An identity authentication method and device, a computing device, and a computer storage medium

Abstract

This invention discloses an identity authentication method, apparatus, computing device, and storage medium. The method includes: receiving at least one account entry information added by a user; encrypting the at least one account entry information; and transmitting the encrypted at least one account entry information to a unified identity authentication database for storage; determining a target login website; verifying the user's identity; and generating and presenting a random code corresponding to the target login website after successful verification for random code verification; and sending the account entry information corresponding to the target login website to a web client after random code verification, so that the web client can automatically fill in the user's account information to log in to the target login website. This invention's unified identity authentication client manages and monitors user information and is responsible for the encryption, verification, and locking / unlocking of information status throughout the authentication process, greatly enhancing the security of passwords during storage and transmission.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, specifically to an identity authentication method, apparatus, computing device, and computer storage medium. Background Technology

[0002] As the security risks of user information system authentication continue to increase, major internet companies are constantly strengthening their user identity authentication technologies. MFA (Multi-Factor Authentication) has evolved into the mainstream technology. The principle of MFA authentication is as follows: when a user needs to access the web version of a certain software, they need to download the corresponding mobile app separately and complete identity authentication within the app before a specified MFA random code is generated. Access to the web version of the software is then granted using this specified MFA random code. However, MFA-based identity authentication systems have the drawback of limited functionality: currently, apps that support MFA authentication (such as QQ and Alibaba Cloud) can only perform further login authentication for their own systems; the apps themselves do not provide password storage functionality, thus failing to provide a convenient authentication solution.

[0003] In addition, there are methods for authentication using a second password combined with a user card, and methods for providing management authentication services by deploying multiple authentication virtual devices. The principle of authentication using a second password combined with a user card is as follows: at least one second dynamic password is generated by combining various time factors within the authentication time window with the first dynamic password, and then used to authenticate the user card. This method has the disadvantage of low security: with the improvement of computer computing performance, attackers can control the remote server clock through NTP (Network Time Protocol), providing a forged timestamp and continuously trying the possibility of the first dynamic password, thereby obtaining the second password and gaining access to the system in a short time. Whether it's authentication using a second password combined with a user card or providing management authentication services by deploying multiple authentication virtual devices, both methods are cumbersome, greatly increasing user operation time and complicating the system's authentication process. Summary of the Invention

[0004] In view of the above problems, the present invention is proposed to provide an authentication method and apparatus, computing device and computer storage medium that overcomes or at least partially solves the above problems.

[0005] According to a first aspect of the present invention, an identity authentication method is provided, applied to a unified identity authentication client, comprising:

[0006] The system receives at least one account entry information added by a user, encrypts the at least one account entry information, and transmits the encrypted at least one account entry information to a unified identity authentication database for storage; wherein, each account entry information includes the login website and the corresponding user account information;

[0007] Monitor user actions to obtain random codes for any login website to determine the target login website;

[0008] The user's identity is verified, and after successful verification, a random code corresponding to the target login website is generated and presented for random code verification.

[0009] After the random code verification is completed, the account entry information corresponding to the target login website is sent to the web client so that the web client can automatically fill in the user account information to log in to the target login website.

[0010] Furthermore, before monitoring a user's random code acquisition operation for any logged-in website, the method further includes:

[0011] Display at least one login website and a control for obtaining the random code for each login website;

[0012] The monitoring of a user's random code acquisition operation for any logged-in website specifically involves monitoring the user's click operation on the random code acquisition control corresponding to any logged-in website.

[0013] Furthermore, the step of receiving at least one account entry information added by the user, encrypting the at least one account entry information, and transmitting the encrypted at least one account entry information to the unified identity authentication database for storage further includes:

[0014] Receive at least one account entry information added by the user;

[0015] The at least one account entry information is symmetrically encrypted using an advanced encryption standard.

[0016] The encrypted account entry information is transmitted to the unified identity authentication database for storage.

[0017] Set the information status of at least one account entry to a locked state.

[0018] Furthermore, the step of verifying the user's identity and generating and presenting a random code corresponding to the target login website after successful verification, for random code verification, further includes:

[0019] The user's identity is verified, and after successful verification, a key is generated by combining the MD5 message digest algorithm and a random salt value. Based on the key, a random code corresponding to the target login website is generated using the TOTP algorithm.

[0020] The random code and the corresponding account entry information are saved to the unified identity authentication database, and the maximum caching time for the unified identity authentication database to cache the random code and the corresponding account entry information is preset.

[0021] The random code cached in the unified identity authentication database is presented, and the total number of verifications of any random code presented by the unified identity authentication client on the web client is preset.

[0022] Set the information status of the account entry information corresponding to the target login website to the active state for random code verification.

[0023] Furthermore, the step of sending the account entry information corresponding to the target login website to the web terminal after the random code verification is completed, so that the web terminal can automatically fill in the user account information to log in to the target login website, further includes:

[0024] After the random code verification is completed, the account entry information corresponding to the target login website is encrypted using an asymmetric encryption algorithm;

[0025] The encrypted account entry information corresponding to the target login website is sent to the web client, so that the web client can automatically fill in the user account information after decryption and log in to the target login website.

[0026] According to a second aspect of the present invention, an identity authentication method is provided, applied to a web application, comprising:

[0027] The system receives a random code corresponding to the target login website input by the user; wherein the random code is generated and presented to the user by the unified identity authentication client after the user's identity has been verified.

[0028] The random code is verified;

[0029] After the random code verification is successful, the system receives the account entry information corresponding to the target login website sent by the unified identity authentication client.

[0030] Decrypt the account entry information to obtain the user account information corresponding to the target login website;

[0031] The user account information is automatically filled in to log in to the target login website.

[0032] According to a third aspect of the present invention, an identity authentication device is provided for use in a unified identity authentication client, comprising:

[0033] The receiving module is used to receive at least one account entry information added by the user, encrypt the at least one account entry information, and transmit the encrypted at least one account entry information to the unified identity authentication database for storage; wherein, each account entry information includes the login website and the corresponding user account information;

[0034] The determination module is used to monitor the user's random code acquisition operation for any login website and determine the target login website;

[0035] The random code generation module is used to verify the user's identity and, after successful verification, generate and present a random code corresponding to the target login website for random code verification.

[0036] The sending module is used to send the account entry information corresponding to the target login website to the Web client after the random code verification is completed, so that the Web client can automatically fill in the account information to log in to the target login website.

[0037] According to a fourth aspect of the present invention, an identity authentication device is provided, applied to a web interface, comprising:

[0038] The first receiving module is used to receive a random code corresponding to the target login website input by the user; wherein, the random code is generated by the unified identity authentication client after the user's identity is verified and presented to the user;

[0039] A random code verification module is used to verify the random code;

[0040] The second receiving module is used to receive the account entry information corresponding to the target login website sent by the unified identity authentication client after the random code verification is passed.

[0041] The decryption module is used to decrypt the account entry information to obtain the user account information corresponding to the target login website;

[0042] The fill module is used to automatically fill in the user account information to log in to the target login website.

[0043] According to a fifth aspect of the present invention, a computing device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0044] The memory is used to store at least one executable instruction, which causes the processor to perform an operation corresponding to any of the authentication methods described above.

[0045] According to a sixth aspect of the present invention, a computer storage medium is provided, the storage medium storing at least one executable instruction that causes a processor to perform an operation corresponding to an authentication method as described in any of the preceding claims.

[0046] The identity authentication method and apparatus according to the present invention have the following beneficial effects:

[0047] The unified identity authentication client of this invention can bind multiple account entries and enables direct login to a specified website via a random code on the web client. This avoids the risk of information leakage caused by directly saving passwords through the browser on the web client, and also solves the problem of users having to remember multiple passwords and enter them every time.

[0048] The unified identity authentication client of this invention manages and monitors user information, and is responsible for the encryption, verification, and locking or unlocking of information status throughout the authentication process, which greatly enhances the security of passwords during storage and transmission.

[0049] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0050] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0051] Figure 1 A flowchart of an identity authentication method provided by an embodiment of the present invention is shown;

[0052] Figure 2 This diagram illustrates the display content of the unified identity authentication client provided in an embodiment of the present invention.

[0053] Figure 3 A flowchart of an identity authentication method provided by another embodiment of the present invention is shown;

[0054] Figure 4 A schematic diagram of the login page on the web side of an embodiment of the present invention is shown;

[0055] Figure 5 A schematic diagram of the structure of an identity authentication device according to an embodiment of the present invention is shown;

[0056] Figure 6 A schematic diagram of an identity authentication device according to another embodiment of the present invention is shown;

[0057] Figure 7 A schematic diagram of a computing device embodiment provided by an embodiment of the present invention is shown. Detailed Implementation

[0058] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0059] Figure 1 A flowchart of an identity authentication method according to an embodiment of the present invention is shown. This method is applied in a computing device. The computing device includes a processor, a memory, a communication interface, and a communication bus. The processor, the memory, and the communication interface communicate with each other via the communication bus. The memory stores at least one executable instruction, which causes the processor to perform an operation corresponding to an identity authentication method. This method is used for a unified identity authentication client. Specifically, after a user downloads the unified identity authentication client, they need to enter a username, password, and mobile phone verification code to complete registration. Additionally, upon first use, the unified identity authentication client will force the user to bind the MFA function and prompt the user to enable biometric recognition binding. Biometric recognition mainly includes fingerprint and / or facial recognition, facilitating quick login to the unified identity authentication client. Figure 1 As shown, the method includes the following steps:

[0060] Step 110: Receive at least one account entry information added by the user, encrypt the at least one account entry information, and transmit the encrypted at least one account entry information to the unified identity authentication database for storage; wherein, each account entry information includes the login website and the corresponding user account information; the specific user account information includes the user's username and password, or the user's username and password field;

[0061] Step 120: Monitor the user's random code acquisition operation for any login website to determine the target login website;

[0062] Step 130: Verify the user's identity, and generate and present the random code corresponding to the target login website after successful verification for random code verification; In this step, when the user needs to obtain a random code, the unified identity authentication client requires the user to first verify the human biometrics bound during the first use. Only after the user's human biometrics verification is successful will the unified identity authentication client generate a random code according to the user's needs, and the generated random code will be presented on the unified identity authentication client.

[0063] Step 140: After the random code verification is completed, send the account entry information corresponding to the target login website to the Web client so that the Web client can automatically fill in the user account information to log in to the target login website.

[0064] In an alternative embodiment, before monitoring the user's random code acquisition operation for any login website in step 120, the method further includes: displaying at least one login website and a random code acquisition control corresponding to each login website;

[0065] The monitoring of a user's random code acquisition operation for any logged-in website specifically involves monitoring the user's click operation on the random code acquisition control corresponding to any logged-in website.

[0066] like Figure 2 As shown, after a user adds account entry information through the unified identity authentication client, the unified identity authentication client displays the login website in the account entry information added by the user. In addition, the unified identity authentication client also displays the random code retrieval control corresponding to each login website. The unified identity authentication client can determine the target login website that the user needs to log in to by monitoring the user's click operation on the random code retrieval control corresponding to any login website. In addition, when the user clicks the random code retrieval control corresponding to any login website, the unified identity authentication client will execute the content of step 130.

[0067] In one alternative approach, step 110, which involves receiving at least one account entry information added by the user, encrypting the at least one account entry information, and transmitting the encrypted at least one account entry information to a unified identity authentication database for storage, further includes:

[0068] Receive at least one account entry information added by the user;

[0069] The at least one account entry information is symmetrically encrypted using an advanced encryption standard.

[0070] The encrypted account entry information is transmitted to the unified identity authentication database for storage.

[0071] Set the information status of at least one account entry to a locked state.

[0072] In this optional approach, during the symmetric encryption of the at least one account entry information using advanced encryption standards, the username and password information in the account entry information are encrypted using different keys, thereby improving the security of the account entry information. In addition, setting the information status of the at least one account entry information to a locked state can prevent the unified identity authentication client or web client from accessing the account entry information, and the information status can be adjusted to an active state, further improving the security of the unified identity authentication client storing the account entry information.

[0073] In one alternative approach, step 130 verifies the user's identity and, upon successful verification, generates and presents a random code corresponding to the target login website for random code verification, further comprising:

[0074] The user's identity is verified, and after successful verification, a key is generated by combining the MD5 message digest algorithm and a random salt value. Based on the key, a random code corresponding to the target login website is generated using the TOTP algorithm.

[0075] The random code and the corresponding account entry information are saved to the unified identity authentication database, and the maximum caching time for the random code and the corresponding account entry information in the unified identity authentication database is preset, for example, the maximum caching time is 30 seconds.

[0076] The random code cached in the unified identity authentication database is presented, and the total number of times the Web client verifies any random code presented by the unified identity authentication client is preset. For example, the total number of verifications on the Web client for any random code presented by the unified identity authentication client is limited to 3.

[0077] The information status of the account entry information corresponding to the target login website is set to the active state, so that the web client can access the random code presented by the unified identity authentication client. The random code is compared with the random code entered by the user to complete the random code verification.

[0078] In this optional method, the total number of verifications performed by the web client on any random code presented by the unified identity authentication client is pre-set. For example, for any random code presented by the unified identity authentication client, the web client is set to verify the random code a maximum of 3 times, thereby preventing brute-force attacks. Specifically, the random code consists of 6 digits, therefore there are 10... 6 One possibility is that, assuming verification occurs every 0.1 seconds, the total verification time would be 0.1 * 10^6 seconds. 6 The time step is approximately 27.8 hours, while the total time step in the TOTP function is 30 seconds, and the total number of verifications on the web side is limited to 3, thus completely preventing attackers from brute-forcing the attack.

[0079] Secondly, a key is generated by combining the MD5 message digest algorithm with a random salt value, replacing the single MD5 message digest algorithm. The random salt value enhances the difficulty of cracking the key. In this embodiment, a random salt value is generated, and the number of bits in the salt value is determined according to specific requirements. The random salt value is combined with the plaintext parameters and the MD5 message digest algorithm to obtain the ciphertext parameters, i.e., the key. Therefore, even if a reverse lookup is performed using an MD5 ciphertext lookup tool, only the plaintext parameters with the added random salt value can be found. Since the random salt value is unknown, the difficulty of cracking the key is increased.

[0080] The total function of the TOTP algorithm is:

[0081]

[0082] In the above formula, HMAC-SHA-1 is a keyed hash algorithm constructed from the SHA-1 hash function and used as a hash-based message verification code. K is the shared key between the unified identity authentication client and the unified identity authentication server, T0 is the start time of counting, X is the time step, N is the number of decimal digits truncated, and T is the current timestamp. Furthermore, a maximum cache time is preset for the unified identity authentication database to cache the random code and its corresponding account entry information. When the cache time for the unified identity authentication database reaches the maximum cache time, the random code becomes invalid, and the unified identity authentication client no longer presents the random code cached in the unified identity authentication database, thereby ensuring the security of random code verification on the web client.

[0083] In an optional approach, step 140, after the random code verification is completed, sends the account entry information corresponding to the target login website to the web client so that the web client can automatically fill in the user account information to log in to the target login website, further includes:

[0084] After the random code verification is completed, the account entry information corresponding to the target login website is encrypted using an asymmetric encryption algorithm;

[0085] The encrypted account entry information corresponding to the target login website is sent to the web client, so that the web client can automatically fill in the user account information after decryption and log in to the target login website.

[0086] In this optional approach, the unified identity authentication client and the web client transmit information using an asymmetric encryption algorithm to ensure the security of information transmission. The specific asymmetric encryption algorithm has a public key and a private key. The private key is stored in the hard code of the unified identity authentication client, while the public key is sent from the unified identity authentication client to the web client for the web client to decrypt the account entry information.

[0087] One authentication method in this invention combines traditional username and password verification. Initial use requires a mobile phone verification code. The unified identity authentication client stores the user's registration context, including mobile phone information and IP address. User information is encrypted using an advanced encryption standard and further encrypted during transmission using an asymmetric encryption algorithm, ensuring the security of user information storage and the security of uplink and downlink processes. Simultaneously, the 6-digit random code generated by the unified identity authentication client is random, unpredictable, and unobtainable. Only when the user clicks to obtain it will the system generate a 64-bit key using an MD5 message digest algorithm and a random salt value. The salt value is different each time a key is generated. The MD5 key and salt value are not stored in a database, so hackers cannot predict or obtain them.

[0088] An identity authentication method according to an embodiment of the present invention is used in a unified identity authentication client. The unified identity authentication client provides a locking function, which can adjust the information status of user information, that is, set the information status to a locked state or set the information status to an active state. Only in the active state will the user be allowed to perform random code verification, thus truly transferring identity security verification from the Web end to the unified identity authentication client.

[0089] Figure 3 A flowchart of another embodiment of the authentication method of the present invention is shown, which is applied in a computing device. The computing device includes a processor, a memory, a communication interface, and a communication bus. The processor, the memory, and the communication interface communicate with each other through the communication bus. The memory stores at least one executable instruction, which causes the processor to perform an operation corresponding to an authentication method. Specifically, the method is used on a web application and includes the following steps:

[0090] Step 210: Receive the random code corresponding to the target login website input by the user; wherein the random code is generated by the unified identity authentication client after the user's identity is verified and presented to the user;

[0091] Step 220: Verify the random code; The specific verification of the random code on the Web end is as follows: The Web end accesses the random code presented by the unified identity authentication client, compares the random code presented by the unified identity authentication client with the random code entered by the user, and thus determines whether the verification passes.

[0092] Step 230: After the random code verification is successful, receive the account entry information corresponding to the target login website sent by the unified identity authentication client; the account entry information corresponding to the target login website received here is encrypted information, as well as the public key required to decrypt the encrypted information, and the private key is configured in the hard code by the unified identity authentication client;

[0093] Step 240: Decrypt the account entry information to obtain the user account information corresponding to the target login website; specifically, decrypting the account entry information involves decrypting the ciphertext account entry information using the received ciphertext information and the public key required to decrypt the ciphertext information, and using the public key and the private key configured in the unified identity authentication client.

[0094] Step 250: Automatically fill in the user account information and log in to the target login website.

[0095] In addition, before receiving the random code input by the user in step 210, the method further includes displaying the random code input unit and login control corresponding to each login website;

[0096] The specific details of receiving the random code input by the user are as follows:

[0097] The system monitors the random code entered by the user through the random code input unit and the user's click operation on the login control, and receives the random code entered by the user through the random code input unit after the user clicks the login control.

[0098] One embodiment of the present invention provides an identity authentication method that transfers the web-based login authentication process to a unified identity authentication client. This allows users to log in to the corresponding website simply by entering a 6-digit random code. The web-based password storage is not limited to a single server, and users must pass MFA authentication through the unified identity authentication client to use the web-based system, making it more secure than the browser's "remember password" function.

[0099] To facilitate understanding of the above embodiments of the present invention, a specific embodiment will be described below:

[0100] First, after downloading the unified identity authentication client, users need to enter their username, password, and mobile phone verification code to complete the registration. In addition, on the first use, the unified identity authentication client will force users to bind the MFA function and prompt users to enable human biometric recognition binding.

[0101] When a user enters account entry information through the unified identity authentication client, the unified identity authentication client receives the account entry information entered by the user, encrypts the account entry information using advanced encryption standards, and then transmits it to the unified identity authentication database for storage.

[0102] The unified identity authentication client monitors the user's random code acquisition operation. That is, when the user clicks the random code acquisition control, it means that the login website corresponding to the random code acquisition control is the target login website that the user needs to log in on the web. The unified identity authentication client will verify the user's identity based on the MFA function bound when the user first uses it and human biometric characteristics. After the verification is successful, a key is generated according to the user's needs by using the MD5 message digest algorithm and random salt value. Based on the key, the random code corresponding to the target login website is generated and presented through the TOTP algorithm.

[0103] After obtaining a random code through the unified identity authentication client, the user enters the random code into the verification page on the web. The web login page looks like this. Figure 4 As shown, it includes at least one login website, and each login website is equipped with a random code input unit and a login control. The random code input unit is used to input the random code obtained by the user through the unified identity authentication client. After inputting the random code, the user clicks the login control. The web terminal detects the user's click operation, receives the random code input by the user through the random code input unit, and verifies the random code.

[0104] After successful verification, the unified identity authentication client encrypts the account entry information corresponding to the target login website using an asymmetric encryption algorithm and sends the encrypted account entry information to the web client. Upon receiving the encrypted account entry information, the web client decrypts it to obtain the user account information corresponding to the target login website. The web client then automatically fills in the user account information based on the decrypted result and logs in to the target login website, thereby completing the identity authentication and automatic web client login in this embodiment of the invention.

[0105] The identity authentication method of the above embodiments of the present invention is applied to a unified identity authentication client and a web client. The unified identity authentication client is divided into a front-end and a back-end. The front-end is responsible for displaying the information status settings of the random code and account entry information, and the back-end is responsible for storing the account entry information and the corresponding random code. The web client is responsible for receiving the random code and account entry information, verifying the random code, decrypting the account entry information, and automatically filling in the user account information to log in to the target login website.

[0106] The identity authentication method of the above embodiments of the present invention dynamically generates a 32-bit key by combining the MD5 message digest algorithm and a random salt value, replacing the traditional method of generating a fixed key. Since the key generated each time is different, the value of the 6-bit random code is also different. The web client performs verification through a slow verification method, limiting the number of times the random code is authenticated, that is, the total number of verifications for the same random code is 3, to prevent hackers from brute-forcing the authentication code. The encrypted data is stored in the unified identity authentication server according to the Advanced Encryption Standard (AES128 algorithm), and the account and password are encrypted and stored using different key information. Even if the database is compromised, hackers will not be able to obtain the plaintext of the user's account and password. The unified identity authentication client and the web client interact through an asymmetric encryption algorithm for information transmission. The web client obtains the public key, while the private key is set in the hard code by the APP. Only when the public and private keys match can the transmitted encrypted information be parsed. The unified identity authentication client can set a security lock for account and password entries. When the information is locked, the web client must wait for the unified identity authentication client to unlock it before it can perform information operations. Moreover, the web client does not directly access the database, but only interacts with the unified identity authentication client, further enhancing the security of the system.

[0107] The above-described embodiment of the present invention provides an identity authentication method in which the unified identity authentication client can store any number of account entries, each of which generates a different 6-digit random code. Users can also configure the unified resource positioning system for account and password login to locate the target login website. Thus, the web client opens the target login website based on the located target login website address, automatically fills in the user account information, and easily completes the login authentication of user information.

[0108] Figure 5 A schematic diagram of an identity authentication device according to an embodiment of the present invention is shown. This device is used for a unified identity authentication client. Specifically, after a user downloads the unified identity authentication client, they need to enter a username, password, and mobile phone verification code to complete registration. Additionally, upon first use, the unified identity authentication client will force the user to bind the MFA function and prompt the user to enable biometric identification binding. Biometric identification mainly includes fingerprint and / or facial recognition, facilitating quick login to the unified identity authentication client. Figure 5 As shown, the device includes a receiving module 310, a determining module 320, a random code generating module 330, and a transmitting module 340, wherein:

[0109] The receiving module 310 is used to receive at least one account entry information added by the user, encrypt the at least one account entry information, and transmit the encrypted at least one account entry information to the unified identity authentication database for storage; wherein, each account entry information includes the login website and the corresponding user account information;

[0110] The determination module 320 is used to monitor the user's random code acquisition operation for any login website and determine the target login website;

[0111] The random code generation module 330 is used to verify the user's identity and, after successful verification, generate and present the random code corresponding to the target login website for random code verification.

[0112] The sending module 340 is used to send the account entry information corresponding to the target login website to the Web terminal after the random code verification is completed, so that the Web terminal can automatically fill in the account information to log in to the target login website.

[0113] In one alternative embodiment, the device further includes a display module for displaying at least one login website and a random code acquisition control corresponding to each login website;

[0114] The determination module 320 monitors the user's random code acquisition operation for any login website. Specifically, the determination module 320 monitors the user's click operation on the random code acquisition control corresponding to any login website, and the click operation triggers the determination module 320 to determine the target login website.

[0115] In one optional approach, the receiving module 310 receives at least one account entry information added by the user, encrypts the at least one account entry information, and transmits the encrypted at least one account entry information to the unified identity authentication database for storage, further including:

[0116] The receiving module 310 receives at least one account entry information added by the user;

[0117] The receiving module 310 uses Advanced Encryption Standard (AES) to perform symmetric encryption on the at least one account entry information;

[0118] The receiving module 310 transmits the encrypted account entry information to the unified identity authentication database for storage;

[0119] The receiving module 310 sets the information status of the at least one account entry information to a locked state.

[0120] In this optional approach, during the symmetric encryption of the at least one account entry information using advanced encryption standards, the username and password information in the account entry information are encrypted using different keys, thereby improving the security of the account entry information. In addition, setting the information status of the at least one account entry information to a locked state can prevent the unified identity authentication client or web client from accessing the account entry information, and this information status can be adjusted, further improving the security of the unified identity authentication client storing the account entry information.

[0121] In one alternative approach, the random code generation module 330 verifies the user's identity and, upon successful verification, generates and presents a random code corresponding to the target login website for random code verification, further including:

[0122] The random code generation module 330 verifies the user's identity and, after successful verification, generates a key using a combination of the MD5 message digest algorithm and a random salt value. Based on the key, it generates a random code corresponding to the target login website using the TOTP algorithm.

[0123] The random code generation module 330 saves the random code and the account entry information corresponding to the random code to the unified identity authentication database, and pre-sets the maximum caching time for the unified identity authentication database to cache the random code and the corresponding account entry information, for example, a maximum caching time of 30 seconds;

[0124] The random code generation module 330 presents the random code corresponding to the target login website, and pre-sets the total number of verifications of any random code presented by the unified identity authentication client on the Web client. For example, the total number of verifications on the Web client for any random code presented by the unified identity authentication client is limited to 3.

[0125] The random code generation module 330 sets the information status of the account entry information corresponding to the target login website to an active state for random code verification.

[0126] In this alternative approach, a key is generated by combining the MD5 message digest algorithm with a random salt value, replacing the single MD5 message digest algorithm. The random salt value enhances the difficulty of cracking the key.

[0127] In one optional approach, after the random code verification is completed, the sending module 340 sends the account entry information corresponding to the target login website to the web client so that the web client can automatically fill in the user account information to log in to the target login website. This further includes:

[0128] After the random code verification is completed, the sending module 340 encrypts the account entry information corresponding to the target login website using an asymmetric encryption algorithm;

[0129] The sending module 340 sends the encrypted account entry information corresponding to the target login website to the web terminal, so that the web terminal can automatically fill in the user account information after decryption and log in to the target login website.

[0130] In this optional approach, the unified identity authentication client and the web client transmit information using an asymmetric encryption algorithm to ensure the security of information transmission.

[0131] This invention provides an identity authentication device that combines traditional username and password verification methods. Initial use requires a mobile phone verification code. The unified identity authentication client stores the user's registration context, including mobile phone information and IP address. User account information is encrypted and stored using an advanced encryption standard, and further encrypted during transmission using an asymmetric encryption algorithm, ensuring the security of user information storage and uplink / downlink processes. Simultaneously, the 6-digit random code generated by the unified identity authentication client is random, unpredictable, and unobtainable. This is because the system only generates a 64-bit key using an MD5 message digest algorithm and a random salt value when the user clicks to obtain it. Furthermore, the salt value generated each time is different, and the MD5 key and salt value are not stored in a database, making them unpredictable and unobtainable for hackers.

[0132] An identity authentication device according to an embodiment of the present invention is used in a unified identity authentication client. The unified identity authentication client provides a locking function, which can set the information status of user information to a locked state or an active state. Only when the information status is active will the user be allowed to perform random code verification. The unified identity authentication client verifies the locking or activation operation, truly transferring identity security verification from the web client to the unified identity authentication client.

[0133] Figure 6 A schematic diagram of an identity authentication device according to another embodiment of the present invention is shown. This device is used on a web platform, such as… Figure 6 As shown, the device includes a first receiving module 410, a random code verification module 420, a second receiving module 430, a decryption module 440, and a filling module 450, wherein:

[0134] The first receiving module 410 is used to receive a random code corresponding to the target login website input by the user; wherein, the random code is generated by the unified identity authentication client after the user's identity is verified and presented to the user;

[0135] The random code verification module 420 is used to verify the random code; specifically, the random code presented by the unified identity authentication client is accessed on the web terminal, and the random code presented by the unified identity authentication client is compared with the random code input by the user to determine whether the verification is successful.

[0136] The second receiving module 430 is used to receive the account entry information corresponding to the target login website sent by the unified identity authentication client after the random code verification is passed.

[0137] The decryption module 440 is used to decrypt the account entry information to obtain the user account information corresponding to the target login website;

[0138] The fill module 450 is used to automatically fill in the user account information to log in to the target login website.

[0139] In addition, the device also includes a display module for displaying the random code input unit and the login control;

[0140] The first receiving module 410 receives the random code input by the user in the following ways:

[0141] The first receiving module 410 monitors the random code entered by the user through the random code input unit and the user's click operation on the login control, and receives the random code entered by the user through the random code input unit after the user clicks the login control.

[0142] An identity authentication device according to an embodiment of the present invention transfers the web-based login authentication process to a unified identity authentication client, enabling users to log in to the corresponding website by simply entering a 6-digit random code. Password storage on the web client is not limited to a single server, and users must pass MFA authentication through the unified identity authentication client to use the web-based system, making it more secure than the browser's "remember password" function.

[0143] This invention provides a non-volatile computer storage medium storing at least one executable instruction that can execute an authentication method in any of the above-described method embodiments.

[0144] Figure 7 The diagram shows a structural schematic of a computing device embodiment provided by the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computing device.

[0145] like Figure 7 As shown, the computing device may include: a processor 510, a communications interface 520, a memory 530, and a communications bus 540.

[0146] The processor 510, communication interface 520, and memory 530 communicate with each other via communication bus 540. Communication interface 520 is used to communicate with other network elements such as clients or other servers. The processor 510 executes program 550, specifically performing the relevant steps in the above-described embodiment of an authentication method for a computing device.

[0147] Specifically, program 550 may include program code that includes computer operation instructions.

[0148] The processor 510 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The authentication device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0149] Memory 530 is used to store program 550. Memory 530 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0150] Specifically, program 550 can be used to cause processor 510 to execute an authentication method in any of the above method embodiments.

[0151] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the content of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0152] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0153] Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more of the various inventive aspects, features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0154] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0155] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0156] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0157] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. An identity authentication method, characterized in that, Applied to unified identity authentication clients, including: The system receives at least one account entry information added by a user, encrypts the at least one account entry information, and transmits the encrypted at least one account entry information to a unified identity authentication database for storage; the system sets the information status of the at least one account entry information to a locked state; wherein, each account entry information includes the logged-in website and the corresponding user account information; Monitor user actions to obtain random codes for any login website to determine the target login website; The user's identity is verified, and after successful verification, a random code corresponding to the target login website is generated and presented for random code verification. The information status of the account entry information corresponding to the target login website is set to an active state so that the random code presented by the unified identity authentication client can be accessed by the web client. The random code is compared with the random code entered by the user to complete the random code verification. After the random code verification is completed, the account entry information corresponding to the target login website is sent to the web client so that the web client can automatically fill in the user account information to log in to the target login website.

2. The method according to claim 1, characterized in that, Before monitoring a user's random code acquisition operation for any logged-in website, the method further includes: Display at least one login website and a control for obtaining the random code for each login website; The monitoring of a user's random code acquisition operation for any logged-in website specifically involves monitoring the user's click operation on the random code acquisition control corresponding to any logged-in website.

3. The method according to claim 1, characterized in that, The step of receiving at least one account entry information added by the user, encrypting the at least one account entry information, and transmitting the encrypted at least one account entry information to the unified identity authentication database for storage further includes: Receive at least one account entry information added by the user; The at least one account entry information is symmetrically encrypted using an advanced encryption standard. The encrypted account entry information is transmitted to the unified identity authentication database for storage.

4. The method according to claim 1, characterized in that, The step of verifying the user's identity and generating and presenting a random code corresponding to the target login website after successful verification for random code verification further includes: The user's identity is verified, and after successful verification, a key is generated by combining the MD5 message digest algorithm and a random salt value. Based on the key, a random code corresponding to the target login website is generated using the TOTP algorithm. The random code and the corresponding account entry information are saved to the unified identity authentication database, and the maximum caching time for the unified identity authentication database to cache the random code and the corresponding account entry information is preset. The random code cached in the unified identity authentication database is presented, and the total number of verifications of any random code presented by the unified identity authentication client on the web client is preset. Set the information status of the account entry information corresponding to the target login website to the active state for random code verification.

5. The method according to claim 1, characterized in that, The step of sending the account entry information corresponding to the target login website to the web client after the random code verification is completed, so that the web client can automatically fill in the user account information to log in to the target login website, further includes: After the random code verification is completed, the account entry information corresponding to the target login website is encrypted using an asymmetric encryption algorithm; The encrypted account entry information corresponding to the target login website is sent to the web client, so that the web client can automatically fill in the user account information after decryption and log in to the target login website.

6. An identity authentication method, characterized in that, Applied to the web, including: The system receives a random code corresponding to the target login website input by the user; wherein the random code is generated and presented to the user by the unified identity authentication client after the user's identity has been verified. The random code is verified; wherein, the unified identity authentication client sets the information status of the account entry information corresponding to the target login website from the locked state to the active state, the web client accesses the random code presented by the unified identity authentication client, and compares the random code presented by the unified identity authentication client with the random code entered by the user to complete the random code verification. After the random code verification is successful, the system receives the account entry information corresponding to the target login website sent by the unified identity authentication client. Decrypt the account entry information to obtain the user account information corresponding to the target login website; The user account information is automatically filled in to log in to the target login website.

7. An identity authentication device, characterized in that, Applied to unified identity authentication clients, including: The receiving module is used to receive at least one account entry information added by the user, encrypt the at least one account entry information, and transmit the encrypted at least one account entry information to the unified identity authentication database for storage; and set the information status of the at least one account entry information to a locked state; wherein, each account entry information includes the login website and the corresponding user account information; The determination module is used to monitor the user's random code acquisition operation for any login website and determine the target login website; The random code generation module is used to verify the user's identity and generate and present the random code corresponding to the target login website after successful verification for random code verification. The module sets the information status of the account entry information corresponding to the target login website to an active state so that the web client can access the random code presented by the unified identity authentication client. The random code is compared with the random code input by the user to complete the random code verification. The sending module is used to send the account entry information corresponding to the target login website to the Web client after the random code verification is completed, so that the Web client can automatically fill in the account information to log in to the target login website.

8. An identity authentication device, characterized in that, Applied to the web, including: The first receiving module is used to receive a random code corresponding to the target login website input by the user; wherein, the random code is generated by the unified identity authentication client after the user's identity is verified and presented to the user; The random code verification module is used to verify the random code; wherein, the unified identity authentication client sets the information status of the account entry information corresponding to the target login website from the locked state to the active state, the web client accesses the random code presented by the unified identity authentication client, and compares the random code presented by the unified identity authentication client with the random code input by the user to complete the random code verification. The second receiving module is used to receive the account entry information corresponding to the target login website sent by the unified identity authentication client after the random code verification is passed. The decryption module is used to decrypt the account entry information to obtain the user account information corresponding to the target login website; The fill module is used to automatically fill in the user account information to log in to the target login website.

9. A computing device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform an operation corresponding to an authentication method as described in any one of claims 1-6.

10. A computer storage medium, characterized in that, The storage medium stores at least one executable instruction that causes the processor to perform an operation corresponding to an authentication method as described in any one of claims 1-6.

Images