Authentication method and device, electronic equipment and storage medium
By receiving and verifying the encrypted authentication data and signature returned by the server on the client side, and using the authentication file compiled with the target language pack for decryption and signature verification, the problem of client application authentication data being tampered with is solved, achieving higher security and accuracy.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING DAJIA INTERNET INFORMATION TECH CO LTD
- Filing Date
- 2022-09-05
- Publication Date
- 2026-05-12
AI Technical Summary
How to ensure the security of authentication operations, especially how to prevent authentication data from being tampered with during the use of client applications.
By sending an authentication data retrieval request to the server, encrypted authentication data and data signature are received, and decryption and signature verification are performed using a preset authentication file. The authentication file is an executable file compiled according to the target language pack, which supports client systems and increases the difficulty of cracking.
It improves the security of authentication operations, reduces the possibility of authentication data being tampered with, ensures that authentication files run normally on the client, and enhances the accuracy and security of authentication operations.
Smart Images
Figure CN116244671B_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of computer technology, and in particular to an authentication method, apparatus, electronic device, and storage medium. Background Technology
[0002] Currently, with the continuous development of network technology, there are more and more applications on client devices. To ensure the secure operation of these applications, authentication is often required when using them. Authentication can refer to authorizing or authorizing the application.
[0003] Since authentication results affect whether users can use the application normally, ensuring the security of authentication operations has become an urgent technical problem to be solved. Summary of the Invention
[0004] This disclosure provides an authentication method, apparatus, electronic device, and storage medium to at least solve the aforementioned problem of ensuring the security of authentication operations. The technical solution of this disclosure is as follows:
[0005] According to a first aspect of the present disclosure, an authentication method is provided, applied to a client, comprising:
[0006] In response to the authentication trigger operation, a request to obtain authentication data for the application to be authenticated is sent to the server;
[0007] Receive the encrypted authentication data and data signature returned by the server in response to the authentication data acquisition request;
[0008] Based on a preset authentication file, the application to be authenticated is authenticated according to the encrypted authentication data and the data signature; the authentication file is an executable file compiled according to the target language pack that conforms to the system adapted by the client.
[0009] Optionally, the step of authenticating the application to be authenticated based on a preset authentication file, the encrypted authentication data, and the data signature includes:
[0010] Obtain the key held by the client based on the authentication file;
[0011] The encrypted authentication data is decrypted using the key to obtain the plaintext authentication data.
[0012] Based on the plaintext authentication data, a reference data signature is generated;
[0013] If the reference data signature matches the data signature, the application to be authenticated is authenticated based on the plaintext authentication data.
[0014] Optionally, obtaining the key held by the client based on the authentication file includes:
[0015] The plaintext key is retrieved from the specified library defined in the authentication file based on the specified library call function;
[0016] Alternatively, the disguised key can be obtained from the authentication file; the disguised key can be restored to obtain the plaintext key.
[0017] Optionally, the disguised key is obtained by obfuscating the plaintext key, and the disguised key is stored in the authentication file.
[0018] Optionally, the target language package is written based on a specified language that supports compilation into an intermediate language, wherein the intermediate language supports interpreters adapted to different systems; the method further includes:
[0019] Compile the target language package into a file that conforms to the intermediate language;
[0020] The authentication file is obtained by compiling the file that conforms to the intermediate language according to the interpreter corresponding to the system adapted by the client.
[0021] Optionally, the above methods also include:
[0022] The authentication file is pre-encapsulated as a target interface; the authentication of the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature includes:
[0023] The target interface is invoked to authenticate the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature.
[0024] According to a second aspect of the present disclosure, an authentication device is provided, applied to a client, comprising:
[0025] The sending module is configured to respond to the authentication trigger operation by sending an authentication data retrieval request to the server for the application to be authenticated.
[0026] The receiving module is configured to receive the encrypted authentication data and data signature returned by the server in response to the authentication data acquisition request;
[0027] The authentication module is configured to execute an authentication file based on a preset authentication file, and to authenticate the application to be authenticated based on the encrypted authentication data and the data signature; the authentication file is an executable file compiled according to the target language pack and conforming to the system adapted by the client.
[0028] Optionally, the authentication module includes:
[0029] The acquisition submodule is configured to perform an operation based on the authentication file to obtain the key held by the client;
[0030] The decryption submodule is configured to perform decryption of the ciphertext authentication data based on the key to obtain plaintext authentication data;
[0031] The generation submodule is configured to generate a reference data signature based on the plaintext authentication data;
[0032] The authentication submodule is configured to perform authentication on the application to be authenticated based on the plaintext authentication data if the reference data signature matches the data signature.
[0033] Optionally, the above-mentioned acquisition submodule is specifically configured to execute:
[0034] The plaintext key is retrieved from the specified library defined in the authentication file based on the specified library call function;
[0035] Alternatively, the disguised key can be obtained from the authentication file; the disguised key can be restored to obtain the plaintext key.
[0036] Optionally, the disguised key is obtained by obfuscating the plaintext key, and the disguised key is stored in the authentication file.
[0037] Optionally, the target language package is written based on a specified language that supports compilation into an intermediate language, the intermediate language supporting interpreters adapted to different systems; the apparatus further includes:
[0038] The compilation module is configured to compile the target language package into a file conforming to the intermediate language.
[0039] The interpretation module is configured to execute an interpreter corresponding to the system adapted by the client to compile the file that conforms to the intermediate language, so as to obtain the authentication file.
[0040] Optionally, the authentication file is pre-encapsulated as a target interface; the apparatus further includes:
[0041] The calling module is configured to call the target interface before the authentication module authenticates the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature, so as to trigger the execution of the operation of authenticating the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature.
[0042] According to a third aspect of the present disclosure, an electronic device is provided, comprising:
[0043] processor;
[0044] Memory used to store the processor's executable instructions;
[0045] The processor is configured to execute the instructions to implement the method as described in any one of the first aspects.
[0046] According to a fourth aspect of the present disclosure, a storage medium is provided such that, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device performs the method as described in any one of the first aspects.
[0047] According to a fifth aspect of the present disclosure, a computer program product is provided, the computer program product including readable program instructions that, when executed by a processor of an electronic device, cause the electronic device to perform the method as described in any one of the first aspects.
[0048] The technical solutions provided by the embodiments of this disclosure offer at least the following beneficial effects: In these embodiments, in response to an authentication triggering operation, an authentication data acquisition request for the application to be authenticated is sent to the server; encrypted authentication data and a data signature are received from the server in response to the authentication data acquisition request; based on a preset authentication file, the application to be authenticated is authenticated according to the encrypted authentication data and the data signature; the authentication file is an executable file compiled from a target language pack that conforms to the system adapted by the client. Thus, by using a compiled executable file for authentication, the possibility of tampering is reduced to some extent due to the high difficulty of cracking executable files. Furthermore, by having the server provide encrypted authentication data and a data signature, and the client performs authentication based on the encrypted authentication data and the data signature, the difficulty of tampering with the authentication data is further increased, thereby enhancing the security of the authentication operation to some extent.
[0049] Furthermore, by using the authentication file of the system adapted to the client, it can be ensured that the authentication file supports the client, that the authentication file can be used normally by the client, and thus that the authentication operation can be executed smoothly.
[0050] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description
[0051] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.
[0052] Figure 1 This is a flowchart illustrating an authentication method according to an exemplary embodiment.
[0053] Figure 2 This is a flowchart illustrating an encryption / decryption process according to an exemplary embodiment;
[0054] Figure 3 This is a schematic diagram illustrating a structure for compiling a target language pack according to an exemplary embodiment;
[0055] Figure 4 This is a block diagram illustrating an authentication device according to an exemplary embodiment;
[0056] Figure 5 This is a block diagram illustrating an authentication apparatus according to an exemplary embodiment;
[0057] Figure 6 This is a block diagram illustrating another device for authentication according to an exemplary embodiment. Detailed Implementation
[0058] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.
[0059] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.
[0060] Figure 1 This is a flowchart illustrating an authentication method according to an exemplary embodiment, such as... Figure 1 As shown, this authentication method, applied to the client, may include the following steps:
[0061] Step 101: In response to the authentication trigger operation, send an authentication data retrieval request for the application to be authenticated to the server.
[0062] The authentication trigger operation refers to the action that initiates authentication. For example, when a user opens an application, authentication for that user's permission to use the application is triggered. Similarly, when a user clicks on a service or function within an application, authentication for that service or function is triggered. The application to be authenticated refers to the application used in the examples above, which can include various applications installed on the client. The authentication data retrieval request may contain information such as the name or identity document (ID) of the object to be authenticated.
[0063] Specifically, a retrieval request can be sent to the server through the Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS). This HTTPS trusted data channel can make requests by calling an open application programming interface (OpenAPI), thereby ensuring the security of data during network transmission.
[0064] Step 102: Receive the encrypted authentication data and data signature returned by the server in response to the authentication data acquisition request.
[0065] The encrypted authentication data refers to the encrypted authentication data, also known as the license source data. This data includes information required for authentication, such as whether authorization is granted and the duration of that authorization. The data signature refers to the signed authentication data, also known as signature information. The server-side returned data can also be processed through the aforementioned HTTPS trusted data channel.
[0066] Specifically, the aforementioned license source data can be encrypted using the AES-GCM encryption algorithm to obtain the encrypted authentication data. The authentication data is then signed using the SHA256withRSA signature algorithm to obtain the aforementioned data signature. Of course, other encryption and decryption algorithms can also be used to process the authentication data; this embodiment of the invention does not impose any limitations on this.
[0067] Optionally, after obtaining the encrypted authentication data and data signature, the data can be encoded using Base64 encoding to facilitate transmission and improve transmission efficiency.
[0068] Step 103: Based on the preset authentication file, the application to be authenticated is authenticated according to the encrypted authentication data and the data signature; the authentication file is an executable file compiled according to the target language pack that conforms to the system adapted by the client.
[0069] The aforementioned preset authentication file refers to the file used to verify the authentication data. The authentication file can be a binary file. It may include the authentication operations required after receiving the encrypted authentication data and data signature, such as decrypting and unsigning the encrypted authentication data and data signature respectively, and then verifying them. Specifically, the client can perform the above authentication operations by executing the preset authentication file. The aforementioned client-compatible system refers to the client's own operating system. Different systems represent different platforms. For example, when the client is a mobile phone using the Android system, the aforementioned compatible system refers to the Android system.
[0070] The aforementioned target language pack, also known as a license software development toolkit (license SDK), refers to pre-written authentication files applicable to multiple systems, including iOS, Android, macOS, and Windows. Compiling the target language pack yields authentication files suitable for these various systems, allowing clients on different systems to perform authentication operations using these files.
[0071] In summary, the authentication method provided in this disclosure involves sending an authentication data acquisition request for an application to be authenticated to a server in response to an authentication trigger operation; receiving encrypted authentication data and a data signature returned by the server in response to the authentication data acquisition request; and authenticating the application to be authenticated based on a preset authentication file, according to the encrypted authentication data and the data signature. The authentication file is an executable file compiled from a target language pack and compatible with the system of the client. By using a compiled executable file for authentication, the possibility of tampering is reduced to some extent due to the high difficulty of cracking executable files. Furthermore, the server providing encrypted authentication data and a data signature, with the client authenticating based on these, further increases the difficulty of tampering with the authentication data, thereby enhancing the security of the authentication operation to a certain extent.
[0072] Furthermore, by using the authentication file of the system adapted to the client, it can be ensured that the authentication file supports the client, that the authentication file can be used normally by the client, and thus that the authentication operation can be executed smoothly.
[0073] Optionally, the above-mentioned operation of authenticating the application to be authenticated based on a preset authentication file, the encrypted authentication data, and the data signature can be implemented through the following steps in this embodiment of the invention:
[0074] Step 201: Obtain the key held by the client based on the authentication file.
[0075] The aforementioned key can be pre-set in the authentication file, or it can be generated and stored in the authentication file after the authentication operation is triggered.
[0076] Step 202: Decrypt the encrypted authentication data based on the key to obtain plaintext authentication data.
[0077] After receiving the authentication data retrieval request, the server can use the aforementioned key to encrypt the plaintext authentication data using the AES-GCM encryption algorithm, and then encode it using BASE64 to generate ciphertext authentication data, which is then sent to the client. When the client receives the ciphertext authentication data returned by the server, it can decode it using BASE64 and then decrypt it using the same key to obtain the license source data, i.e., the plaintext authentication data.
[0078] Step 203: Generate a reference data signature based on the plaintext authentication data.
[0079] After receiving the authentication data retrieval request, the server can process the plaintext authentication data using the SHA256 with RSA signature algorithm to obtain a data digest. Then, it uses the RSA algorithm and private key A to encrypt the data digest, completing the signing process. Afterward, it generates a data signature using BASE64 encoding and sends it to the client. When the client obtains the plaintext authentication data through step 302, it can perform the corresponding signing operation using the SHA256 signature algorithm to obtain a data digest, which serves as the reference data signature.
[0080] Step 204: If the reference data signature matches the data signature, authenticate the application to be authenticated based on the plaintext authentication data.
[0081] When the client receives the data signature returned by the server, it first decodes it using BASE64 to obtain the decoded data signature. Then, it decrypts it using public key B to obtain the data digest information obtained by the server after processing the plaintext authentication data using the SHA256 algorithm. The reference data signature is compared with the data digest information to determine if they match the data signature returned by the server. Specifically, if the reference data signature matches the data digest information, they are considered a match. Conversely, if they do not match, they are considered a mismatch. The private key A and public key B are a pair. When a user first uses the authentication service, a public-private key pair is assigned to the user, with the private key uploaded to the server for storage and the public key provided to the client for storage. The user can be either the user of the client or any application installed on the client.
[0082] Furthermore, if both match, it indicates that the data has not been tampered with during transmission and the obtained data is secure, allowing subsequent authentication operations to be performed. If they do not match, it indicates that the data may have been tampered with or have been injected with insecure data during transmission. In this case, subsequent authentication operations should be prohibited to prevent incorrect authentication results or impact on client security.
[0083] In this embodiment of the invention, the key held by the client is obtained based on a preset authentication file; the encrypted authentication data is decrypted based on the key to obtain plaintext authentication data; a reference data signature is generated based on the plaintext authentication data; and if the reference data signature matches the data signature, the application to be authenticated is authenticated based on the plaintext authentication data. Thus, by simultaneously performing encryption / decryption and signature matching operations, data security during the authentication process can be further guaranteed, and the accuracy of the authentication operation can be improved.
[0084] Figure 2 This is a flowchart illustrating an encryption / decryption process according to an exemplary embodiment, such as... Figure 2 As shown, after receiving a request from the client, the server can encrypt the authentication data corresponding to the request using the aforementioned key, and sign the authentication data using the aforementioned private key. The encrypted and signed data are then Base64 encoded and sent to the client. In other words, the data received by the client includes both ciphertext license data and signature data. Figure 3As shown, after receiving the encrypted license data and signature data, the client can obtain the plaintext license data by decoding and encrypting the encrypted license data, and obtain the decoded signature data by decoding the signature data. Then, it uses the public key corresponding to the private key to decrypt the data, obtaining the data digest information obtained by the server processing the plaintext authentication data using the SHA256 algorithm. The client then applies the SHA256 algorithm from the SHA256withRSA signature algorithm to the plaintext license data to generate the reference data signature. This reference data signature can be compared with the data digest information, and the comparison result can be either consistent or inconsistent. If the comparison result is consistent, authentication is performed on the application to be authenticated based on the plaintext authentication data. It can be seen that by simultaneously performing encryption / decryption and signature matching operations, data security in the authentication process can be further guaranteed, and the accuracy of the authentication process can be improved.
[0085] Optionally, the operation of obtaining the key held by the client based on the authentication file, as described above, may specifically include the following in this embodiment of the invention:
[0086] Step 301: Retrieve the plaintext key from the specified library defined in the authentication file by calling the function based on the specified library.
[0087] The library call function specified above refers to the function used to call the specified library, which is the library that stores the aforementioned plaintext key. The client can directly retrieve the aforementioned plaintext key from the specified library through the aforementioned call function.
[0088] Alternatively, in step 302, obtain the disguised key from the authentication file; restore the disguised key to obtain the plaintext key.
[0089] Alternatively, the client can obtain a disguised key from the aforementioned authentication file. This disguise refers to re-encrypting the key so that other users cannot obtain the plaintext key held by the client through decompilation.
[0090] Specifically, after obtaining the disguised key, the client can obtain the restored plaintext key through corresponding anti-disguise or decryption operations.
[0091] In this embodiment of the invention, the plaintext key is retrieved from a specified library defined in the authentication file by calling a specified library function; or, a disguised key is obtained from the authentication file; the disguised key is then restored to obtain the plaintext key. In this way, obtaining the plaintext key from the authentication file ensures key security while avoiding any impact on subsequent authentication operations.
[0092] Optionally, the disguised key is obtained by obfuscating the plaintext key, and the disguised key is stored in the authentication file.
[0093] The obfuscation process described above refers to the operation of scrambling and rearranging the key. When the target language package is written in the Rust language, this obfuscation can be performed using the obfstr instruction. Specifically, a temporary variable can be set, and the obfstr instruction performs random obfuscation based on the address and length of this temporary variable, then copies it to runtime memory (buffer) and stores it directly in the compiled authentication file. This prevents the plaintext key from being symbolically represented as a string constant in the compilation output, ensuring that it remains within the scope of the aforementioned license SDK.
[0094] In this embodiment of the invention, the disguised key is obtained by obfuscating the plaintext key, and the disguised key is stored in the authentication file. This allows the authentication file to store the obfuscated key, preventing the plaintext key from being stolen by other users and further ensuring the data security of the authentication service.
[0095] In one alternative embodiment, the target language package is written based on a specified language that supports compilation into an intermediate language; the intermediate language supports interpreters adapted to different systems; the embodiments of the present invention may further include:
[0096] Step 401: Compile the target language package into a file that conforms to the intermediate language;
[0097] Step 402: Compile the file that conforms to the intermediate language according to the interpreter corresponding to the system adapted by the client to obtain the authentication file.
[0098] The specified language can be chosen according to actual needs. For example, the specified language can be Rust or Java, as long as it can be compiled into an intermediate language. It should be noted that different specified languages correspond to different intermediate languages, and correspondingly, the interpreters supported by the intermediate languages for different systems also differ. When the specified language is Rust, the intermediate language refers to LLVM IR (Intermediate Representation). Compiling the target language package into a file conforming to the intermediate language can be done using the Rust compiler rustc. rustc can compile the original target language package into LLVM IR, and then the LLVM IR can be processed into an executable file adapted to different systems by the interpreters corresponding to those systems. For example, the interpreter for iOS is the LLVM backend, and the interpreter for Android is the NDK (Native Development Kits) backend. Similarly, when the specified language is Java, the intermediate language refers to Java bytecode. Compiling the target language package into a file conforming to the intermediate language can be done using a Java compiler (e.g., javac). After being compiled by the compiler, Java will produce the corresponding bytecode file. In this way, bytecode files can be processed into executable files adapted to different systems using interpreters corresponding to those systems. It should be noted that executable files derived from the Java language must run on the Java Virtual Machine (JVM). Therefore, when using Java to write a target language package, the resulting executable file will only be compatible with clients that have a JVM installed.
[0099] It should be noted that if the client uses a native language to write the target language package, the interfaces developed for Android (Java or Kotlin) and iOS (Objective-C) may be dynamically replaced or easily cracked. When using C / C++, the language characteristics and memory management quality issues demand higher development skills, making development more difficult. In this embodiment of the invention, Rust is used as the specified language. Because Rust does not allow null pointers or dangling pointers, pointers can only be constructed through fixed initialization forms. These forms have already undergone security analysis upon initial input, thus ensuring memory safety and avoiding the risk of memory leaks due to insufficient development capabilities.
[0100] Furthermore, in this embodiment of the invention, the target language package is written based on a specified language that supports compilation into an intermediate language, and the intermediate language can be adapted to interpreters of different systems. Thus, by using the interpreter corresponding to the client's adapted system to compile a file conforming to the intermediate language, an executable file conforming to the client's adapted system can be obtained. Since the intermediate language supports interpreters of different systems, authentication files adapted to different systems can be compiled based on a single target language package, enabling cross-platform development, thereby reducing manpower costs and improving efficiency. At the same time, compared to different developers developing multiple language packages to adapt to different systems, since authentication files adapted to different systems can be compiled based on a single target language package, the logical inconsistencies caused by different compilation habits of developers can be avoided.
[0101] Furthermore, authentication services need to be completed on the client side, and existing technologies often require corresponding coding for clients of different systems. In this embodiment of the invention, a target language package is written in a specified language, so that executable files adapted to different systems can be compiled based on the target language package, thus adapting to clients of different systems. This avoids the problem of low development efficiency caused by the need for separate coding for clients of different systems.
[0102] Optionally, the aforementioned authentication file is pre-encapsulated as a target interface; before authenticating the application to be authenticated based on the preset authentication file, the embodiments of the present invention may further include the following steps:
[0103] Step 501: Call the target interface to trigger the execution of the authentication operation based on the preset authentication file, the encrypted authentication data, and the data signature for authenticating the application to be authenticated.
[0104] The aforementioned target interface refers to the interface that the client's adapted system can call. The client can specifically call the interface that matches its adapted system; that is, it calls the target interface to perform authentication operations. Specifically, the `extern` keyword can be used in the target language package to set foreign function interfaces (FFIs) corresponding to different systems. For example, a C interface can be set so that iOS and Windows systems can perform authentication operations through this interface, and correspondingly, a Java native interface can be set so that Android systems can perform authentication operations through this interface. Specifically, when compiling the target language package into authentication files adapted to different systems, this can be achieved by calling the corresponding FFIs for each system, and the generated authentication files can be directly encapsulated into these FFIs.
[0105] Optionally, Figure 3 This is a schematic diagram illustrating a structure for compiling a target language pack according to an exemplary embodiment, such as... Figure 3 As shown, when the target language package is written in the Rust language, the compilation operation can be performed using the RustC compiler. By specifying different system objects and calling the corresponding FFI, authentication files adapted to different systems can be compiled. Figure 3 The application layer shown represents the application to be authenticated. Initialization refers to sending a request containing the application name and its functions to the server each time the application is used. This stores the encrypted authentication data returned by the server on the client. When verifying other functions within the application, the authentication data can be directly retrieved from the client's storage without sending another request to the server. Passing in user configuration refers to accessing the user's system configuration, which may include the user's system type. Calling the verification interface refers to starting the authentication service by calling the verification interface. The system layer can correspond to iOS, Android, macOS, Linux, and Windows systems, etc. Figure 3This only illustrates three of them. The system layer is mainly responsible for data interaction with the server and persisting the content returned by the server locally. The content returned by the server refers to the encrypted authentication data. The FFI layer refers to the different interfaces mentioned above, which can include C and Java interfaces. The RUST layer, also known as the authentication layer, is mainly responsible for authenticating the received encrypted authentication data. In other words, the authentication operation is completed at the RUST layer. Because the binary file of the RUST layer is unreadable, it can prevent tampering, raising the barrier to cracking and enhancing the security of the authentication operation. The application layer, system layer, FFI layer, and RUST layer can all reside on the client side.
[0106] Specifically, when the client needs to perform authentication operations, it can do so by calling the corresponding target interface encapsulated above.
[0107] In this embodiment of the invention, the aforementioned authentication file is pre-encapsulated as a target interface. By calling the target interface, the operation of authenticating the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature is triggered. In this way, only the pre-encapsulated target interface needs to be called to perform the corresponding authentication operation, thereby reducing the number of operations required for authentication and improving authentication efficiency.
[0108] Furthermore, since the authentication file encapsulated in the target interface is compatible with the client's system, the problem of being unable to call the service normally due to system incompatibility can be avoided, thereby improving the effectiveness of the authentication service.
[0109] Figure 4 This is a block diagram illustrating an authentication device 40 according to an exemplary embodiment, which can be applied to a client, such as... Figure 4 As shown, the device 40 may include:
[0110] The sending module 401 is configured to execute a request to obtain authentication data of the application to be authenticated in response to the authentication trigger operation.
[0111] The receiving module 402 is configured to receive the encrypted authentication data and data signature returned by the server in response to the authentication data acquisition request;
[0112] The authentication module 403 is configured to execute an authentication file based on a preset authentication file, and to authenticate the application to be authenticated based on the encrypted authentication data and the data signature; the authentication file is an executable file compiled according to the target language pack that conforms to the system adapted by the client.
[0113] In one alternative embodiment, the authentication module 403 includes:
[0114] The acquisition submodule is configured to perform an operation based on the authentication file to obtain the key held by the client;
[0115] The decryption submodule is configured to perform decryption of the ciphertext authentication data based on the key to obtain plaintext authentication data;
[0116] The generation submodule is configured to generate a reference data signature based on the plaintext authentication data;
[0117] The authentication submodule is configured to perform authentication on the application to be authenticated based on the plaintext authentication data if the reference data signature matches the data signature.
[0118] In one alternative embodiment, the acquisition submodule is specifically configured to execute:
[0119] The plaintext key is retrieved from the specified library defined in the authentication file based on the specified library call function;
[0120] Alternatively, the disguised key can be obtained from the authentication file; the disguised key can be restored to obtain the plaintext key.
[0121] In one alternative embodiment, the disguised key is obtained by obfuscating the plaintext key, and the disguised key is stored in the authentication file.
[0122] In one alternative embodiment, the target language package is written based on a specified language that supports compilation into an intermediate language, the intermediate language supporting interpreters adapted to different systems; the apparatus 40 further includes:
[0123] The compilation module is configured to compile the target language package into a file conforming to the intermediate language.
[0124] The interpretation module is configured to execute an interpreter corresponding to the system adapted by the client to compile the file that conforms to the intermediate language, so as to obtain the authentication file.
[0125] In one alternative embodiment, the authentication file is pre-encapsulated as a target interface; the device 40 further includes:
[0126] The calling module is configured to call the target interface before the authentication module 403 authenticates the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature, so as to trigger the execution of the operation of authenticating the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature.
[0127] In summary, the authentication method provided in this disclosure involves sending an authentication data acquisition request for an application to be authenticated to a server in response to an authentication trigger operation; receiving encrypted authentication data and a data signature returned by the server in response to the authentication data acquisition request; and authenticating the application to be authenticated based on a preset authentication file, according to the encrypted authentication data and the data signature. The authentication file is an executable file compiled from a target language pack and compatible with the system of the client. By using a compiled executable file for authentication, the possibility of tampering is reduced to some extent due to the high difficulty of cracking executable files. Furthermore, the server providing encrypted authentication data and a data signature, with the client authenticating based on these, further increases the difficulty of tampering with the authentication data, thereby enhancing the security of the authentication operation to a certain extent.
[0128] Furthermore, by using the authentication file of the system adapted to the client, it can be ensured that the authentication file supports the client, that the authentication file can be used normally by the client, and thus that the authentication operation can be executed smoothly.
[0129] According to one embodiment of this disclosure, an electronic device is provided, including: a processor and a memory for storing processor-executable instructions, wherein the processor is configured to, when executed, implement the steps in the authentication method as described in any of the above embodiments.
[0130] According to one embodiment of this disclosure, a storage medium is also provided, which, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform the steps in the authentication method as described in any of the above embodiments.
[0131] According to one embodiment of this disclosure, a computer program product is also provided, which includes readable program instructions that, when executed by a processor of an electronic device, enable the electronic device to perform the steps in the authentication method as described in any of the above embodiments.
[0132] Figure 5This is a block diagram illustrating an authentication apparatus according to an exemplary embodiment. The apparatus 500 may include a processing component 502, a memory 504, a power supply component 506, a multimedia component 508, an audio component 510, an input / output interface 512, a sensor component 514, a communication component 516, and a processor 520. The processing component 502 may include one or more processors 520 to execute instructions to complete all or part of the steps of the authentication method described above. In the exemplary embodiment, a storage medium including instructions is also provided, such as the memory 504 including instructions, which can be executed by the processor 520 of the apparatus 500 to complete the method described above. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.
[0133] Figure 6 This is a block diagram illustrating another authentication apparatus according to an exemplary embodiment. The apparatus 600 may include a processing component 622, a memory 632, an input / output interface 658, a network interface 650, and a power supply component 626. The apparatus 600 may be provided as a server. The application program stored in the memory 632 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 622 is configured to execute instructions to perform the authentication method described above.
[0134] All user information (including but not limited to user device information, user personal information, etc.) and related data involved in this disclosure are information authorized by the user or by the parties involved.
[0135] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.
[0136] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.
Claims
1. An authentication method, characterized in that, Applied to a client, the method includes: In response to the authentication trigger operation, a request to obtain authentication data for the application to be authenticated is sent to the server; Receive the encrypted authentication data and data signature returned by the server in response to the authentication data acquisition request; Based on a preset authentication file, the application to be authenticated is authenticated according to the encrypted authentication data and the data signature; The authentication file is an executable file compiled from a file conforming to the LLVM IR language according to the interpreter corresponding to the system adapted by the client. The file conforming to the LLVM IR language is obtained by compiling a target language package written in the RUST language using the rustc compiler. The authentication file stores a disguised key, which is obtained by obfuscating the plaintext key.
2. The method according to claim 1, characterized in that, The authentication of the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature includes: The key held by the client is obtained based on the authentication file; The encrypted authentication data is decrypted using the key to obtain the plaintext authentication data. Based on the plaintext authentication data, a reference data signature is generated; If the reference data signature matches the data signature, the application to be authenticated is authenticated based on the plaintext authentication data.
3. The method according to claim 2, characterized in that, The step of obtaining the key held by the client based on the authentication file includes: The plaintext key is retrieved from the specified library defined in the authentication file based on the specified library call function; Alternatively, the disguised key can be obtained from the authentication file; the disguised key can be restored to obtain the plaintext key.
4. The method according to any one of claims 1-3, characterized in that, The target language package is written in a specified language that supports compilation into an intermediate language, which supports interpreters for different systems; the method further includes: Compile the target language package into a file that conforms to the intermediate language; The authentication file is obtained by compiling the file that conforms to the intermediate language according to the interpreter corresponding to the system adapted by the client.
5. The method according to any one of claims 1-3, characterized in that, The authentication file is pre-encapsulated as a target interface; before authenticating the application to be authenticated based on the preset authentication file, the encrypted authentication data, and the data signature, the method further includes: The target interface is invoked to trigger the execution of the authentication operation based on the preset authentication file, the encrypted authentication data, and the data signature, to authenticate the application to be authenticated.
6. An authentication device, characterized in that, Applied to a client, the device includes: The sending module is configured to respond to the authentication trigger operation by sending an authentication data retrieval request to the server for the application to be authenticated. The receiving module is configured to receive the encrypted authentication data and data signature returned by the server in response to the authentication data acquisition request; The authentication module is configured to execute an authentication file based on a preset authentication file, and to authenticate the application to be authenticated according to the encrypted authentication data and the data signature. The authentication file is an executable file compiled from a file conforming to the LLVM IR language according to the interpreter corresponding to the system adapted by the client. The file conforming to the LLVM IR language is obtained by compiling a target language package written in the RUST language using the rustc compiler. The authentication file stores a disguised key, which is obtained by obfuscating the plaintext key.
7. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the method as described in any one of claims 1 to 5.
8. A storage medium, characterized in that, When the instructions in the storage medium are executed by the processor of the electronic device, the electronic device performs the method as described in any one of claims 1 to 5.
9. A computing device program product, characterized in that, The computing device program product includes readable program instructions that, when executed by the processor of the electronic device, cause the electronic device to perform the method as described in any one of claims 1 to 5.