Information authentication method, device, equipment, medium and program product

Abstract

The present disclosure provides an information authentication method, device, equipment, medium and program product, which can be applied to the technical field of information processing and financial technology. The method is applied to a server and includes: in response to receiving an authentication request about a target service from a target object on a client, sending identification information corresponding to the target service and a public key for encryption to the client; receiving encrypted information about the target service from the client, wherein the encrypted information is obtained by encrypting binding information by the client using the public key, the binding information is obtained according to the identification information and object information of the target object, and the object information is obtained by authorization of the target object; decrypting the encrypted information by using a private key to obtain decrypted information, wherein the private key corresponds to the public key; and determining an authentication result of the authentication request according to the decrypted information and initial information corresponding to the target object.

Description

Technical Field

[0001] This disclosure relates to the fields of information processing technology and financial technology, and specifically to an information authentication method, apparatus, device, medium, and program product. Background Technology

[0002] With the development of technology, various network services have emerged. When users use these services, they often need to complete some information authentication before they can use them. For example, some network services require users to log in for authentication.

[0003] In realizing the concept disclosed herein, the inventors discovered at least the following problems in the related technologies: the information authentication methods in the related technologies are simple and easily lead to security problems with user information. Summary of the Invention

[0004] In view of the above problems, this disclosure provides an information authentication method, apparatus, device, medium and program product.

[0005] According to the first aspect of this disclosure, an information authentication method is provided, applied to a server, the method comprising:

[0006] In response to receiving an authentication request from the target object on the client regarding the target service, the system sends the identification information corresponding to the target service and the public key used for encryption to the client.

[0007] Receive encrypted information from the aforementioned client regarding the aforementioned target service, wherein the encrypted information is obtained by the aforementioned client encrypting the binding information using the aforementioned public key, the binding information is obtained based on the aforementioned identification information and the object information of the aforementioned target object, and the object information is obtained with authorization from the aforementioned target object;

[0008] The encrypted information is decrypted using the private key to obtain the decrypted information, wherein the private key corresponds to the public key; and

[0009] Based on the decrypted information and the initial information corresponding to the target object, the authentication result of the authentication request is determined.

[0010] According to embodiments of this disclosure, determining the authentication result of the authentication request based on the decrypted information and the initial information corresponding to the target object includes:

[0011] If it is determined that the above decryption information is consistent with the initial information corresponding to the above target object, obtain the count value related to the above initial information;

[0012] If the above count value is determined to meet the preset conditions, the authentication result of the above authentication request is determined to represent that the authentication request has been successfully authenticated;

[0013] If the above count value does not meet the preset conditions, the authentication result of the above authentication request is determined to indicate that the authentication request failed; and

[0014] If the decrypted information and the initial information corresponding to the target object are inconsistent, the authentication result of the authentication request indicates that the authentication request has failed.

[0015] According to embodiments of this disclosure, the above method further includes:

[0016] In response to receiving an initial authentication request from the target object on the client regarding the target service, the identification information and the public key are sent to the client.

[0017] Receive initial encrypted information from the aforementioned client regarding the aforementioned target service, wherein the initial encrypted information is obtained by the aforementioned client encrypting the initial binding information using the aforementioned public key, and the initial binding information is obtained based on the aforementioned identification information and the aforementioned object information;

[0018] Decrypt the initial encrypted information using the private key to obtain the initial information; and

[0019] Store the above initial information.

[0020] According to embodiments of this disclosure, the above method further includes:

[0021] The above-mentioned determination, based on the premise that the count value meets the preset conditions, indicates that the authentication result of the authentication request represents the successful authentication of the authentication request; and

[0022] Update the above count values.

[0023] According to embodiments of this disclosure, the above method further includes:

[0024] The aforementioned private key and count value are generated in the target computing environment, which is built based on trusted computing technology.

[0025] A second aspect of this disclosure provides an information authentication method applied to a client, the method comprising:

[0026] Send an authentication request for the target service to the server;

[0027] Receive the identification information corresponding to the target service and the public key used for encryption from the server;

[0028] Based on the above identification information and the object information of the target object, binding information is obtained, wherein the above object information is obtained with the authorization of the above target object;

[0029] The encrypted information is obtained by encrypting the binding information using the aforementioned public key; and

[0030] The encrypted information is sent to the server so that the server can decrypt the encrypted information using its private key to obtain the decrypted information. Based on the decrypted information and the initial information corresponding to the target object, the server determines the authentication result of the authentication request. The private key corresponds to the public key.

[0031] According to embodiments of this disclosure, obtaining binding information based on the aforementioned identification information and object information of the target object includes:

[0032] The binding information is obtained by mapping the above-mentioned identification information and the above-mentioned object information of the target object using a one-way mapping function.

[0033] A third aspect of this disclosure provides an information authentication device applied to a server, the device comprising:

[0034] The first sending module is used to send identification information corresponding to the target service and a public key for encryption to the client in response to receiving an authentication request from the target object on the client regarding the target service.

[0035] The first receiving module is used to receive encrypted information about the target service from the client, wherein the encrypted information is obtained by the client encrypting the binding information using the public key, the binding information is obtained based on the identification information and the object information of the target object, and the object information is obtained after authorization by the target object.

[0036] The first module is used to decrypt the encrypted information using a private key to obtain decrypted information, wherein the private key corresponds to the public key; and

[0037] The first determining module is used to determine the authentication result of the above authentication request based on the above decryption information and the initial information corresponding to the above target object.

[0038] A fourth aspect of this disclosure provides an information authentication device applied to a client, the device comprising:

[0039] The second sending module is used to send an authentication request for the target service to the server.

[0040] The second receiving module is used to receive the identification information corresponding to the target service and the public key used for encryption from the server.

[0041] The second obtaining module is used to obtain binding information based on the above-mentioned identification information and the object information of the target object, wherein the above-mentioned object information is obtained through authorization of the above-mentioned target object;

[0042] The third module is used to encrypt the binding information using the public key to obtain encrypted information; and

[0043] The fourth module is used to send the encrypted information to the server so that the server can decrypt the encrypted information using the private key to obtain decrypted information, and determine the authentication result of the authentication request based on the decrypted information and the initial information corresponding to the target object, wherein the private key corresponds to the public key.

[0044] A fifth aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0045] A sixth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0046] The seventh aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0047] According to the information authentication method, apparatus, device, medium, and program products provided in this disclosure, since the encrypted information is obtained by encrypting the binding information with a public key, and the binding information is obtained based on the identification information of the target service and the object information of the target object, the encrypted information received by the server contains both the identification information of the target service and the object information of the target object. Compared with sending only the object information of the target object to the server, the encrypted information in the method of this disclosure cannot be universal across different target services. Furthermore, after the object information of the target object and the identification information of the target service are combined, the target object does not need to remember different object information for different target services, reducing the memory difficulty of the target object. In addition, the embodiments of this disclosure improve the security of the authentication process by using paired public and private keys for encryption and decryption. Attached Figure Description

[0048] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0049] Figure 1 The illustrations depict application scenarios of information authentication methods, apparatuses, devices, media, and program products according to embodiments of this disclosure.

[0050] Figure 2 A flowchart illustrating an information authentication method applied to a server according to an embodiment of this disclosure is shown schematically.

[0051] Figure 3 A flowchart illustrating an information authentication method applied to a client according to an embodiment of the present disclosure is shown schematically;

[0052] Figure 4 A flowchart illustrating the application framework of the information authentication method according to an embodiment of the present disclosure is shown schematically.

[0053] Figure 5 This schematically illustrates a structural block diagram of information authentication applied to a server according to an embodiment of the present disclosure;

[0054] Figure 6 This schematically illustrates a structural block diagram of an information authentication device applied to a client according to an embodiment of the present disclosure; and

[0055] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing an information processing method according to an embodiment of the present disclosure. Detailed Implementation

[0056] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0057] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0058] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0059] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0060] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0061] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this disclosure all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0062] The internet provides a wide variety of services, and users need to perform authentication when using these services. For example, when logging into an account on a network service, a user enters a password for authentication. This password needs to be remembered by the user, serving as proof of identity. The network service records the user's password. During authentication, the user presents the password to the network service to prove their identity, and the network service verifies the correctness of the password to complete the authentication. To make them easy to remember, user credentials are usually simple or predictable, such as birthdays, the last few digits of a phone number, or initials of a name. Because these passwords are too simple and predictable, they pose security risks. Furthermore, users often use the same password on multiple network services, which means that if the password stored on one network service is leaked, it can trigger authentication security issues in many other services.

[0063] The solution in related technologies often involves introducing and combining more authentication methods, such as SMS verification codes. This approach is also known as multi-factor authentication. While multi-factor authentication can improve security, its implementation requires more resources, such as sending SMS messages and collecting and comparing fingerprints. Furthermore, multi-factor authentication only adds an authentication method without addressing the inherent security issues of password authentication itself.

[0064] In view of this, embodiments of the present disclosure provide an information authentication method applied to a server, comprising: responding to receiving an authentication request from a target object on a client regarding a target service, sending identification information corresponding to the target service and a public key for encryption to the client; receiving encrypted information from the client regarding the target service, wherein the encrypted information is obtained by the client encrypting binding information using the public key, the binding information is obtained based on the identification information and object information of the target object, and the object information is obtained after authorization by the target object; decrypting the encrypted information using a private key to obtain decrypted information, wherein the private key corresponds to the public key; and determining the authentication result of the authentication request based on the decrypted information and initial information corresponding to the target object.

[0065] Figure 1 The illustrations depict application scenarios of information authentication methods, apparatuses, devices, media, and program products according to embodiments of the present disclosure.

[0066] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0067] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0068] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0069] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0070] It should be noted that the information authentication method applied to the server side provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the information authentication device applied to the server side provided in this disclosure embodiment can generally be located in server 105. The information authentication method applied to the server side provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the information authentication device applied to the server side provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0071] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0072] Figure 2 A flowchart illustrating an information authentication method applied to a server according to an embodiment of this disclosure is shown schematically.

[0073] like Figure 2 As shown, the information authentication method of this embodiment is applied to the server and includes operations S210 to S240.

[0074] In operation S210, in response to receiving an authentication request from the target object on the client regarding the target service, the system sends the identification information corresponding to the target service and the public key used for encryption to the client.

[0075] During operation S220, encrypted information about the target service is received from the client. The encrypted information is obtained by the client encrypting the binding information using a public key. The binding information is obtained based on the identification information and the object information of the target object. The object information is obtained after authorization by the target object.

[0076] In operation S230, the encrypted information is decrypted using the private key to obtain the decrypted information. The private key corresponds to the public key.

[0077] In operation S240, the authentication result of the authentication request is determined based on the decrypted information and the initial information corresponding to the target object.

[0078] According to embodiments of this disclosure, the target service may be a service provided by a server, such as a product query service, a forum communication service, etc.

[0079] According to embodiments of this disclosure, a target object can initiate an authentication request for a target service on a client. When a target object initiates an authentication request for a target service on a client, the server can authenticate the target object. The client can have a front-end page related to the target service, and the target user can log in and initiate an authentication request on the front-end page.

[0080] According to embodiments of this disclosure, the identification information corresponding to the target service may be the address information, identification information, etc. of the server. The identification information corresponding to the target service can identify the target service, and the identification information may be unique.

[0081] According to embodiments of this disclosure, when the server receives an authentication request from the target object, it can send identification information corresponding to the target service and a public key for encryption to the client.

[0082] According to embodiments of this disclosure, the object information may be the login name and login password of the target object in the target service when requesting the target service, and the login password may be password information recorded by the target object itself.

[0083] According to embodiments of this disclosure, the target object's consent or authorization can be obtained before acquiring the target object's object information. For example, before operating S220, a request to acquire object information can be sent to the target object. If the target object consents or authorizes the acquisition of object information, binding information is obtained based on the identification information and the target object's object information.

[0084] According to embodiments of this disclosure, the binding information can be obtained by binding the identification information corresponding to the target service and the object information of the target object. The identification information corresponding to the target service and the object information of the target object can be mapped using function mapping.

[0085] According to embodiments of this disclosure, a public key is a key used in an asymmetric encryption system that can be securely and widely distributed. The public key can be used to encrypt data and verify digital signatures. During encryption, the public key is used to encrypt information, and only the corresponding private key can decrypt it. The public key is designed to be publicly shared and is typically distributed in the form of digital certificates. The private key, which appears in pair with the public key, should be kept strictly confidential. The private key can be used to decrypt data encrypted with the public key and generate digital signatures. In the context of digital signatures, the private key is used to generate the signature, while the public key is used to verify the signature. The confidentiality of the private key is crucial to the security of the entire encryption system.

[0086] According to embodiments of this disclosure, public and private keys, as the core of asymmetric encryption technology, provide a secure way to encrypt information and ensure information security.

[0087] According to embodiments of this disclosure, encrypted information is decrypted using a private key, and the decrypted information obtained can be information corresponding to the binding information.

[0088] According to embodiments of this disclosure, the initial information corresponding to the target object may be pre-generated information.

[0089] According to embodiments of this disclosure, decrypted information and initial information corresponding to the target object can be compared, and the authentication result of the authentication request can be determined based on the comparison result. If the comparison result indicates that the decrypted information and the initial information corresponding to the target object are the same, the authentication result of the authentication request can be determined to be successful. If the comparison result indicates that the decrypted information and the initial information corresponding to the target object are different, the authentication result of the authentication request can be determined to be unsuccessful.

[0090] According to the embodiments of this disclosure, since the encrypted information is obtained by encrypting the binding information with a public key, and the binding information is obtained based on the identification information of the target service and the object information of the target object, the encrypted information received by the server contains both the identification information of the target service and the object information of the target object. Compared with sending only the object information of the target object to the server, the encrypted information in the method of this disclosure cannot be universal across different target services. Furthermore, after the object information of the target object and the identification information of the target service are combined, the target object does not need to remember different object information for different target services, which reduces the memory difficulty of the target object. In addition, the embodiments of this disclosure improve the security of the authentication process by using paired public and private keys for encryption and decryption.

[0091] According to embodiments of this disclosure, determining the authentication result of an authentication request based on decrypted information and initial information corresponding to the target object includes: if the decrypted information and the initial information corresponding to the target object are consistent, obtaining a count value related to the initial information; if the count value meets a preset condition, determining that the authentication result of the authentication request indicates that the authentication request has passed; if the count value does not meet the preset condition, determining that the authentication result of the authentication request indicates that the authentication request has failed; and if the decrypted information and the initial information corresponding to the target object are inconsistent, determining that the authentication result of the authentication request indicates that the authentication request has failed.

[0092] According to embodiments of this disclosure, the information authentication method may further include: determining that the authentication result of the authentication request represents the successful authentication of the authentication request when the count value meets preset conditions; and updating the count value.

[0093] According to embodiments of this disclosure, the count value can represent the remaining number of times the initial information can be used. For example, the count value can be 30, indicating that the target object's authentication is successful if the initial information and the decrypted information are consistent.

[0094] According to embodiments of this disclosure, the preset condition can be a count value equal to zero. When the count value is zero, meaning the initial information has reached its maximum number of authentication attempts, the authentication request will fail.

[0095] According to embodiments of this disclosure, by setting a counter value, excessive initial information authentication can be avoided, thus preventing leakage and improving information security.

[0096] According to embodiments of this disclosure, the information authentication method may further include: in response to receiving an initial authentication request from a target object on a client regarding a target service, sending identification information and a public key to the client; receiving initial encrypted information from the client regarding the target service, wherein the initial encrypted information is obtained by the client encrypting initial binding information using the public key, and the initial binding information is obtained based on the identification information and object information; decrypting the initial encrypted information using a private key to obtain initial information; and storing the initial information.

[0097] According to embodiments of this disclosure, the initial information may be obtained when the target object first requests the target service.

[0098] According to embodiments of this disclosure, the process of obtaining initial information is similar to that of obtaining decryption information. It also requires first binding the initial binding information based on the identifier and object information, then encrypting the initial binding information using the public key to obtain initial encrypted information. The server then receives the initial encrypted information and decrypts it using the private key to obtain the initial information, which is then stored on the server. A counter value for the initial information can also be set during storage.

[0099] According to embodiments of this disclosure, by pre-generating and storing initial information, it is possible to complete the authentication request using the initial information when the target object initiates an authentication request again. Furthermore, the stored initial information is processed rather than information directly memorized by the target object, which can improve information security.

[0100] According to embodiments of this disclosure, the information authentication method may further include: generating a private key and a counter value in a target computing environment, wherein the target computing environment is built based on trusted computing technology.

[0101] According to embodiments of this disclosure, the target computing environment can be built using trusted computing technology, which can be a technology that provides hardware-based security protection. For example, trusted computing technology can be based on a Trusted Platform Module (TPM) or a Trusted Cryptography Module (TCM).

[0102] According to embodiments of this disclosure, a private key and a counter value are stored in a trusted computing environment to ensure that they are not used maliciously. For example, if a server is maliciously compromised, the attacker will not be able to obtain the private key.

[0103] According to embodiments of this disclosure, trusted computing technology further enhances the security of the information authentication method of this disclosure.

[0104] Figure 3 A flowchart illustrating an information authentication method applied to a client according to an embodiment of this disclosure is shown schematically.

[0105] like Figure 3 As shown, the information authentication method of this embodiment is applied to the client and includes operations S310 to S350.

[0106] When operating S310, an authentication request for the target service is sent to the server.

[0107] During operation S320, the system receives identification information corresponding to the target service and a public key for encryption from the server.

[0108] In operation S330, binding information is obtained based on the identification information and the object information of the target object. The object information is obtained after authorization by the target object.

[0109] When operating the S340, the public key is used to encrypt the binding information to obtain encrypted information.

[0110] When operating the S350, encrypted information is sent to the server so that the server can decrypt the encrypted information using the private key, obtain the decrypted information, and determine the authentication result of the authentication request based on the decrypted information and the initial information corresponding to the target object. The private key corresponds to the public key.

[0111] According to embodiments of this disclosure, the client may have a display interface related to the target service, and the target object may perform authentication request-related operations in the display interface to send an authentication request for the target service to the server.

[0112] According to embodiments of this disclosure, identification information and object information of a target object can be bound together to obtain binding information, enabling the object information of the target object to establish a connection with the target service.

[0113] According to embodiments of this disclosure, public and private keys, as the core of asymmetric encryption technology, provide a secure way to encrypt information and ensure information security.

[0114] According to the embodiments of this disclosure, since the encrypted information is obtained by encrypting the binding information with a public key, and the binding information is obtained based on the identification information of the target service and the object information of the target object, the encrypted information received by the server contains both the identification information of the target service and the object information of the target object. Compared with sending only the object information of the target object to the server, the encrypted information in the method of this disclosure cannot be universal across different target services. Furthermore, after the object information of the target object and the identification information of the target service are combined, the target object does not need to remember different object information for different target services, which reduces the memory difficulty of the target object. In addition, the embodiments of this disclosure improve the security of the authentication process by using paired public and private keys for encryption and decryption.

[0115] According to embodiments of this disclosure, binding information is obtained based on identification information and object information of the target object, including: mapping the identification information and object information of the target object using a one-way mapping function to obtain binding information.

[0116] According to embodiments of this disclosure, for any x in the domain of the one-way mapping function f, f(x) = y can be computed in polynomial time, while for any y in the range of f, x = f cannot be computed in polynomial time. -1(y). Therefore, by using a one-way mapping function to map the identification information and the object information of the target object to obtain the binding information, the binding information can be prevented from being reverse-calculated and thus leaking the object information and identification information of the target object.

[0117] Figure 4 A flowchart illustrating the application framework of the information authentication method according to an embodiment of the present disclosure is shown.

[0118] like Figure 4 As shown, the application framework 400 of the information authentication method includes a server 410 and a client 420. The server 410 is equipped with an authentication module 411 and a trusted computing chip 412.

[0119] According to embodiments of this disclosure, server 410 can generate a private key using trusted computing chip 412.

[0120] Taking password authentication as an example, when the target object initiates an authentication request for the first time through client 420, server 410 sends identification information A and public key PK to client 420. Client 420 performs a one-way mapping function H on the target object's object information C (which may include the password information remembered by the target object) and identification information A to generate initial binding information H(C|A) for the target service, where | indicates concatenation. The initial binding information is then encrypted using public key PK to obtain initial encrypted information PK(H(C|A)), which is sent to server 410. Server 410 decrypts the initial encrypted information using private key SK to obtain the initial information, i.e., H(C|A) = SK(PK(H(C|A))), and stores H(C|A) on server 410. Optionally, a trusted monotonic counter is bound to this initial information to record the remaining usage count, i.e., Sig(H(C|A), count). Here, Sig represents the signature, and count is the current value of the trusted counter.

[0121] If the target object initiates a password authentication request again through client 420, server 410 sends the identification information A and public key PK to client 420. Client 420 performs a one-way mapping function H to map the target object's object information C and identification information A, generating the target service's binding information H*(C|A). It then encrypts the binding information using the public key PK to obtain encrypted information PK(H*(C|A)) and sends it to server 410. Server 410 decrypts the encrypted information using the private key SK, obtaining the decrypted information, i.e., H*(C|A) = SK(PK(H(C|A))). Server 410 compares the decrypted H*(C|A) with its initial information H(C|A) stored on the server. If they match, authentication is successful; otherwise, authentication fails. Since server 410 limits the number of times the initial information can be used, after the comparison between the initial information and the decrypted information is successful, it needs to read the bound monotonic counter value count and check if count is 0. If count is 0, authentication fails; otherwise, authentication succeeds, and the count value is decremented by 1. The trusted computing environment then signs a new Sig(H(C|A),new_count) and stores it on the server.

[0122] For example, the target service on the server side could be a fund website A, whose identifier is TTJJ. When user B logs into website A, website A sends the public key PK and TTJJ to user B, who then returns PK(H(C|TTJJ)). Another example is a financial forum website, www.aaaaa.com. When user B logs into www.aaaaa.com, the forum's server sends its PK and www.aaaaa.com to user B. User B still uses their memorized password C, but the user sends PK(H(C|www.aaaaa.com)) to the server. As you can see, user B has no memory burden; they are still using their memorized password C. However, an attacker who has compromised TTJJ's backend database can only obtain H(C|TTJJ). Due to the one-way nature of hash functions, the attacker cannot calculate H(C|www.aaaaa.com). Therefore, even though user B uses the same password C across different websites, the security of different online services is isolated, and the security risks of one website will not affect other websites. At the same time, users do not need to remember many different complex passwords for different websites.

[0123] According to embodiments of this disclosure, users only need to remember one password, instead of multiple passwords. Furthermore, the password is bound to different target services, and can even be bound to more granular network service functions. Passwords are not interchangeable between different network services or network service functions, avoiding the harm to other network services caused by password leaks due to security vulnerabilities in a single network service. Thus, it simultaneously possesses ease of use and security. It can also support password usage limits, and because the trusted monotonic counter is a tamper-proof counter that can only monotonically increase within the storage area of ​​a trusted computing environment, its security is higher, capable of preventing attackers from attacking the password.

[0124] Based on the aforementioned information authentication method applied to the server, this disclosure also provides an information authentication device applied to the server. The following will be combined with... Figure 5 The device is described in detail.

[0125] Figure 5 The diagram illustrates a structural block diagram of information authentication applied to a server according to an embodiment of the present disclosure.

[0126] like Figure 5 As shown, the information authentication device 500 of this embodiment is applied to the server and includes a first sending module 510, a first receiving module 520, a first obtaining module 530 and a first determining module 540.

[0127] The first sending module 510 is configured to, in response to receiving an authentication request from the target object on the client regarding the target service, send identification information corresponding to the target service and a public key for encryption to the client. In one embodiment, the first sending module 510 may be used to perform the operation S210 described above, which will not be repeated here.

[0128] The first receiving module 520 is used to receive encrypted information about the target service from the client. The encrypted information is obtained by the client encrypting binding information using a public key. The binding information is obtained based on the identification information and the object information of the target object, and the object information is obtained after authorization by the target object. In one embodiment, the first receiving module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0129] The first obtaining module 530 is used to decrypt the encrypted information using the private key to obtain decrypted information, wherein the private key corresponds to the public key. In one embodiment, the first obtaining module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0130] The first determining module 540 is used to determine the authentication result of the authentication request based on the decrypted information and the initial information corresponding to the target object. In one embodiment, the first determining module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0131] According to embodiments of this disclosure, a first determining module 540 for determining the authentication result of an authentication request based on decrypted information and initial information corresponding to a target object includes:

[0132] The first determining unit is used to obtain a count value related to the initial information when it is determined that the decrypted information and the initial information corresponding to the target object are consistent.

[0133] The second determining unit is used to determine, when the determined count value meets the preset conditions, the authentication result of the authentication request represents the successful authentication of the authentication request;

[0134] The third determining unit is used to determine, when the determination count value does not meet a preset condition, that the authentication result of the authentication request indicates that the authentication request has failed; and

[0135] The fourth determining unit is used to determine, when the decrypted information and the initial information corresponding to the target object are inconsistent, that the authentication result of the authentication request indicates that the authentication request has failed.

[0136] According to embodiments of this disclosure, the information authentication device 500 further includes:

[0137] The third sending module is used to send identification information and public key to the client in response to receiving an initial authentication request from the target object on the client regarding the target service;

[0138] The third receiving module is used to receive initial encrypted information about the target service from the client. The initial encrypted information is obtained by the client encrypting the initial binding information using a public key. The initial binding information is obtained based on the identification information and the object information.

[0139] The fifth module is used to decrypt the initial encrypted information using the private key to obtain the initial information; and

[0140] The storage module is used to store initial information.

[0141] According to embodiments of this disclosure, the information authentication device 500 further includes:

[0142] The second determining module is used to determine, when the determined count value meets preset conditions, the authentication result of the authentication request, representing the successful authentication of the authentication request; and

[0143] The update module is used to update the count value.

[0144] According to embodiments of this disclosure, the information authentication device 500 further includes:

[0145] The generation module is used to generate a private key and a counter value in the target computing environment, which is built based on trusted computing technology.

[0146] According to embodiments of this disclosure, any plurality of modules among the first transmitting module 510, the first receiving module 520, the first obtaining module 530, and the first determining module 540 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the first transmitting module 510, the first receiving module 520, the first obtaining module 530, and the first determining module 540 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the first sending module 510, the first receiving module 520, the first obtaining module 530, and the first determining module 540 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0147] Based on the aforementioned information authentication method applied to clients, this disclosure also provides an information authentication device applied to clients. The following will be combined with... Figure 6 The device is described in detail.

[0148] Figure 6 The diagram illustrates a structural block diagram of an information authentication device applied to a client according to an embodiment of the present disclosure.

[0149] like Figure 6 As shown, the client device 600 of this embodiment is applied to a client and includes a second sending module 610, a second receiving module 620, a second obtaining module 630, a third obtaining module 640 and a fourth obtaining module 650.

[0150] The second sending module 610 is used to send an authentication request for the target service to the server. In one embodiment, the second sending module 610 can be used to perform the operation S310 described above, which will not be repeated here.

[0151] The second receiving module 620 is used to receive identification information corresponding to the target service and a public key for encryption from the server. In one embodiment, the second receiving module 620 can be used to perform the operation S320 described above, which will not be repeated here.

[0152] The second obtaining module 630 is used to obtain binding information based on the identification information and the object information of the target object, wherein the object information is obtained after authorization by the target object. In one embodiment, the second obtaining module 630 can be used to perform the operation S330 described above, which will not be repeated here.

[0153] The third obtaining module 640 is used to encrypt the binding information using the public key to obtain encrypted information. In one embodiment, the third obtaining module 640 can be used to perform the operation S340 described above, which will not be repeated here.

[0154] The fourth obtaining module 650 is used to send encrypted information to the server so that the server can decrypt the encrypted information using the private key to obtain decrypted information. Based on the decrypted information and the initial information corresponding to the target object, the server determines the authentication result of the authentication request, wherein the private key and the public key correspond. In one embodiment, the fourth obtaining module 650 can be used to perform the operation S350 described above, which will not be repeated here.

[0155] According to embodiments of this disclosure, a second obtaining module 630 for obtaining binding information based on identification information and object information of a target object includes:

[0156] The first obtaining unit is used to map the identification information and the object information of the target object using a one-way mapping function to obtain the binding information.

[0157] According to embodiments of this disclosure, any plurality of modules among the second transmitting module 610, the second receiving module 620, the second obtaining module 630, the third obtaining module 640, and the fourth obtaining module 650 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the second transmitting module 610, the second receiving module 620, the second obtaining module 630, the third obtaining module 640, and the fourth obtaining module 650 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging the circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the second sending module 610, the second receiving module 620, the second obtaining module 630, the third obtaining module 640, and the fourth obtaining module 650 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0158] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing an information processing method according to an embodiment of the present disclosure.

[0159] like Figure 7 As shown, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. The processor 701 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0160] RAM 703 stores various programs and data required for the operation of electronic device 700. Processor 701, ROM 702, and RAM 703 are interconnected via bus 704. Processor 701 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than ROM 702 and RAM 703. Processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0161] According to embodiments of this disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0162] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0163] According to embodiments of this disclosure, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 702 and / or RAM 703 and / or one or more memories other than ROM 702 and RAM 703 described above.

[0164] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0165] When the computer program is executed by the processor 701, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0166] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0167] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the processor 701, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0168] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0169] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0170] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0171] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. An information authentication method, applied to a server, characterized in that, The method includes: In response to receiving an authentication request from the target object on the client regarding the target service, the system sends identification information corresponding to the target service and a public key for encryption to the client, wherein the identification information is used to identify the target service and is unique; The system receives encrypted information from the client regarding the target service, wherein the encrypted information is obtained by the client encrypting binding information using the public key, the binding information is obtained by mapping the identification information and the object information of the target object using a one-way mapping function, and the object information is obtained after authorization by the target object; The encrypted information is decrypted using the private key to obtain decrypted information, wherein the private key corresponds to the public key; and Based on the decryption information and the initial information corresponding to the target object, the authentication result of the authentication request is determined; In response to receiving an initial authentication request from the target object on the client regarding the target service, the identification information and the public key are sent to the client; Receive initial encrypted information from the client regarding the target service, wherein the initial encrypted information is obtained by the client encrypting initial binding information using the public key, and the initial binding information is obtained based on the identification information and the object information; The initial encrypted information is decrypted using the private key to obtain the initial information; and Store the initial information.

2. The method according to claim 1, characterized in that, Determining the authentication result of the authentication request based on the decryption information and the initial information corresponding to the target object includes: If it is determined that the decrypted information and the initial information corresponding to the target object are consistent, a count value related to the initial information is obtained; If the count value meets the preset conditions, the authentication result of the authentication request is determined to represent that the authentication request has been successfully authenticated; If the count value does not meet the preset conditions, the authentication result of the authentication request is determined to indicate that the authentication request failed; and If it is determined that the decryption information and the initial information corresponding to the target object are inconsistent, the authentication result of the authentication request indicates that the authentication request has failed.

3. The method according to any one of claims 1 to 2, characterized in that, The method further includes: The step of determining that the authentication result of the authentication request represents the successful authentication of the authentication request when the count value meets a preset condition; and Update the count value.

4. The method according to any one of claims 1 to 2, characterized in that, The method further includes: The private key and the count value are generated in the target computing environment, wherein the target computing environment is built based on trusted computing technology.

5. An information authentication method applied to a client, characterized in that, The method includes: Send an authentication request for the target service to the server; Receive from the server an identification information corresponding to the target service and a public key for encryption, wherein the identification information is used to identify the target service and is unique; A one-way mapping function is used to map the identification information and the object information of the target object to obtain binding information, wherein the object information is obtained through authorization of the target object; The binding information is encrypted using the public key to obtain encrypted information; and The encrypted information is sent to the server so that the server can decrypt the encrypted information using its private key to obtain decrypted information. Based on the decrypted information and initial information corresponding to the target object, the server determines the authentication result of the authentication request. The private key corresponds to the public key. The initial information is obtained by the server through the following operations: in response to receiving an initial authentication request from the target object on the client regarding the target service, the server sends the identification information and the public key to the client; receives initial encrypted information from the client regarding the target service, wherein the initial encrypted information is obtained by the client encrypting initial binding information using the public key, and the initial binding information is obtained based on the identification information and the object information; decrypts the initial encrypted information using the private key to obtain the initial information; and stores the initial information.

6. An information authentication device, applied to a server, characterized in that, The device includes: The first sending module is configured to, in response to receiving an authentication request from the target object on the client regarding the target service, send to the client identification information corresponding to the target service and a public key for encryption, wherein the identification information is used to identify the target service and the identification information is unique; The first receiving module is configured to receive encrypted information about the target service from the client, wherein the encrypted information is obtained by the client encrypting binding information using the public key, the binding information is obtained by mapping the identification information and the object information of the target object using a one-way mapping function, and the object information is obtained after authorization by the target object; The first obtaining module is used to decrypt the encrypted information using a private key to obtain decrypted information, wherein the private key corresponds to the public key; and The first determining module is used to determine the authentication result of the authentication request based on the decryption information and the initial information corresponding to the target object; The third sending module is configured to, in response to receiving an initial authentication request from the target object on the client regarding the target service, send the identification information and the public key to the client; The third receiving module is used to receive initial encrypted information about the target service from the client, wherein the initial encrypted information is obtained by the client encrypting initial binding information using the public key, and the initial binding information is obtained based on the identification information and the object information; The fifth module is used to decrypt the initial encrypted information using a private key to obtain the initial information; and A storage module is used to store the initial information.

7. An information authentication device, applied to a client, characterized in that, The device includes: The second sending module is used to send an authentication request for the target service to the server. The second receiving module is used to receive identification information corresponding to the target service and a public key for encryption from the server, wherein the identification information is used to identify the target service and the identification information is unique; The second obtaining module is used to obtain binding information based on the identification information and the object information of the target object, wherein the object information is obtained through authorization of the target object; The third module is used to encrypt the binding information using the public key to obtain encrypted information; and The fourth module is used to send the encrypted information to the server, so that the server can decrypt the encrypted information using its private key to obtain decrypted information, and determine the authentication result of the authentication request based on the decrypted information and the initial information corresponding to the target object. The private key corresponds to the public key, and the initial information is obtained by the server through the following operations: in response to receiving an initial authentication request from the target object on the client regarding the target service, the server sends the identification information and the public key to the client; receives the initial encrypted information from the client regarding the target service, wherein the initial encrypted information is obtained by the client encrypting initial binding information using the public key, and the initial binding information is obtained based on the identification information and the object information; decrypts the initial encrypted information using the private key to obtain the initial information; and stores the initial information. The second obtaining module includes: The first obtaining unit is used to map the identification information and the object information of the target object using a one-way mapping function to obtain the binding information.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 5.

Images