A user login authentication method, device, equipment and storage medium

Abstract

The application discloses a user login authentication method and device, equipment and medium, and relates to the technical field of information security, and comprises the following steps: obtaining initial public key and user identity information generated after the initial login of a client to a target applet; forwarding a key generation request carrying the user identity information to a key generation center, so that the key generation center generates a first private key segment; calculating a complete public key of the user through a certificateless public key cryptography algorithm and based on the user identity information and the initial public key; sending the first private key segment to the client, so that the client generates a complete private key of the user based on the first private key segment and a second private key segment, and uses the saved complete private key and complete public key of the user to perform corresponding user authentication in the process of logging in the target applet; and the second private key segment of the user is an initial private key generated after the initial login of the client. The first private key segment and the second private key segment are combined to form a complete private key of the user, so that identity authentication in the applet login process is realized.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a user login authentication method, apparatus, device, and storage medium. Background Technology

[0002] Currently, both network security level protection and commercial cryptography application and security assessment requirements clearly state that user authentication in information systems must be implemented using cryptographic technology. Currently, products used in browsers or WeChat mini-programs face issues with the installation and deployment of browser plugins and cryptographic devices. Furthermore, a typical authentication method currently uses digital certificate authentication within traditional public key cryptography systems based on PKI (Public Key Infrastructure) technology. This certificate authentication requires a professional CA certificate system for full certificate lifecycle management; additionally, there is an identifier cryptographic mechanism based on user identity; and the private key based on the user identity needs to be generated and managed in a third-party key management system. Therefore, if a hacker attacks the third-party key management system and obtains the private key used to authenticate the user identity, it can lead to information leakage and identity fraud.

[0003] In summary, how to generate secure public and private key information without relying on a password module during installation, and how to enable secure identity authentication when the client logs in to the mini-program, is a problem that needs to be solved in this field. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a user login authentication method, apparatus, device, and storage medium that can generate secure public and private key information without relying on a password module, and enable secure identity authentication when the client logs in via a mini-program. The specific solution is as follows:

[0005] Firstly, this application discloses a user login authentication method, applied to the server side, including:

[0006] Obtain the initial public key and user identity information generated after the client's first login to the target mini-program;

[0007] The key generation request carrying the user's identity information is forwarded to the key generation center, so that the key generation center can generate a first private key fragment and a complete user public key based on the user's identity information; wherein, the complete user public key is calculated using a certificateless public key cryptography algorithm based on the user's identity information and the initial public key;

[0008] The first private key fragment is sent to the client so that the client can generate a complete user private key based on the first private key fragment and the second private key fragment, and perform corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini program; the second user private key fragment is the initial private key generated after the client logs in for the first time.

[0009] Optionally, before obtaining the initial public key and user identity information generated after the client's first login to the target mini-program, the method further includes:

[0010] Obtain the access request generated by the client and initialize the login of the target mini-program based on the access request;

[0011] The target mini-program generates the initial public key, the second private key fragment, and the user identity information for the user's client.

[0012] Optionally, the process of sending the first private key fragment to the client further includes:

[0013] The complete public key of the user is sent to the client so that the client can perform key pairing verification on the complete public key and the complete private key of the user after generating the complete private key of the user based on the first private key fragment and the second private key fragment.

[0014] Optionally, sending the first private key fragment to the client includes:

[0015] The first private key fragment, the user's complete public key, and preset calculation parameters are encrypted using the initial public key to obtain the corresponding encryption result, and the encryption result is sent to the client.

[0016] Optionally, after calculating the user's complete public key using a certificateless public-key cryptography algorithm based on the user's identity information and the initial public key, the method further includes:

[0017] The user's complete public key is bound to and stored with the user's identity information, so that user authentication can be completed by querying the corresponding user's complete public key based on the user's identity information.

[0018] Secondly, this application discloses a user login authentication method, applied to a client, including:

[0019] A login request carrying user identity information is sent to the server, and then the corresponding random number generated by the server is obtained.

[0020] The target mini-program calls the user's pre-saved complete private key locally to sign the random number to obtain a signature value, and then encapsulates the signature value with the user's identity information to obtain an encapsulated identity authentication request.

[0021] The authentication request is sent to the server so that the server can use the user's complete public key corresponding to the user's identity information to verify the validity of the signature value, and determine whether to allow login to the target mini-program based on the verification result.

[0022] Thirdly, this application discloses a user login authentication device applied to a server, comprising:

[0023] The information acquisition module is used to acquire the initial public key and user identity information generated after the client logs into the target mini program for the first time;

[0024] The first private key generation module is used to forward a key generation request carrying the user's identity information to the key generation center, so that the key generation center can generate a first private key fragment and a complete user public key based on the user's identity information; wherein, the complete user public key is calculated using a certificateless public key cryptography algorithm based on the user's identity information and the initial public key;

[0025] The login authentication module is used to send the first private key fragment to the client, so that the client can generate a complete user private key based on the first private key fragment and the second private key fragment, and perform corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client's first login.

[0026] Fourthly, this application discloses a user login authentication device applied to a client, comprising:

[0027] The random number acquisition module is used to send a login request carrying user identity information to the server and then acquire the corresponding random number generated by the server.

[0028] The request encapsulation module is used to sign the random number by calling the user's complete private key pre-stored locally through the target applet to obtain a signature value, and encapsulate the signature value with the user's identity information to obtain an encapsulated identity authentication request.

[0029] The identity login verification module is used to send the identity authentication request to the server, so that the server can use the user's complete public key corresponding to the user's identity information to verify the validity of the signature value, and determine whether to allow login to the target mini program based on the verification result.

[0030] Fifthly, this application discloses an electronic device, comprising:

[0031] Memory, used to store computer programs;

[0032] A processor is configured to execute the computer program to implement the steps of the aforementioned disclosed user login authentication method.

[0033] Sixthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed user login authentication method.

[0034] As can be seen, this application discloses a user login authentication method applied to the server side, comprising: obtaining an initial public key and user identity information generated after the client's first login to the target mini-program; forwarding a key generation request carrying the user identity information to a key generation center, so that the key generation center generates a first private key fragment and a complete user public key based on the user identity information; wherein, the complete user public key is calculated based on the user identity information and the initial public key using a certificateless public key cryptography algorithm; sending the first private key fragment to the client, so that the client generates a complete user private key based on the first private key fragment and a second private key fragment, and performs corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client's first login. Therefore, this application obtains the user's complete private key by combining the first private key fragment generated by the key generation center with the second private key fragment automatically generated by the client, thereby realizing user authentication during the mini-program login process. This avoids the need to install additional password modules or devices, overcomes the disadvantage of directly storing the user's complete private key in a third-party key management system, and eliminates the use of digital certificates, thus avoiding the problem of leakage of the user's complete private key. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0036] Figure 1 This is a flowchart of an identity authentication method disclosed in this application;

[0037] Figure 2This application discloses a flowchart of an identity authentication method based on a certificateless public key cryptography algorithm.

[0038] Figure 3 This is a logical structure diagram of an identity authentication service disclosed in this application;

[0039] Figure 4 This is a flowchart of a specific identity authentication method disclosed in this application;

[0040] Figure 5 This is a flowchart of a specific identity authentication method disclosed in this application;

[0041] Figure 6 This application discloses a specific client login authentication method flowchart;

[0042] Figure 7 This is a schematic diagram of the structure of an identity authentication method device disclosed in this application;

[0043] Figure 8 This is a schematic diagram of the device structure for another identity authentication method disclosed in this application;

[0044] Figure 9 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0045] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0046] Currently, both network security level protection and commercial cryptography application and security assessment requirements clearly state that user authentication in information systems must be implemented using cryptographic technology. Currently, products used in browsers or WeChat mini-programs face issues with the installation and deployment of browser plugins and cryptographic devices. Furthermore, a typical authentication method currently uses digital certificate authentication within traditional public key cryptography systems based on PKI (Public Key Infrastructure) technology. This certificate authentication requires a professional CA certificate system for full certificate lifecycle management; additionally, there is an identifier cryptographic mechanism based on user identity; and the private key based on the user identity needs to be generated and managed in a third-party key management system. Therefore, if a hacker attacks the third-party key management system and obtains the private key used to authenticate the user identity, it can lead to information leakage and identity fraud.

[0047] To address this, the present invention provides a user login authentication scheme that can generate secure public and private key information without relying on a password module during installation, and enables secure identity authentication when the client logs in to the mini-program.

[0048] Reference Figure 1 As shown in the figure, an embodiment of the present invention discloses a user login authentication method, applied to the server side, including:

[0049] Step S11: Obtain the initial public key and user identity information generated after the client logs into the target mini-program for the first time.

[0050] In this embodiment, before obtaining the initial public key and user identity information generated after the client's first login to the target mini-program, the method further includes: obtaining the access request generated by the client and initializing login to the target mini-program based on the access request; generating the initial public key, the second private key fragment, and the user identity information of the user client through the target mini-program. It is understood that when a user logs into a mini-program on a non-trusted device for the first time, a corresponding access request is generated, requiring registration of corresponding identity information on the mini-program and initial login using an account + password. After the user successfully initializes login for the first time, the mini-program generates the user's identity information and a portion of the user's public and private keys, namely the initial public key and the second private key fragment. It should be noted that both the initial public key and the second private key fragment are generated by the client's mini-program and are independent of any other third-party key generation system.

[0051] In this embodiment, after the mini-program generates the user's identity information, initial public key, and second private key fragment, the client obtains the user's identity information and initial public key, and generates a key generation request carrying the user's identity information. In practical applications, the user's identity information can be name + communication address, mobile phone number, ID card number, or email address, etc.

[0052] Step S12: Forward the key generation request carrying the user identity information to the key generation center, so that the key generation center can generate a first private key fragment and a complete user public key based on the user identity information; wherein, the complete user public key is calculated by using a certificateless public key cryptography algorithm based on the user identity information and the initial public key.

[0053] In this embodiment, refer to Figure 2As shown, the key generation request is received and forwarded to the key generation center. It is understood that since the key pair generated by the previous mini-program is a partial public-private key pair, not the complete user key pair, it is necessary to additionally send the key generation request carrying user identity information to the KGC (Key Generation Center) service. This allows the KGC service to generate a first private key fragment based on the user identity information. It should be noted that this first private key fragment is also not the user's complete private key. In this way, each time the KGC service generates a first private key fragment for a different user, only a partial private key is generated, avoiding the insecurity of directly generating the user's complete private key and preventing the leakage of a large number of complete user private keys in the event of a hacker attack on the KGC service.

[0054] In this embodiment, in the KGC service, the user's complete public key is calculated based on the user's identity information and the initial public key using a certificateless public key cryptography algorithm. This can be understood as follows: the user's complete public key is calculated based on the obtained user identity information and the corresponding partial user public key information, using the certificateless public key cryptography algorithm. The complete user public key is used for identity verification when the user logs into the target mini-program for subsequent times. The certificateless public key cryptography system can solve the complex certificate management problem in the traditional certificate-based public key cryptography system.

[0055] Step S13: Send the first private key fragment to the client so that the client can generate a complete user private key based on the first private key fragment and the second private key fragment, and perform corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client's first login.

[0056] In this embodiment, the first private key fragment is sent to the client so that the client can generate a complete user private key based on the first private key fragment and the second private key fragment. While synthesizing the complete user private key based on the certificateless public key cryptography algorithm, the client generates a corresponding signature value and verifies the signature value. The purpose of signing and verifying the signature is to ensure that the complete user public key and the complete user private key are successfully paired, and to determine that the complete key pair corresponding to the user's identity information is the complete user private key and the complete user public key.

[0057] In this embodiment, refer to Figure 3As shown, on the client-side mini-program, the generation of the user's partial key, the synthesis of the user's complete password, and the password calculation are performed. On the server-side KGC service, the generation of the system master public and private keys, the generation of the system identifier, the generation of another part of the user's private key, and the generation of the user's complete public key are performed.

[0058] In this embodiment, the process of sending the first private key fragment to the client further includes: sending the complete user public key to the client, so that after the client generates a complete user private key based on the first private key fragment and the second private key fragment, it can perform key pairing verification on the complete user public key and the complete user private key. It can be understood that the first private key fragment generated by the KGC service for the target user's user identity information and the complete user public key are returned to the client again. Then, the client uses the second private key fragment generated by the mini-program and the first private key fragment returned by the server to synthesize the complete user private key based on a certificateless public-key cryptography algorithm. Finally, the complete user public key and the complete user private key are used to authenticate the user who is logging in.

[0059] As can be seen, this application discloses a user login authentication method applied to the server side, comprising: obtaining an initial public key and user identity information generated after the client's first login to the target mini-program; forwarding a key generation request carrying the user identity information to a key generation center, so that the key generation center generates a first private key fragment and a complete user public key based on the user identity information; wherein, the complete user public key is calculated based on the user identity information and the initial public key using a certificateless public key cryptography algorithm; sending the first private key fragment to the client, so that the client generates a complete user private key based on the first private key fragment and a second private key fragment, and performs corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client's first login. Therefore, this application obtains the user's complete private key by combining the first private key fragment generated by the key generation center with the second private key fragment automatically generated by the client, thereby realizing user authentication during the mini-program login process. This avoids the need to install additional password modules or devices, overcomes the disadvantage of directly storing the user's complete private key in a third-party key management system, and eliminates the use of digital certificates, thus avoiding the problem of leakage of the user's complete private key.

[0060] Reference Figure 4 As shown, this embodiment of the invention discloses a specific user login authentication method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution. Specifically:

[0061] Step S21: Obtain the initial public key and user identity information generated after the client logs into the target mini-program for the first time.

[0062] Step S22: Forward the key generation request carrying the user identity information to the key generation center, so that the key generation center can generate a first private key fragment and a complete user public key based on the user identity information; wherein, the complete user public key is calculated by using a certificateless public key cryptography algorithm based on the user identity information and the initial public key.

[0063] For more detailed procedures in steps S21 and S22, please refer to the aforementioned disclosed embodiments, which will not be repeated here.

[0064] Step S23: Bind and store the user's complete public key with the user's identity information so that user authentication can be completed by querying the corresponding user's complete public key based on the user's identity information.

[0065] In this embodiment, after the KGC service generates the user's complete public key and the first private key fragment, the user's complete public key is bound to the user's identity information and stored in the server's local database. This allows the server to directly query and obtain the corresponding user's complete public key from the local database based on the user's identity information when the mini-program sends a login request containing the user's identity information to the server before logging in, so as to use the user's complete public key to complete the user's identity authentication during the login process.

[0066] Step S24: Use the initial public key to encrypt the first private key fragment, the user's complete public key, and preset calculation parameters to obtain the corresponding encryption result, and send the encryption result to the client.

[0067] In this embodiment, after the KGC service generates the user's complete public key and the first private key fragment, the first private key fragment, the user's complete public key, and the calculation parameter R are encrypted using the user's partial public key, and the encryption result is sent to the client so that the client can receive the protected first private key fragment, the user's complete public key, and the calculation parameter R.

[0068] Step S25: The client decrypts the encryption result based on the user's second private key fragment, so that the client generates the user's complete private key based on the first private key fragment and the second private key fragment, and performs corresponding user authentication using the user's complete private key stored by the client and the user's complete public key stored by the server during the login process of the target mini-program; the user's second private key fragment is the initial private key generated after the client's first login.

[0069] In this embodiment, the encryption result is decrypted using the user's second private key fragment, and the required first private key fragment is obtained from it. Then, the first private key fragment and the second private key fragment are combined to form a complete user private key, so as to authenticate the user when performing a login operation using the complete user private key and the complete user public key.

[0070] As can be seen, in this embodiment, based on a certificateless public-key cryptography system, the user's complete private key is determined by two cryptographic factors: one is the key generated by the user, and the other is the key related to the user's identity obtained from the KGC service. Furthermore, the other cannot be calculated from one secret factor; that is, the KGC cannot calculate the part of the key generated by the user, and the user cannot calculate the part of the key generated by the KGC. In addition, the server encrypts and transmits the first private key fragment and the user's complete public key to the client, thereby improving the security of the key transmission process.

[0071] Reference Figure 5 As shown, this embodiment of the invention discloses a specific user login authentication method, applied to a client, including:

[0072] Step S31: Send a login request carrying user identity information to the server, and then obtain the corresponding random number generated by the server.

[0073] In this embodiment, refer to Figure 6 As shown, the client first sends a login request carrying user identity information to the server, and then the server sends a random number t to the client based on the received login request.

[0074] Step S32: The target applet calls the user's pre-saved complete private key locally to sign the random number to obtain a signature value, and encapsulates the signature value with the user's identity information to obtain an encapsulated identity authentication request.

[0075] In this embodiment, the client calls the complete private key of the target user generated when the target user logs in for the first time to sign the random number t sent by the server to obtain the corresponding signature value, and encapsulates the signature value, the user identity information and the static password to obtain the encapsulated identity authentication request. The encapsulated identity authentication request can specifically be: username + static password + signature value, and the addition of the static password is optional.

[0076] Step S33: Send the identity authentication request to the server so that the server can use the user's complete public key corresponding to the user's identity information to verify the validity of the signature value, and determine whether to allow login to the target mini-program based on the verification result.

[0077] In this embodiment, the authentication request is sent to the server, so that the server can find the complete public key of the user corresponding to the user's identity information from the local database. Then, the server uses the complete public key to verify the validity of the user's identity, verify the signature value and static password to obtain the verification result. The server then chooses whether to respond to the client based on the verification result. If all verification results are successful, the server's identity verification is successful, and the client's user can directly log in to the mini-program. If the verification result fails, it means that there is an error in the user's identity information or other information, and the mini-program cannot respond to the client. For example, if an attacker successfully replaces the victim's public key with their own public key during the authentication process, the attacker still cannot forge a victim's signature or decrypt a piece of encrypted information sent to the victim, thus preventing the attacker from successfully logging into the mini-program using the victim's identity information and ensuring the security of user information.

[0078] As can be seen, this application discloses a user login authentication method applied to the server side, comprising: obtaining an initial public key and user identity information generated after the client's first login to the target mini-program; forwarding a key generation request carrying the user identity information to a key generation center, so that the key generation center generates a first private key fragment and a complete user public key based on the user identity information; wherein, the complete user public key is calculated based on the user identity information and the initial public key using a certificateless public key cryptography algorithm; sending the first private key fragment to the client, so that the client generates a complete user private key based on the first private key fragment and a second private key fragment, and performs corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client's first login. Therefore, this application obtains the user's complete private key by combining the first private key fragment generated by the key generation center with the second private key fragment automatically generated by the client, thereby realizing user authentication during the mini-program login process. This avoids the need to install additional password modules or devices, overcomes the disadvantage of directly storing the user's complete private key in a third-party key management system, and eliminates the use of digital certificates, thus avoiding the problem of leakage of the user's complete private key.

[0079] Reference Figure 7 As shown, this embodiment of the invention discloses a specific user login authentication device, applied to a server, comprising:

[0080] Information acquisition module 11 is used to acquire the initial public key and user identity information generated after the client logs into the target mini program for the first time;

[0081] The first private key generation module 12 is used to forward a key generation request carrying the user's identity information to the key generation center, so that the key generation center can generate a first private key fragment and a complete user public key based on the user's identity information; wherein, the complete user public key is calculated using a certificateless public key cryptography algorithm based on the user's identity information and the initial public key;

[0082] The login authentication module 13 is used to send the first private key fragment to the client, so that the client can generate a complete user private key based on the first private key fragment and the second private key fragment, and perform corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client logs in for the first time.

[0083] As can be seen, this application discloses a user login authentication method applied to the server side, comprising: obtaining an initial public key and user identity information generated after the client's first login to the target mini-program; forwarding a key generation request carrying the user identity information to a key generation center, so that the key generation center generates a first private key fragment and a complete user public key based on the user identity information; wherein, the complete user public key is calculated based on the user identity information and the initial public key using a certificateless public key cryptography algorithm; sending the first private key fragment to the client, so that the client generates a complete user private key based on the first private key fragment and a second private key fragment, and performs corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client's first login. Therefore, this application obtains the user's complete private key by combining the first private key fragment generated by the key generation center with the second private key fragment automatically generated by the client, thereby realizing user authentication during the mini-program login process. This avoids the need to install additional password modules or devices, overcomes the disadvantage of directly storing the user's complete private key in a third-party key management system, and eliminates the use of digital certificates, thus avoiding the problem of leakage of the user's complete private key.

[0084] Reference Figure 8 As shown, this embodiment of the invention discloses a specific user login authentication device applied to a client, comprising:

[0085] The random number acquisition module 21 is used to send a login request carrying user identity information to the server and then acquire the corresponding random number generated by the server.

[0086] The request encapsulation module 22 is used to call the user's complete private key pre-stored locally by the target applet to sign the random number to obtain a signature value, and encapsulate the signature value with the user's identity information to obtain the encapsulated identity authentication request.

[0087] The identity login verification module 23 is used to send the identity authentication request to the server so that the server can use the user's complete public key corresponding to the user's identity information to verify the validity of the signature value, and determine whether to allow login to the target mini program based on the verification result.

[0088] As can be seen, this application discloses a user login authentication method applied to the server side, comprising: obtaining an initial public key and user identity information generated after the client's first login to the target mini-program; forwarding a key generation request carrying the user identity information to a key generation center, so that the key generation center generates a first private key fragment and a complete user public key based on the user identity information; wherein, the complete user public key is calculated based on the user identity information and the initial public key using a certificateless public key cryptography algorithm; sending the first private key fragment to the client, so that the client generates a complete user private key based on the first private key fragment and a second private key fragment, and performs corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second user private key fragment is the initial private key generated after the client's first login. Therefore, this application obtains the user's complete private key by combining the first private key fragment generated by the key generation center with the second private key fragment automatically generated by the client, thereby realizing user authentication during the mini-program login process. This avoids the need to install additional password modules or devices, overcomes the disadvantage of directly storing the user's complete private key in a third-party key management system, and eliminates the use of digital certificates, thus avoiding the problem of leakage of the user's complete private key.

[0089] Furthermore, embodiments of this application also disclose an electronic device, Figure 9 This is a structural diagram of an electronic device 30 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0090] Figure 9This is a schematic diagram of the structure of an electronic device 30 provided in an embodiment of this application. Specifically, the electronic device 30 may include: at least one processor 31, at least one memory 32, a power supply 33, a communication interface 34, an input / output interface 35, and a communication bus 36. The memory 32 stores a computer program, which is loaded and executed by the processor 31 to implement the relevant steps in the authentication method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 30 in this embodiment may specifically be an electronic computer.

[0091] In this embodiment, the power supply 33 is used to provide operating voltage for each hardware device on the electronic device 30; the communication interface 34 can create a data transmission channel between the electronic device 30 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 35 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0092] The processor 31 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 31 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 31 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 31 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 31 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0093] In addition, the memory 32, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 321, computer program 322, etc., and the storage method can be temporary storage or permanent storage.

[0094] The operating system 321 manages and controls the various hardware devices and computer programs 322 on the electronic device 20 to enable the processor 31 to perform calculations and processing on the massive amounts of data 323 in the memory 32. The operating system 321 can be Windows Server, Netware, Unix, Linux, etc. The computer program 322, in addition to including a computer program capable of performing the authentication method executed by the electronic device 30 as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 323 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 35.

[0095] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed authentication method. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0096] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0097] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can implement the described functions using different methods for each specific application, but such implementation should not be considered beyond the scope of this application. The steps of the methods or algorithms described in connection with the embodiments disclosed herein can be implemented directly in hardware, software modules executed by a processor, or a combination of both. Software modules can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0098] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0099] The present invention has provided a detailed description of an identity authentication method, apparatus, device, and storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A user login authentication method, characterized in that, Applied to the server side, including: Obtain the initial public key and user identity information generated after the client's first login to the target mini-program; The key generation request carrying the user's identity information is forwarded to the key generation center, so that the key generation center can generate a first private key fragment and a complete user public key based on the user's identity information; wherein, the complete user public key is calculated using a certificateless public key cryptography algorithm based on the user's identity information and the initial public key; The first private key fragment is sent to the client so that the client can generate a complete user private key based on the first private key fragment and the second private key fragment, and perform corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini program; the second private key fragment is the initial private key generated by the client after the first login.

2. The user login authentication method according to claim 1, characterized in that, Before obtaining the initial public key and user identity information generated after the client's first login to the target mini-program, the process also includes: Obtain the access request generated by the client and initialize the login of the target mini-program based on the access request; The target mini-program generates the client's initial public key, the second private key fragment, and the user identity information.

3. The user login authentication method according to claim 1, characterized in that, The process of sending the first private key fragment to the client also includes: The complete public key of the user is sent to the client so that the client can perform key pairing verification on the complete public key and the complete private key of the user after generating the complete private key of the user based on the first private key fragment and the second private key fragment.

4. The user login authentication method according to claim 1, characterized in that, Sending the first private key fragment to the client includes: The first private key fragment, the user's complete public key, and preset calculation parameters are encrypted using the initial public key to obtain the corresponding encryption result, and the encryption result is sent to the client.

5. The user login authentication method according to any one of claims 1 to 4, characterized in that, After calculating the user's complete public key using a certificateless public-key cryptography algorithm based on the user's identity information and the initial public key, the method further includes: The user's complete public key is bound to and stored with the user's identity information, so that user authentication can be completed by querying the corresponding user's complete public key based on the user's identity information.

6. A user login authentication method, characterized in that, Applied to the client side, including: A login request carrying user identity information is sent to the server, and then the corresponding random number generated by the server is obtained. The target mini-program calls the user's pre-saved complete private key locally to sign the random number to obtain a signature value, and then encapsulates the signature value with the user's identity information to obtain an encapsulated identity authentication request. The authentication request is sent to the server so that the server can use the user's complete public key corresponding to the user's identity information to verify the validity of the signature value, and determine whether to allow login to the target mini-program based on the verification result.

7. A user login authentication device, characterized in that, Applied to the server side, including: The information acquisition module is used to acquire the initial public key and user identity information generated after the client logs into the target mini program for the first time; The first private key generation module is used to forward a key generation request carrying the user's identity information to the key generation center, so that the key generation center can generate a first private key fragment and a complete user public key based on the user's identity information; wherein, the complete user public key is calculated using a certificateless public key cryptography algorithm based on the user's identity information and the initial public key; The login authentication module is used to send the first private key fragment to the client, so that the client can generate a complete user private key based on the first private key fragment and the second private key fragment, and perform corresponding user authentication using the complete user private key stored by the client and the complete user public key stored by the server during the login process of the target mini-program; the second private key fragment is the initial private key generated by the client after the first login.

8. A user login authentication device, characterized in that, Applied to the client side, including: The random number acquisition module is used to send a login request carrying user identity information to the server and then acquire the corresponding random number generated by the server. The request encapsulation module is used to sign the random number by calling the user's complete private key pre-stored locally through the target applet to obtain a signature value, and encapsulate the signature value with the user's identity information to obtain an encapsulated identity authentication request. The identity login verification module is used to send the identity authentication request to the server, so that the server can use the user's complete public key corresponding to the user's identity information to verify the validity of the signature value, and determine whether to allow login to the target mini program based on the verification result.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the user login authentication method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the user login authentication method as described in any one of claims 1 to 6.

Images