Login authentication method, device, equipment and storage medium

Abstract

The application discloses a login authentication method and device, equipment and storage medium, and is applied to the authentication end of a shared device. In a sharing mode, a first identity authentication request of a current user is received and responded. When the verification of the first identity of the current user is successful, a login information list of the current user is determined. After receiving a login authentication request of a target login account issued by the current user based on the login information list, a target authentication mode is determined according to the login authentication request, and a second identity corresponding to the target authentication mode is obtained. Finally, according to the verification result of the second identity, a to-be-verified data packet is generated and sent to the proxy end of the shared device. The application can distinguish different users according to the identity, and only display the account under the identified target user name, so that the user logs in to his own account through his own identity, reduces the risk of user privacy data leakage and illegal login of the account, and improves the security of the scheme.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to a login authentication method, apparatus, device, and storage medium. Background Technology

[0002] Current login authentication schemes offer a method for users to log in to websites using an identity identifier instead of the traditional username and password. In scenarios where multiple individuals share a device, a single user may register multiple identity identifiers (such as fingerprints, facial recognition, and QR codes), and multiple users may also register their own unique identity identifiers. However, the current scheme cannot distinguish between these two scenarios, and therefore cannot determine whether the individual logging in using an identity identifier (i.e., the individual using the shared device) is the owner of the pre-login account. This could lead to the individual using the shared device being able to log in to other users' accounts using their fingerprint, thus gaining access to information about other users' registered accounts.

[0003] Therefore, in scenarios where multiple individuals share devices, the current solution carries the risk of unauthorized login to user accounts and leakage of user privacy data. Summary of the Invention

[0004] This application provides a login authentication method, apparatus, device, and storage medium to reduce the risk of user privacy data leakage and unauthorized account login, thereby improving the security of the solution.

[0005] Firstly, this application provides a login authentication method applied to the authentication terminal of a shared device, wherein the shared device includes a proxy terminal, an access terminal, and the authentication terminal, and the method includes:

[0006] In shared mode, receive and respond to the current user's first identity authentication request, and obtain the current user's first identity identifier;

[0007] Verify the first identity identifier. When the first identity identifier is successfully verified, determine the current user's login information list based on the first identity identifier. The login information list includes the login account, account credentials, and the verification method corresponding to the account credentials.

[0008] Receive the login authentication request for the target login account sent by the current user based on the login information list;

[0009] Based on the login authentication request, determine the target authentication method and obtain the second identity identifier corresponding to the target authentication method;

[0010] Verify the second identity identifier and obtain the verification result;

[0011] Based on the verification result, a data packet to be verified is generated and sent to the proxy terminal. The data packet to be verified is used to instruct the access terminal to authenticate the login authentication request.

[0012] Secondly, this application provides a login authentication device applied to the authentication end of a shared device, wherein the shared device includes a proxy end, an access end, and the authentication end, and the device includes:

[0013] The first acquisition module is used to receive and respond to the first identity authentication request of the current user in the sharing mode, and to acquire the first identity identifier of the current user;

[0014] The first verification module is used to verify the first identity identifier. When the first identity identifier is successfully verified, the module determines the login information list of the current user based on the first identity identifier. The login information list includes the login account, account credentials, and the verification method corresponding to the account credentials.

[0015] The request receiving module is used to receive the login authentication request for the target login account sent by the current user based on the login information list;

[0016] The second acquisition module is used to determine the target authentication method based on the login authentication request, and to acquire the second identity identifier corresponding to the target authentication method;

[0017] The second verification module is used to verify the second identity identifier and obtain the verification result;

[0018] The data packet generation module is used to generate and send a data packet to be verified to the agent based on the verification result. The data packet to be verified is used to instruct the access terminal to authenticate the login authentication request.

[0019] Thirdly, this application provides an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the login authentication method as described in any one of the first aspects.

[0020] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, the computer program being loaded by a processor to perform the steps of the login authentication method as described in any one of the first aspects.

[0021] This application provides a login authentication method, apparatus, device, and storage medium. Compared to the prior art where the authentication terminal directly displays its own maintained login information list to the current user using the shared device, in this application embodiment, under the sharing mode, on the one hand, when the authentication terminal receives the current user's first identity authentication request, it verifies the obtained first identity identifier. If the verification is successful, it determines the current user's login information list based on the first identity identifier. At this time, the shared device cannot display other users' login information lists to the current user, thereby reducing the risk of user login information leakage and improving the confidentiality of user login information. On the other hand, after receiving the current user's login authentication request for a target login account based on the login information list, it determines the target authentication method and obtains the second identity identifier corresponding to the target authentication method. It verifies the second identity identifier and sends the verification result to the proxy terminal, enabling the access terminal to authenticate this login authentication request, thereby reducing the risk of user accounts being illegally logged in and further improving the security of the login authentication scheme. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of a scenario for the login authentication method provided in an embodiment of this application;

[0024] Figure 2 This is a flowchart illustrating the login authentication method provided in an embodiment of this application;

[0025] Figure 3 This is a schematic diagram of the interaction between the various terminals of the shared device in the login authentication method provided in the embodiments of this application;

[0026] Figure 4 This is a schematic diagram of the process for creating a set of identity identifiers provided in an embodiment of this application;

[0027] Figure 5 This is a flowchart illustrating the association of user login information and identity identifier set provided in the embodiments of this application;

[0028] Figure 6 This is a schematic diagram of the login authentication device provided in the embodiments of this application;

[0029] Figure 7 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] In the following description, specific embodiments of this application will be illustrated with reference to steps and symbols performed by one or more computers, unless otherwise stated. Therefore, these steps and operations will be referred to several times as being performed by a computer, and computer execution as referred to herein includes operations by a computer processing unit representing electronic signals of data in a structured format. This operation transforms the data or maintains it at a location in the computer's memory system, which can be reconfigured or otherwise alter the operation of the computer in a manner well known to those skilled in the art. The data structure maintained by the data is the physical location of the memory, which has specific characteristics defined by the data format. However, the principles of this application are described in the foregoing text, which is not intended to be limiting, and those skilled in the art will understand that many of the steps and operations described below can also be implemented in hardware.

[0032] The terms "module" or "unit" as used herein can be considered as software objects executing on the computing system. The different components, modules, engines, and services described herein can be considered as implementation objects on the computing system. The apparatus and methods described herein are preferably implemented in software, but can also be implemented in hardware, both of which are within the scope of this application.

[0033] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or wireless coupling. The term “and / or” as used herein includes all or any units and all combinations of one or more associated listed items.

[0034] The W3C (World Wide Web Consortium) and the Fast Identity Online (FIDO) Consortium have launched the WebAuthn scheme, which supports providing users with biometric authentication methods (such as fingerprint recognition and facial recognition) and identity verification codes (PIN codes) to replace the traditional method of entering account passwords for website login. After detailed analysis and research, the inventors discovered that the WebAuthn scheme allows the same user to register multiple WebAuthn authentication credentials for the same account on the same website using different authentication terminals. In scenarios where multiple individuals share a device, a user may register multiple identity identifiers (such as fingerprints, facial recognition, and identity verification codes), and multiple users may also register their own identity identifiers separately. However, the current WebAuthn scheme cannot distinguish between these two situations, and therefore cannot determine whether the individual using the identity identifier to log in to the account (i.e., the individual using the shared device) is the owner of the pre-login account. This could lead to the individual using the shared device being able to log in to other users' accounts using their fingerprint and, based on the login information list provided by the authentication terminal, know the accounts and credential information of other users who have registered authentication credentials.

[0035] To address the aforementioned problems, the inventors, through long-term research, have proposed a login authentication method, apparatus, device, and storage medium as provided in the embodiments of this application, which is applied to the authentication end of a shared device, the shared device including a proxy end, an access end, and an authentication end.

[0036] like Figure 1 The diagram shown illustrates a scenario of the login authentication method in this application. This scenario primarily includes users and shared devices. Users refer to individuals preparing to register / login, i.e., natural persons using shared devices; shared devices can be mobile phones, tablets, etc., and include:

[0037] Authentication Terminal 101: This is the terminal that authenticates the login authentication request, such as the authenticator. It usually refers to the fingerprint scanner, iris scanner, facial recognition device built into the USB Key or shared device. It is these devices that act as proxies for the password or even the username during the usage process.

[0038] Proxy 102: The browser or system used by the user, responsible for interacting with authentication 101.

[0039] Access 103: refers to the service provider, such as a website.

[0040] The authentication terminal 101, the proxy terminal 102, and the access terminal 103 are connected by the following: Figure 1 The communication link shown is used to achieve information exchange; the type of communication link may include wired, wireless communication links, or fiber optic cables, etc., and this application does not impose any restrictions. Wherein:

[0041] First, when the owner of the shared device triggers the sharing activation operation, the user accesses a website (referred to as the access terminal 103) in a browser (referred to as the access terminal 102) and initiates a login operation. The access terminal 103 generates a challenge value (referred to as the challenge) and calls the relevant API (Application Programming Interface) of the proxy terminal 102 to pass the challenge to the proxy terminal 102. After the proxy terminal 102 confirms that the authentication terminal 101 is available, it passes the challenge to the authentication terminal 101. Subsequently, the authentication terminal 103 authenticates the user's identity, requesting the user to verify their registered primary identity identifier (such as any fingerprint). After successful identity identifier verification... Based on the user identity set maintained by itself, the current user and the corresponding login information list are identified, and the login information list is displayed to the current user. When the current user selects a target login account from the login information list, the target authentication method (e.g., fingerprint verification) corresponding to the target login account is identified, and the user's corresponding second identity is obtained for verification. The verification result and other data are packaged together to generate a data packet to be verified and sent to the proxy terminal 102. Finally, the proxy terminal 102 sends the data packet to be verified to the access terminal 103, and the access terminal 103 verifies the data packet to determine whether the user's login authentication request is approved.

[0042] In the above process, when the authentication terminal successfully verifies the obtained first identity identifier, it determines the current user's login information list based on the first identity identifier. At this time, the shared device cannot display other users' login information lists to the current user, thereby reducing the risk of user login information leakage and improving the confidentiality of user login information. In addition, after receiving the login authentication request for the target login account issued by the current user based on the login information list, the target authentication method is determined, and the second identity identifier corresponding to the target authentication method is obtained. The second identity identifier is verified, and the verification result is sent to the proxy terminal, enabling the access terminal to authenticate this login authentication request, thereby reducing the risk of user accounts being illegally logged in and further improving the security of the login authentication scheme.

[0043] It should be noted that, Figure 1 The schematic diagrams shown are merely examples. The schematic diagrams described in this application are intended to more clearly illustrate the technical solutions of this application and do not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will know, with the evolution of technology and the emergence of new business scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0044] The following detailed description is based on specific embodiments.

[0045] Please see Figure 2 , Figure 2 The login authentication method provided in this application embodiment is applied to the authentication end of a shared device, which includes a proxy end, an access end, and an authentication end. The method includes the following steps:

[0046] 201: In shared mode, receive and respond to the current user's first identity authentication request and obtain the current user's first identity identifier.

[0047] The sharing mode refers to a mode in which multiple natural persons can share the use of a single device; the current user refers to the user currently using the shared device.

[0048] In this embodiment, the sharing mode is activated by the device owner (i.e., the device master). Specifically, the authentication terminal of the shared device has a sharing mode switch, which can only be controlled by the shared device owner. The shared device owner can be confirmed by means of "the owner of the first identity identifier (such as biometrics, identity code, etc.) registered on the authentication terminal is the owner of the shared device".

[0049] In this embodiment, the first authentication request refers to the request triggered by the current user's login operation initiated when accessing an access terminal (e.g., a website) through a proxy terminal (e.g., a browser). The first identity identifier refers to the identifier provided by the current user for verifying their identity, which may include biometric identifiers (e.g., fingerprints, irises, faces, etc.) and may also include an identity identification code (PIN code), etc.

[0050] It should be noted that, in this embodiment of the application, the user's identity can be collected by the sensing unit (such as an image sensor, an ultrasonic sensor, etc.) on the shared device and sent to the authentication terminal for verification. The specific method of collecting the user's identity is not limited here.

[0051] 202: Verify the first identity identifier. When the first identity identifier is successfully verified, determine the current user's login information list based on the first identity identifier.

[0052] The login information list includes the login account, account credentials, and the corresponding verification method for the account credentials. The login account can be an account with web authentication credentials; different identity types correspond to different verification methods, which may include biometric verification (such as fingerprint verification, iris verification, and facial recognition verification), or identity identification code (PIN code) verification, etc.

[0053] It should be noted that in this embodiment, the login account and account credentials have a one-to-one correspondence, while the account credentials and verification methods can have a one-to-many relationship. That is, one account can correspond to multiple verification methods.

[0054] Specifically, in this embodiment, the authentication terminal first verifies whether the first identity identifier is a registered identity identifier. If so, it determines that the current user is a registered shared user; otherwise, it considers the current user to be an unknown user. Further, the authentication terminal searches its own maintained identity identifier database to determine which user the currently verified first identity identifier belongs to, thereby determining the current user's identity. It then finds all registered login accounts, account credentials, and corresponding verification methods associated with the current user's identity identifier set, forming a login information list for the target user to choose from. The identity identifier database is a comprehensive database of the identity identifier sets of all shared users.

[0055] 203: Receives a login authentication request from the current user for the target login account based on the login information list.

[0056] The current user selects a target login account from the login information list provided by the authentication terminal, thereby triggering a login authentication request for that target login account.

[0057] It should be noted that if the current user wishes to log in to the account of another user who has registered on this shared device, the other user needs to verify their identity. The authentication terminal will display the login information list of the other user based on their identity, and the user will then complete the subsequent verification process.

[0058] 204: Based on the login authentication request, determine the target authentication method and obtain the second identity identifier corresponding to the target authentication method.

[0059] Specifically, the authentication server determines the account credentials corresponding to the target login account based on the login authentication request triggered by the current user. It then determines the corresponding target authentication method based on these credentials and requests the current user to provide a secondary identity identifier corresponding to that authentication method. It should be noted that if there are multiple authentication methods corresponding to the target login account, the current user can choose any one to authenticate and execute the subsequent credential verification and account login process according to the Web identity authentication protocol.

[0060] 205: Verify the second identity identifier and obtain the verification result.

[0061] Specifically, the authentication terminal identifies the second identity provided by the current user and obtains a verification result indicating whether the current user's identity authentication has passed.

[0062] 206: Based on the verification result, generate and send the data packet to be verified to the agent. The data packet to be verified is used to instruct the client to authenticate the login authentication request.

[0063] Among them, the data packet to be verified refers to the data packet formed by the authentication end packaging the verification results and other data.

[0064] Specifically, the authentication end confirms the identifier (denoted as credID) of the target account credentials corresponding to the target login account, and uses the private key corresponding to credID to sign the verification result (denoted as result), the target login account (denoted as accountID), the identifier (denoted as credID) of the target account credentials corresponding to the target login account, the target authentication method, and the challenge value (denoted as challenge) received from the proxy end, to obtain the unverified signature value (denoted as signature) of the transmission data packet {challenge, result, accountID, credID, target authentication method}; finally, the authentication end sends the unverified data packet {challenge, result, accountID, credID, target authentication method, signature} composed of the transmission data packet and the unverified signature value to the proxy end.

[0065] This application provides a login authentication method. In a shared mode, the authentication terminal of the shared device receives and responds to the first identity authentication request of the current user, verifies the obtained first identity identifier of the current user, and when the first identity identifier is successfully verified, determines the login information list of the current user based on the first identity identifier. The login information list includes the login account, account credentials, and the verification method corresponding to the account credentials. After receiving the login authentication request of the target login account issued by the current user based on the login information list, the target authentication method is determined according to the login authentication request, and the second identity identifier corresponding to the target authentication method is obtained and verified to obtain the verification result. Finally, based on the verification result, a data packet to be verified is generated and sent to the agent terminal of the shared device. The data packet to be verified is used to instruct the access terminal of the shared device to authenticate the login authentication request. Compared to existing technologies where the authentication terminal directly displays its own maintained login information list to the target user using the shared device, this application embodiment, on the one hand, verifies the obtained first identity identifier when the authentication terminal receives a user's first identity authentication request. Upon successful verification, it determines the current user's login information list based on the first identity identifier. At this time, the shared device cannot display the login information lists of other shared users to the current user, thereby reducing the risk of user login information leakage and improving the confidentiality of user login information. On the other hand, after receiving a login authentication request from the current user for a target login account based on the login information list, it determines the target authentication method and obtains the second identity identifier corresponding to the target authentication method. It verifies the second identity identifier and sends the verification result to the proxy terminal, enabling the access terminal to authenticate this login authentication request, thereby reducing the risk of user accounts being illegally logged in and further improving the security of the login authentication scheme.

[0066] To more clearly describe the interactions between different devices during login authentication on a shared device, please refer to [link / reference]. Figure 3 , Figure 3 This is a schematic diagram illustrating the interaction between the various terminals of the shared device in the login authentication method provided in this application embodiment. The specific interaction flow is as follows:

[0067] 301~303: Access terminal 103 receives the login operation initiated by the current user; generates a challenge value and calls the target application interface corresponding to proxy terminal 102; sends the challenge value to proxy terminal 102.

[0068] In this embodiment of the application, when the owner of the shared device has enabled the sharing mode, the current user initiates an account login operation. Specifically, this includes: the current user accessing an access terminal (e.g., a website) through the proxy terminal 102 (e.g., a browser) and initiating a login operation; the access terminal 103 receiving the login operation initiated by the current user, generating a challenge value, and calling the relevant application programming interface (API) of the proxy terminal 102 to pass the challenge value to the proxy terminal 102.

[0069] 304~305: Agent 102 receives the challenge value sent by access 103 and sends the challenge value to authentication 101.

[0070] Specifically, in this embodiment of the application, the proxy terminal 102 receives the challenge value sent by the access terminal 103, then confirms the available authentication terminal 101 from multiple authentication terminals, and passes the challenge value to the authentication terminal 101.

[0071] 306~307: Authentication terminal 101 receives and stores the challenge value; receives and responds to the first identity authentication request and obtains the first identity identifier.

[0072] Specifically, the authentication terminal 101 receives the challenge value sent by the proxy terminal 102, prompting the current user to verify any of its registered identity identifiers. After receiving the prompt from the authentication terminal 101, the current user sends a first identity authentication request and transmits the first identity identifier to the authentication terminal 101. The authentication terminal 101 obtains the first identity identifier provided by the current user.

[0073] It should be noted that, in this embodiment of the application, the user's identity can be collected by the sensing unit (such as an image sensor, an ultrasonic sensing unit, etc.) on the shared device and sent to the authentication terminal 101 for verification. The specific method of collecting the user's identity is not limited here.

[0074] In this embodiment of the application, the authentication terminal 101 verifies the first identity identifier. When the first identity identifier is successfully verified, determining the current user's login information list based on the first identity identifier may include the following steps 308-311:

[0075] 308. Verify the first identity based on the identity database and the first identity.

[0076] Among them, the identity identifier database is a comprehensive database of the identity identifiers of each registered user maintained by the authentication end.

[0077] In this embodiment, the authentication terminal 101 first verifies whether the first identity is a registered identity based on its own maintained identity database. If so, the current user is determined to be a registered shared user; otherwise, the current user is considered an unfamiliar user.

[0078] 309. When the first identity verification is successful, determine the target identity set corresponding to the current user based on the first identity.

[0079] Specifically, in this embodiment, when the authentication terminal 101 determines that the first identity identifier is the identity identifier of a registered shared user, it further matches the first identity identifier with the identity identifier database to determine which user the first identity identifier belongs to, thereby determining the identity of the current user and thus determining the target identity identifier set corresponding to the current user. This method of verifying the current user's identity before logging into an account reduces the risk of user identity being impersonated and unauthorized account login, thus improving the security of the solution.

[0080] 310. Determine each login account, account credentials, and corresponding verification method associated with the target identity set, and generate a list of login information for the current user to select.

[0081] Specifically, the authentication terminal 101 confirms the target identity set of the current user, and finds all registered login accounts, account credentials, and verification methods associated with the target user's identity set, forming a login information list for the current user to choose from.

[0082] The login information list includes the login account, account credentials, and the corresponding verification method for the account credentials. The login account can be an account with web authentication credentials; different identity types correspond to different verification methods, which may include biometric verification (such as fingerprint verification, iris verification, and facial recognition verification), or identity identification code (PIN code) verification, etc.

[0083] It should be noted that in this embodiment, the login account and account credentials have a one-to-one correspondence, while the account credentials and verification methods can have a one-to-many relationship. That is, one account can correspond to multiple verification methods.

[0084] This application's embodiments use identity identifiers to distinguish different users and associate all of a user's accounts and credentials with the user's identity identifier set. This allows for the differentiation of different users' identity and account information in scenarios where multiple individuals share a device, further enhancing the security of the solution from a data storage and processing perspective.

[0085] 311~313: Authentication terminal 101 receives the login authentication request of the target login account sent by the current user based on the login information list; determines the target authentication method according to the login authentication request, and obtains the second identity identifier corresponding to the target authentication method; verifies the second identity identifier and obtains the verification result.

[0086] Specifically, in this embodiment, the current user selects a target login account (denoted as accountID) to pre-login based on the login information list displayed by the authentication terminal, thereby triggering a login authentication request for the target login account. The authentication terminal 101 determines the account credentials (denoted as cred) corresponding to the target login account based on the login authentication request triggered by the current user, and then determines the corresponding target authentication method based on the cred, and requests the current user to provide the second identity identifier corresponding to the target authentication method. The current user provides the corresponding second identity identifier according to the target authentication method. After obtaining the second identity identifier, the authentication terminal 101 verifies it and obtains the corresponding verification result (denoted as result).

[0087] It should be noted that if the current user wishes to log in to another user's account already registered on this shared device, the corresponding other user needs to verify their identity. The authentication terminal 101 will display the login information list of the other user based on their identity, and that user will then complete the subsequent verification process. Furthermore, if the target login account has multiple authentication methods, the current user can choose any one to authenticate, and the subsequent credential verification and account login process will be executed according to the Web identity authentication protocol. This method of only displaying all accounts under the current user's name, without showing other users' account information, strengthens privacy data protection and reduces the risk of user privacy data leakage.

[0088] In this embodiment of the application, the authentication terminal 101 may generate and send the data packet to be verified to the proxy terminal based on the verification result, including the following steps 314 to 319:

[0089] 314. Read the challenge value sent by agent 102.

[0090] In this embodiment, the proxy 102 has previously sent the challenge value generated by the access terminal 103 to the authentication terminal 101. Therefore, the authentication terminal 101 needs to read the challenge value in its memory for subsequent verification.

[0091] 315. Determine the target account credential identifier based on the target login account.

[0092] Specifically, in this embodiment of the application, since there is a one-to-one correspondence between login accounts and account credentials, and the account credential identifier is also unique, the authentication terminal 101 can uniquely determine the corresponding target account credential identifier (denoted as credID) based on the target login account (accountID).

[0093] 316. Package the challenge value, verification result, target login account, target account credential identifier, and target authentication method into a transmission data packet.

[0094] In this embodiment of the application, the authentication terminal 101 packages the result, accountID, credID, target authentication method, and the challenge value (denoted as challenge) sent by the proxy terminal to obtain the transmission data packet {challenge, result, accountID, credID, target authentication method}.

[0095] 317. Sign the transmitted data packet according to the private key corresponding to the target account credential identifier to obtain the signature value to be verified.

[0096] 318. Generate a data packet to be verified based on the transmitted data packet and the signature value to be verified.

[0097] 319. Send the data packet to be verified to the agent.

[0098] In this embodiment of the application, the authentication terminal 101 uses the private key corresponding to credID to sign the transmitted data packet to obtain the signature value to be verified (denoted as signature); then, the data packet to be verified, consisting of {challenge, result, accountID, credID, target authentication method} and signature, is sent to the proxy terminal.

[0099] 320~321: Agent 102 receives the data packet to be verified; sends the data packet to the access terminal 103.

[0100] 322-324: Access terminal 103 receives the data packet to be verified; it determines whether the challenge value in the data packet to be verified is consistent with the challenge value it generated; if they are consistent, it executes steps 325 to 327; if they are inconsistent, it terminates the login authentication process.

[0101] It should be noted that the challenge value in the data packet to be verified is the challenge value received from the proxy 102 and stored at the authentication end 101. Since there may be interference / attacks during the transmission process, the access end needs to verify whether the transmitted challenge value is consistent with its own generated challenge value to determine whether to verify the signature value to be verified, thereby further improving the security of the login process.

[0102] 325-327: Access terminal 103 reads the public key corresponding to the account credential identifier from the database based on the account credential identifier; uses the public key to verify the signature value to be verified in the data packet to be verified; if the signature verification is successful, the verification result is trusted to determine whether the target login account is allowed to log in; if the signature verification fails, the verification result is not trusted, and subsequent operations are taken according to its own policy.

[0103] Specifically, in this embodiment of the application, the access terminal 103 looks up the public key corresponding to the credID stored in its own memory based on the credID, and uses the public key to verify the signature value to be verified in the data packet to be verified.

[0104] If the signature verification is successful, the access terminal 103 trusts the verification result (result) of the authentication terminal 101, and determines whether the user account corresponding to the accountID is allowed to log in based on whether the user identity authentication is successful as shown in the result.

[0105] If the signature verification fails, the access terminal 103 does not trust the verification result of the authentication terminal 101 and takes subsequent actions according to its own policy (for example, prompting the user that the second identity is incorrect and asking them to re-verify the second identity; or locking the user's account login, etc.).

[0106] It's important to note that when a user registers web authentication credentials on a website, the authentication server generates a public-private key pair for the user's website account. Each account on different access points corresponds to a different public-private key pair. Generally, the access point holds the public key, and the authentication server holds the private key.

[0107] This application embodiment establishes separate identity identifier sets for different users, which can distinguish between a user registering multiple identity identifiers and multiple users registering their own identity identifiers. This avoids the risk of natural persons using their own identity identifiers to log in to other natural persons' accounts and impersonating identities to illegally log in, thereby improving the security of the solution.

[0108] like Figure 4 As shown in this embodiment, the first identity identifier exists in the current user's identity identifier set. Therefore, for the authentication end, a series of pre-preparations will be performed first, wherein creating the identity identifier set specifically includes the following steps 401 to 404:

[0109] 401. Respond to the sharing enable operation triggered by the device owner and enable sharing mode.

[0110] Among them, the equipment owner is the owner of the shared equipment determined according to the preset equipment ownership conditions; the sharing mode refers to the mode in which multiple natural persons can share and use a single device.

[0111] In this embodiment, the sharing mode is activated by the device owner (i.e., the device master). Specifically, the authentication terminal of the shared device has a sharing mode switch, which can only be controlled by the device owner, further strengthening the protection of user privacy data. The preset device ownership condition can be "the owner of the shared device is the owner of the first identity identifier (e.g., biometrics, identification code, etc.) registered on the authentication terminal".

[0112] 402. Receive the current user's identity registration request.

[0113] Here, "current user" refers to the user currently using the shared device; after registering, the current user becomes one of the shared users who can use the shared device, while "shared user" refers to a natural person who can share the use of the same device; "identity registration request" is a request initiated by the user to register web authentication credentials.

[0114] 403. Respond to the identity registration request and obtain the current user's identity registration identifier.

[0115] The identity registration identifier may include biometric identifiers (such as fingerprints, irises, and faces) and may also include identity identification codes (PIN codes).

[0116] 404. Determine the set of identity identifiers corresponding to the current user based on the identity registration identifier.

[0117] Specifically, step 404 may further include: determining whether the identity registration identifier is the first identity registration identifier of the current user; if yes, then creating an identity identifier set corresponding to the current user; if no, then determining the current identity identifier set corresponding to the current user from the identity identifier database, and associating the identity registration identifier with the current identity identifier set to obtain the identity identifier set corresponding to the current user.

[0118] In this embodiment, when a current user registers web authentication credentials using an identity identifier, the authentication terminal requests the current user to associate their identity identifier with one or more previously registered identity identifiers via pop-up windows or other means. First, it determines whether the identity registration identifier is the current user's first identity registration identifier. Then, based on the determination result, it determines whether an identity identifier association operation is required, thereby obtaining the current user's set of identity identifiers.

[0119] Taking fingerprints as an identity identifier, when a user registers their first fingerprint, no association operation is required, but a fingerprint set corresponding to the current user can be created. At this time, the fingerprint set contains only the user's fingerprint. When the current user registers their second fingerprint, they need to verify the first fingerprint to find the previously created fingerprint set so that the second fingerprint can be associated with the previously created fingerprint set, forming the current user's fingerprint set. At this time, the fingerprint set contains the user's first and second fingerprints. Subsequently, if the current user registers a new fingerprint, they need to verify any of the previously associated fingerprints to find the corresponding fingerprint set so that the new fingerprint can be associated with the current user's fingerprint set.

[0120] like Figure 5 As shown, in some embodiments of this application, after determining the current user's identity set, it is also necessary to associate the user login information with the identity set. The association process may include the following steps 501 to 503:

[0121] 501. Send account association prompt.

[0122] The authentication endpoint sends an account association prompt to the current user to inquire whether there is an account that has not yet been associated with their set of identity identifiers and has been registered on this shared device with web authentication credentials.

[0123] 502. Receive and respond to the list trigger operation initiated by the current user based on the account association prompt, and display the list of login accounts associated with the current user.

[0124] In this embodiment of the application, the current user can click a button or perform other operations to make the authentication terminal display a list of login accounts that are associated with the shared user identity set.

[0125] 503. Receive and respond to the association operation triggered by the current user, and associate each unassociated login information in the login account list with the identity identifier set corresponding to the shared user.

[0126] Specifically, step 503 may further include: receiving login information entered by the current user based on account association prompts, wherein the login information is login information not associated in the login account list, and the login information includes the login account and account credentials; verifying whether the entered account credentials are correct; if so, associating the login information with the identity identifier set corresponding to the shared user.

[0127] In this embodiment, if an unassociated login account exists, the current user enters a login account and corresponding account credentials that were previously registered on this shared device using web authentication credentials. The authentication server then searches its own maintained account credentials based on the login account to verify the correctness of the account credentials entered by the current user. If the account credentials are successfully verified, the login account and account credentials are associated with the current user's corresponding identity set for subsequent login authentication.

[0128] The login authentication method in this application embodiment is described below with reference to a specific application scenario.

[0129] In a specific implementation scenario, the authentication end of the shared device is denoted as authenticator, the proxy end of the user login account is denoted as agent (e.g., a browser), the access end is denoted as relayParty (e.g., a website), the device owner is denoted as deviceOwner (i.e., the device owner), the current user is denoted as currentUser, the challenge value is denoted as challenge, and the application programming interface is denoted as API.

[0130] In this specific scenario embodiment, taking fingerprint as the identity identifier as an example, the login authentication method may specifically include the following steps:

[0131] First, the authentication terminal in the shared device will perform a series of pre-preparations, specifically including:

[0132] 1) Add a device sharing mode switch to the authenticator, limited to deviceOwner only. This allows for verification of the device owner's identity using methods such as "the owner of the first fingerprint registered on the device authenticator is the device owner."

[0133] Secondly, when the device owner has enabled sharing mode, the current user registers login credentials and associates them with registered information, specifically including:

[0134] 2) Turn on the device sharing mode switch in deviceOwner.

[0135] 3) When currentUser registers web identity (webAuthn) credentials using a fingerprint, the authenticator requests currentUser to associate their fingerprint with one or more previously registered fingerprints via pop-up windows or other means, thus forming a fingerprint set for currentUser. The specific association method is as follows:

[0136] ①When currentUser registers its first fingerprint, this association operation is not performed;

[0137] ②When currentUser registers a second fingerprint, currentUser needs to verify the first fingerprint in order to associate the first and second fingerprints and form a fingerprint set for currentUser;

[0138] ③ If currentUser subsequently registers a new fingerprint, it needs to verify any previously associated fingerprint in order to associate the new fingerprint with the user's fingerprint set.

[0139] 4) The authenticator queries the currentUser to see if there are any accounts that have not yet been associated with the currentUser's fingerprint set and have already registered webAuthn credentials on this device. At this point, the currentUser can click a button or perform other actions to have the authenticator display a list of login accounts associated with the currentUser's fingerprint set.

[0140] 5) If there are any accounts that have not yet been associated, currentUser will associate that account with its fingerprint set. The specific association method is as follows:

[0141] ①The authenticator asks currentUser whether there are any accounts that have not yet been associated with the currentUser fingerprint set and have been registered with webauthn credentials on this device. currentUser enters the account and corresponding credentials that have been registered on this device but not associated with the webauthn credentials through the login account list displayed by the authenticator.

[0142] ②The authenticator searches for the corresponding credentials it maintains based on the account whose webauth credentials currentUser enters, and verifies whether the credentials entered by currentUser are correct;

[0143] ③ If the credentials are successfully verified, the account and credentials will be associated with the fingerprint set of currentUser.

[0144] 6) The final authenticator records and maintains the fingerprint set of the currentUser, as well as all accounts and corresponding credentials associated with the fingerprints.

[0145] Assuming all preparations are complete and the device owner has enabled device sharing mode, the currentUser login account includes:

[0146] 7) The currentUser accesses a relayParty on the agent and initiates a login operation;

[0147] 8) relayParty generates a challenge and calls the agent-related API to pass the challenge to the agent;

[0148] 9) The agent identifies an available authenticator and passes the challenge to the authenticator.

[0149] Next, the authenticator authenticates the currentUser's identity and signs the result, specifically including:

[0150] 10) The authenticator requests the currentUser to verify any of its registered fingerprints.

[0151] 11) After successful fingerprint verification, the authenticator searches for and confirms which user the currently verified fingerprint belongs to based on the fingerprint sets of different users it maintains.

[0152] 12) Based on the confirmed current user identity and its fingerprint set, the authenticator finds all accounts (denoted as accountID), account credentials (denoted as cred), and authentication methods (such as fingerprint recognition) associated with the current user's fingerprint set, and forms a login information list for currentUser to select.

[0153] It should be noted that if currentUser wishes to log in to another user's account on this shared device (denoted as otherUser), otherUser needs to verify their fingerprint. In this case, the authenticator displays otherUser's account, and otherUser completes the subsequent credential verification process.

[0154] 13) The currentUser selects an accountID, and the authentication method of the cred corresponding to the accountID is fingerprint recognition.

[0155] It should be noted that, in this step, users can also choose other verification methods besides fingerprints, and then perform subsequent credential verification and account login processes in accordance with the WebAuth protocol.

[0156] 14) The authenticator performs fingerprint recognition on the currentUser.

[0157] 15) The authenticator packages the following information into a data packet: challenge, user fingerprint recognition result (denoted as result), accountID for authentication, cred identifier corresponding to accountID (denoted as credID), cred authentication method, etc., to obtain a transmission data packet, and signs it with the private key corresponding to credID to generate a signature value to be verified (denoted as signature) for the transmission data packet {challenge, result, accountID, credID, cred authentication method}.

[0158] 16) The authenticator sends the data packet to be verified, {challenge, result, accountID, credID, cred authentication method, signature}, to the agent.

[0159] 17) The agent sends the data packet to be verified, {challenge, result, accountID, credID, cred authentication method, signature}, to relayParty.

[0160] Finally, relayParty verifies the received results, specifically including:

[0161] 18) relayParty checks whether the challenge in the data packet to be verified is consistent with the challenge value it sent this time:

[0162] If they match, proceed to step 19;

[0163] If there is a discrepancy, the process will be terminated.

[0164] 19) relayParty uses the credID to find the public key corresponding to the stored credID, and uses the public key to verify the signature:

[0165] If the signature verification is successful, relayParty trusts the result and determines whether to allow the user account corresponding to accountID to log in based on whether the user identity authentication is successful as shown in the result.

[0166] If the signature verification fails, relayParty will not trust the result and will take further action according to its own strategy.

[0167] In this embodiment, fingerprints are used to distinguish different users, and all of a user's accounts and credentials are associated with the user's fingerprint set. This allows for the differentiation of different users' identities and account information in scenarios where multiple individuals share a device, improving security from a data storage and processing perspective.

[0168] In this embodiment, a separate fingerprint set is established for each user, which can distinguish between a user registering multiple fingerprints and multiple users registering their own fingerprints. This avoids the risk of a natural person using their own fingerprint to log in to another natural person's account on a shared device, thus impersonating the user and illegally logging in, thereby improving the security of the solution.

[0169] In this embodiment, only all accounts under a user's name are displayed, and the account information of other users is not displayed, thereby strengthening privacy data protection and reducing the risk of user privacy data leakage.

[0170] To facilitate better implementation of the login authentication method provided in this application, this application also provides an apparatus based on the above-described login authentication method. The meanings of the terms used are the same as in the login authentication method described above, and specific implementation details can be found in the descriptions within the method embodiments.

[0171] Please see Figure 6 , Figure 6 This is a schematic diagram of the login authentication device provided in an embodiment of this application. It is applied to the authentication end of a shared device. The shared device includes a proxy end, an access end, and an authentication end. The login authentication device 600 may include a first acquisition module 601, a first verification module 602, a request receiving module 603, a second acquisition module 604, a second verification module 605, and a data packet generation module 606, wherein:

[0172] The first acquisition module 601 is used to receive and respond to the first identity authentication request of the current user in the sharing mode, and to acquire the first identity identifier of the current user;

[0173] The first verification module 602 is used to verify the first identity identifier. When the first identity identifier is successfully verified, the login information list of the current user is determined based on the first identity identifier. The login information list includes the login account, account credentials, and the verification method corresponding to the account credentials.

[0174] The request receiving module 603 is used to receive the login authentication request for the target login account sent by the current user based on the login information list;

[0175] The second acquisition module 604 is used to determine the target authentication method based on the login authentication request and obtain the second identity identifier corresponding to the target authentication method;

[0176] The second verification module 605 is used to verify the second identity identifier and obtain the verification result;

[0177] The data packet generation module 606 is used to generate and send a data packet to be verified to the agent based on the verification result. The data packet to be verified is used to instruct the access end to authenticate the login authentication request.

[0178] In this embodiment, under the sharing mode, on the one hand, when the authentication terminal receives the first identity authentication request from the current user, it verifies the obtained first identity identifier. If the verification is successful, it determines the current user's login information list based on the first identity identifier. At this time, the sharing device cannot display the login information list of other shared users to the current user, thereby reducing the risk of user login information leakage and improving the confidentiality of user login information. On the other hand, after receiving the login authentication request for the target login account issued by the current user based on the login information list, it determines the target authentication method and obtains the second identity identifier corresponding to the target authentication method. It verifies the second identity identifier and sends the verification result to the proxy terminal, so that the access terminal authenticates this login authentication request, thereby reducing the risk of user account being illegally logged in and further improving the security of the login authentication scheme.

[0179] In some embodiments of this application, the first identity identifier exists in the current user's identity identifier set. The device further includes a set creation module, which is used to: respond to a sharing start operation triggered by a device owner, start a sharing mode, wherein the device owner is the owner of the shared device determined according to preset device ownership conditions; receive an identity identifier registration request from the current user; respond to the identity identifier registration request and obtain the current user's identity registration identifier; and determine the identity identifier set corresponding to the current user based on the identity registration identifier.

[0180] In some embodiments of this application, the set creation module is specifically used to: determine whether the identity registration identifier is the first identity registration identifier of the current user; if yes, then create an identity identifier set corresponding to the current user; if no, then determine the current identity identifier set corresponding to the current user from the identity identifier library, and associate the identity registration identifier with the current identity identifier set to obtain the identity identifier set corresponding to the current user.

[0181] In some embodiments of this application, the login authentication device further includes an account association module, which is used to: send an account association prompt; receive and respond to a list triggering operation initiated by the current user based on the account association prompt, and display a list of login accounts associated with the current user; receive and respond to an association operation triggered by the current user, and associate each unassociated login information in the login account list with the identity identifier set corresponding to the current user.

[0182] In some embodiments of this application, the account association module is specifically used to: receive login information entered by the current user based on the account association prompt, wherein the login information is login information not associated in the login account list, and the login information includes a login account and account credentials; verify whether the entered account credentials are correct; if so, associate the login information with the identity identifier set corresponding to the current user.

[0183] In some embodiments of this application, the first verification module is specifically used to: verify the first identity identifier based on the identity identifier library and the first identity identifier, wherein the identity identifier library is a comprehensive library of identity identifier sets of registered users maintained by the authentication terminal; when the first identity identifier is successfully verified, determine the target identity identifier set corresponding to the current user based on the first identity identifier; determine each login account, account credentials, and verification method corresponding to the account credentials associated with the target identity identifier set, and generate a login information list for the current user.

[0184] In some embodiments of this application, the data packet generation module is specifically used for: reading the challenge value to be verified sent by the agent; determining the target account credential identifier based on the target login account; packaging the challenge value, the verification result, the target login account, the target account credential identifier, and the target authentication method to obtain a transmission data packet; signing the transmission data packet according to the private key corresponding to the target account credential identifier to obtain a signature value to be verified; and generating and sending a data packet to be verified to the agent based on the transmission data packet and the signature value to be verified.

[0185] This application also provides an electronic device, such as... Figure 7 As shown, it illustrates a structural schematic diagram of the electronic device involved in the embodiments of this application, specifically:

[0186] The electronic device may include components such as a processor 701 with one or more processing cores, a memory 702 with one or more computer-readable storage media, an input unit 703, and a power supply 704. Those skilled in the art will understand that... Figure 7 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0187] The processor 701 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 702, and by calling data stored in the memory 702, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Optionally, the processor 701 may include one or more processing cores; preferably, the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operation of the storage medium, user interface, and application programs, while the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor 701.

[0188] The memory 702 can be used to store software programs and modules. The processor 701 executes various functional applications and data processing by running the software programs and modules stored in the memory 702. The memory 702 may mainly include a program storage area and a data storage area. The program storage area may store applications required for operating the storage medium and at least one function (such as sound playback function, image playback function, etc.); the data storage area may store data created according to the use of the electronic device. In addition, the memory 702 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 702 may also include a memory controller to provide the processor 701 with access to the memory 702.

[0189] The electronic device also includes a sensing unit 703, which can be used to collect information such as the user's identity.

[0190] The electronic device also includes a power supply 704 that supplies power to various components. Preferably, the power supply 704 can be logically connected to the processor 701 via a power management storage medium, thereby enabling functions such as charging, discharging, and power consumption management through the power management storage medium. The power supply 704 may also include one or more DC or AC power supplies, recharge storage media, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0191] Although not shown, the electronic device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 701 in the electronic device loads the executable files corresponding to the processes of one or more applications into the memory 702 according to the following instructions, and the processor 701 runs the applications stored in the memory 702, thereby implementing the steps in the above-described login authentication method embodiment.

[0192] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0193] Therefore, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, the computer program being loaded by a processor to execute the steps in any of the login authentication methods provided in embodiments of this application.

[0194] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0195] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0196] Since the computer program stored in the computer-readable storage medium can execute the steps of any of the login authentication methods provided in the embodiments of this application, the beneficial effects that any of the login authentication methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0197] The above provides a detailed description of a login authentication method, apparatus, device, and storage medium provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A login authentication method, characterized in that, An authentication terminal applied to a shared device, wherein the shared device includes a proxy terminal, an access terminal, and the authentication terminal, the method comprising: In shared mode, receive and respond to the current user's first identity authentication request, and obtain the current user's first identity identifier; Verify the first identity identifier. When the first identity identifier is successfully verified, determine the current user's login information list based on the first identity identifier. The login information list includes the login account, account credentials, and the verification method corresponding to the account credentials. Receive the login authentication request for the target login account sent by the current user based on the login information list; Based on the login authentication request, determine the target authentication method and obtain the second identity identifier corresponding to the target authentication method; Verify the second identity identifier and obtain the verification result; Based on the verification result, a data packet to be verified is generated and sent to the proxy terminal. The data packet to be verified is used to instruct the access terminal to authenticate the login authentication request. The step of determining the current user's login information list based on the first identity identifier includes: searching and determining the target user corresponding to the first identity identifier in the identity identifier database, and forming the login information list based on all registered login accounts, account credentials, and verification methods corresponding to the account credentials associated with the target user's identity identifier set; the identity identifier database is a comprehensive database of identity identifier sets of various shared users.

2. The login authentication method according to claim 1, characterized in that, The first identity identifier exists in the current user's identity identifier set; Before receiving and responding to the current user's first identity authentication request and obtaining the current user's first identity identifier in the shared mode, the method further includes: In response to a sharing activation operation triggered by the device owner, the sharing mode is activated, wherein the device owner is the owner of the shared device determined according to preset device ownership conditions; Receive the current user's identity registration request; In response to the identity registration request, obtain the current user's identity registration identifier; Based on the identity registration identifier, determine the set of identity identifiers corresponding to the current user.

3. The login authentication method according to claim 2, characterized in that, The step of determining the set of identity identifiers corresponding to the current user based on the identity registration identifier includes: Determine whether the identity registration identifier is the first identity registration identifier of the current user; If so, then create the identity identifier set corresponding to the current user; If not, then determine the current identity set corresponding to the current user from the identity identifier database, and associate the identity registration identifier with the current identity set to obtain the identity set corresponding to the current user.

4. The login authentication method according to claim 2, characterized in that, After determining the set of identity identifiers corresponding to the current user based on the identity registration identifier, the method further includes: Send account association notification; Receive and respond to the list trigger operation initiated by the current user based on the account association prompt, and display a list of login accounts associated with the current user; Receive and respond to the association operation triggered by the current user, and associate each unassociated login information in the login account list with the identity identifier set corresponding to the current user.

5. The login authentication method according to claim 4, characterized in that, The step of receiving and responding to the association operation triggered by the current user, and associating each unassociated login information in the login account list with the identity identifier set corresponding to the current user, includes: Receive login information input by the current user based on the account association prompt, wherein the login information is login information not associated in the login account list, and the login information includes the login account and account credentials; Verify that the entered account credentials are correct; If so, the login information will be associated with the identity set corresponding to the current user.

6. The login authentication method according to claim 1, characterized in that, The first identity identifier is verified. When the first identity identifier is successfully verified, the login information list of the current user is determined based on the first identity identifier, including: The first identity is verified based on the identity identifier database and the first identity identifier. The identity identifier database is a comprehensive database of the identity identifiers of all registered users maintained by the authentication terminal. When the first identity identifier is successfully verified, the target identity identifier set corresponding to the current user is determined based on the first identity identifier; Determine each login account, account credentials, and verification method corresponding to the account credentials associated with the target identity set, and generate a login information list for the current user.

7. The login authentication method according to claim 1, characterized in that, The step of generating and sending a data packet to be verified to the proxy based on the verification result includes: Read the challenge value to be verified sent by the agent; Determine the target account credential identifier based on the target login account; The challenge value, the verification result, the target login account, the target account credential identifier, and the target authentication method are packaged together to obtain a transmission data packet; The transmitted data packet is signed using the private key corresponding to the target account credential identifier to obtain a signature value to be verified. Based on the transmitted data packet and the signature value to be verified, a data packet to be verified is generated and sent to the agent.

8. A login authentication device, characterized in that, An authentication terminal for a shared device, wherein the shared device includes a proxy terminal, an access terminal, and the authentication terminal, and the device includes: The first acquisition module is used to receive and respond to the first identity authentication request of the current user in the sharing mode, and to acquire the first identity identifier of the current user; The first verification module is used to verify the first identity identifier. When the first identity identifier is successfully verified, the module determines the login information list of the current user based on the first identity identifier. The login information list includes the login account, account credentials, and the verification method corresponding to the account credentials. The request receiving module is used to receive the login authentication request for the target login account sent by the current user based on the login information list; The second acquisition module is used to determine the target authentication method based on the login authentication request, and to acquire the second identity identifier corresponding to the target authentication method; The second verification module is used to verify the second identity identifier and obtain the verification result; The data packet generation module is used to generate and send a data packet to be verified to the proxy terminal based on the verification result. The data packet to be verified is used to instruct the access terminal to authenticate the login authentication request. The step of determining the current user's login information list based on the first identity identifier includes: searching and determining the target user corresponding to the first identity identifier in the identity identifier database, and forming the login information list based on all registered login accounts, account credentials, and verification methods corresponding to the account credentials associated with the target user's identity identifier set; the identity identifier database is a comprehensive database of identity identifier sets of various shared users.

9. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the login authentication method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores a computer program, which is loaded by a processor to perform the steps of the login authentication method according to any one of claims 1 to 7.

Images