code stored in the server through the object identifier, and determine whether to actually process the interface access request based on the matching result between the pending authorization code in the interface access request and the object authorization code. In this way, interface access requests that do not carry the correct object authorization code can be blocked at the very beginning. Even if an attacker launches a flood attack, the impact will only be limited to the initial authentication stage. If the authentication fails, the platform interface will not be accessible. In other words, the platform will not actually process the interface access request, so the impact on the platform's actual business services is minimal.

[0147] The second authentication method: authentication based on integrity detection.

[0148] In this manner, the interface access request further includes a service data packet and a pending service signature sequence obtained by the service data packet based on the pending authorization code.

[0149] That is to say, the embodiment of the present application also provides a link for borrowing the object authorization code to the integrity detection link. The server can complete the identity authentication work of the interface access request while implementing the integrity detection, which not only improves the efficiency but also saves system resources.

[0150] When the server determines that the interface access request also includes a business data packet and a pending business signature sequence, it can determine the corresponding object authorization code based on the object identifier carried in the interface access request, and then digitally sign the business data packet based on the object authorization code to obtain the target business signature sequence.

[0151] For details about the digital signature mentioned here, please refer to the above Figure 2 If the pending service signature sequence obtained based on the service data packet matches the target service signature sequence, this indicates that the identity verification is successful and the request is legitimate. In addition, the integrity check is completed to confirm that the service data packet has not been tampered with by an attacker during transmission.

[0152] If the pending service signature sequence does not match the target service signature sequence, determining that the interface access request is an illegal request and the service data packet fails the integrity check, and denying access to the platform interface by the interface access request;

[0153] If the pending service signature sequence matches the target service signature sequence, it is determined that the interface access request is a legitimate request sent by the object and the service data packet passes the integrity check, and the object is allowed to access the corresponding platform interface through the interface access request.

[0154] It can be seen that through the second authentication method, identity authentication and business data packet integrity detection can be completed based on a single authentication operation, thereby improving the efficiency of identity authentication.

[0155] Next, we will explain it through application scenarios, such as Figure 3 The scenario shown is the aforementioned quality inspection scenario for biometric identification devices. The platform is used for quality inspection, and identity authentication and business services are provided through the collaboration between the business service module 311, the manufacturer authorization code verification module 312, and the manufacturer authorization code acquirer 313 configured in the server 310. The platform is associated with the manufacturer that provides biometric identification devices, and business process interaction is carried out between the business service module 311 of the management platform interface through the manufacturer system 320.

[0156] The business service module 311 obtains the manufacturer's currently valid object authorization code from the manufacturer authorization code acquirer 313 and provides it to the manufacturer in some way (such as through a special web page, rather than providing it in every interface interaction).

[0157] After the manufacturer obtains the authorization code, during the interface interaction between the manufacturer system 320 and the business service module 311, the manufacturer carries the assigned object authorization code and the interface parameters and passes them to the business service module 311 through an interface access request. When the business service module 311 receives the interface access request, it first passes the pending authorization code and manufacturer identification it receives to the manufacturer authorization code verification module 312 for identity authentication. When the identity authentication is passed (that is, the pending authorization code provided by the manufacturer system is valid and corresponds to the identity of its manufacturer identification), the business service module 311 performs the logical operation of the interface. If it is invalid (the object authorization code has expired and becomes an invalid authorization code, or does not match its identity), the interface access request will be rejected.

[0158] Therefore, the method of verifying the manufacturer's identity through the object authorization code is to use the manufacturer's identity identifier plus a random string and further convert it using MD5 to obtain the object authorization code; then, the validity period of the authorization code is manually set and refreshed, or the object authorization code is automatically updated with the validity period to maintain the validity verification; finally, the credibility and integrity of the data are guaranteed by directly comparing the authorization code or using the authorization code to digitally sign the data packet. Based on the above solution, the object authorization code can be effectively prevented from being forged or guessed, and the cost of human intervention can be reduced. At the same time, the effect of the authorization code is expanded, and the additional effect of data integrity verification is achieved.

[0159] In the aforementioned Figure 1-Figure 3 Based on the corresponding embodiment, Figure 4 This is a device structure diagram of an identity authentication device provided in an embodiment of the present application. The identity authentication device 400 includes an acquisition unit 401, a determination unit 402, a signature unit 403, and an identity authentication unit 404:

[0160] The acquisition unit 401 is used to acquire the object identifier of the object associated with the platform;

[0161] The determining unit 402 is configured to determine the content to be signed based on the object identifier and a random number corresponding to the object;

[0162] The signing unit 403 is configured to digitally sign the content to be signed to obtain a signature sequence comprising N characters;

[0163] The determining unit 402 is further configured to determine M characters from the N characters in the signature sequence as the object authorization code of the object, and send the object authorization code to the object. <N;

[0164] The acquisition unit 401 is further configured to acquire an interface access request including an object identifier of the object and a pending authorization code;

[0165] The identity authentication unit 404 is configured to perform identity authentication based on the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object.

[0166] In one possible implementation, the object authorization code is a temporary authorization code that is valid only within a valid period. The determination unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine M characters from the N characters of the signature sequence as the object authorization code of the object, and return the re-determined object authorization code to the object; wherein the re-determined M characters are not exactly the same as the M characters determined when generating the invalid authorization code.

[0167] In one possible implementation, the acquisition unit is further used to trigger the determination unit to re-determine M characters from the N characters in the signature sequence as the object authorization code of the object when obtaining the authorization code update request sent by the object, and return the re-determined object authorization code to the object.

[0168] In a possible implementation, the M characters used as the object authorization code are consecutive characters among the N characters, and the determining unit is further configured to:

[0169] The first position interval of the M characters corresponding to the invalid authorization code in the N characters is moved according to the selection rule to obtain a second position interval, where both the first position interval and the second position interval identify a position range of M characters in the N characters;

[0170] The M characters in the second position interval among the N characters are used as the object authorization code of the object.

[0171] In a possible implementation, the object authorization code is a temporary authorization code that is valid only within a valid period, and the apparatus further includes a sending unit:

[0172] the sending unit is configured to send the signature sequence and a first authorization code update condition to the object, wherein the first authorization code update condition is configured to instruct the object to re-determine the corresponding object authorization code from the signature sequence based on a first update rule when the object authorization code becomes an invalid authorization code;

[0173] The determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine the object authorization code corresponding to the object from the signature sequence based on the first update rule.

[0174] In a possible implementation, the object authorization code is a temporary authorization code that is valid only within a valid period, and the apparatus further includes a sending unit:

[0175] The sending unit is configured to send a second authorization code update condition to the object, wherein the second authorization code update condition is configured to instruct the object to redetermine the object authorization code based on a second update rule for M characters corresponding to the invalid authorization code when the authorization code becomes an invalid authorization code;

[0176] The determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine the object authorization code based on a second updating rule for the M characters corresponding to the invalid authorization code.

[0177] In a possible implementation, the identity verification unit is further configured to:

[0178] If the pending authorization code does not match the object authorization code, determining that the interface access request is an illegal request, and denying access to the platform interface by the interface access request;

[0179] If the pending authorization code matches the object authorization code, it is determined that the interface access request is a legitimate request sent by the object, and the object is allowed to access the corresponding platform interface through the interface access request.

[0180] In a possible implementation, the interface access request further includes a service data packet and a pending service signature sequence obtained by the service data packet based on the pending authorization code, and the identity authentication unit is further configured to:

[0181] Digitally signing the data packet according to the object authorization code to obtain a target service signature sequence;

[0182] If the pending service signature sequence does not match the target service signature sequence, determining that the interface access request is an illegal request and the service data packet fails the integrity check, and denying access to the platform interface by the interface access request;

[0183] If the pending service signature sequence matches the target service signature sequence, it is determined that the interface access request is a legitimate request sent by the object and the service data packet passes the integrity check, and the object is allowed to access the corresponding platform interface through the interface access request.

[0184] In a possible implementation, the determining unit is further configured to concatenate the object identifier and the random number to obtain the content to be signed.

[0185] In a possible implementation, the signature unit is further configured to digitally sign the content to be signed using an information digest algorithm to obtain a signature sequence comprising N characters.

[0186] In a possible implementation, the object identifier is a merchant number, a manufacturer code, or a self-increment identifier of the object.

[0187] As can be seen from this, for objects associated with the platform, their object identifiers can serve as unique counterparts. Determining the content to be signed using the object identifier and random number not only reduces the likelihood of different objects being identified as having the same content, but also adds a random factor to the content to be signed, ensuring randomness while ensuring uniqueness, reducing the likelihood of the content being deduced. Digitally signing the content to be signed produces a signature sequence consisting of N characters, from which M characters are selected as the object authorization code for the object. This makes the object authorization code not only difficult to predict, but even if an attacker obtains the content to be signed, it would require significant effort to determine the M characters from the N that constitute the object authorization code. Furthermore, the object authorization code is only used for identity verification, further increasing the difficulty of cracking it. Furthermore, the object authorization code comprises fewer characters than the signature sequence, reducing its complexity and improving its applicability while still meeting identity verification requirements.

[0188] The embodiment of the present application further provides a computer device, which is the computer device described above and may include a terminal device or a server, and the aforementioned identity verification device may be configured in the computer device. The computer device is described below with reference to the accompanying drawings.

[0189] If the computer device is a terminal device, see Figure 5 As shown, the embodiment of the present application provides a terminal device, taking a mobile phone as an example:

[0190] Figure 5 The block diagram shows a partial structure of a mobile phone related to the terminal device provided in the embodiment of the present application. Figure 5 The mobile phone includes components such as a radio frequency (RF) circuit 1410, a memory 1420, an input unit 1430, a display unit 1440, a sensor 1450, an audio circuit 1460, a wireless fidelity (WiFi) module 1470, a processor 1480, and a power supply 1490. It will be understood by those skilled in the art that Figure 5 The mobile phone structure shown in the figure does not constitute a limitation to the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0191] The following combination Figure 5 A detailed introduction to the various components of a mobile phone:

[0192] The RF circuit 1410 can be used to receive and send signals during information transmission or calls. In particular, after receiving downlink information from the base station, it is sent to the processor 1480 for processing. In addition, the designed uplink data is sent to the base station. Generally, the RF circuit 1410 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the RF circuit 1410 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0193] Memory 1420 can be used to store software programs and modules. Processor 1480 executes the various functional applications and data processing of the mobile phone by running the software programs and modules stored in memory 1420. Memory 1420 may mainly include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area may store data created based on the use of the mobile phone (such as audio data, a phone book, etc.). In addition, memory 1420 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0194] The input unit 1430 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile phone. Specifically, the input unit 1430 may include a touch panel 1431 and other input devices 1432. The touch panel 1431, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using a finger, stylus, or any other suitable object or accessory on or near the touch panel 1431) and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 1431 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch direction and detects the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the processor 1480. It can also receive commands sent by the processor 1480 and execute them. In addition, the touch panel 1431 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1431, the input unit 1430 may further include other input devices 1432. Specifically, the other input devices 1432 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, power keys, etc.), a trackball, a mouse, and a joystick.

[0195] The display unit 1440 can be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 1440 may include a display panel 1441. Optionally, the display panel 1441 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, the touch panel 1431 may cover the display panel 1441. When the touch panel 1431 detects a touch operation on or near it, it is transmitted to the processor 1480 to determine the type of touch event. Subsequently, the processor 1480 provides corresponding visual output on the display panel 1441 according to the type of touch event. Although in Figure 5 In the embodiment, the touch panel 1431 and the display panel 1441 are used as two independent components to realize the input and output functions of the mobile phone, but in some embodiments, the touch panel 1431 and the display panel 1441 can be integrated to realize the input and output functions of the mobile phone.

[0196] The mobile phone may also include at least one sensor 1450, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1441 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1441 and / or the backlight when the mobile phone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that the mobile phone can also be configured with, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be described here.

[0197] Audio circuit 1460, speaker 1461, and microphone 1462 provide an audio interface between the user and the phone. Audio circuit 1460 converts received audio data into electrical signals and transmits them to speaker 1461, which then converts them into sound signals for output. Microphone 1462, on the other hand, converts collected sound signals into electrical signals, which are then received by audio circuit 1460 and converted into audio data. The audio data is then processed by processor 1480 and transmitted to, for example, another phone via RF circuit 1410, or stored in memory 1420 for further processing.

[0198] WiFi is a short-range wireless transmission technology. Mobile phones can help users send and receive emails, browse the web, and access streaming media through the WiFi module 1470. It provides users with wireless broadband Internet access. Figure 5 A WiFi module 1470 is shown, but it is understandable that it is not an essential component of the mobile phone and can be omitted as needed without changing the essence of the invention.

[0199] Processor 1480 is the control center of the phone, connecting all parts of the phone using various interfaces and circuits. It executes software programs and / or modules stored in memory 1420 and accesses data stored in memory 1420 to perform various phone functions and process data. Optionally, processor 1480 may include one or more processing units. Preferably, processor 1480 integrates an application processor and a modem processor. The application processor primarily handles the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 1480.

[0200] The mobile phone also includes a power supply 1490 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 1480 through a power management system, thereby realizing functions such as charging, discharging, and power consumption management through the power management system.

[0201] Although not shown, the mobile phone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0202] In this embodiment, the processor 1480 included in the terminal device further has the following functions:

[0203] Get the object identifier of the object associated with the platform;

[0204] Determine the content to be signed according to the object identifier and a random number corresponding to the object;

[0205] Digitally signing the content to be signed to obtain a signature sequence including N characters;

[0206] Determine M characters from the N characters of the signature sequence as the object authorization code of the object, and send the object authorization code to the object, M <N;

[0207] Obtaining an interface access request including an object identifier of the object and a pending authorization code;

[0208] Authentication is performed based on the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object.

[0209] If the computer device is a server, this embodiment of the application also provides a server, see Figure 6 As shown, Figure 6 The structural diagram of the server 1500 provided in the embodiment of the present application, the server 1500 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPUs) 1522 (for example, one or more processors) and a memory 1532, and one or more storage media 1530 (for example, one or more mass storage devices) for storing application programs 1542 or data 1544. Among them, the memory 1532 and the storage medium 1530 can be temporary storage or permanent storage. The program stored in the storage medium 1530 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1522 can be configured to communicate with the storage medium 1530 to execute a series of instruction operations in the storage medium 1530 on the server 1500.

[0210] The server 1500 may also include one or more power supplies 1526, one or more wired or wireless network interfaces 1550, one or more input and output interfaces 1558, and / or one or more operating systems 1541, such as Windows Server 2003. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM etc.

[0211] The steps performed by the server in the above embodiment can be based on Figure 6 The server structure shown.

[0212] In addition, an embodiment of the present application further provides a storage medium, which is used to store a computer program, and the computer program is used to execute the method provided by the above embodiment.

[0213] An embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the method provided in the above embodiment.

[0214] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the above-mentioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the above-mentioned storage medium can be at least one of the following media: read-only memory (English: Read-only Memory, abbreviated: ROM), RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0215] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0216] The above is only one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Moreover, based on the implementation methods provided in the above aspects, the present application can also be further combined to provide more implementation methods. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. An identity authentication method, characterized in that: The method includes: Obtaining an object identifier of an object associated with the platform; Determining the content to be signed according to the object identifier and a random number corresponding to the object; Performing a digital signature on the content to be signed to obtain a signature sequence including N characters; Determining M characters from the N characters of the signature sequence as the object authorization code of the object, and sending the object authorization code to the object, where M < N, and the object authorization code is a temporary authorization code that is only valid within a valid duration; Obtaining an interface access request including the object identifier of the object and a pending authorization code; Performing identity verification according to the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object; When the object authorization code becomes an invalid authorization code, re-determining M characters from the N characters of the signature sequence as the object authorization code of the object, and returning the re-determined object authorization code to the object, where the re-determined M characters are not exactly the same as the M characters that generated the invalid authorization code; Among them, the M characters used as the object authorization code are consecutive characters in the N characters. The re-determining M characters from the N characters of the signature sequence as the object authorization code of the object includes: Moving the first position interval of the M characters corresponding to the invalid authorization code in the N characters according to a selection rule to obtain a second position interval, where both the first position interval and the second position interval are within the position range of the N characters that identify M characters; Using the M characters in the N characters that are in the second position interval as the object authorization code of the object.

2. The method according to claim 1, characterized in that The method further includes: If an authorization code update request sent by the object is obtained, performing the operation of re-determining M characters from the N characters of the signature sequence as the object authorization code of the object, and returning the re-determined object authorization code to the object.

3. The method according to claim 1, characterized in that The method further includes: Sending the signature sequence and a first authorization code update condition to the object, where the first authorization code update condition is used to instruct the object to re-determine the corresponding object authorization code from the signature sequence based on a first update rule when the object authorization code becomes an invalid authorization code; When the object authorization code becomes an invalid authorization code, re-determining the object authorization code corresponding to the object from the signature sequence based on the first update rule.

4. The method according to claim 1, wherein The method further includes: Sending a second authorization code update condition to the object, where the second authorization code update condition is used to instruct the object to re-determine the object authorization code by re-determining the M characters corresponding to the invalid authorization code based on a second update rule when the authorization code becomes an invalid authorization code; When the object authorization code becomes an invalid authorization code, re-determining the object authorization code by re-determining the M characters corresponding to the invalid authorization code based on the second update rule.

5. The method according to any one of claims 1 to 4, characterized in that The performing identity verification according to the pending authorization code and the object authorization code to determine whether the interface access request is a legitimate request sent by the object includes: If the pending authorization code does not match the object authorization code, determine that the interface access request is an illegal request, and reject the interface access request's access to the platform interface; If the pending authorization code matches the object authorization code, determine that the interface access request is a legal request sent by the object, and allow the object to access the corresponding platform interface through the interface access request.

6. The method according to any one of claims 1 to 4, characterized in that: The interface access request further includes a service data packet and a pending service signature sequence obtained from the service data packet based on the pending authorization code. The authentication based on the pending authorization code and the object authorization code to determine whether the interface access request is a legal request sent by the object includes: Perform digital signature on the data packet according to the object authorization code to obtain a target service signature sequence; If the pending service signature sequence does not match the target service signature sequence, determine that the interface access request is an illegal request and the service data packet fails the integrity check, and reject the interface access request's access to the platform interface; If the pending service signature sequence matches the target service signature sequence, determine that the interface access request is a legal request sent by the object and the service data packet passes the integrity check, and allow the object to access the corresponding platform interface through the interface access request.

7. The method according to any one of claims 1 to 4, characterized in that The determination of the content to be signed according to the object identifier and the random number corresponding to the object includes: Concatenate the object identifier and the random number to obtain the content to be signed.

8. The method according to any one of claims 1 to 4, characterized in that The digital signature of the content to be signed to obtain a signature sequence including N characters includes: Perform digital signature on the content to be signed through a message digest algorithm to obtain a signature sequence including N characters.

9. The method according to any one of claims 1 to 4, characterized in that: The object identifier is the merchant number, manufacturer code or auto-increment identifier of the object.

10. An identity verification device, characterized in that: The device includes an acquisition unit, a determination unit, a signature unit and an authentication unit: The acquisition unit is used to acquire the object identifier of the object associated with the platform; The determination unit is used to determine the content to be signed according to the object identifier and the random number corresponding to the object; The signature unit is used to perform digital signature on the content to be signed to obtain a signature sequence including N characters; The determination unit is further used to determine M characters from the N characters of the signature sequence as the object authorization code of the object, and send the object authorization code to the object, where M < N, and the object authorization code is a temporary authorization code that is only valid within the effective duration; The acquisition unit is further used to acquire an interface access request including the object identifier and the pending authorization code of the object; The authentication unit is used to perform authentication according to the pending authorization code and the object authorization code to determine whether the interface access request is a legal request sent by the object; The determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine M characters from the N characters of the signature sequence as the object authorization code of the object, and return the re-determined object authorization code to the object, wherein the re-determined M characters are not completely identical to the M characters used to generate the invalid authorization code; The M characters used as the object authorization code are consecutive characters among the N characters, and the determining unit is further used to: The first position interval of the M characters corresponding to the invalid authorization code in the N characters is moved according to the selection rule to obtain a second position interval, where both the first position interval and the second position interval identify a position range of M characters in the N characters; The M characters in the second position interval among the N characters are used as the object authorization code of the object.

11. The device according to claim 10, characterized in that The acquisition unit is further configured to, upon obtaining an authorization code update request sent by the object, execute the operation of re-determining M characters from the N characters of the signature sequence as the object authorization code of the object, and return the re-determined object authorization code to the object.

12. The device according to claim 10, characterized in that The device further includes a sending unit; the sending unit is configured to send the signature sequence and a first authorization code update condition to the object, wherein the first authorization code update condition is configured to instruct the object to re-determine the corresponding object authorization code from the signature sequence based on a first update rule when the object authorization code becomes an invalid authorization code; The determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine the object authorization code corresponding to the object from the signature sequence based on the first update rule.

13. The device according to claim 10, characterized in that The device further includes a sending unit; The sending unit is configured to send a second authorization code update condition to the object, wherein the second authorization code update condition is configured to instruct the object to redetermine the object authorization code based on a second update rule by performing a re-analysis of M characters corresponding to the invalid authorization code when the authorization code becomes an invalid authorization code; The determining unit is further configured to, when the object authorization code becomes an invalid authorization code, re-determine the object authorization code based on a second updating rule by performing a multi-character update on the M characters corresponding to the invalid authorization code.

14. The device according to any one of claims 10 to 13, characterized in that: The identity verification unit is further configured to: If the pending authorization code does not match the object authorization code, determining that the interface access request is an illegal request, and denying access to the platform interface by the interface access request; If the pending authorization code matches the object authorization code, it is determined that the interface access request is a legitimate request sent by the object, and the object is allowed to access the corresponding platform interface through the interface access request.

15. The device according to any one of claims 10 to 13, characterized in that: The interface access request also includes a service data packet and a pending service signature sequence obtained by the service data packet based on the pending authorization code. The identity authentication unit is further configured to: Digitally signing the data packet according to the object authorization code to obtain a target service signature sequence; If the pending service signature sequence does not match the target service signature sequence, determining that the interface access request is an illegal request and the service data packet fails the integrity check, and denying access to the platform interface by the interface access request; If the pending service signature sequence matches the target service signature sequence, it is determined that the interface access request is a legitimate request sent by the object and the service data packet passes the integrity check, and the object is allowed to access the corresponding platform interface through the interface access request.

16. The device according to any one of claims 10 to 13, characterized in that The determining unit is further configured to concatenate the object identifier and the random number to obtain the content to be signed.

17. The device according to any one of claims 10 to 13, characterized in that The signature unit is further configured to digitally sign the content to be signed using an information digest algorithm to obtain a signature sequence comprising N characters.

18. The device according to any one of claims 10 to 13, characterized in that The object identifier is the merchant number, manufacturer code or self-increment identifier of the object.

19. A computer device, characterized in that: The computer device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the identity authentication method described in any one of claims 1 to 9 according to the instructions in the program code.

20. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the identity authentication method according to any one of claims 1 to 9.

21. A computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the identity authentication method according to any one of claims 1 to 9.

Images