Security authentication method, system, storage medium and electronic device

Abstract

The application discloses a security authentication method and system, a storage medium and an electronic device. It relates to the field of cloud computing. The method comprises the following steps: obtaining a query sequence of a target user, and determining the number of truncated bits of the target user; obtaining the coordinates of the current location of a password generator, encoding the coordinates by using a first hash algorithm to obtain an initial position code, and truncating the initial position code based on the number of truncated bits to obtain a target position code; processing the target position code and the query sequence by using a second hash algorithm to obtain a result sequence; generating a result sequence set based on the query sequence, and determining whether the result sequence belongs to the result sequence set; and determining that the security authentication of the target user is passed in the case where the result sequence belongs to the result sequence set. The application solves the problem of single authentication element and poor security of the security authentication service in the related art.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more specifically, to a security authentication method, system, storage medium, and electronic device. Background Technology

[0002] In related technologies, the security of a cryptographic device relies solely on the password used to activate it, which is a single-factor authentication method with relatively low security strength. Institutions such as banks that use cryptographic devices store user data, including user address information. However, this address information is merely a static attribute used for customer service verification questions. Therefore, the use of this location information is very rudimentary. Furthermore, in other non-cryptographic device scenarios, there are also some schemes that use geographic location information for authentication, but these often rely on terminal signatures of the geographic location. This method suffers from low signature verification efficiency and difficulty in supporting customizable location constraints.

[0003] In related technologies, security authentication schemes using cryptographic devices can only provide a single authentication element. In some other non-cryptographic device scenarios, geolocation authentication schemes mainly involve signing the geolocation on the terminal and then verifying the correctness of the signature on the server. This signature verification is inefficient, and the efficiency of comparing whether the geolocation is consistent is also low. It cannot support custom limitations of multiple geolocation ranges.

[0004] There is currently no effective solution to the problem that the authentication elements of security authentication services in related technologies are too simple and the security is too poor. Summary of the Invention

[0005] The main purpose of this application is to provide a secure authentication method, system, storage medium, and electronic device to solve the problem of single authentication elements and poor security in related technologies.

[0006] To achieve the above objectives, according to one aspect of this application, a security authentication method is provided. The method includes: acquiring a query sequence of a target user and determining a truncation bit for the target user, wherein the query sequence is a sequence of security authentication services requested by the target user, and the truncation bit is a value restricting the area where the target user is located during security authentication; acquiring the coordinates of the current location of a cryptographic device, encoding the coordinates using a first hash algorithm to obtain an initial position code, and truncating the initial position code based on the truncation bit to obtain a target position code, wherein the target user carries a cryptographic device; processing the target position code and the query sequence using a second hash algorithm to obtain a result sequence; generating a result sequence set based on the query sequence and determining whether the result sequence belongs to the result sequence set, wherein the result sequence set is a set of preset usage position sequences for the cryptographic device; and determining that the target user's security authentication is successful if the result sequence belongs to the result sequence set.

[0007] Optionally, determining the truncation bit for the target user includes: obtaining the preset usage area of ​​the target user's cryptographic device and obtaining the usage area restriction of the server; determining the truncation bit based on the preset usage area and the usage area restriction, wherein the truncation bit is negatively correlated with the area of ​​the cryptographic device's usage area.

[0008] Optionally, truncating the initial position code based on the truncation number to obtain the target position code includes: determining the number of bits and the order of the initial position code; determining whether the truncation number is less than or equal to the number of bits; if the truncation number is less than or equal to the number of bits, truncating the first N bits of the initial position code according to the order to obtain the target position code, where N is the truncation number; if the truncation number is greater than the number of bits, re-acquiring the initial position code.

[0009] Optionally, processing the target location encoding and query sequence using the second hash algorithm to obtain the result sequence includes: obtaining the symmetric key pre-configured by the cryptographer; processing the target location encoding and query sequence using the second hash algorithm to obtain the initial sequence; and encrypting the initial sequence using the symmetric key to obtain the result sequence.

[0010] Optionally, generating a result sequence set based on the query sequence includes: obtaining a list of preset location codes for the target user from the server's database based on the query sequence, wherein the list of preset location codes includes multiple preset location codes, and the preset location is the preset usage location of the cryptographer; processing each preset location code using a second hash algorithm to obtain a target location code list; encrypting the target location code list using the server's symmetric key to obtain a result sequence set, wherein the result sequence set contains the result sequence corresponding to each preset location code.

[0011] Optionally, determining whether a result sequence belongs to the result sequence set includes: comparing the result sequence with the result sequence corresponding to each preset position code in the result sequence set; if the result sequence is the same as the result sequence corresponding to any preset position code in the result sequence set, determining that the result sequence belongs to the result sequence set; if the result sequence is different from the result sequences corresponding to all preset position codes in the result sequence set, determining that the result sequence does not belong to the result sequence set.

[0012] Optionally, after determining whether the result sequence belongs to the result sequence set, the method further includes: if the result sequence does not belong to the result sequence set, sending a target prompt message to the cryptographer, wherein the target prompt message is used to prompt the target user that the security authentication has failed.

[0013] According to another aspect of this application, a secure authentication system is provided. The system includes: a cryptographer, configured to acquire a query sequence and the coordinates of the cryptographer's current location; encode the coordinates using a first hash algorithm to obtain an initial position code; truncate the initial position code based on the target user's truncation bits to obtain a target position code; process the target position code and the query sequence using a second hash algorithm to obtain a result sequence; and send the result sequence to a server; and a server, configured to generate a query sequence corresponding to the target user, send the query sequence to the cryptographer, generate a set of result sequences based on the query sequence, and determine whether a result sequence belongs to the set of result sequences. If a result sequence belongs to the set of result sequences, the server determines that the target user's security authentication has passed.

[0014] To achieve the above objectives, according to another aspect of this application, a security authentication device is provided. The device includes: a first acquisition unit, configured to acquire a query sequence of a target user and determine the truncation bit for the target user, wherein the query sequence is a sequence of security authentication services requested by the target user, and the truncation bit is a value restricting the area where the target user is located during security authentication; a second acquisition unit, configured to acquire the query sequence and the coordinates of the current location of a cryptographic device, encode the coordinates using a first hash algorithm to obtain an initial location code, and truncate the initial location code based on the truncation bit to obtain a target location code, wherein the target user carries a cryptographic device; a processing unit, configured to process the target location code and the query sequence using a second hash algorithm to obtain a result sequence; a judgment unit, configured to generate a query sequence corresponding to the target user, send the query sequence to the cryptographic device, generate a result sequence set based on the query sequence, and determine whether the result sequence belongs to the result sequence set, wherein the result sequence set is a set of preset usage location sequences of the cryptographic device; and a determination unit, configured to determine that the target user's security authentication is successful if the result sequence belongs to the result sequence set.

[0015] This application employs the following steps: obtaining the target user's query sequence and determining the truncation bit, wherein the query sequence is the sequence of the security authentication service requested by the target user, and the truncation bit is a value restricting the area where the target user is located during security authentication; obtaining the coordinates of the current location of the cryptographic device, encoding the coordinates using a first hash algorithm to obtain an initial location code, and truncating the initial location code based on the truncation bit to obtain a target location code, wherein the target user carries the cryptographic device; processing the target location code and the query sequence using a second hash algorithm to obtain a result sequence; generating a result sequence set based on the query sequence and determining whether the result sequence belongs to the result sequence set, wherein the result sequence set is a set of preset location sequences used by the cryptographic device; if the result sequence belongs to the result sequence set, determining that the target user's security authentication is successful, thus solving the problem of single authentication elements and poor security in related technologies. By adding location information to the security authentication service, more security authentication elements are added, thereby improving the security of the security authentication. Attached Figure Description

[0016] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a flowchart of a security authentication method provided according to an embodiment of this application;

[0018] Figure 2 This is a schematic diagram of a security authentication system provided according to an embodiment of this application;

[0019] Figure 3 This is a flowchart illustrating the security authentication method performed by the security authentication system according to the embodiments of this application;

[0020] Figure 4 This is a schematic diagram of a security authentication device provided according to an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0022] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0026] The present invention will now be described in conjunction with preferred implementation steps. Figure 1 This is a flowchart of a security authentication method provided according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0027] Step S101: Obtain the query sequence of the target user and determine the truncation number of the target user. The query sequence is the sequence of security authentication services applied for by the target user, and the truncation number is the value that restricts the area where the target user is located when performing security authentication.

[0028] Specifically, the target user can be a user who initiates security authentication when transacting with a financial institution. The truncation bit is a value of the initial position code that is negotiated and set between the target user and the server. The initial position code is the code corresponding to the usage position of the cryptographic device carried by the target user. By setting the truncation bit, the usage range of the cryptographic device can be restricted. When the target user needs to use the cryptographic device to authenticate his / her identity to the server, that is, to apply for security authentication service, the server will send a query sequence to the target user, such as "2358". The user enters the activation password to activate the cryptographic device and sends the query sequence "2358" and the truncation bit N to the HMAC (keyed-Hashing for Message Authentication, which uses a hash algorithm as the MAC (message authentication code)) calculation module of the cryptographic device.

[0029] Step S102: Obtain the coordinates of the current location of the cryptographic device, encode the coordinates using the first hash algorithm to obtain the initial location code, and truncate the initial location code based on the truncation bit to obtain the target location code, wherein the target user carries the cryptographic device.

[0030] Specifically, the cryptographic device is a security authentication tool carried by the target user. It contains a GPS chip that can obtain the device's current location in real time. The HMAC calculation module sends the truncated bit N to the GeoHash algorithm module. The GeoHash algorithm, also known as the first hash algorithm, is used. The cryptographic device obtains its current latitude and longitude coordinates L from the GPS chip and sends L to the GeoHash algorithm module. The GeoHash algorithm module uses the first hash algorithm to encode the latitude and longitude coordinates L, calculating G = GeoHash(L,N) to obtain the initial location code. The first N bits of the initial location code are then truncated as the target location code G.

[0031] It's important to note that GeoHash is an algorithm for building spatial indexes. It can convert any latitude and longitude coordinates into a string, such as "wm3vzg". Location codes converted by GeoHash have the following characteristics: adjacent geographical locations will have the same prefix. For example, "wm3v" represents a location range A, while "wm3vzg" and "wm3vzc" are both locations within range A.

[0032] A cryptographic device is a security authentication tool. During authentication, the server displays a query sequence (e.g., "38923"). The client needs to input this query sequence into the cryptographic device, which then uses a cryptographic algorithm to calculate a result sequence (e.g., "55632"). The client submits this result sequence to the server for verification. The server also calculates its own result sequence and compares it with the client's. If they match, authentication is successful. The advantage of this authentication method is that the cryptographic device and the server have no communication network connection, are naturally physically isolated, and therefore the possibility of an attacker directly attacking the cryptographic device is low.

[0033] Step S103: The target location encoding and query sequence are processed by the second hash algorithm to obtain the result sequence.

[0034] Specifically, the second hash algorithm can be the HMAC algorithm. The security of the second hash algorithm is based on key security. The HMAC calculation module of the cryptosystem calls the symmetric key S previously injected into the cryptosystem to encode the target position G. i The query sequence Q is concatenated with the query sequence Q and input into the HMAC calculation module. The resulting sequence is H = HMAC(S,G). i |Q), for example, if you get "6855", which is the result sequence, send the result sequence to the server.

[0035] Step S104: Generate a result sequence set based on the query sequence, and determine whether the result sequence belongs to the result sequence set, wherein the result sequence set is a set of preset usage position sequences of the cryptographer.

[0036] Specifically, the server is the end that communicates with the cryptographic device and provides security authentication services for the target user. On the server side, the query sequence sent by the cryptographic device determines whether to query multiple pre-stored preset position codes for the target user in the server's database. These preset position codes are generated by the target user based on the cryptographic device's preset usage positions. A second hash algorithm is used to process these multiple preset position codes to obtain a set of result sequences. The result sequence sent by the cryptographic device is compared with multiple result sequences in the result sequence set to determine whether the result sequence sent by the cryptographic device belongs to the result sequence set.

[0037] Step S105: If the result sequence belongs to the result sequence set, it is determined that the target user's security authentication has passed.

[0038] Specifically, if the result sequence sent by the cryptographic device is the same as any result sequence in the result sequence set, it means that the current position coordinates of the cryptographic device are within the range of the target user's preset selectable positions, and the security authentication of the target user can be confirmed.

[0039] The security authentication method provided in this application involves obtaining a query sequence from a target user and determining the truncation bit for that user. The query sequence is the sequence of security authentication services requested by the target user, and the truncation bit is a value that restricts the area where the target user is located during security authentication. The method then obtains the coordinates of the current location of the cryptographic device, encodes these coordinates using a first hash algorithm to obtain an initial location code, and truncates the initial location code based on the truncation bit to obtain a target location code. The target user carries the cryptographic device. A second hash algorithm is used to process the target location code and the query sequence to obtain a result sequence. A set of result sequences is generated based on the query sequence, and it is determined whether each result sequence belongs to the set of result sequences, which is a set of preset location sequences used by the cryptographic device. If a result sequence belongs to the set of result sequences, the target user's security authentication is deemed successful. This method solves the problem of single authentication elements and poor security in related technologies. By adding location information to the security authentication service, more security authentication elements are added, thereby improving the security of the authentication process.

[0040] The use area of ​​the cryptographic device is determined by setting a truncation bit. Optionally, in the security authentication method provided in this application embodiment, determining the truncation bit for the target user includes: obtaining the preset use area of ​​the target user's cryptographic device and obtaining the use area restriction of the server; determining the truncation bit based on the preset use area and the use area restriction, wherein the truncation bit is negatively correlated with the area of ​​the use area of ​​the cryptographic device.

[0041] Specifically, the target user submits a list of preset usage locations for the cryptographic device, L1, L2, L3..., to the server, which represents the preset usage areas. The server also sets usage area restrictions for the cryptographic device, for example, the cryptographic device cannot be used in areas L4 and L5. The truncation bit length N is determined based on the preset usage areas and usage area restrictions.

[0042] For example, each location Li is a latitude and longitude coordinate. This information list represents the set of locations where the user intends to use the cryptographic device. For example, the coordinates of building C in district B of city A, or the coordinates of building Z in district Y of city X. Whether the cryptographic device's location is restricted to a specific building, street, or district is negotiated between the target user and the server, with the result being the truncation bit N. A larger N results in a smaller restricted location range, such as being restricted to a street. A smaller N results in a larger restricted range, such as being restricted to Beijing. This is achieved through the characteristics of GeoHash encoding; the shorter the GeoHash code, the larger the geographical area it represents. By setting the truncation bit N, the target user can customize the geographical location constraint range. Furthermore, leveraging the characteristics of GeoHash encoding, it provides constraints at multiple levels, such as province, city, district, street, and community. This cryptographic device supports geographical location as an authentication factor, achieving two-factor authentication of the cryptographic device and location information, thus improving the security of the authentication process.

[0043] After determining the truncation number, the target position code is obtained by truncating the initial position code based on the truncation number. Optionally, in the security authentication method provided in this application embodiment, truncating the initial position code based on the truncation number to obtain the target position code includes: determining the number of bits and the arrangement order of the initial position code; determining whether the truncation number is less than or equal to the number of bits; if the truncation number is less than or equal to the number of bits, truncating the first N bits of the initial position code according to the arrangement order to obtain the target position code, where N is the truncation number; if the truncation number is greater than the number of bits, re-acquiring the initial position code.

[0044] For example, if the initial position code is "wm3vzg" and the truncation bit is 4, then the first 4 bits of the code are truncated according to the number of bits and the order of the initial position code to obtain the target position code "wm3v". Before truncating, it is necessary to determine whether the truncation bit is less than or equal to the number of bits of the initial code. For example, if the truncation bit is 8, but the initial position code has a total of 6 bits, the truncation process cannot be completed, indicating that the initial position code may have been obtained incorrectly, and it is necessary to obtain the initial position code again. By processing the initial position code with the truncation bit, the target position code is obtained, and the result sequence used for authentication is obtained based on the target position code.

[0045] To improve the security of authentication services, the target location code needs to be encrypted. Optionally, in the security authentication method provided in this application embodiment, the target location code and query sequence are processed by a second hash algorithm to obtain a result sequence, including: obtaining a symmetric key pre-configured by the cryptographer; processing the target location code and query sequence by the second hash algorithm to obtain an initial sequence; and encrypting the initial sequence with the symmetric key to obtain a result sequence.

[0046] Specifically, the server generates a symmetric key S and stores it on the server. Simultaneously, the symmetric key S is injected into a cryptographic device, which is then distributed to the target user. After generating the target location code, the cryptographic device processes the target location code and the query sequence using a second hash algorithm to obtain an initial sequence. The pre-configured symmetric key S is then used to encrypt the initial sequence, yielding the result sequence. Because HMAC and GeoHash are computationally very efficient, this embodiment provides highly efficient location authentication, far superior to many schemes that verify location through signatures.

[0047] Before performing security authentication, it is necessary to obtain the result sequence set from the server. Optionally, in the security authentication method provided in this application embodiment, generating the result sequence set based on the query sequence includes: obtaining a list of preset location codes for the target user from the server's database based on the query sequence, wherein the list of preset location codes includes multiple preset location codes, and the preset location is the preset usage location of the cryptographic device; processing each preset location code using a second hash algorithm to obtain a target location code list; encrypting the target location code list using the server's symmetric key to obtain a result sequence set, wherein the result sequence set contains the result sequence corresponding to each preset location code.

[0048] Specifically, the server retrieves a list of preset location codes for the target user from its database based on the query sequence, such as L1, L2, L3... It then uses the GeoHash algorithm to calculate the location codes for L1, L2, L3... sequentially, and extracts the first N bits to obtain G1, G2, G3... These codes, along with the query sequence Q "2358", are sent to the server's HMAC calculation module. The HMAC calculation module uses its stored symmetric key S to calculate multiple result sequences H1, H2, H3..., where Hi = HMAC(S, G...). i |Q), thus obtaining a set of result sequences. This set of result sequences is then compared with the original result sequence to determine whether authentication has passed.

[0049] After obtaining the result sequence set, it is determined whether the result sequence belongs to the result sequence set. Optionally, in the security authentication method provided in this application embodiment, determining whether the result sequence belongs to the result sequence set includes: comparing the result sequence with the result sequence corresponding to each preset position code in the result sequence set; if the result sequence is the same as the result sequence corresponding to any preset position code in the result sequence set, it is determined that the result sequence belongs to the result sequence set; if the result sequence is different from the result sequences corresponding to all preset position codes in the result sequence set, it is determined that the result sequence does not belong to the result sequence set.

[0050] For example, the result sequence and the set of result sequences are simultaneously input to the server's authentication code comparison module for comparison. The authentication code comparison module checks whether the result sequence H from the target user is in the result sequence set H1, H2, H3... For example, whether "6855" is in H1, H2, H3... If it is, it returns "authentication passed" to the server; otherwise, it returns "authentication failed". The success of security authentication is determined by whether the result sequence belongs to the result sequence set.

[0051] Optionally, in the security authentication method provided in the embodiments of this application, after determining whether the result sequence belongs to the result sequence set, the method further includes: if the result sequence does not belong to the result sequence set, sending a target prompt message to the cryptographer, wherein the target prompt message is used to prompt the target user that the security authentication has failed.

[0052] Specifically, if the result sequence does not belong to the result sequence set, it indicates that the target user's security authentication has failed. In this case, a target prompt message needs to be sent to the cryptographic device to indicate the failure of the security authentication. Sending the target prompt message to the cryptographic device promptly reminds the target user of the security authentication failure.

[0053] According to another embodiment of this application, a security authentication system is also provided. Figure 2 This is a schematic diagram of a security authentication system provided according to an embodiment of this application. For example... Figure 2 As shown, the system includes:

[0054] The cryptographic device 201 is used to obtain the coordinates of its current location. The coordinates are encoded using a first hash algorithm to obtain an initial location code. The initial location code is truncated based on the target user's truncation bits to obtain a target location code. The target location code and the query sequence are processed using a second hash algorithm to obtain a result sequence, which is then sent to the server 202.

[0055] Specifically, Figure 3 This is a flowchart illustrating the security authentication method performed by the security authentication system provided in the embodiments of this application. For example... Figure 3As shown, the cryptographic device 201 includes an HMAC calculation module, a GeoHash algorithm module, a symmetric key S, and a GPS chip. The target user inputs the activation password to activate the cryptographic device 201 and manually inputs the query sequence "2358" obtained from the server and the truncation bit N into the HMAC calculation module. The HMAC calculation module sends the truncation bit N to the GeoHash algorithm module. The cryptographic device 201 obtains the latitude and longitude coordinates L of its current location from the GPS chip and sends L to the GeoHash algorithm module. The GeoHash algorithm module calls the first hash algorithm to encode the latitude and longitude coordinates L, obtaining an initial position code. Based on the truncation bit, it truncates the initial position code to obtain the target position code G, which is then sent to the HMAC calculation module. The HMAC calculation module calls the second hash algorithm to process the target position code G, obtaining the result sequence "68555", and sends the result sequence "6855" and the query sequence "2358" to the server 202.

[0056] Server 202 is used to generate a query sequence corresponding to the target user, send the query sequence to the cryptographer, generate a set of result sequences based on the query sequence, and determine whether the result sequence belongs to the set of result sequences. If the result sequence belongs to the set of result sequences, it is determined that the target user's security authentication has passed.

[0057] Specifically, such as Figure 3 As shown, server 202 includes an authentication code comparison module, an HMAC calculation module, a database, and a symmetric key S. Server 202 sends the result sequence "6855" and the query sequence "2358" to the authentication code comparison module. The authentication code comparison module queries the database for pre-stored preset position codes G1, G2... based on the query sequence "2358", and sends the preset position codes G1, G2... to the HMAC calculation module. The HMAC calculation module calls the second hash algorithm to generate an initial sequence set, and calls the symmetric key S to encrypt the initial sequence set, generating a result sequence set H1, H2, H3... The HMAC calculation module sends the result sequence set H1, H2, H3... to the authentication code comparison module. The authentication code comparison module determines whether the result sequence belongs to the result sequence set. If the result sequence belongs to the result sequence set, the target user's security authentication is confirmed to be successful.

[0058] The security authentication system provided in this application uses HMAC and GeoHash to perform a one-way mapping of the geographical location of the cryptographic device, generating a message authentication code containing geographical location information. The server uses the same HMAC and a reserved, valid GeoHash encoding to verify the message authentication code calculated by the user based on the cryptographic device, thereby achieving dual-factor authentication of both the cryptographic device held by the user and its location. This improves the security of the authentication process.

[0059] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0060] This application also provides a security authentication device. It should be noted that the security authentication device of this application can be used to execute the security authentication method provided in this application. The security authentication device provided in this application is described below.

[0061] Figure 4 This is a schematic diagram of a security authentication device provided according to an embodiment of this application. For example... Figure 4 As shown, the device includes:

[0062] The first acquisition unit 10 is used to acquire the query sequence of the target user and determine the truncation number of the target user, wherein the query sequence is the sequence of the security authentication service applied for by the target user, and the truncation number is a value that restricts the area where the target user is located when performing security authentication.

[0063] The second acquisition unit 20 is used to acquire the query sequence and the coordinates of the current location of the cryptographer, encode the coordinates using the first hash algorithm to obtain the initial position code, and truncate the initial position code based on the truncation bit to obtain the target position code, wherein the target user carries the cryptographer;

[0064] Processing unit 30 is used to process the target position encoding and query sequence using a second hash algorithm to obtain a result sequence;

[0065] The judgment unit 40 is used to generate a query sequence corresponding to the target user, send the query sequence to the cryptographer, generate a result sequence set based on the query sequence, and determine whether the result sequence belongs to the result sequence set. The result sequence set is a set of preset usage position sequences of the cryptographer.

[0066] The determining unit 50 is used to determine that the target user's security authentication has passed if the result sequence belongs to the result sequence set.

[0067] The security authentication device provided in this application embodiment acquires a query sequence of a target user and determines the truncation bit of the target user through a first acquisition unit 10. The query sequence is the sequence of the security authentication service requested by the target user, and the truncation bit is a value that restricts the area where the target user is located when performing security authentication. A second acquisition unit 20 acquires the coordinates of the current location of the cryptographic device, encodes the coordinates using a first hash algorithm to obtain an initial location code, and truncates the initial location code based on the truncation bit to obtain a target location code. The target user carries the cryptographic device. A processing unit 30 processes the target location code and the query sequence using a second hash algorithm to obtain a result sequence. A judgment unit 40 generates a result sequence set based on the query sequence and determines whether the result sequence belongs to the result sequence set. The result sequence set is a set of preset usage location sequences of the cryptographic device. A determination unit 50 determines that the target user's security authentication is successful if the result sequence belongs to the result sequence set. This solves the problem of single authentication elements and poor security in related technologies. By adding location information to the security authentication service, the security authentication elements are increased, thereby improving the security of the security authentication.

[0068] Optionally, in the security authentication device provided in this application embodiment, the first acquisition unit 10 includes: a first acquisition module, used to acquire the preset usage area of ​​the target user's cryptographic device and acquire the usage area restriction of the server; and a first determination module, used to determine the truncation number based on the preset usage area and the usage area restriction, wherein the truncation number is negatively correlated with the area of ​​the cryptographic device's usage area.

[0069] Optionally, in the security authentication device provided in this application embodiment, the second acquisition unit 20 includes: a second determining module, used to determine the number of bits and the arrangement order of the initial position code; a judging module, used to judge whether the truncated number of bits is less than or equal to the number of bits of the code; a truncating module, used to truncate the first N bits of the initial position code according to the arrangement order when the truncated number of bits is less than or equal to the number of bits of the code to obtain the target position code, where N is the truncated number of bits; and a second acquisition module, used to reacquire the initial position code when the truncated number of bits is greater than the number of bits of the code.

[0070] Optionally, in the security authentication device provided in this application embodiment, the processing unit 30 includes: a third acquisition module, used to acquire a symmetric key pre-configured by the cryptographer; a generation module, used to process the target position encoding and query sequence through a second hash algorithm to obtain an initial sequence; and an encryption module, used to call the symmetric key to encrypt the initial sequence to obtain a result sequence.

[0071] Optionally, in the security authentication device provided in this application embodiment, the judgment unit 40 includes: a fourth acquisition module, used to acquire a list of preset location codes of the target user from the database of the server based on a query sequence, wherein the list of preset location codes includes multiple preset location codes, and the preset location is the preset usage location of the cryptographic device; and a processing module, used to process each preset location code using a second hash algorithm to obtain a list of target location codes, and to encrypt the list of target location codes using the symmetric key of the server to obtain a set of result sequences, wherein the set of result sequences contains the result sequence corresponding to each preset location code.

[0072] Optionally, in the security authentication device provided in this application embodiment, the judgment unit 40 includes: a comparison module, used to compare the result sequence with the result sequence corresponding to each preset position code in the result sequence set; a third determination module, used to determine that the result sequence belongs to the result sequence set if the result sequence is the same as the result sequence corresponding to any preset position code in the result sequence set; and a fourth determination module, used to determine that the result sequence does not belong to the result sequence set if the result sequence is different from the result sequences corresponding to all preset position codes in the result sequence set.

[0073] Optionally, in the security authentication device provided in the embodiments of this application, the device further includes: a sending unit, configured to send target prompt information to the cryptographer when the result sequence does not belong to the result sequence set, wherein the target prompt information is used to prompt the target user that the security authentication has failed.

[0074] The security authentication device includes a processor and a memory. The first acquisition unit 10, the second acquisition unit 20, the processing unit 30, the judgment unit 40, and the determination unit 50 are all stored in the memory as program units. The processor executes the program units stored in the memory to realize the corresponding functions.

[0075] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and the security of authentication can be improved by adjusting kernel parameters.

[0076] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0077] This invention provides a computer-readable storage medium having a program stored thereon that, when executed by a processor, implements a security authentication method.

[0078] This invention provides a processor for running a program, wherein the program executes a security authentication method during runtime.

[0079] Figure 5 This is a schematic diagram of an electronic device provided according to an embodiment of this application. For example... Figure 5 As shown, electronic device 501 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: a security authentication method. The device in this document can be a server, PC, PAD, mobile phone, etc.

[0080] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing a program that initializes a security authentication method with the following steps.

[0081] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0082] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0083] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0084] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0085] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0086] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0087] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0088] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0089] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0090] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A security authentication method, characterized in that, include: Obtain the query sequence of the target user and determine the truncation number of the target user, wherein the query sequence is the sequence of the security authentication service applied for by the target user, and the truncation number is a value that restricts the area where the target user is located when performing security authentication; The coordinates of the current location of the cryptographic device are obtained, and the coordinates are encoded using a first hash algorithm to obtain an initial location code. The initial location code is then truncated based on the truncation number to obtain a target location code, wherein the target user carries the cryptographic device. The target location encoding and the query sequence are processed by a second hash algorithm to obtain a result sequence; A result sequence set is generated based on the query sequence, and it is determined whether the result sequence belongs to the result sequence set, wherein the result sequence set is a set of preset usage position sequences of the cryptographer; If the result sequence belongs to the set of result sequences, it is determined that the target user's security authentication has passed; The determination of the truncation bit for the target user includes: obtaining the preset usage area of ​​the target user's cryptographic device and obtaining the usage area restriction of the server; determining the truncation bit based on the preset usage area and the usage area restriction, wherein the truncation bit is negatively correlated with the area of ​​the cryptographic device's usage area.

2. The method according to claim 1, characterized in that, Based on the truncation bit, the initial position code is truncated to obtain the target position code, including: Determine the number of bits and the order of arrangement of the initial position code; Determine whether the truncated number of bits is less than or equal to the number of encoded bits; When the truncation number is less than or equal to the encoding number, the first N bits of the initial position encoding are truncated according to the arrangement order to obtain the target position encoding, where N is the truncation number; If the truncated bit length is greater than the encoded bit length, the initial position code is reacquired.

3. The method according to claim 1, characterized in that, The target location encoding and the query sequence are processed using a second hash algorithm to obtain the following result sequence: Obtain the symmetric key pre-configured in the cryptographer; The target location encoding and the query sequence are processed using the second hash algorithm to obtain an initial sequence; The initial sequence is encrypted using the symmetric key to obtain the result sequence.

4. The method according to claim 1, characterized in that, The result sequence set generated based on the query sequence includes: Based on the query sequence, the target user's preset location code list is obtained from the server's database. The preset location code list includes multiple preset location codes, and the preset location is the preset usage location of the cryptographic device. The second hash algorithm is used to process each preset location code to obtain a target location code list. The symmetric key of the server is then used to encrypt the target location code list to obtain the result sequence set, wherein the result sequence set contains the result sequence corresponding to each preset location code.

5. The method according to claim 1, characterized in that, Determining whether the result sequence belongs to the result sequence set includes: The result sequence is compared with the result sequence corresponding to each preset position code in the result sequence set; If the result sequence is the same as the result sequence corresponding to any preset position code in the result sequence set, then the result sequence is determined to belong to the result sequence set. If the result sequence is different from all the result sequences corresponding to the preset position codes in the result sequence set, then the result sequence is determined not to belong to the result sequence set.

6. The method according to claim 1, characterized in that, After determining whether the result sequence belongs to the set of result sequences, the method further includes: If the result sequence does not belong to the set of result sequences, a target prompt message is sent to the cryptographer, wherein the target prompt message is used to indicate that the target user's security authentication has failed.

7. A security authentication system, characterized in that, include: A cryptographic device is used to obtain a query sequence and the coordinates of the current location of the cryptographic device. The coordinates are encoded using a first hash algorithm to obtain an initial position code. The initial position code is then truncated based on the target user's truncation bit to obtain a target position code. The target position code and the query sequence are processed using a second hash algorithm to obtain a result sequence, which is then sent to the server. The truncation bit for the target user is determined as follows: a preset usage area for the cryptographic device of the target user is obtained, and the usage area restriction of the server is obtained. The truncation bit is determined based on the preset usage area and the usage area restriction, wherein the truncation bit is negatively correlated with the area of ​​the cryptographic device's usage area. The server is configured to generate a query sequence corresponding to the target user, send the query sequence to the cryptographer, generate a set of result sequences based on the query sequence, and determine whether the result sequence belongs to the set of result sequences. If the result sequence belongs to the set of result sequences, the server determines that the target user's security authentication has passed.

8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein the program, when running, controls the device where the non-volatile storage medium is located to execute the security authentication method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the security authentication method according to any one of claims 1 to 6.

Images