Method, server side, system and electronic device for private cloud service authentication

Abstract

The application relates to a private cloud service identity authentication method, a server side, a system and an electronic device, and belongs to the technical field of information security. The method comprises the following steps: when an account is logged in for the first time, a generation rule is configured for the account, and the generation rule is sent to a generation tool corresponding to the account; the generation rule is used for generating a first dynamic password; the generation tool is used for generating a second dynamic password on the client side; the second dynamic password and a password generation time are received; the first dynamic password is generated according to the password generation time and the generation rule; if the first dynamic password is the same as the second dynamic password, the account is allowed to be logged in again; the password will be changed every certain time interval, the risk of data leakage can be effectively reduced, and continuous loss caused by password leakage can be avoided; different accounts correspond to different generation rules, so that the uniqueness and security of the generation rules are ensured.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a private cloud service identity authentication method, a server side, a system and an electronic device. BACKGROUND

[0002] In the field of information security, identity authentication is one of the important means to protect computer networks from unauthorized access. Traditional identity authentication methods usually rely on static usernames and passwords, which are vulnerable to security threats such as brute force attacks and social engineering attacks. In recent years, some new identity authentication methods have emerged to improve the security and privacy of accounts, such as multi-factor authentication and biometric identification. However, these methods still have certain limitations. For example, multi-factor authentication requires access to third-party service providers, which poses a single point of failure and data leakage risk. Biometric identification technology requires high device costs and is affected by environmental and personnel state factors. Due to the above-mentioned limitations of existing identity authentication methods, such as single point of failure, data leakage risk, high verification cost, and many uncontrollable factors, they cannot meet the requirements of private cloud service account identity authentication. SUMMARY

[0003] Therefore, the application provides a private cloud service identity authentication method, a server side, a system and an electronic device to solve the problem that existing identity authentication methods have a single point of failure, data leakage risk, high verification cost, and many uncontrollable factors, which cannot meet the requirements of private cloud service account identity authentication.

[0004] To achieve the above purpose, the application adopts the following technical solutions:

[0005] In a first aspect, the application provides a private cloud service identity authentication method applied to a server side, which comprises:

[0006] When an account logs in for the first time, a generation rule is configured for the account, and the generation rule is sent to a generation tool corresponding to the account; the generation rule is used to generate a first dynamic password; and the generation tool is used to generate a second dynamic password on the client side;

[0007] The second dynamic password and the password generation time sent by the client side are received;

[0008] According to the password generation time, the first dynamic password is generated by using the generation rule, and if the first dynamic password is the same as the second dynamic password, the account is allowed to log in again.

[0009] Further, when the account logs in for the first time, the generation rule is configured for the account, which comprises:

[0010] The generation rule is created according to the initial password of the account, and the generation rule corresponds to the account uniquely, and / or,

[0011] The generation rule is created according to the account, and the generation rule corresponds to the account uniquely.

[0012] Further, the sending of the generation rule to the generation tool corresponding to the account comprises:

[0013] The verification information is generated according to the account, and the verification information is used to check the integrity of the generation rule received by the generation tool, so that the generation tool receives the accurate generation rule;

[0014] The generation rule and the verification information are sent to the generation tool corresponding to the account;

[0015] The verification code generated by the generation tool according to the verification information is received;

[0016] If the verification code passes the check, the generation rule is marked as a valid rule corresponding to the account;

[0017] If the verification code fails the check, the verification information is regenerated, and the generation rule and the verification information are sent to the generation tool corresponding to the account.

[0018] Further, the method further comprises:

[0019] The permission level of the account is obtained;

[0020] If the permission level is higher than a preset level, the generation rule is configured for the account.

[0021] Further, the method further comprises:

[0022] If the first dynamic password is different from the second dynamic password, the account login is recorded once, and when the cumulative login reaches a preset number, the account login is prohibited, and the account is frozen.

[0023] Further, the same generation rule generates the same password in the same period, and the first dynamic password is generated by using the generation rule according to the password generation time, comprising:

[0024] A preset period is obtained according to the password generation time of the second dynamic password;

[0025] The first dynamic password is generated in the preset period by using the generation rule, so that the first dynamic password and the second dynamic password are generated in the same preset period.

[0026] Further, the sending of the generation rule to the generation tool corresponding to the account comprises:

[0027] The generation rule is sent to the generation tool through HTTPS protocol after being encrypted.

[0028] In a second aspect, the application provides a server end, comprising:

[0029] a rule configuration module configured to configure a generation rule for an account when the account logs in for the first time and send the generation rule to a generation tool corresponding to the account, wherein the generation rule is used to generate a first dynamic password, and the generation tool is used to generate a second dynamic password for a client;

[0030] an identity information acquisition module configured to receive the second dynamic password and a password generation time sent by the client;

[0031] an account verification module configured to generate the first dynamic password according to the password generation time by using the generation rule, and allow the account to log in again if the first dynamic password is the same as the second dynamic password.

[0032] In a third aspect, the application provides a system for private cloud service identity authentication, comprising:

[0033] a server end;

[0034] a generation tool;

[0035] a client;

[0036] The generation tool and the server end store the same generation rule, and the generation tool is configured to generate a dynamic password according to the stored generation rule.

[0037] The client is configured to send an initial login password or a dynamic password generated by the generation tool to the server end.

[0038] The server end is configured to execute any of the above-mentioned methods for private cloud service identity authentication.

[0039] In a fourth aspect, the application provides an electronic device, comprising:

[0040] at least one processor; and

[0041] a memory connected to the at least one processor in communication; wherein

[0042] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any of the above-mentioned methods for private cloud service identity authentication.

[0043] The present application has at least the following beneficial effects by adopting the above technical solution:

[0044] When the client user needs to log in to the private cloud service, the password dynamically generated according to the generation rule of the generation tool needs to be input, and the password will change every certain time interval, which can effectively reduce the risk of data leakage and avoid continuous loss caused by password leakage; the corresponding generation rule is generated according to the account on the server side, different accounts correspond to different generation rules, ensuring the uniqueness and security of the generation rule, the generation rule of the server side is consistent with the generation rule of the generation tool, ensuring the consistency of the dynamically generated password, and providing effective support for identity verification.

[0045] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0047] Figure 1 is a flow chart of a private cloud service identity verification method according to an exemplary embodiment of the present application;

[0048] Figure 2 is a flow chart of a private cloud service identity verification method according to another exemplary embodiment of the present application;

[0049] Figure 3 is a schematic block diagram of a server side according to an exemplary embodiment of the present application;

[0050] Figure 4 is a schematic block diagram of a private cloud service identity verification system according to an exemplary embodiment of the present application;

[0051] Figure 5 is a schematic block diagram of an electronic device according to an exemplary embodiment of the present application;

[0052] The present application will be further described below in combination with the drawings and specific embodiments. DETAILED DESCRIPTION

[0053] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail below. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work belong to the scope protected by the present application.

[0054] The traditional identity authentication method usually relies on static username and password, which is vulnerable to security threats such as brute force cracking and social engineering attacks. In order to improve the security and privacy of the account, some new identity authentication methods have appeared in recent years, such as multi-factor authentication and biometric identification. However, these methods still have certain limitations. For example, multi-factor authentication requires access to third-party service providers, which has the risk of single point of failure and data leakage. Biometric identification technology requires high device cost and is affected by environmental factors and personnel state, with many uncontrollable factors.

[0055] The embodiments of the present application provide a private cloud service identity authentication method, server side, system and electronic equipment. When a client user needs to log in to a private cloud service, a password generated dynamically according to a generation rule of a generation tool needs to be input. The password will change every certain time interval, which can effectively reduce the risk of data leakage and avoid continuous loss caused by password leakage. On the server side, different generation rules correspond to each account, and each account is consistent with the generation rule of the generation tool on the server side, which ensures the consistency of the dynamically generated password and provides effective support for identity authentication.

[0056] The method for real-time pushing messages in the present application will be described below through specific embodiments.

[0057] Please refer to Figure 1 , Figure 1 is a flowchart of a private cloud service identity authentication method according to an exemplary embodiment of the present application. As shown in Figure 1 , the method comprises the following steps.

[0058] Step S11, when an account logs in for the first time, a generation rule is configured for the account, and the generation rule is sent to a generation tool corresponding to the account. The generation rule is used to generate a first dynamic password. The generation tool is used to generate a second dynamic password on the client side.

[0059] Step S12, receiving the second dynamic password sent by the client and the password generation time.

[0060] Step S13, generating the first dynamic password according to the password generation time and the generation rule. If the first dynamic password is the same as the second dynamic password, the account is allowed to log in again.

[0061] It should be noted that the technical solutions provided in the embodiments can be loaded in existing projects in the form of plug-ins in specific practice, or provided in the form of independent applications to realize private cloud service account authentication. Applicable scenarios include, but are not limited to, private cloud services, cloud services, and application scenarios requiring account authentication.

[0062] It can be understood that the technical solutions provided in the embodiments can effectively reduce the risk of data leakage and avoid continuous losses caused by password leakage when a client user needs to log in to a private cloud service and needs to input a password dynamically generated according to the generation rules of the generation tool. The password will change every certain time interval. On the server side, each account corresponds to different generation rules, and each account is consistent with the generation rules of the generation tool on the server side, which ensures the consistency of the dynamically generated password and provides effective support for identity authentication.

[0063] In specific practice, the "when the account is initially logged in" in step S11 includes: using the initial password to log in to consider that the account is initially logged in, and if logged in again after initial login, the dynamic password generated by the generation rule needs to be used.

[0064] It should be noted that the user first fills in the registration information on the client side and submits it to the server side for review. The registration information at least includes an account and an initial password. The relevant administrator or automatic review program of the server side reviews the registration information, and stores the account and the initial password on the server side after the review is passed.

[0065] In specific practice, the "configuring the generation rule for the account" in step S11 includes:

[0066] creating the generation rule according to the initial password of the account, the generation rule being uniquely corresponding to the account, and / or,

[0067] creating the generation rule according to the account, the generation rule being uniquely corresponding to the account.

[0068] It should be noted that there are two ways to create the generation rule. One is to create the generation rule according to the initial password. The developer creates a unique generation rule for the account according to the set creation rule combined with the initial password. The other is that the developer creates a corresponding unique generation rule according to the set creation rule combined with the unique identifier of the account. When creating the generation rule, in order to ensure that the generation rule is uniquely corresponding to the account, either one of the above two ways of creating the generation rule can be selected, or the two ways of creating the generation rule can be combined.

[0069] It can be understood that the technical scheme provided by the embodiment provides that the developer develops a creation rule, combines the initial password, the unique identifier of the account, or combines the initial password and the unique identifier of the account, realizes that each account has a unique generation rule, and improves the security of the account.

[0070] In specific practice, the step S11 of "sending the generation rule to the generation tool corresponding to the account" comprises:

[0071] According to the account generation verification information, the verification information is used to check the integrity of the generation rule received by the generation tool, so that the generation tool receives accurate generation rules;

[0072] The generation rule and the verification information are sent to the generation tool corresponding to the account;

[0073] The verification code generated by the generation tool according to the verification information is received;

[0074] If the verification code is checked, the generation rule is marked as a valid rule corresponding to the account;

[0075] If the verification code fails to check, the verification information is regenerated, and the generation rule and the verification information are sent to the generation tool corresponding to the account.

[0076] It should be noted that after the generation rule is created, the generation rule is encrypted by using an encryption algorithm. The encryption algorithm can be AES (Advanced Encryption Standard, the most common symmetric encryption algorithm), DES (Data Encryption Standard, a block algorithm using key encryption), RSA (RSA algorithm is the first algorithm that can be used for encryption and digital signature, and is easy to understand and operate), or can be combined with an open source OTP library (One-time Password, also known as dynamic password), TOTP library (Time-base One-Time Password, also known as time-synchronized dynamic password), and the encrypted generation rule is sent to the generation tool through the HTTPS protocol.

[0077] It should be noted that when the generation rule in the generation tool is verified for completeness and accuracy, the verification information is fed back to the server side, and the server side judges whether the generation rule needs to be retransmitted according to the verification information.

[0078] It can be understood that the technical scheme provided by the embodiment, after the generation rule is created, the generation rule is encrypted and then encrypted and transmitted, which effectively improves the security level of the generation rule, and the generation tool further verifies the integrity and accuracy of the generation rule when receiving the generation rule, which provides an effective guarantee for subsequent account identity verification.

[0079] In one embodiment, further comprising:

[0080] obtaining the permission level of the account;

[0081] If the permission level is higher than the preset level, the account is configured with the generation rule.

[0082] It should be noted that the account will be configured with the permission level after registration. If the permission level of the account is set to a low level, i.e., the account has no permission to operate to obtain the key data, there is no need to configure the generation rule, and the initial password during registration is directly used for login. If the permission level of the account is set to a high level, i.e., the account has the permission to operate to obtain the key data, the generation rule needs to be configured, and in addition to the initial password during the initial login, the dynamic password generated by the generation rule needs to be input for subsequent login. The preset level is set according to whether the account has the permission to operate to obtain the key data. The account has the permission to obtain the key data, which is higher than the preset level. The account has no permission to operate to obtain the key data, which is lower than the preset level.

[0083] It can be understood that the technical scheme provided by the embodiment flexibly controls the security level of identity verification according to the permission level of the account, provides convenient and fast login for the account with low permission, and also ensures the security of the account with high permission.

[0084] In one embodiment, further comprising:

[0085] If the first dynamic password is different from the second dynamic password, the account login exception is recorded once. When the cumulative login exceptions reach a preset number of times, the account login is prohibited, and the account is frozen.

[0086] It should be noted that too many allowed account login exceptions can lead to password leakage, and can also lead to the generation rule being deduced in reverse by enough dynamic passwords. Therefore, the account login exception is recorded, and when the continuous account login exceptions reach a preset number of times, the account login is prohibited, and the account is frozen. The preset number of times is set to at least once according to the permission level of the account. If the account needs to be unfrozen, the administrator needs to be contacted to provide that the account login exception is caused by an operation mistake.

[0087] It can be understood that the technical scheme provided by the embodiment effectively avoids the problems of password leakage and generation rule deduced in reverse due to too many account login exceptions by presetting the number of account login exceptions.

[0088] In specific practice, the step S13 of "generating the first dynamic password by using the generation rule according to the password generation time" includes:

[0089] obtaining a preset time period according to the password generation time of the second dynamic password;

[0090] The first dynamic password is generated in a preset time period according to a generation rule, so that the first dynamic password is generated in the same preset time period as the second dynamic password.

[0091] It should be noted that the same generation rule generates the same password in the same time period, and the same account uses the same generation rule on the generation tool and the server side.

[0092] It can be understood that the technical scheme provided by the embodiment provides an effective guarantee for dynamic password login, because the same account uses the same generation rule on the generation tool and the server side.

[0093] Please refer to Figure 2 , Figure 2 is a flowchart of a method for private cloud service identity verification according to another exemplary embodiment of the present application, please refer to Figure 2 , the method comprises the following steps:

[0094] In step S21, the private cloud service accesses a dynamic password generation tool.

[0095] In step S22, the user inputs an account name encryption information into the dynamic password generation tool.

[0096] In step S23, the dynamic password generation tool generates a login password according to the account name encryption information input by the user and returns the login password to the user.

[0097] In step S24, the user inputs the account and the generated login password into a login interface of the private cloud service, and waits for a login result to be returned.

[0098] In step S25, the private cloud service receives the account and the login password and sends them to the dynamic password generation tool for verification, the dynamic password generation tool returns a verification result to the private cloud service, and the private cloud service returns a login result to the user according to the verification result.

[0099] In specific practice, when the dynamic password generation tool verifies the account and the login password, a new password is dynamically generated according to the account, and is compared with the received login password. If they are the same, the verification result is passed, otherwise the verification result is failed. If the private cloud service receives the verification result as passed, the login result is login success, otherwise the login result is login failure.

[0100] It should be noted that the technical scheme provided by the embodiment can be loaded in the existing project in the form of a plug-in in specific practice, or in the form of an independent application, and an interface is provided to realize the private cloud service account identity verification. The applicable scenarios include but are not limited to private cloud services, cloud services and application scenarios requiring account identity verification.

[0101] It can be understood that the technical scheme provided by the embodiment can effectively reduce the risk of data leakage and avoid continuous loss caused by password leakage when a client user needs to log in to a private cloud service, and needs to input a password dynamically generated according to a generation rule of a generation tool, and the password will change every certain time.

[0102] Please refer to Figure 3 , Figure 3 is a schematic block diagram of a server end according to an exemplary embodiment of the present application, please refer to Figure 3 , the server end 100 comprises:

[0103] The rule configuration module 101 is configured to obtain the configuration information input by the developer in the sub-configuration file of the first function module.

[0104] The identity information acquisition module 102 is configured to change the configuration information of the first function module in the main configuration file to the configuration information in the sub-configuration file if the sub-configuration file is changed, so that the project performs corresponding operations according to the configuration information of the first function module in the main configuration file.

[0105] The account verification module 103 is configured to generate a first dynamic password according to the generation time of the password and the generation rule, and allow the account to log in again if the first dynamic password is the same as the second dynamic password.

[0106] It should be noted that the technical scheme provided by the server end of the embodiment can be loaded in the existing project in the form of a plug-in in specific practice, or provided as an independent application to realize the account identity verification of the private cloud service. The applicable scenarios include but are not limited to: private cloud service, cloud service and application scenarios requiring account identity verification.

[0107] It can be understood that the technical scheme provided by the embodiment can effectively reduce the risk of data leakage and avoid continuous loss caused by password leakage when a user needs to log in to a private cloud service, and needs to input a password dynamically generated according to a generation rule of a generation tool, and the password will change every certain time; and on the server end, each account corresponds to a different generation rule, and each account is consistent with the generation rule of the generation tool on the server end, so that the dynamically generated password is consistent, and effective support is provided for identity verification.

[0108] Please refer to Figure 4 , Figure 4 is a schematic block diagram of a private cloud service identity verification system according to an exemplary embodiment of the present application, please refer to Figure 4 , the private cloud service identity verification system 200 comprises:

[0109] a server end 201;

[0110] a generation tool 202;

[0111] a client 203;

[0112] The generation tool 202 stores the same generation rule as the server end 201, and the generation tool 202 is used to generate a dynamic password according to the stored generation rule;

[0113] The client 203 is used to send an initial login password or a dynamic password generated by the generation tool 202 to the server end 201;

[0114] The server end 201 is used to execute any of the above private cloud service authentication methods.

[0115] It should be noted that the system provided in the embodiment can be loaded in the existing project in the form of a plug-in in specific practice, or in the form of an independent application to provide an interface to realize private cloud service account authentication. Applicable scenarios include but are not limited to private cloud services, cloud services, and application scenarios requiring account authentication.

[0116] It can be understood that the technical solution provided in the embodiment requires inputting a password dynamically generated according to the generation rule of the generation tool when the client user needs to log in to the private cloud service. The password will change every certain time interval, which can effectively reduce the risk of data leakage and avoid continuous losses caused by password leakage; on the server end, different generation rules correspond to each account, and each account is consistent with the generation rule of the generation tool on the server end, which ensures the consistency of the dynamically generated password and provides effective support for identity authentication.

[0117] Please refer to Figure 5 , Figure 5 is a schematic block diagram of an electronic device according to an example embodiment of the present application, referring to Figure 5 , the electronic device 300 comprises:

[0118] at least one processor 302; and

[0119] a memory 301 connected in communication with the at least one processor 302; wherein,

[0120] The memory 301 stores instructions executable by the at least one processor 302, and the instructions are executed by the at least one processor 302 to enable the at least one processor 302 to execute any of the above private cloud service authentication methods.

[0121] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative description of the above terms does not necessarily mean the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0122] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary, and cannot be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. A method for authentication in a private cloud service, characterized in that, Applied to the server side, the method includes: When an account logs in for the first time, a generation rule is configured for the account, and the generation rule is sent to the generation tool corresponding to the account; the generation rule is used to generate a first dynamic password; the generation tool is used by the client to generate a second dynamic password; Receive the second dynamic password and the password generation time sent by the client; Based on the password generation time, a first dynamic password is generated using the generation rules. If the first dynamic password is the same as the second dynamic password, the account is allowed to log in again. When an account logs in for the first time, the configuration of generation rules for the account includes: The generation rule is created based on the initial password of the account, and the generation rule uniquely corresponds to the account, and / or, The generation rule is created based on the unique identifier of the account, and the generation rule corresponds uniquely to the account.

2. The method according to claim 1, characterized in that, Sending the generation rule to the generation tool corresponding to the account includes: Verification information is generated based on the account. The verification information is used to check the completeness of the generation rules received by the generation tool, so that the generation tool receives accurate generation rules. Send the generation rules and the verification information to the generation tool corresponding to the account; Receive the verification code generated by the generation tool based on the verification information; If the verification code passes, the generated rule will be marked as a valid rule corresponding to the account. If the verification code fails to be verified, the verification information is regenerated, and the generation rules and the verification information are sent to the generation tool corresponding to the account.

3. The method according to claim 1, characterized in that, The method further includes: Obtain the permission level of the account; If the permission level is higher than the preset level, then generate rules for the account.

4. The method according to claim 1, characterized in that, The method further includes: If the first dynamic password is different from the second dynamic password, then the account login is recorded as abnormal once. When the cumulative number of login abnormalities reaches a preset number, the account login is prohibited and the account is frozen.

5. The method according to claim 1, characterized in that, Passwords generated under the same generation rule at the same time period are identical. The step of generating a first dynamic password based on the password generation time and using the generation rule includes: A preset time period is obtained based on the password generation time at which the second dynamic password is generated; The first dynamic password is generated using the generation rules during the preset time period, so that the first dynamic password and the second dynamic password are generated during the same preset time period.

6. The method according to claim 1, characterized in that, Sending the generation rule to the generation tool corresponding to the account includes: The generation rules are encrypted and sent to the generation tool via HTTPS protocol.

7. A server-side component, characterized in that, include: The rule configuration module is used to configure generation rules for the account when the account logs in for the first time, and send the generation rules to the generation tool corresponding to the account; The generation rules are used to generate a first dynamic password; the generation tool is used by the client to generate a second dynamic password. The identity information acquisition module is used to receive the second dynamic password and the password generation time sent by the client; The account verification module is used to generate a first dynamic password based on the password generation time and the generation rules. If the first dynamic password is the same as the second dynamic password, the account is allowed to log in again. The rule configuration module is further configured to create the generation rule based on the initial password of the account, wherein the generation rule uniquely corresponds to the account, and / or, The generation rule is created based on the unique identifier of the account, and the generation rule corresponds uniquely to the account.

8. A system for authenticating identity in a private cloud service, characterized in that, include: Server-side; Generation tools; Client; The generation tool has the same generation rules as the server, and the generation tool is used to generate dynamic passwords according to the stored generation rules; The client is used to send an initial login password or a dynamic password generated by the generation tool to the server. The server is used to execute the method according to any one of claims 1-6.

9. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

Images