User authentication method, computer device and computer storage medium
By generating and comparing authentication credentials on the server side, the cumbersome user authentication process is solved, achieving seamless user authentication, simplifying the operation process and improving the user experience.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHENZHEN SHENXIN INFORMATION SECURITY CO LTD
- Filing Date
- 2023-06-29
- Publication Date
- 2026-05-29
AI Technical Summary
In existing technologies, the user authentication process requires two input operations, which makes the authentication process cumbersome and affects the user experience.
The server obtains the first target data based on the key identifier sent by the target client, generates the first authentication credential, and compares and verifies it with the second authentication credential sent by the target client, thus realizing user authentication without requiring the user to enter a username and password.
It simplifies the user authentication process, reduces user operations, and improves the user experience.
Smart Images
Figure CN116707961B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security, specifically to a user authentication method, computer device, and computer storage medium. Background Technology
[0002] Zero Trust is a concept for preventing data leakage from an organization's trusted network; it advocates never trusting and always verifying. Its main technologies include Software-Defined Perimeter (SDP). SDP requires clients to establish a trusted connection through Single-Session Authorization (SPA) before accessing hidden assets, and employs a least-authorization strategy to control user access.
[0003] In related technologies, when a client needs to access a server, it first performs SPA single-package authorization authentication. This authentication requires the user to input authentication information. After successful verification, identity authentication proceeds. Identity authentication involves the user entering their username and password on the client, which then sends these to the server for verification. Only after both authentications are successful can the client-server session begin. This process requires the client to perform identity authentication after SPA single-package authorization, necessitating two separate inputs: one for single-package authorization and another for identity authentication. This excessive user interaction and cumbersome authentication process negatively impacts user experience. Summary of the Invention
[0004] This application provides a user authentication method, computer device, and computer storage medium to simplify the user authentication process and reduce user operations.
[0005] A first aspect of this application provides a user authentication method, the method being applied to a server, the method comprising:
[0006] Receive the authentication request message and key identifier sent by the target client, verify the authentication request message, and establish a connection with the target client when the authentication request message is verified.
[0007] First target data is obtained based on the key identifier, and first authentication credentials are generated based on the first target data;
[0008] Receive the second authentication credential sent by the target client based on the connection;
[0009] The first authentication credential and the second authentication credential are compared and verified. If the verification passes, the online service is enabled for the target client.
[0010] A second aspect of this application provides a user authentication method, the method being applied to a target client, the method comprising:
[0011] Send an authentication request message and a key identifier to the server. The authentication request message is used by the server to verify the authentication request message, and the key identifier is used by the server to generate the first authentication credential.
[0012] A connection is established with the server when the authentication request message passes verification.
[0013] Obtain a second authentication credential and send the second authentication credential to the server based on the connection, so that the server compares and verifies the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification is successful.
[0014] A third aspect of this application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the methods of the first or second aspect described above.
[0015] A fourth aspect of this application provides a computer storage medium storing instructions that, when executed on a computer, cause the computer to perform the methods described in the first or second aspect.
[0016] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:
[0017] The server can obtain the first target data based on the key identifier sent by the target client and generate the first authentication credential based on the first target data. It then verifies the authentication request message sent by the target client. If the verification is successful, a connection is established with the target client. When the server receives the second authentication credential sent by the target client through this connection, it compares and verifies the first and second authentication credentials. If the verification is successful, the server enables the online service for the target client. Therefore, user authentication does not require the user to enter a username and password. The server automatically authenticates the user based on locally generated authentication credentials and the authentication credentials sent by the client. This process is seamless for the user, reducing user input and simplifying the authentication process, thus improving the user experience. Attached Figure Description
[0018] Figure 1 This is a flowchart illustrating the user authentication method in an embodiment of this application;
[0019] Figure 2 This is another flowchart illustrating the user authentication method in this application embodiment;
[0020] Figure 3 This is another flowchart illustrating the user authentication method in this application embodiment;
[0021] Figure 4 This is a schematic diagram of a display style of the login interface of the target client in an embodiment of this application;
[0022] Figure 5 This application provides a schematic diagram illustrating a display style for the user authentication process of the target client in this embodiment.
[0023] Figure 6 This is a schematic diagram of the structure of a computer device in an embodiment of this application;
[0024] Figure 7 This is another schematic diagram of the structure of the computer device in the embodiments of this application;
[0025] Figure 8 This is another schematic diagram of the structure of the computer device in the embodiments of this application;
[0026] Figure 9 This is another schematic diagram of the structure of the computer device in the embodiments of this application. Detailed Implementation
[0027] This application provides a user authentication method, computer device, and computer storage medium to simplify the user authentication process and reduce user operations.
[0028] Please see Figure 1 One embodiment of the user authentication method in this application includes:
[0029] 101. Receive the authentication request message and key identifier sent by the target client, verify the authentication request message, and establish a connection with the target client when the authentication request message passes the verification.
[0030] The method in this embodiment can be applied to the server side, which can be the server side of a Software Defined Perimeter (SDP) product, including an SDP control center and a proxy gateway. Software Defined Perimeter (SDP) is a security framework for resource access management built on the Zero Trust concept.
[0031] Correspondingly, the Software-Defined Perimeter (SDP) product also includes a client. Users can log in and access the server on the client to use the online services provided by the server, but user authentication by the server is required beforehand. When a target user enters an access command for the server's services on the target client, instructing the target client to access the server's services, the target client can send an authentication request message and a key identifier to the server. The server then verifies the authentication request message and establishes a connection with the target client when the authentication request message is successfully verified.
[0032] 102. Obtain first target data based on the key identifier, and generate first authentication credentials based on the first target data;
[0033] The server can use this to generate the first authentication credential. Specifically, the server obtains the first target data based on the key identifier and generates the first authentication credential based on the first target data. The first authentication credential can be used to verify the legitimacy of the target client's identity.
[0034] 103. Receive the second authentication credential sent by the target client based on the connection;
[0035] The target client also sends a second authentication credential to the server. The server receives the second authentication credential based on the connection established with the target client in the aforementioned steps. The second authentication credential can be used to verify the legitimacy of the target client's identity.
[0036] 104. Compare and verify the first authentication credential and the second authentication credential, and enable the online service for the target client when the verification passes;
[0037] After generating the first authentication credential and receiving the second authentication credential sent by the target client, the server can compare and verify the first authentication credential and the second authentication credential. If the verification is successful, the server can enable the online service for the target client, allowing the target client to access the server's services.
[0038] In this embodiment, the server can obtain first target data based on the key identifier sent by the target client and generate first authentication credentials based on the first target data. The server then verifies the authentication request message sent by the target client. If the verification is successful, a connection is established with the target client. When the server receives a second authentication credential sent by the target client based on this connection, it compares and verifies the first and second authentication credentials. If the verification is successful, the server enables the online service for the target client. Therefore, user authentication does not require the user to enter a username and password. The server automatically authenticates the user based on locally generated authentication credentials and the authentication credentials sent by the client. This process is seamless for the user, reducing user input and simplifying the authentication process, thus improving the user experience.
[0039] Based on the above Figure 1 Using the same inventive concept as the illustrated embodiments, this application also proposes another embodiment of this user authentication method. Please refer to... Figure 2 Another embodiment of the user authentication method in this application includes:
[0040] 201. Send an authentication request message and a key identifier to the server. The authentication request message is used by the server to verify the authentication request message, and the key identifier is used by the server to generate the first authentication credential.
[0041] The method in this embodiment can be applied to a target client, which can be a client of a Software Defined Edge (SDP) product, including any SDP connection initiating host. The target client can send an authentication request message and a key identifier to the server. The authentication request message is used by the server to verify the authentication request message, and the key identifier is used by the server to generate the first authentication credential.
[0042] 202. Establish a connection with the server when the authentication request message is successfully verified;
[0043] When the authentication request message is successfully verified on the server side, the server can establish a connection with the target client. This connection can be based on a reliable communication protocol, such as a TCP connection based on the TCP protocol. Data transmission through a connection established with a reliable communication protocol ensures that the transmitted data will not be lost, or reduces the probability of data loss.
[0044] 203. Obtain the second authentication credential and send the second authentication credential to the server based on the connection, so that the server compares and verifies the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification is successful;
[0045] The target client further obtains a second authentication credential and sends the second authentication credential to the server based on the connection established in the aforementioned steps. The server then compares and verifies the first and second authentication credentials, and enables the target client to access the online service when the verification passes.
[0046] In this embodiment, the target client sends an authentication request message and a key identifier to the server. When the server verifies the authentication request message, it establishes a connection with the target client. The key identifier is used by the server to generate a first authentication credential. The target client also sends a second authentication credential to the server based on the connection. The server then compares and verifies the first and second authentication credentials. If the verification is successful, the server enables the online service for the target client. Therefore, user authentication does not require the user to enter a username and password. The client automatically sends authentication credentials, and the server automatically authenticates the user based on the locally generated authentication credentials and the credentials sent by the client. This process is seamless for the user, reducing input operations and simplifying the user authentication process, thus improving the user experience.
[0047] The following will be discussed in the preceding text. Figure 1 and Figure 2 Based on the illustrated embodiments, embodiments of this application will be described in further detail. Please refer to [link to relevant documentation]. Figure 3 Another embodiment of the user authentication method in this application includes:
[0048] 301. The target client receives access setting information input by the target user, the access setting information including access address information, target key, and key identifier of the target key;
[0049] A key function of Software-Defined Perimeter (SDP) products is establishing trusted connections through Single-Package Authorization (SPA). Therefore, the vendor's administrator can enable SPA SPA authorization on the server and send an SPA knock-on key identifier and an SPA knock-on key to the target user via out-of-band communication. Thus, in this embodiment, the target key can be an SPA knock-on key, and the key identifier can be an SPA knock-on key identifier. The target user can use this SPA knock-on key identifier and SPA knock-on key to log in to the client.
[0050] Because the SPA knock key is transmitted through the out-of-band channel, while the in-band channel (i.e., the channel used to transmit business data) does not transmit the SPA knock key and its hash, attackers cannot obtain the SPA knock key through man-in-the-middle spoofing, rainbow table brute-force, or other methods, nor can they forge authentication credentials using the same algorithm and key, thus improving the security of authentication credentials.
[0051] In this embodiment, when a target user needs to access a service provided by a server, the target user can input access settings information on the target client. The access settings information includes access address information, as well as the previously obtained target key and the key identifier of the target key (such as the SPA knock key and the SPA knock key identifier). Then, the target client can connect to the server that the target user wants to access based on the access settings information.
[0052] For example, such as Figure 4 As shown, the target client displays a login interface, which displays various input boxes for access settings information. For example, if the target user enters or selects an access address in the first input box, enters the SPA knock-on key identifier in the second input box, and enters the SPA knock-on key in the third input box, the target client obtains the above access settings information and connects to the server corresponding to the access address based on the above access settings information.
[0053] 302. The target client determines the server to be accessed based on the access address information, and determines the user identifier that is bound to the key identifier of the target key;
[0054] In this embodiment, a binding relationship is established between the key identifier and the user identifier, that is, each key identifier is bound to one user identifier, and the target client can save this binding relationship. Therefore, when the target client receives a key identifier input by the user, it can determine the user identifier bound to that key identifier. This user identifier can be used by the server to generate a first authentication credential or by the target client to generate a second authentication credential.
[0055] Furthermore, when generating the authentication request message, the target client can use the target key to encrypt the target client's device identifier and the user identifier based on an encryption algorithm to obtain the authentication request message, and then send the authentication request message to the server corresponding to the access address information entered by the target user. The encryption algorithm can be a Chinese national cryptographic algorithm, such as SM1, SM2, SM3, SM4, etc., or other algorithms besides Chinese national cryptographic algorithms.
[0056] 303. The target client sends an authentication request message and key identifier to the server;
[0057] The target client can determine the server corresponding to the access address information entered by the target user, and then send an authentication request message and key identifier to that server so that the server can verify the authentication request message. This authentication request message can be a Single-Packet Authorization Authentication Request Message (SPA).
[0058] For example, the target client and server can transmit data using the UDP transport protocol, such as transmitting an authentication request message to the server using UDP. However, this method is not reliable, and data loss is common. Therefore, a reliable connection needs to be established in subsequent steps.
[0059] 304. The server verifies the authentication request message and establishes a connection with the target client when the authentication request message passes verification;
[0060] The server stores key identifiers corresponding to each key. When it receives a key identifier from a target client, it can determine the target key corresponding to that key identifier. Therefore, upon receiving an authentication request message from the target client, since the authentication request message is obtained by the target client encrypting its device identifier and user identifier using the target key according to an encryption algorithm, the server can determine the decryption algorithm corresponding to the encryption algorithm of the authentication request message, and decrypt the authentication request message using the target key according to the decryption algorithm to obtain the device identifier and user identifier.
[0061] The server verifies the legitimacy of the authentication request message. The verification content includes, but is not limited to, replay verification, forgery verification, user identifier verification, device identifier verification, etc. This embodiment does not limit the verification method of the authentication request message.
[0062] In this embodiment, when establishing a connection with the target client, a TCP connection can be established based on the TCP communication protocol. On the basis of the TCP connection, a TLS encrypted tunnel can be established based on the Transport Layer Security (TLS) protocol. The second authentication credential sent by the target client to the server can be transmitted in this TLS encrypted tunnel. Attackers cannot obtain the second authentication credential through man-in-the-middle spoofing or other means, thereby improving the security of authentication credential transmission.
[0063] When the server verifies the authentication request message, the target client can display a message indicating that the authentication request message has been successfully verified. For example... Figure 5 As shown, the target client's interface displays the message "SPA single package authorization authentication passed, passwordless online environment testing in progress," indicating that the SPA single package authorization authentication has been passed and the authentication credentials are being verified.
[0064] 305. The server obtains the first target data based on the key identifier and generates the first authentication credential based on the first target data;
[0065] After receiving the key identifier sent by the target client, the server can obtain the first target data used to generate the first authentication credential based on the key identifier. Specifically, the server can determine the target key corresponding to the key identifier, obtain the first timestamp, and generate the first authentication credential based on the target key, the first timestamp, and the device identifier and user identifier obtained by decrypting the authentication request message. The first authentication credential can be used to verify the legitimacy of the target client's identity.
[0066] The first timestamp can be the time when the server generates the first authentication credential. For example, after obtaining information such as the user identifier, device identifier, and target key, the server combines this information with the current time to generate the first authentication credential.
[0067] In addition, the target client can generate a random number and send it to the server. The server uses this random number along with data such as the user identifier, device identifier, target key, and first timestamp to generate the first authentication credential. This embodiment does not limit the type of data used to generate the first authentication credential.
[0068] 306. The target client obtains the second authentication credential and sends the second authentication credential to the server based on the connection;
[0069] In this embodiment, there are multiple ways for the target client to obtain the second authentication credential. One way to obtain the second authentication credential is for the target client to generate the second authentication credential based on second target data. The second target data includes the target client's device identifier, the target user's user identifier logged in on the target client, the target key, and the second timestamp. Therefore, the client can generate the second authentication credential based on the target client's device identifier, the target user's user identifier, the target key, and the second timestamp.
[0070] The second timestamp can be the time when the target client generates the second authentication credential. For example, after obtaining information such as the user identifier, device identifier, and target key, the target client combines this information with the current time to generate the second authentication credential.
[0071] In addition, the target client can generate a random number and use this random number along with data such as the user identifier, device identifier, target key, and second timestamp to generate a second authentication credential. This embodiment does not limit the type of data used to generate the second authentication credential.
[0072] Another way for the target client to obtain the second authentication credential is that the second authentication credential is generated by another client based on the user identifier, the other client's device identifier, a key, and a timestamp. The target user downloads the second authentication credential from the other client and uploads it to the target client, or the user instructs the host of the other client to send the second authentication credential to the host of the target client, thereby allowing the target client to obtain the second authentication credential. This embodiment does not limit the method by which the target client obtains the second authentication credential.
[0073] In this embodiment, the server can convert the first timestamp into a dynamic password using the TOTP algorithm, and then apply this dynamic password to generate the first authentication credential. Similarly, the target client can also convert the second timestamp into a dynamic password using the TOTP algorithm, and apply this dynamic password to generate the second authentication credential. The TOTP (Time-Based One-Time Password) algorithm is a time-based one-time password algorithm that calculates a one-time password based on a pre-shared key and the current time. Due to the characteristics of the TOTP algorithm, as long as the time interval between two timestamps is less than a preset duration (e.g., 30 seconds), the dynamic passwords corresponding to these two timestamps calculated by the TOTP algorithm will be consistent. Therefore, when the device identifier, user identifier, target key, and dynamic password corresponding to the timestamp are all consistent, the first authentication credential generated by the server and the second authentication credential generated by the target client will be the same.
[0074] Therefore, in this embodiment, the server generates the first authentication credential based on the device identifier, user identifier, target key, and first timestamp. This can be achieved by using an encryption algorithm to encrypt and hash the dynamic password corresponding to the device identifier, user identifier, and first timestamp using the target key, thereby obtaining the first authentication credential. The encryption algorithm can be a Chinese national cryptographic algorithm, or it can be another algorithm besides the Chinese national cryptographic algorithm.
[0075] Similarly, the target client generates a second authentication credential based on the device identifier, user identifier, target key, and second timestamp. This can be achieved by using an encryption algorithm to encrypt and hash the dynamic password corresponding to the device identifier, user identifier, and second timestamp using the target key, thereby obtaining the second authentication credential.
[0076] 307. The server compares and verifies the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification passes.
[0077] In this embodiment, the server can verify the first authentication credential and the second authentication credential by determining whether the second authentication credential is the same as the first authentication credential. If they are the same, the server determines that the second authentication credential sent by the target client has passed the verification and allows the target client to access the service provided by the server. If they are different, the server determines that the second authentication credential sent by the target client has failed the verification and does not allow the target client to access the service provided by the server.
[0078] As mentioned earlier, the second authentication credential is generated based on the second target data. Therefore, the second authentication credential is identical to the first authentication credential in the following situations: the device identifier included in the second target data is the same as the device identifier of the target client; the user identifier included in the second target data is the same as the user identifier of the target user; the key included in the second target data is the same as the target key; and the time interval between the second timestamp included in the second target data and the first timestamp is less than a preset duration. In other words, the authentication credentials generated by the target client and the server based on the same device identifier, the same user identifier, the same key, and timestamps with a time interval less than the preset duration are identical.
[0079] Correspondingly, situations where the second authentication credential differs from the first authentication credential include: the device identifier included in the second target data differs from the device identifier of the target client; the user identifier included in the second target data differs from the user identifier of the target user; the key included in the second target data differs from the target key; or the time interval between the second timestamp and the first timestamp included in the second target data exceeds a preset duration. In other words, if the device identifier used to generate the first authentication credential is inconsistent with the device identifier used to generate the second authentication credential, or the user identifier is inconsistent, or the key is inconsistent, or the time interval between the timestamps exceeds the preset duration, the ultimately generated first and second authentication credentials will be different. Therefore, the client's user identity can be authenticated based on the authentication credential, conveniently and quickly verifying the legitimacy of the client's user identity.
[0080] For example, if the user's identity on the client side is legitimate, the target client generates a second authentication credential based on its own device identifier, the user identifier bound to the key identifier entered by the user, the key entered by the user, and a second timestamp. At the same time, it also sends the device identifier, the user identifier, and the key identifier to the server. The server also generates a first authentication credential based on the device identifier, the user identifier, the key identifier corresponding to the key identifier (i.e., the key entered by the user on the target client), and a first timestamp. If the time interval between the first timestamp and the second timestamp is less than a preset duration (e.g., 30 seconds), then the second authentication credential generated by the target client is consistent with the first authentication credential generated by the server. After the target client sends the second authentication credential to the server, the server can determine that the second authentication credential is the same as the first authentication credential, and confirm that the second authentication credential verification is successful.
[0081] When the target client's second authentication credential is stolen, the unauthorized user can use this credential on other clients. These other clients will also send their device identifiers and the unauthorized user's user identifier to the server. The server will then generate the first authentication credential based on the other client's device identifier and the unauthorized user's user identifier, not the target client's device identifier and the target user's user identifier. Clearly, the second authentication credential differs from the server-generated first authentication credential, and the server can determine that the verification fails, disallowing the unauthorized user from using the server's services.
[0082] Furthermore, even if the device identifier and user identifier are the same, if the time interval between the timestamp used to generate the first authentication credential and the timestamp used to generate the second authentication credential is greater than a preset duration, the resulting first authentication credential will differ from the second authentication credential sent by the client. Therefore, authentication credentials have an expiration date, preventing unauthorized users from accessing the server using expired authentication credentials.
[0083] In this embodiment, verification can be performed on either authentication credentials alone or on the target client's login environment simultaneously. Specifically, the server can compare and verify the first and second authentication credentials, as well as verify the target client's login environment information. When both the first and second authentication credentials pass verification and the target client's login environment information passes verification, the server enables the online service for the target client. When both the first and second authentication credentials pass verification but the target client's login environment information fails verification, since the client's login environment is untrusted, user authentication can continue. The server returns a first prompt to the target client, prompting the user to enter account information for authentication. The target client sends the user's account information to the server, which authenticates the user's account information. If authentication is successful, the server enables the online service for the target client. Conversely, when both the first and second authentication credentials fail verification, the server returns a second prompt to the target client, indicating that the second authentication credential verification failed and the user cannot use the server's services.
[0084] The verification of the client's login environment information can be performed on various login environment information such as the client's network information, terminal information, and process information, and is not limited here.
[0085] 308. The target client cancels the target user's account logged in on the target client based on the user's account cancellation operation, and clears the second authentication credentials stored locally;
[0086] In this embodiment, a user can log out of their account on the target client. The target client then logs out the user's account based on the user's logout action. Simultaneously, to ensure that authentication credentials are not leaked or stolen, the locally stored second authentication credentials can be cleared, and new authentication credentials can be generated the next time login to the server is required.
[0087] 309. The target client sends the corresponding account cancellation information to the server;
[0088] 310. The server clears the first authentication credentials corresponding to the target user's account based on the account cancellation information;
[0089] The target client also sends an account cancellation message to the server. The account cancellation message indicates that the target user has cancelled the account logged in on the target client. In this way, the server can determine that the target user's account has been cancelled and clear the first authentication credentials corresponding to the target user's account to save storage space.
[0090] 311. The target client receives the access settings information input by the target user again and returns to step 302.
[0091] After the target user's account is cancelled, when the target user wants to log in again, they enter the access settings information, and the target client returns to execute the aforementioned step 302. The user authentication process with the server is completed in the same way. That is, the target client will send an authentication request message and key identifier to the server again. The server returns to execute step 304, continues to verify the authentication request message and execute the subsequent steps. When the authentication credentials are verified, the online service is enabled for the target client.
[0092] In this embodiment, the second authentication credential of the target client can be used once within its validity period or used multiple times within its validity period. Therefore, after the second authentication credential is used for the first time and a connection is established between the target client and the server, if the connection between the target client and the server is subsequently lost and the target user needs to access the server's services, the target user can enter a login operation on the target client. For example, if the login interface of the target client displays a "One-click Login" button, and the user clicks this button, the target client sends the second authentication credential to the server (e.g., via a UDP packet). The server then continues to compare and verify the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification passes.
[0093] In this embodiment, each key identifier is bound to a user identifier, i.e., "one person, one code." This ensures that if a user's key identifier is stolen, it can be illegally used by other users. Specifically, when the client detects that an unauthorized user's key identifier is not bound to their user identifier, it can determine that the user is unauthorized. Of course, each user's user identifier can be bound to multiple key identifiers, with one key identifier used each time a user logs in, i.e., "one code per login." Alternatively, each user's user identifier can be bound to multiple key identifiers, with one key identifier used for each of the user's terminals, i.e., "one code per terminal." This embodiment only needs to ensure that each key identifier corresponds to only one user's user identifier; no limitation is imposed here.
[0094] In related technical solutions, user authentication requires three steps: SPA single-package authentication, initial authentication (such as logging in with a username and password), and MFA authentication (such as SMS verification code authentication). In contrast, this application only requires SPA single-package authentication and MFA authentication, eliminating the need for username and password login. Users only need to undergo two authentication steps, significantly simplifying the user authentication process, reducing user operations, and improving the user experience.
[0095] The user authentication method in the embodiments of this application has been described above. The computer device in the embodiments of this application is described below; this computer device is used on the server side. Please refer to... Figure 6 One embodiment of the computer device in this application includes:
[0096] The receiving unit 601 is used to receive the authentication request message and key identifier sent by the target client;
[0097] The verification unit 602 is used to verify the authentication request message and establish a connection with the target client when the authentication request message passes verification.
[0098] The generation unit 603 is used to obtain first target data according to the key identifier and generate a first authentication credential based on the first target data;
[0099] The receiving unit 601 is also configured to receive a second authentication credential sent by the target client based on the connection;
[0100] The verification unit 604 is used to compare and verify the first authentication credential and the second authentication credential, and enable the online service for the target client when the verification is successful.
[0101] In a preferred embodiment of this invention, the authentication request message is obtained by the target client encrypting the device identifier of the target client and the user identifier of the target user logged in on the target client according to an encryption algorithm.
[0102] The generation unit 603 is specifically used to determine the target key corresponding to the key identifier, and to obtain a first timestamp; to decrypt the authentication request message using the target key according to the decryption algorithm corresponding to the encryption algorithm of the authentication request message, to obtain the device identifier of the target client and the user identifier of the target user; and to generate the first authentication credential based on the device identifier of the target client, the user identifier of the target user, the target key and the first timestamp.
[0103] In a preferred embodiment of this example, the verification unit 604 is specifically used to determine whether the second authentication credential is the same as the first authentication credential; if they are the same, the second authentication credential is determined to have passed verification; if they are different, the second authentication credential is determined to have failed verification.
[0104] In a preferred embodiment of this invention, the second authentication credential is generated based on the second target data;
[0105] The cases where the second authentication credential is the same as the first authentication credential include:
[0106] The device identifier included in the second target data is the same as the device identifier of the target client, and the user identifier included in the second target data is the same as the user identifier of the target user, and the key included in the second target data is the same as the target key, and the time interval between the second timestamp included in the second target data and the first timestamp is less than a preset duration;
[0107] The second authentication credential is different from the first authentication credential in the following cases:
[0108] The device identifier included in the second target data is different from the device identifier of the target client, or the user identifier included in the second target data is different from the user identifier of the target user, or the key included in the second target data is different from the target key, or the time interval between the second timestamp included in the second target data and the first timestamp is greater than a preset duration.
[0109] In a preferred embodiment of this example, the receiving unit 601 is further configured to receive an account cancellation message sent by the target client, the account cancellation message indicating that the target user has cancelled the account logged in on the target client;
[0110] Computer equipment also includes:
[0111] The clearing unit 605 is used to clear the first authentication credential corresponding to the target user's account based on the account cancellation information;
[0112] The verification unit 602 is also configured to return to the step of verifying the authentication request message when it receives the authentication request message and key identifier sent by the target client again.
[0113] In a preferred embodiment of this example, the verification unit 604 is specifically used to compare and verify the first authentication credential and the second authentication credential, and to verify the environment information of the login environment of the target client; when the verification of the first authentication credential and the second authentication credential passes and the verification of the environment information of the login environment of the target client passes, the online service is enabled for the target client; when the verification of the first authentication credential and the second authentication credential passes but the verification of the environment information of the login environment of the target client fails, a first prompt message is returned to the target client, the first prompt message being used to prompt the user of the target client to enter account information for user authentication; when the verification of the first authentication credential and the second authentication credential fails, a second prompt message is returned to the target client, the second prompt message being used to indicate that the verification of the second authentication credential failed.
[0114] In a preferred embodiment of this example, after the connection with the target client is disconnected, the receiving unit 601 is further configured to receive the second authentication credential sent by the target client, and the verification unit 604 is further configured to compare and verify the first authentication credential and the second authentication credential, and enable the online service for the target client when the verification passes.
[0115] In this embodiment, the operations performed by each unit in the computer device are the same as described above. Figure 1 and Figure 3 The embodiments shown are similar and will not be repeated here.
[0116] In this embodiment, the server can obtain first target data based on the key identifier sent by the target client and generate first authentication credentials based on the first target data. The server then verifies the authentication request message sent by the target client. If the verification is successful, a connection is established with the target client. When the server receives a second authentication credential sent by the target client based on this connection, it compares and verifies the first and second authentication credentials. If the verification is successful, the server enables the online service for the target client. Therefore, user authentication does not require the user to enter a username and password. The server automatically authenticates the user based on locally generated authentication credentials and the authentication credentials sent by the client. This process is seamless for the user, reducing user input and simplifying the authentication process, thus improving the user experience.
[0117] The computer device in the embodiments of this application is described below, and this computer device is applied to the target client. Please refer to... Figure 7 One embodiment of the computer device in this application includes:
[0118] The sending unit 701 is used to send an authentication request message and a key identifier to the server. The authentication request message is used by the server to verify the authentication request message, and the key identifier is used by the server to generate a first authentication credential.
[0119] Establishment unit 702 is used to establish a connection with the server when the authentication request message is verified successfully.
[0120] Acquisition unit 703 is used to acquire the second authentication credential;
[0121] The sending unit 701 is further configured to send the second authentication credential to the server based on the connection, so that the server compares and verifies the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification is successful.
[0122] In a preferred embodiment of this example, the acquisition unit 703 is specifically used to receive access setting information input by the target user, the access setting information including access address information, target key, and key identifier of the target key; determine the server to be accessed based on the access address information, and determine the user identifier that is bound to the key identifier of the target key; acquire a second timestamp, and generate the second authentication credential based on the device identifier of the target client, the user identifier, the target key, and the second timestamp.
[0123] In a preferred embodiment of this invention, the computer device further includes:
[0124] The cancellation unit 704 is used to cancel the account logged in by the target user on the target client according to the user's account cancellation operation, and clear the second authentication credentials stored locally;
[0125] The sending unit 701 is also used to send corresponding account cancellation information to the server, wherein the account cancellation message indicates that the target user has cancelled the account he / she logged into on the target client;
[0126] The acquisition unit 703 is further configured to, when receiving the access setting information input by the target user again, return to the steps of determining the server to be accessed based on the access address information and determining the user identifier that is mutually bound to the key identifier of the target key.
[0127] In a preferred embodiment of this example, the sending unit 701 is specifically used to encrypt the device identifier and the user identifier of the target client using the target key based on an encryption algorithm, to obtain the authentication request message, and to send the authentication request message to the server.
[0128] In a preferred embodiment of this example, after the connection with the server is disconnected, the sending unit 701 is further configured to receive the login operation input by the target user, and send the second authentication credential to the server according to the login operation, so that the server compares and verifies the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification is successful.
[0129] In this embodiment, the operations performed by each unit in the computer device are the same as described above. Figure 2 and Figure 3 The embodiments shown are similar and will not be repeated here.
[0130] In this embodiment, the target client sends an authentication request message and a key identifier to the server. When the server verifies the authentication request message, it establishes a connection with the target client. The key identifier is used by the server to generate a first authentication credential. The target client also sends a second authentication credential to the server based on the connection. The server then compares and verifies the first and second authentication credentials. If the verification is successful, the server enables the online service for the target client. Therefore, user authentication does not require the user to enter a username and password. The client automatically sends authentication credentials, and the server automatically authenticates the user based on the locally generated authentication credentials and the credentials sent by the client. This process is seamless for the user, reducing input operations and simplifying the user authentication process, thus improving the user experience.
[0131] The computer device in the embodiments of this application is described below. This computer device is used on a server side. Please refer to [link / reference]. Figure 8 One embodiment of the computer device in this application includes:
[0132] The computer device 800 may include one or more central processing units (CPUs) 801 and a memory 805, in which one or more applications or data are stored.
[0133] The memory 805 can be volatile or persistent storage. The program stored in the memory 805 can include one or more modules, each module including a series of instruction operations on the computer device. Furthermore, the central processing unit 801 can be configured to communicate with the memory 805 and execute the series of instruction operations in the memory 805 on the computer device 800.
[0134] The computer device 800 may also include one or more power supplies 802, one or more wired or wireless network interfaces 803, one or more input / output interfaces 804, and / or one or more operating systems, such as Windows Server™, MacOSX™, Unix™, Linux™, FreeBSD™, etc.
[0135] The central processing unit 801 can perform the aforementioned... Figure 1 and Figure 3 The specific operations performed by the computer device in the illustrated embodiment will not be described in detail here.
[0136] The computer device in the embodiments of this application is described below. This computer device is used on a server side. Please refer to [link / reference]. Figure 9 One embodiment of the computer device in this application includes:
[0137] The computer device 900 may include one or more central processing units (CPUs) 901 and a memory 905, in which one or more applications or data are stored.
[0138] The memory 905 can be volatile or persistent storage. The program stored in the memory 905 can include one or more modules, each module including a series of instruction operations on the computer device. Furthermore, the central processing unit 901 can be configured to communicate with the memory 905 and execute the series of instruction operations stored in the memory 905 on the computer device 900.
[0139] The computer device 900 may also include one or more power supplies 902, one or more wired or wireless network interfaces 903, one or more input / output interfaces 904, and / or one or more operating systems, such as Windows Server™, MacOSX™, Unix™, Linux™, FreeBSD™, etc.
[0140] The central processing unit 901 can perform the aforementioned... Figure 2 and Figure 3 The specific operations performed by the computer device in the illustrated embodiment will not be described in detail here.
[0141] This application also provides a computer storage medium, one embodiment of which includes: the computer storage medium storing instructions, which, when executed on a computer, cause the computer to perform the aforementioned... Figure 1 and Figure 3 The operations performed by the computer device in the illustrated embodiment.
[0142] This application also provides a computer storage medium, one embodiment of which includes: the computer storage medium storing instructions, which, when executed on a computer, cause the computer to perform the aforementioned... Figure 2 and Figure 3 The operations performed by the computer device in the illustrated embodiment.
[0143] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0144] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.
[0145] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0146] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0147] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
Claims
1. A user authentication method, characterized in that, The method is applied to the server side, and the method includes: Receive the authentication request message and key identifier sent by the target client, verify the authentication request message, and establish a connection with the target client based on the transport layer security protocol when the authentication request message is verified. First target data is obtained based on the key identifier, and the first target data includes the target key corresponding to the key identifier, the device identifier of the target client, and the user identifier of the target user. Generate a first authentication credential based on the current timestamp, the device identifier, the user identifier, and the target key in the first target data; Receive the second authentication credential sent by the target client based on the connection; The first authentication credential and the second authentication credential are compared and verified. If the verification passes, the online service is enabled for the target client.
2. The method according to claim 1, characterized in that, The authentication request message is obtained by the target client encrypting the device identifier of the target client and the user identifier of the target user logged in on the target client according to the encryption algorithm; The step of obtaining the first target data based on the key identifier includes: Determine the target key corresponding to the key identifier, and obtain the first timestamp; Based on the decryption algorithm corresponding to the encryption algorithm of the authentication request message, the authentication request message is decrypted using the target key to obtain the device identifier of the target client and the user identifier of the target user.
3. The method according to claim 2, characterized in that, The comparison and verification of the first authentication credential and the second authentication credential includes: Determine whether the second authentication credential is the same as the first authentication credential; If they are the same, then the second authentication credential has passed verification. If they are not the same, then the second authentication credential has failed verification.
4. The method according to claim 3, characterized in that, The second authentication credential is generated based on the second target data; The cases where the second authentication credential is the same as the first authentication credential include: The device identifier included in the second target data is the same as the device identifier of the target client, and the user identifier included in the second target data is the same as the user identifier of the target user, and the key included in the second target data is the same as the target key, and the time interval between the second timestamp included in the second target data and the first timestamp is less than a preset duration; The second authentication credential is different from the first authentication credential in the following cases: The device identifier included in the second target data is different from the device identifier of the target client, or the user identifier included in the second target data is different from the user identifier of the target user, or the key included in the second target data is different from the target key, or the time interval between the second timestamp included in the second target data and the first timestamp is greater than a preset duration.
5. The method according to claim 1, characterized in that, The method further includes: Receive an account cancellation message sent by the target client, the account cancellation message indicating that the target user has cancelled the account logged in on the target client; The first authentication credentials corresponding to the target user's account are cleared based on the account cancellation information. When the authentication request message and key identifier sent by the target client are received again, the process returns to the step of verifying the authentication request message.
6. The method according to claim 1, characterized in that, The comparison and verification of the first authentication credential and the second authentication credential includes: The first authentication credential and the second authentication credential are compared and verified, and the environment information of the login environment of the target client is verified. When the verification of the first authentication credential and the second authentication credential is successful and the verification of the login environment information of the target client is successful, the online service is enabled for the target client; When the verification of the first authentication credential and the second authentication credential passes but the verification of the login environment information of the target client fails, a first prompt message is returned to the target client. The first prompt message is used to prompt the user of the target client to enter account information for user authentication. When the verification between the first authentication credential and the second authentication credential fails, a second prompt message is returned to the target client, which indicates that the verification of the second authentication credential has failed.
7. The method according to any one of claims 1 to 6, characterized in that, After the connection with the target client is broken, the method further includes: The system receives the second authentication credential sent by the target client, compares and verifies the first authentication credential with the second authentication credential, and enables the online service for the target client when the verification passes.
8. A user authentication method, characterized in that, The method is applied to the target client, and the method includes: Send an authentication request message and a key identifier to the server. The authentication request message is used by the server to verify the authentication request message, and the key identifier is used by the server to generate the first authentication credential. When the authentication request message passes verification, a connection with the server is established based on the transport layer security protocol. Obtain a second authentication credential and send the second authentication credential to the server based on the connection, so that the server compares and verifies the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification is successful.
9. The method according to claim 8, characterized in that, The process of obtaining the second authentication credential includes: Receive access setting information input by the target user, the access setting information including access address information, target key, and key identifier of the target key; The server to be accessed is determined based on the access address information, and the user identifier that is bound to the key identifier of the target key is determined. Obtain the second timestamp, and generate the second authentication credential based on the target client's device identifier, the user identifier, the target key, and the second timestamp.
10. The method according to claim 9, characterized in that, The method further includes: The target user's account logged in on the target client is cancelled based on the user's account cancellation action; The second authentication credential stored locally is cleared, and the corresponding account cancellation information is sent to the server. The account cancellation message indicates that the target user has cancelled the account logged in on the target client. When the access settings information input by the target user is received again, the process returns to the steps of determining the server to be accessed based on the access address information and determining the user identifier that is bound to the key identifier of the target key.
11. The method according to claim 8, characterized in that, Sending the authentication request message to the server includes: Based on the encryption algorithm, the target key is used to encrypt the device identifier and the user identifier of the target client to obtain the authentication request message, and then the authentication request message is sent to the server.
12. The method according to any one of claims 8 to 11, characterized in that, After the connection with the server is broken, the method further includes: The system receives a login operation input from the target user, sends the second authentication credential to the server based on the login operation, so that the server compares and verifies the first authentication credential and the second authentication credential, and enables the online service for the target client when the verification is successful.
13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 7; or, when the processor executes the computer program, it implements the method as described in any one of claims 8 to 12.
14. A computer storage medium, characterized in that, The computer storage medium stores instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 7; or cause the computer to perform the method as described in any one of claims 8 to 12.