Mobile terminal password-free authentication method and device based on token hierarchical conversion and storage medium

Abstract

The application relates to a mobile terminal password-free authentication method based on token layered conversion, a device and a storage medium, and the method comprises the following steps: an authorization process: enabling biological authentication under a login state, uploading a public key to a server through a session token sessionToken to exchange and acquire a device token deviceToken; an authentication process: performing biological authentication login under a non-login state, and only decrypting data encrypted by a public key of a server through a client with a corresponding private key; wherein, in a data interaction process, the session token sessionToken serves as a voucher for data interaction between the client and the server, and the device token deviceToken is a newly-added device voucher in the biological authentication process, which is used for exchanging the session token sessionToken with the server in the biological authentication login process and cannot be used for exchanging data with the server. Compared with the prior art, the application guarantees layered conversion of two different life cycles of tokens, realizes uniformity of authentication token life cycles of multiple platforms, realizes a biological authentication function based on layered conversion of tokens, and has high expansibility.

Description

Technical Field

[0001] This invention relates to the field of passwordless authentication, and in particular to a mobile passwordless authentication method based on token hierarchical conversion. Background Technology

[0002] The rapid development of the mobile internet in recent years has led to an explosive growth in mobile applications, resulting in a landscape of one application server and numerous clients. Different clients have different user scenarios, different security threats, different session lifecycles, and different authentication methods. Therefore, based on token authorization and authentication technology, this paper designs a session management solution suitable for different platform devices, and combines it with mobile biometric technology to achieve passwordless authentication for trusted clients, providing users with a safer and more reliable user experience.

[0003] Existing single-credential passwordless authentication schemes on mobile systems (Android, iOS, HarmonyOS) all provide the function of binding a key to system security. After successful user biometric authentication, a symmetric key is generated, and the token is encrypted and stored in the mobile device's localStorage using symmetric encryption technology. Users can only authorize applications to use the key to encrypt and decrypt the token after passing system authentication, without needing to request server authorization again. The single-credential passwordless authentication method has the following drawbacks:

[0004] 1) Insecure. In order to avoid frequent token expiration in this login-free solution, a long lifespan is usually required. However, the token needs to be carried frequently in the data interaction between the mobile device and the server, which poses a security risk of being hijacked by malicious users.

[0005] 2) Incompatibility: In a multi-platform system, the token may become invalid because the user logs in on other client devices. However, the mobile device is still unaware of whether the currently stored token is still valid. The user needs to perform biometric verification to obtain the key, decrypt the ciphertext to obtain the plaintext token, and send a request to the server to determine whether the token is valid, which brings a poor user experience.

[0006] In addition, a passwordless login scheme based on dual credentials with short and long expiration periods is proposed. This scheme is mainly to avoid the security risks of a single authorization credential having an excessively long expiration period and frequently appearing in data interactions between the client and the server, thus being hijacked. It includes: a short-term token, which has a short validity period cached on the server, usually with a 15-minute expiration strategy. After the client obtains this token, it is stored in sessionStorage and used for data interaction with the server; and a long-term token, which has a longer validity period cached on the server, usually with a 30-day expiration strategy. After the client obtains this token, it is stored in localStorage and used by the user to seamlessly request the short-term token from the server to achieve passwordless login.

[0007] However, in the above-mentioned passwordless login scheme based on dual credentials of long and short periods, if the long-period token is stored in plaintext at the local storage level on the client, it is easily intercepted by other applications on jailbroken devices, posing a security risk. Summary of the Invention

[0008] The purpose of this invention is to overcome the shortcomings of the existing technology by providing a mobile passwordless authentication method based on token layering conversion. This invention ensures the layering conversion of two tokens with different lifecycles, thereby guaranteeing the consistency of token lifecycles for multi-platform authentication. It implements biometric authentication based on the token layering conversion concept, improves system scalability, allows access to clients on different platforms, and features clear layering for easy maintenance.

[0009] The objective of this invention can be achieved through the following technical solutions:

[0010] This invention provides a mobile passwordless authentication method based on token-based hierarchical conversion, the method comprising:

[0011] Authorization process: When a user is logged in, they enable biometric authentication and upload their public key (pubKey) to the server via a session token to exchange for a device token (deviceToken).

[0012] Authentication process: When a user logs in without being logged in, biometric authentication is used. Data encrypted with the server's public key pubKey is only decrypted by a client with the corresponding private key priKey.

[0013] In the data interaction process, the session token serves as the credential for data interaction between the client and the server, while the device token is a new device credential added during the biometric authentication process. It is used to exchange the session token with the server during the biometric authentication login process and cannot be used to exchange data with the server.

[0014] Preferably, the method includes an account password authentication process, a biometric authentication support activation process, and a biometric authentication passwordless login process;

[0015] After the account and password authentication process is completed and the login is successful, the biometric authentication support process is initiated. The mobile device generates a key and securely binds it to the mobile device system. The generated token and public key are sent to the server for binding. The client obtains the device token generated by the server and permanently stores it in the system. The mobile device stores the device token locally.

[0016] The next time you log in, you will be prompted to enter the biometric authentication passwordless login process.

[0017] Preferably, the biometric authentication support process includes:

[0018] 1) The user enables biometric authentication in the settings;

[0019] 2) Verify the biometric features of the sensor. If the verification is successful, proceed to step 3).

[0020] 3) The mobile device generates a key, which is securely bound to the mobile device system. The mobile device must be authenticated before the key can be authorized for use.

[0021] 4) Securely store the private key priKey and public key pubKey on the mobile system; send the session token sessionToken and public key pubKey to the server for binding; the client obtains the device token deviceToken generated by the server and stores it permanently in the system; the mobile device stores the device token deviceToken locally.

[0022] 5) The server stores the user's public key (pubKey) and device token (deviceToken) for querying purposes.

[0023] Preferably, the biometric authentication support process generates three types of relational data, including:

[0024] 1) Public key pubKey and private key priKey:

[0025] When enabling biometric authentication on mobile devices, a security policy is implemented that generates a key that is strongly bound to the system device security. After the key is generated, the application is only authorized to use the key to encrypt and decrypt sensitive data after being authenticated by the system.

[0026] 2) Device token (deviceToken), public key (pubKey), and user ID (userId):

[0027] After a user is logged in and verifies their biometrics on the mobile device, the public key pubKey and the session token generated by the account and password login are sent to the server. The server then generates a device token deviceToken, controls the lifecycle of the device token deviceToken, and stores the binding relationship between the deviceToken, pubKey, and user ID.

[0028] 3) Device Token and Device:

[0029] After obtaining the device token generated by the server, the client stores it at the localStorage level so that it does not expire when the server is turned off.

[0030] Preferably, the biometric authentication passwordless login process includes:

[0031] 1) Client authentication:

[0032] The server holds the public key pubKey, and the client holds the private key priKey. Based on the characteristics of asymmetric keys, ciphertext encrypted with the public key pubKey can only be decrypted with the corresponding private key priKey, and ciphertext encrypted with the private key priKey can only be decrypted with the corresponding public key pubKey.

[0033] 2) The client uses the private key priKey to sign, and the server uses the public key pubKey to verify the signature to confirm whether the client user is a legitimate user. After verification, a session token is generated and encrypted with the public key pubKey and returned to the client.

[0034] 3) The client then uses priKey to decrypt and obtain the plaintext session token, and stores it at the session storage level.

[0035] Preferably, any information system and any client has at least one account password authentication method;

[0036] During the authentication process, the generated session token is used for data exchange between the client and the server. The server controls the lifecycle of the session token, while the client stores the session token at the session storage level. The session token becomes invalid when the client closes the session storage.

[0037] Preferably, the account password authentication includes mobile phone verification code and email verification code authentication.

[0038] Preferably, the token has a lifespan of 15 minutes.

[0039] According to a second aspect of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement any of the methods described above.

[0040] According to a third aspect of the invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the methods described herein.

[0041] Compared with the prior art, the present invention has the following advantages:

[0042] 1) Good uniformity can solve the problem of normalizing the lifecycle of sessions on different platforms such as desktop clients and mobile clients. Both desktop and mobile clients use session tokens to communicate and interact with the server to exchange user data.

[0043] 2) Good decoupling: the authentication session credentials for core interface calls to the server can be implemented and deployed independently;

[0044] 3) Good hierarchy, with session credentials and device credentials separated, each performing its own function, resulting in high maintainability;

[0045] 4) Good security: Based on mobile biometric authentication technology, the generation and access of keys require system-level authentication. Even on jailbroken devices, the system key can still be used to securely encrypt and protect device credentials. Attached Figure Description

[0046] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0048] Example

[0049] Tokens serve as user credentials and have diverse applications, presenting challenges such as classification, privacy parameter settings, usage scenarios, and layered conversion. Traditional account and password login methods are suitable for most client platforms. The server verifies the client's identity by checking the account and password, and then grants the client a token to indicate that the client's identity is legitimate. Clients typically store tokens at the session level, which are short-lived and expire when closed.

[0050] Mobile biometric authentication is a client-side system-level authentication method related to the customer's biometric characteristics. It has the characteristics of being long-lasting and not expiring when closed. However, establishing long-lasting and expiring session credentials poses significant security risks and is not suitable for devices without biometric authentication. Therefore, a credential with this long-lasting and expiring characteristic is defined as a device credential. Device credentials are used to transform mobile client-side system-level authentication into server-side authentication, thereby ensuring system security. At the same time, it solves the problem of session credential normalization between traditional login methods and mobile biometric authentication methods. Layered conversion reduces coupling and maintenance costs.

[0051] This embodiment provides a mobile passwordless authentication method based on token hierarchical conversion, the method including:

[0052] Authorization process: When a user is logged in, they enable biometric authentication and upload their public key (pubKey) to the server via a session token to exchange for a device token (deviceToken).

[0053] Authentication process: When a user logs in without being logged in, biometric authentication is used. Data encrypted with the server's public key pubKey is only decrypted by a client with the corresponding private key priKey.

[0054] In the data interaction process, the session token serves as the credential for data interaction between the client and the server, while the device token is a new device credential added during the biometric authentication process. It is used to exchange session tokens with the server during biometric authentication login and cannot be used to exchange data with the server, thereby achieving the purpose of token layering and reducing coupling.

[0055] The overall plan is as follows: Figure 1 As shown, specifically:

[0056] 1. Account and password authentication process:

[0057] Account and password authentication includes methods such as mobile phone verification codes and email verification codes. Every information system must implement at least one of these authentication methods. Regardless of whether a client supports biometric authentication, it must also implement at least one authentication method to ensure that users have the most secure login option when biometric authentication is unavailable. During the authentication process, a session token is generated and used for data exchange between the client and server. The server controls the token's lifespan to 15 minutes, and the client stores the session token at the session storage level (sessionStorage). The session token becomes invalid when the session is closed.

[0058] like Figure 1 As shown, the account and password authentication process is as follows:

[0059] 1.1, Beginning

[0060] 1.2 Check if a session token exists; if not, proceed to 1.3; otherwise, check with the server whether the access token has expired. If it has expired, proceed to 1.3; otherwise, proceed to 1.6.

[0061] 1.3. Open the account and password login page;

[0062] 1.4 The client requests an account and password from the server to log in;

[0063] 1.5 Upon successful login, the client saves the session token to the session storage level (sessionStorage).

[0064] 1.6. Login successful.

[0065] 2. Enable biometric authentication support process:

[0066] Enabling mobile biometric authentication support generates three types of relational data. The following mainly explains the authentication process and the functions of these three types of relational data in chronological order of their generation:

[0067] 1) Public key pubKey and private key priKey:

[0068] When biometrics is enabled as a security strategy for mobile devices, a key that is strongly bound to the system device's security can be generated. Once generated, this key can only be used by applications that have been authenticated by the system to encrypt and decrypt sensitive data, thereby ensuring system security.

[0069] 2) Device token (deviceToken), public key (pubKey), and user ID (userId):

[0070] The device token is generated by the server. After the user is logged in and verifies their biometrics on the mobile device, they submit the aforementioned public key pubKey and the session token generated by traditional account and password login. The server then generates the device token and controls the lifespan of the device token to be one month or longer. The device token, public key pubKey, and user ID are bound together and stored in the database.

[0071] 3) deviceToken and device: After the client obtains the device token generated by the server, it stores it in local storage at the localStorage level so that it does not become invalid when the server is turned off.

[0072] like Figure 1 As shown, the process to enable biometric authentication support includes:

[0073] 2.1 After successfully logging in with an account and password, the user can enable biometric authentication in the settings;

[0074] 2.2 Sensor biometric verification successful, proceed to 2.3;

[0075] 2.3 The mobile terminal generates a key, which is securely bound to the mobile terminal system. Authentication of the mobile device is required before the key can be authorized for use. The mobile terminal system securely stores the key, including a public key (pubKey) and a private key (priKey).

[0076] 2.4. Send the session token (sessionToken) and public key (pubKey) to the server for binding; the client obtains the device token (deviceToken) generated by the server and persists it to system storage;

[0077] 2.5 The server stores the user ID, public key (pubKey), and device token (deviceToken).

[0078] 3. Biometric authentication passwordless login process:

[0079] During the aforementioned biometric authentication process, the public key `pubKey` is held by the server, and the private key `priKey` is held by the client. Ciphertext encrypted with the public key `pubKey` can only be decrypted with the corresponding private key `priKey`, and vice versa. This asymmetric key characteristic enables client authentication. The client uses its private key `priKey` to sign, and the server then uses its public key `pubKey` to verify the signature, confirming the client's legitimacy. Upon successful verification, a session token `sessionToken` is generated and encrypted using the public key `pubKey` before being returned to the client. The client then uses its private key `priKey` to decrypt the session token in plaintext and stores it at the `sessionStorage` level.

[0080] like Figure 1 As shown, the biometric authentication passwordless login process includes:

[0081] 3.1, Beginning;

[0082] 3.2 Check if a session token exists; if not, proceed to 3.3;

[0083] 3.3. Check if the device token exists to determine if fingerprint recognition is enabled. If it exists, proceed to 3.4; otherwise, proceed to 1.3 to log in with your account and password.

[0084] 3.4 Determine if the biometric data has changed. If it has not changed, proceed to 3.5; otherwise, proceed to 1.3 to log in with your account and password.

[0085] 3.5 Perform sensor biometric verification. If verification is successful, proceed to 3.6; otherwise, proceed to 1.3 to log in with your account and password.

[0086] 3.6. Query the mobile system to obtain the key;

[0087] 3.7. Use the private key priKey to sign and send the device token deviceToken to the server;

[0088] 3.8. The server queries the bound user information;

[0089] 3.9 The server uses the public key pubKey to verify the signature; if the server verifies the signature successfully, the verification is successful, a session token is generated and returned, and the client saves it to the session storage level (sessionStorage), and the login is successful; otherwise, proceed to 1.3 to log in with an account and password.

[0090] The electronic device of this invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) or loaded from a storage unit into random access memory (RAM). The RAM may also store various programs and data required for device operation. The CPU, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0091] Multiple components in the device are connected to the I / O interface, including: input units such as keyboards and mice; output units such as various types of displays and speakers; storage units such as disks and optical discs; and communication units such as network interface cards (NICs), modems, and wireless transceivers. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0092] The processing unit performs the various methods and processes described above. For example, in some embodiments, the methods may be implemented as computer software programs tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute the methods by any other suitable means (e.g., by means of firmware).

[0093] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload programmable logic devices (CPLDs), and so on.

[0094] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0095] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0096] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A mobile passwordless authentication method based on token-based hierarchical conversion, characterized in that, The method includes: Authorization process: When a user is logged in, they enable biometric authentication and upload their public key (pubKey) to the server via a session token to exchange for a device token (deviceToken). Authentication process: When a user logs in without being logged in, biometric authentication is used. Data encrypted with the server's public key pubKey is only decrypted by a client with the corresponding private key priKey. In the data interaction process, the session token serves as the credential for data interaction between the client and the server, while the device token is a new device credential added during the biometric authentication process. It is used to exchange the session token with the server during the biometric authentication login process and cannot be used to exchange data with the server. The method includes an account password authentication process, a process for enabling biometric authentication support, and a biometric authentication passwordless login process. After the account password authentication process is completed and login is successful, the biometric authentication support process is initiated. The mobile device generates a key and securely binds it to the mobile device system. The generated token (Token) and public key (pubKey) are sent to the server for binding. The client obtains the device token (deviceToken) generated by the server and permanently stores it in the system. The mobile device stores the device token (deviceToken) locally. The next time you log in, you will enter the biometric authentication passwordless login process. The biometric authentication passwordless login process includes: 1) Client authentication: The server holds the public key pubKey, and the client holds the private key priKey. Based on the characteristics of asymmetric keys, ciphertext encrypted with the public key pubKey can only be decrypted with the corresponding private key priKey, and ciphertext encrypted with the private key priKey can only be decrypted with the corresponding public key pubKey. 2) The client uses its private key priKey to sign, and the server then uses its public key pubKey to verify the signature to confirm whether the client user is a legitimate user. After verification, a session token (sessionToken) is generated and encrypted using the public key pubKey before being returned to the client. 3) The client then uses priKey to decrypt and obtain the plaintext session token, and stores it at the session storage level (sessionStorage). Every information system and every client must have at least one account password authentication method; During the authentication process, the generated session token is used for data exchange between the client and the server. The server controls the lifecycle of the session token, while the client stores the session token at the session storage level. The session token becomes invalid when the client closes the session storage.

2. The mobile terminal passwordless authentication method based on token-based hierarchical conversion according to claim 1, characterized in that, The biometric authentication support process includes: 1) The user enables biometric authentication in the settings; 2) Sensor biometric verification; if successful, proceed to step 3). 3) The mobile device generates a key and securely binds it to the mobile system, requiring authentication of the mobile device before authorization to use the key is granted; 4) Securely store the private key priKey and public key pubKey on the mobile system; send the session token sessionToken and public key pubKey to the server for binding; the client obtains the device token deviceToken generated by the server and stores it permanently in the system; the mobile device stores the device token deviceToken locally. 5) The server stores the user's public key (pubKey) and device token (deviceToken) for querying purposes.

3. The mobile terminal passwordless authentication method based on token-based hierarchical conversion according to claim 2, characterized in that, The biometric authentication support process generates three types of relational data, including: 1) Public key pubKey and private key priKey: When enabling biometric authentication on mobile devices, a security policy is implemented that generates a key that is strongly bound to the system device security. After the key is generated, the application is only authorized to use the key to encrypt and decrypt sensitive data after being authenticated by the system. 2) Device token (deviceToken), public key (pubKey), and user ID (userId): After a user is logged in and verifies their biometrics on the mobile device, the public key pubKey and the session token generated by the account and password login are sent to the server. The server then generates a device token deviceToken, controls the lifecycle of the device token deviceToken, and stores the binding relationship between the deviceToken, pubKey, and user ID. 3) Device Token and Device: After obtaining the device token generated by the server, the client stores it at the localStorage level so that it does not expire when the server is turned off.

4. The mobile terminal passwordless authentication method based on token hierarchical conversion according to claim 1, characterized in that, The account password authentication includes mobile phone verification code and email verification code authentication.

5. The mobile terminal passwordless authentication method based on token-based hierarchical conversion according to claim 1, characterized in that, The token has a lifespan of 15 minutes.

6. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.

Images