Offline authentication method, system, apparatus, device, and computer program product

Abstract

The application provides an offline authentication method, system, device, equipment and computer program product. The method comprises the following steps: obtaining ciphertext corresponding to a mobile user directory number of a user equipment displayed by a business system; decrypting the ciphertext by using a user identification card key to obtain a first random code and a second random code; the first random code is generated by the business system in an offline registration stage, and the second random code is generated by an operator management platform in the offline registration stage; calling a preset user identification card authentication algorithm by using the user identification card key, taking the second random code as a challenge input, calculating a response output, and obtaining a response result; obtaining a hash result by using the response result, the first random code and the second random code and based on a preset hash algorithm; and displaying the hash result. The whole process does not require the user to input authentication information, the process is simple, and there is no problem of authentication information leakage.

Description

Technical Field

[0001] This application belongs to the field of artificial intelligence technology, specifically relating to an offline authentication method, system, device, equipment, and computer program product. Background Technology

[0002] In related technologies, in offline identity authentication schemes, users need to enter authentication information (key, password, biometrics, etc.) into a business system in advance. When authenticating the user, the authentication information entered by the user in real time is compared with the authentication information entered by the user. If the comparison is consistent, the authentication is considered successful, and a temporary session token for the user is generated. This temporary session token is used as authentication information in subsequent offline sessions.

[0003] However, having users enter their own authentication information is not only cumbersome, but also poses a risk of information leakage. Summary of the Invention

[0004] This application proposes an offline authentication method, system, device, equipment, and computer program product, which can alleviate the problem of users having to enter their own authentication information in related technologies, which is not only cumbersome to operate, but also prone to leakage of authentication information.

[0005] A first aspect of this application provides an offline authentication method applied to a user equipment, the method comprising:

[0006] Obtain the encrypted text displayed by the business system that corresponds to the mobile user number in the user's device's phone book;

[0007] The ciphertext is decrypted using the user identification card key pair to obtain a first random code and a second random code; the first random code is generated by the business system during the offline registration phase, and the second random code is generated by the operator management platform during the offline registration phase.

[0008] Using the user identification card key, a preset user identification card authentication algorithm is invoked, and the second random code is used as the challenge input to calculate the response output and obtain the response result;

[0009] Using the response result, the first random code, and the second random code, and based on a preset hash algorithm, a hash result is obtained;

[0010] Display the hash result.

[0011] In one or more embodiments, the result of the user identification card decrypting the ciphertext further includes the description information of the business system; before using the user identification card key to call a preset user identification card authentication algorithm, using the second random code as the challenge input, calculating the response output, and obtaining the response result, the method further includes:

[0012] Display the description information of the business system;

[0013] It confirms receipt of the instruction from the user, based on the described information, indicating that authentication should continue.

[0014] In one or more embodiments, using the response result, the first random code, and the second random code, and based on a preset hash algorithm, a hash result is obtained, including:

[0015] Combine the first random code and the second random code to obtain the combined random code;

[0016] The hash algorithm is used to perform a hash operation on the merged random code and the response result to obtain the hash result.

[0017] In one or more embodiments, displaying the hash result includes:

[0018] Generate a QR code to represent the hash result;

[0019] Display the QR code.

[0020] In one or more embodiments, obtaining the encrypted text displayed by the business system corresponding to the mobile user number in the user device's phone book includes:

[0021] The encrypted text is obtained by scanning the QR code displayed by the business system to represent the encrypted text; or,

[0022] The encrypted text is obtained through user input.

[0023] In one or more embodiments, after displaying the hash result, the method further includes:

[0024] Display the first random code.

[0025] A second aspect of this application provides an offline authentication method applied to a business system, the method comprising:

[0026] Receives user-inputted mobile subscriber number from the user's mobile subscriber book;

[0027] Query the ciphertext and verification hash results that match the mobile user's address book number;

[0028] Display the ciphertext;

[0029] Obtain the hash result displayed by the user equipment based on the ciphertext;

[0030] The user equipment is authenticated based on the hash result and the verification hash result.

[0031] In one or more embodiments, the method further includes:

[0032] The user equipment obtains the first random code displayed based on the ciphertext;

[0033] If the hash result and the verification hash result are consistent, the first random code and the first random code retrieved locally from the business system based on the mobile user's number are compared to obtain the final verification result of the user equipment.

[0034] In one or more embodiments, before receiving the mobile subscriber number input by the user, the method further includes:

[0035] In response to the offline authentication and registration request of the user equipment, the user offline registration information is sent to the operator management platform. The offline registration information includes a first random code and a mobile user number book number. The offline authentication and registration request carries the mobile user number book number.

[0036] Receive the encrypted and verification hash results returned by the operator management platform based on the user's offline registration information.

[0037] In one or more embodiments, the offline registration information further includes description information of the business system.

[0038] A third aspect of this application provides an offline service system, including a user device and a service system;

[0039] The user equipment is used to perform the method described in the first aspect;

[0040] The business system is used to execute the method described in the second aspect.

[0041] In one or more embodiments, it further includes:

[0042] Operator management platform;

[0043] The operator management platform is used to receive offline registration information from the business system, the offline registration information including a first random code and a mobile user number; obtain a user identification card key matching the mobile user number; encrypt the first random code and a randomly generated second random code using the user identification card key to obtain ciphertext; and, using the user identification card key, call a preset user identification card authentication algorithm, using the second random code as challenge input, calculate the response output, and obtain a response result; use the response result, the first random code, and the second random code, and based on a preset hash algorithm, obtain a verification hash result; and return the ciphertext and the verification hash result to the business system.

[0044] A fourth aspect of this application provides an offline authentication device for use in a user equipment, the device comprising:

[0045] The first acquisition module is used to acquire the encrypted text displayed by the business system that corresponds to the mobile user number book number of the user device.

[0046] The first processing module is used to decrypt the ciphertext using the user identification card key pair to obtain a first random code and a second random code; the first random code is generated by the business system during the offline registration stage, and the second random code is generated by the operator management platform during the offline registration stage;

[0047] The second processing module is used to use the user identification card key to call a preset user identification card authentication algorithm, use the second random code as challenge input, calculate the response output, and obtain the response result.

[0048] The third processing module is used to obtain a hash result by using the response result, the first random code and the second random code, and based on a preset hash algorithm;

[0049] The first display module is used to display the hash result.

[0050] A fifth aspect of this application provides an offline authentication device for use in a business system, the device comprising:

[0051] The receiving module is used to receive user-input mobile subscriber number from the user's mobile subscriber book.

[0052] The query module is used to query the ciphertext and verification hash results that match the mobile user's number in the phone book;

[0053] The second display module is used to display the ciphertext;

[0054] The second acquisition module is used to acquire the hash result displayed by the user equipment based on the ciphertext;

[0055] An authentication module is used to authenticate the user equipment based on the hash result and the verification hash result.

[0056] A sixth aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor running the computer program to implement the methods described in the first and / or second aspects.

[0057] A seventh aspect of this application provides a computer program product including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in a processor of an electronic device, the processor in the electronic device performs the methods described in the first aspect and / or the second aspect.

[0058] The technical solutions provided in this application embodiment have at least the following technical effects or advantages:

[0059] In this embodiment, the user equipment obtains the encrypted data from the business system using the mobile user's number in the mobile user's address book. It then decrypts the encrypted data using the user identification card key to obtain a first random code and a second random code. Using the user identification card key, it calls a preset user identification card authentication algorithm, using the second random code as the challenge input to calculate the response output. The response result, the first random code, and the second random code are combined with a preset hash algorithm to obtain a hash result, which is then displayed. This hash result allows the business system to authenticate the user's identity based on the user's identity. The entire process does not require the user to enter authentication information, is simple, and avoids the problem of authentication information leakage.

[0060] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0061] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0062] In the attached diagram:

[0063] Figure 1 This paper illustrates a flowchart of an offline authentication method provided in an embodiment of this application.

[0064] Figure 2 This illustration shows another flowchart of an offline authentication method provided in an embodiment of this application;

[0065] Figure 3 This illustration shows another flowchart of an offline authentication method provided in an embodiment of this application;

[0066] Figure 4 This illustration shows another flowchart of an offline authentication method provided in an embodiment of this application;

[0067] Figure 5A schematic diagram of the structure of an offline authentication system provided in an embodiment of this application is shown;

[0068] Figure 6 This paper shows a schematic diagram of the structure of an offline authentication device provided in an embodiment of this application;

[0069] Figure 7 This paper shows a schematic diagram of the structure of an offline authentication device provided in an embodiment of this application;

[0070] Figure 8 This illustration shows a schematic diagram of the structure of an electronic device according to an embodiment of this application;

[0071] Figure 9 A schematic diagram of a storage medium provided in one embodiment of this application is shown. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0073] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0074] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0075] In related technologies, in offline identity authentication schemes, users need to enter authentication information (key, password, biometrics, etc.) into a business system in advance. When authenticating the user, the authentication information entered by the user in real time is compared with the authentication information entered by the user. If the comparison is consistent, the authentication is considered successful, and a temporary session token for the user is generated. This temporary session token is used as authentication information in subsequent offline sessions.

[0076] However, having users enter their own authentication information is not only cumbersome, but also poses a risk of information leakage.

[0077] To alleviate the problems existing in related technologies, embodiments of this application provide an offline authentication method, system, device, equipment, and computer program product. The user equipment obtains encrypted data from the business system using the mobile user's number in the user's address book. It then decrypts the encrypted data using a user identification card key to obtain a first random code and a second random code. The user identification card key is used to invoke a preset user identification card authentication algorithm. The second random code is used as the challenge input to calculate the response output, resulting in a response result. The response result, the first random code, and the second random code are combined with a preset hash algorithm to obtain a hash result, which is then displayed. This hash result allows the business system to authenticate the user's identity based on the user's identity. The entire process does not require the user to enter authentication information, is simple, and eliminates the problem of authentication information leakage.

[0078] The offline authentication method in this application embodiment will be described below from the perspectives of user equipment and business system.

[0079] First, this offline authentication method is described from the perspective of the user equipment. In this embodiment, the user equipment can be a computer device with certain computing capabilities, such as a terminal device, a server, or other processing devices. In some possible implementations, this offline authentication method can be implemented by the processor calling computer-readable instructions stored in memory.

[0080] See Figure 1 The diagram shown is a flowchart of an offline authentication method provided in an embodiment of this application. The method may include the following steps:

[0081] Step 101: Obtain the encrypted text displayed by the business system that corresponds to the mobile user number in the user's device's phone book.

[0082] In this embodiment, the encrypted text corresponding to the mobile user's phone book number is obtained through any one of the following two methods:

[0083] First, the encrypted text is obtained by scanning the QR code displayed in the business system.

[0084] In this method, the business system displays the encrypted text on the display interface in the form of a QR code. The user device scans the QR code and decodes it to obtain the encrypted text.

[0085] Second, the user holding the user equipment manually inputs the ciphertext displayed by the business system into the user equipment, thereby enabling the user equipment to obtain the ciphertext.

[0086] In this approach, the business system directly displays the ciphertext on the display interface, allowing the user to manually input the ciphertext into the user's device.

[0087] Step 102: Decrypt the ciphertext using the user identification card key pair to obtain the first random code and the second random code; the first random code is generated by the business system during the offline registration phase, and the second random code is generated by the operator management platform during the offline registration phase.

[0088] In this embodiment, the ciphertext is obtained by the operator's management platform during the offline registration phase using the user identification card key and a preset symmetric encryption algorithm to encrypt the first and second random codes. Therefore, during the authentication phase, the first and second random codes can be obtained by decrypting the ciphertext using the user identification card key and the preset symmetric encryption algorithm. It should be understood that the symmetric encryption algorithm is pre-configured in the user equipment and the operator's management platform. For example, during the offline registration phase, the user equipment and the operator's management platform can negotiate and configure the symmetric encryption algorithm separately for offline authentication.

[0089] It should be understood that the user identification card key refers to the SIM (Subscriber Identity Module) card key. For each SIM card, the operator management platform configures a SIM card key for each SIM card. Both the SIM card and the operator management platform store the SIM card key. At the same time, the operator management platform also configures the correspondence between the SIM card key and the mobile subscriber number of the SIM card.

[0090] In one or more embodiments, the result of decrypting the ciphertext using the user identification card key may include, in addition to the first and second random codes, descriptive information of the business system. Accordingly, before encrypting the second random code using the user identification card key and obtaining the response result, the following steps may also be included:

[0091] Displays a description of the business system;

[0092] Confirmation received from the user, based on the description information, indicating that the authentication process should continue.

[0093] In this embodiment, the description information of the business system includes, but is not limited to, the name and address of the business system.

[0094] In this embodiment, by displaying a description of the business system to the user, the user can easily identify whether the business system is an illegitimate or non-compliant platform. If the user believes the business system is illegitimate or non-compliant, they can instruct the user to refuse to execute the subsequent authentication process to prevent information leakage. If the user believes the business system is legitimate and compliant, they can instruct the user to continue executing the subsequent authentication process.

[0095] Step 103: Using the user identification card key, call the preset user identification card authentication algorithm, use the second random code as the challenge input, calculate the response output, and obtain the response result.

[0096] In this embodiment, the user identification card authentication algorithm is an algorithm for authenticating SIM cards in related technologies. This user identification card authentication algorithm includes, but is not limited to, the AKA (Authentication and Key Agreement Protocol) authentication algorithm.

[0097] Step 104: Using the response result, the first random code, and the second random code, and based on a preset hash algorithm, obtain the hash result.

[0098] In this embodiment, a hash algorithm is used to perform a hash operation on the response result based on the first and second random codes, thus preventing the leakage of the response result. Furthermore, since the second random code used in step 103 is generated on the operator platform and is not transmitted or displayed in plaintext during the interaction between the user equipment and the business system, it is also not easily leaked. In other words, the sample pair consisting of the input parameters and the hash result of the response result cannot be completely obtained, making the SIM card key unbreakable. Consequently, even if the ciphertext is illegally obtained during transmission, it cannot be cracked.

[0099] In one or more embodiments, step 104 may include the following steps:

[0100] Merge the first random code and the second random code to obtain the merged random code;

[0101] A hash algorithm is used to perform a hash operation on the merged random code and the response result to obtain the hash result.

[0102] In this embodiment, the first random code and the second random code can be merged according to a pre-configured merging algorithm. This merging algorithm includes, but is not limited to, addition and subtraction.

[0103] The hash algorithm used in this embodiment includes, but is not limited to, the SHA256 compression function.

[0104] Step 105: Display the hash result.

[0105] This embodiment includes, but is not limited to, displaying the hash result via a QR code or direct display. It should be understood that when displaying the hash result as a QR code, a QR code encoding algorithm is required to encode the hash result, thereby generating a QR code representing the hash result.

[0106] In one or more embodiments, in order to improve the reliability of authentication, the user equipment may display a first random code in addition to the hash result, so that the business system can simultaneously authenticate the user equipment by combining the first random code.

[0107] In the offline authentication scheme provided in this embodiment, the user equipment obtains the encrypted data from the business system using the mobile user's number in the user's address book. It then decrypts the encrypted data using the user identification card key to obtain a first random code and a second random code. Using the user identification card key, it calls a preset user identification card authentication algorithm, using the second random code as the challenge input to calculate the response output. The response result, the first random code, and the second random code are combined with a preset hash algorithm to obtain a hash result, which is then displayed. This hash result allows the business system to authenticate the user's identity based on the user's identity. The entire process does not require the user to enter authentication information, is simple, and eliminates the risk of authentication information leakage.

[0108] This concludes the introduction to offline authentication methods from the perspective of user devices.

[0109] The following section continues the introduction of this offline authentication method from the perspective of a business system. This business system can be a computer device with a certain computing capability, such as a terminal device, a server, or other processing devices. In some possible implementations, this offline authentication method can be implemented by the processor calling computer-readable instructions stored in memory.

[0110] In applications, based on business needs, business systems can, by default, allow government services involving public utilities to obtain offline authentication information from the operator's management platform. Users can also set which units or merchants are allowed to obtain their offline authentication information.

[0111] See Figure 2 The diagram shown is a flowchart of an offline authentication method provided in an embodiment of this application. The method may include the following steps:

[0112] Step 201: Receive the mobile subscriber number of the user device input by the user.

[0113] Step 202: Query the ciphertext and verification hash results that match the mobile user's number in the phone book.

[0114] In this embodiment, during the offline registration phase, the operator management platform returns encrypted text and verification hash results to the business system. The business system then establishes a correspondence between the mobile user's address book number, the encrypted text, and the verification hash result. It should be understood that, depending on the actual verification reliability requirements, if, during the offline authentication phase, in addition to using the verification hash result for user authentication, a second random code is used for further authentication to improve reliability, then this correspondence may also include the second random code used during the offline registration phase.

[0115] Step 203: Display the ciphertext.

[0116] In this embodiment, the encrypted text can be displayed directly on the authentication interaction page of the business system, or it can be displayed in the form of a QR code. This embodiment does not make any specific limitations on this.

[0117] Step 204: Obtain the hash result displayed by the user device based on the ciphertext.

[0118] In this embodiment, it includes, but is not limited to, manual input by the user.

[0119] It should be understood that the hash result here is the hash result obtained by the user equipment after obtaining the ciphertext in the foregoing embodiment, through decrypting the ciphertext, authenticating the second random code, and using the response result, the first random code, and the second random code based on a preset hash algorithm.

[0120] Step 205: Based on the hash result and the verification hash result, perform identity authentication on the user device.

[0121] It should be understood that if the hash result matches the verification hash result, the identity authentication can be confirmed as successful. At this time, the authentication platform can display a prompt message indicating successful authentication through the authentication interaction page.

[0122] In one or more embodiments, if the hash result matches the verification hash result and the first random code displayed by the user equipment matches the first random code corresponding to the mobile user number in the user equipment's locally stored mobile user number book, then the identity authentication is confirmed to be successful.

[0123] In one or more embodiments, the authentication platform participates not only in the offline authentication phase but also in the offline registration phase. In the offline registration phase, the authentication platform performs the following process steps:

[0124] In response to the user equipment's offline authentication and registration request, the user's offline registration information is sent to the operator's management platform. The offline registration information includes a first random code and a mobile user number. The offline authentication and registration request carries the mobile user number.

[0125] Receive the encrypted and verification hash results returned by the operator's management platform based on the user's offline registration information.

[0126] During the offline registration phase, the user equipment, the business system, and the operator's management platform communicate via the network. Based on the user's actions, the user equipment sends an offline authentication and registration request carrying the mobile user's address book number to the business system. In response to this offline authentication and registration request, the business system sends the user's offline registration information to the operator's management platform.

[0127] After receiving the user's offline registration information, the operator management platform obtains the user identification card key that matches the mobile user's number in the phone book; it encrypts the first random code and the randomly generated second random code using the user identification card key to obtain ciphertext; and, using the user identification card key, it calls the preset user identification card authentication algorithm, uses the second random code as the challenge input, calculates the response output, and obtains the response result; it uses the response result, the first random code, and the second random code, and based on the preset hash algorithm, to obtain the verification hash result; and it returns the ciphertext and the verification hash result to the business system.

[0128] It should be understood that, in order to improve the reliability of subsequent offline verification, the offline registration information may also include a description of the business system. After receiving the offline registration information, the operator management platform uses the user identification card key to encrypt the first random code, the second random code, and the description of the business information to obtain ciphertext.

[0129] The process by which the operator's management platform obtains the verification hash result is the same as the process by which the user equipment obtains the hash result. Specifically, the first random code and the second random code are first merged to obtain a merged random code. Then, a preset hash algorithm is used to perform a hash operation on the merged random code and the response result to obtain the verification hash result. It should be understood that the hash algorithm used by the operator's management platform to calculate the verification hash result is the same as the hash algorithm used by the user equipment to calculate the hash result. Similarly, the merging algorithm used by the operator's management platform to merge the first random code and the second random code is also the same as the merging algorithm used by the user equipment to merge the first random code and the second random code.

[0130] It should be understood that after receiving the ciphertext and verification hash results returned by the operator's management platform, the business system saves the ciphertext and verification hash results locally as offline authentication information and establishes a correspondence between the mobile user's number book number and the offline authentication information, so that the ciphertext and verification hash results can be queried based on this correspondence during the offline authentication stage.

[0131] It should also be understood that if offline authentication is required in conjunction with the first random code in the subsequent offline authentication stage, the first random code can be stored locally in the business system, and a correspondence between the mobile user's number book number and the first random code can be established at the same time, so that the first random code can be queried based on the correspondence in the subsequent offline authentication stage.

[0132] To enhance security, the validity period of the encrypted data, verification hash result, and first random code stored locally on the business system side can be set. After this validity period, the locally stored encrypted data, verification hash result, and first random code are considered invalid, and the user device will be unable to perform offline authentication based on the invalid encrypted data, verification hash result, and first random code in offline scenarios. The application also supports users actively initiating a new round of offline registration, which ensures timely updates to the encrypted data, verification hash result, and first random code of the user device stored locally on the business system.

[0133] This concludes the introduction to offline authentication methods from the perspective of business systems.

[0134] For ease of understanding, the offline authentication method of this application will be introduced from two perspectives: the offline registration stage and the offline authentication stage.

[0135] This section introduces offline authentication methods from the perspective of the offline registration phase.

[0136] During the offline registration phase, user devices, business systems, and operator management platforms can communicate via the network. For example... Figure 3 As shown, this stage may specifically include the following steps:

[0137] s1: The business system requests the user's offline authentication information from the operator's management platform. When making the request, the business system includes the user's mobile phone number, the random code (randApp) for this request, and the name of the business system (e.g., Service Desk No. XX of XXX System in XXX City, XXX Province).

[0138] s2: The operator's management platform responds to the request. After receiving the request, the operator's management platform generates its own random code (randAuth) and performs the following operations:

[0139] ① Encrypt the random code (randApp) sent from the business system, the random code (randAuth) generated by yourself, and the name of the business system together into ciphertext using the key of the SIM card.

[0140] ② Combine two random codes (randApp, randAuth) into a single random code (rand) using a pre-defined algorithm (e.g., simple addition of numbers). Then, using the algorithm specified in the AKA authentication standard, generate an AKA response result (res) with the SIM card key and the random code (randAuth). Finally, use res and rand as input parameters for sha256 to calculate heres, where heres = sha256(res, rand).

[0141] ③ Return the encrypted text generated in ① and the hres generated in ② to the business system together.

[0142] s3: After receiving the response, the business system saves (the encrypted text, hres, and randApp must all be saved) as the user's offline authentication information.

[0143] During the offline authentication phase, such as Figure 4 As shown, this stage may specifically include the following steps:

[0144] After a network outage, neither user devices nor business systems can connect to the internet. Assume the business system has a self-service authentication terminal with a display screen and a QR code scanner.

[0145] s1: The user comes to the self-service authentication terminal of the business system, starts the authentication process, and enters their mobile phone number.

[0146] S2: The business system retrieves the encrypted message and HRES corresponding to this phone number from its stored authentication information. It then displays the encrypted message to the user (either as a QR code or a string). Note that HRES and randApp must not be displayed and must remain confidential.

[0147] s3: The user scans the QR code (or enters it manually) to obtain the encrypted text, which is then transmitted to the SIM card. The SIM card decrypts the encrypted text using its own key to obtain the random code (randApp), the random code (randAuth), and the name of the business system, and returns the name of the business system to the user.

[0148] S4: The user verifies the other party's name and asks whether to continue verification.

[0149] s5: Continuing the verification, the SIM card combines the two random codes (randApp, randAuth) into a single random code (rand) using a pre-defined algorithm (e.g., simple addition of numbers). Then, using the algorithm specified in the AKA authentication standard, and with the SIM card key and randAuth, it generates an AKA response result (res). Finally, it uses res and rand as input parameters to calculate hres, where hres = sha256(res, rand).

[0150] s6: The SIM card returns hres, randApp to the user.

[0151] S7: The user's terminal device generates a QR code from hres and randApp, which is then displayed to the self-service authentication terminal of the business system for scanning.

[0152] S8: After the business system obtains the hres and randApp displayed by the user, it compares them with the ones it has saved. If they match, the authentication is successful.

[0153] This embodiment of the solution does not require users to pre-enter their authentication information into various application systems; all that is needed is a mobile phone with a working SIM card, and the process is simple. Furthermore, unlike other offline authentication methods, there is no need to worry about leaking one's biometrics.

[0154] In short, the principle by which this application can authenticate users is as follows:

[0155] ① The SIM card's key is known only to the SIM card and the operator's management platform. Using it for encryption and decryption is secure throughout the entire process. (Encryption and decryption occur on the operator's management platform and within the SIM card, respectively; the key is not leaked). During the decryption of ciphertext and the calculation of res, only those with the correct SIM key can calculate the expected res.

[0156] ②Even if this offline authentication information is leaked, the security risk is very small, because HRES is related to the values ​​of two random numbers. These two random numbers are generated by the application system and the SIM card management platform, respectively, and are dynamic. Crackers simply cannot compile a complete sample (one input parameter corresponds to one HRES as one sample), because crackers do not even know what the input parameters are.

[0157] ③ If the application system requires multiple offline authentications, multiple offline authentication information can be applied for.

[0158] The solution proposed in this application will not result in the leakage of SIM card keys.

[0159] ① Encryption / decryption stage:

[0160] The plaintext before encryption is unpredictable due to the presence of randAuth. Even if the encrypted ciphertext is leaked, others will not only be unable to decrypt it, but also lack a complete sample (a plaintext-ciphertext pair constitutes a sample) to crack the key.

[0161] ②Calculation of res stage:

[0162] The SIM card key is involved in the calculation of `res`. The input parameters for calculating `res` are the SIM card key and `randAuth`, which are inaccessible to others. The result of `res`, the `res` value, is not directly returned to the user. Instead, `res` is used as a parameter in a SHA256 hash and `randApp` to generate a new hash value. This prevents others from obtaining the sample pairs of input parameters and results before and after the calculation of `res`, thus hindering the cracking of the algorithm.

[0163] This application also provides an offline authentication system, such as... Figure 5 As shown, the offline authentication system may include:

[0164] User equipment 51 and business system 52;

[0165] The user equipment 51 is used to perform the offline authentication method described above from the user equipment side;

[0166] The business system 52 is used to execute the offline authentication method described above from the business system side.

[0167] In one or more embodiments, the offline authentication system may further include:

[0168] Operator management platform;

[0169] The operator management platform is used to receive offline registration information from the business system, the offline registration information including a first random code and a mobile user number; obtain a user identification card key matching the mobile user number; encrypt the first random code and a randomly generated second random code using the user identification card key to obtain ciphertext; and, using the user identification card key, call a preset user identification card authentication algorithm, using the second random code as challenge input, calculate the response output, and obtain a response result; use the response result, the first random code, and the second random code, and based on a preset hash algorithm, to obtain a verification hash result; and return the ciphertext and the verification hash result to the business system.

[0170] This application also provides an offline authentication device for use with user equipment, such as... Figure 6 As shown, the device may include:

[0171] The first acquisition module 61 is used to acquire the encrypted text displayed by the business system that corresponds to the mobile user number book number of the user device.

[0172] The first processing module 62 is used to decrypt the ciphertext using the user identification card key pair to obtain a first random code and a second random code; the first random code is generated by the business system during the offline registration stage, and the second random code is generated by the operator management platform during the offline registration stage;

[0173] The second processing module 63 is used to use the user identification card key to call the preset user identification card authentication algorithm, use the second random code as the challenge input, calculate the response output, and obtain the response result.

[0174] The third processing module 64 is used to obtain a hash result by using the response result, the first random code and the second random code, and based on a preset hash algorithm;

[0175] The first display module 65 is used to display the hash result.

[0176] In one or more embodiments, the result of the user identification card decrypting the ciphertext further includes the description information of the business system; the device is also used for:

[0177] Using the user identification card key, a preset user identification card authentication algorithm is invoked, the second random code is used as the challenge input, the response output is calculated, and before the response result is obtained, the description information of the business system is also displayed;

[0178] It confirms receipt of the instruction from the user, based on the described information, indicating that authentication should continue.

[0179] In one or more embodiments, the third processing module 64 is used to:

[0180] Combine the first random code and the second random code to obtain the combined random code;

[0181] The hash algorithm is used to perform a hash operation on the merged random code and the response result to obtain the hash result.

[0182] In one or more embodiments, the first display module 65 is used for:

[0183] Generate a QR code to represent the hash result;

[0184] Display the QR code.

[0185] In one or more embodiments, the first acquisition module 61 is used to:

[0186] The encrypted text is obtained by scanning the QR code displayed by the business system to represent the encrypted text; or,

[0187] The encrypted text is obtained through user input.

[0188] In one or more embodiments, the device is also used for:

[0189] After displaying the hash result, the first random code is displayed.

[0190] This application also provides an offline authentication device for use in business systems, such as... Figure 7 As shown, the device may include:

[0191] Receiver module 71 is used to receive user-input mobile subscriber number from the user equipment's mobile subscriber book.

[0192] Query module 72 is used to query the ciphertext and verification hash results that match the mobile user's number in the phone book;

[0193] The second display module 73 is used to display the ciphertext;

[0194] The second acquisition module 74 is used to acquire the hash result displayed by the user equipment based on the ciphertext;

[0195] The authentication module 75 is used to authenticate the user equipment based on the hash result and the verification hash result.

[0196] In one or more embodiments, the device is also used for:

[0197] The user equipment obtains the first random code displayed based on the ciphertext;

[0198] If the hash result and the verification hash result are consistent, the first random code and the first random code retrieved locally from the business system based on the mobile user's number are compared to obtain the final verification result of the user equipment.

[0199] In one or more embodiments, the device is also used for:

[0200] Before receiving the mobile subscriber number entered by the user, in response to the offline authentication and registration request of the user equipment, the user offline registration information is sent to the operator management platform. The offline registration information includes a first random code and the mobile subscriber number. The offline authentication and registration request carries the mobile subscriber number.

[0201] Receive the encrypted and verification hash results returned by the operator management platform based on the user's offline registration information.

[0202] In one or more embodiments, the offline registration information may further include description information of the business system.

[0203] This application also provides an electronic device for performing the above-described offline authentication method. Please refer to... Figure 8 It illustrates a schematic diagram of an electronic device provided by some embodiments of this application. For example... Figure 8As shown, the electronic device 8 includes: a processor 800, a memory 801, a bus 802, and a communication interface 803. The processor 800, the communication interface 803, and the memory 801 are connected via the bus 802. The memory 801 stores a computer program that can run on the processor 800. When the processor 800 runs the computer program, it executes the offline authentication method provided in any of the foregoing embodiments of this application.

[0204] The memory 801 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this device network element and at least one other network element is achieved through at least one communication interface 803 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0205] Bus 802 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 801 is used to store programs. After receiving an execution instruction, the processor 800 executes the program. The offline authentication method disclosed in any of the foregoing embodiments of this application can be applied to the processor 800, or implemented by the processor 800.

[0206] The processor 800 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 800 or by instructions in software form. The processor 800 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 801. Processor 800 reads the information in memory 801 and, in conjunction with its hardware, completes the steps of the above method.

[0207] The electronic device provided in this application embodiment and the offline authentication method provided in this application embodiment are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0208] This application also provides a computer-readable storage medium corresponding to the offline authentication method provided in the foregoing embodiments. Please refer to... Figure 9 The computer-readable storage medium shown is an optical disc 30, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it executes the offline authentication method provided in any of the foregoing embodiments.

[0209] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0210] The computer-readable storage medium provided in the above embodiments of this application and the offline authentication method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0211] It should be noted that:

[0212] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known structures and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0213] Similarly, it should be understood that, for the sake of brevity and to aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of this application, various features of this application are sometimes grouped together in a single embodiment, figure, or description thereof. However, this disclosure should not be construed as reflecting a schematic diagram in which the claimed application requires more features than expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.

[0214] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

[0215] The above description is merely a preferred embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An offline authentication method, characterized in that, Applied to user equipment, the method includes: Obtain the encrypted text displayed by the business system that corresponds to the mobile user number in the user's device's phone book; The ciphertext is decrypted using the user identification card key to obtain a first random code and a second random code; the first random code is generated by the business system during the offline registration phase, and the second random code is generated by the operator management platform during the offline registration phase. Using the user identification card key, a preset user identification card authentication algorithm is invoked, the second random code is used as the challenge input, the response output is calculated, and the response result is obtained; Using the response result, the first random code, and the second random code, and based on a preset hash algorithm, a hash result is obtained; Display the hash result.

2. The method according to claim 1, characterized in that, The result of the user identification card decrypting the ciphertext also includes the description information of the business system; before using the user identification card key to call the preset user identification card authentication algorithm, using the second random code as the challenge input, calculating the response output, and obtaining the response result, it also includes: Display the description information of the business system; It confirms receipt of the instruction from the user, based on the described information, indicating that authentication should continue.

3. The method according to claim 1, characterized in that, Using the response result, the first random code, and the second random code, and based on a preset hash algorithm, a hash result is obtained, including: Combine the first random code and the second random code to obtain the combined random code; The hash algorithm is used to perform a hash operation on the merged random code and the response result to obtain the hash result.

4. The method according to claim 1, characterized in that, Displaying the hash result includes: Generate a QR code to represent the hash result; Display the QR code.

5. The method according to claim 1, characterized in that, Retrieve the encrypted text displayed by the business system corresponding to the mobile user number in the user's device's phone book, including: The encrypted text is obtained by scanning the QR code displayed by the business system to represent the encrypted text; or, The encrypted text is obtained through user input.

6. The method according to claim 1, characterized in that, After displaying the hash result, the following is also included: Display the first random code.

7. An offline authentication method, characterized in that, Applied to a business system, the method includes: Receives user-inputted mobile subscriber number from the user's mobile subscriber book; Query the ciphertext and verification hash results that match the mobile user's address book number; Display the ciphertext; Obtain the hash result displayed by the user equipment based on the ciphertext; the hash result is obtained by the user equipment using the response result, a first random code, and a second random code, based on a preset hash algorithm; the first random code and the second random code are obtained by the user equipment using the user identification card key to decrypt the ciphertext; the first random code is generated by the business system during the offline registration phase, the second random code is generated by the operator management platform during the offline registration phase, and the response result is obtained by the user equipment using the user identification card key, calling a preset user identification card authentication algorithm, using the second random code as the challenge input, and calculating the response output; The user equipment is authenticated based on the hash result and the verification hash result.

8. The method according to claim 7, characterized in that, The method further includes: The user equipment obtains the first random code displayed based on the ciphertext; If the hash result and the verification hash result are consistent, the first random code and the first random code retrieved locally from the business system based on the mobile user's number are compared to obtain the final verification result of the user equipment.

9. The method according to claim 7, characterized in that, Before receiving the mobile subscriber number entered by the user, the process also includes: In response to the offline authentication and registration request of the user equipment, the user offline registration information is sent to the operator management platform. The offline registration information includes a first random code and a mobile user number book number. The offline authentication and registration request carries the mobile user number book number. Receive the encrypted and verification hash results returned by the operator management platform based on the user's offline registration information.

10. The method according to claim 9, characterized in that, The offline registration information also includes description information of the business system.

11. An offline business system, characterized in that, This includes user equipment and business systems; The user equipment is used to perform the method according to any one of claims 1-6; The business system is used to execute the method described in any one of claims 7-10.

12. The offline business system according to claim 11, characterized in that, Also includes: Operator management platform; The operator management platform is used to receive user offline registration information from the business system, the offline registration information including a first random code and a mobile user number; obtain a user identification card key matching the mobile user number; and encrypt the first random code and a randomly generated second random code using the user identification card key to obtain ciphertext. Furthermore, using the user identification card key, a preset user identification card authentication algorithm is invoked, the second random code is used as the challenge input, the response output is calculated, and the response result is obtained; Using the response result, the first random code, and the second random code, and based on a preset hash algorithm, a verification hash result is obtained; The ciphertext and the verification hash result are returned to the business system.

13. An offline authentication device, characterized in that, Applied to user equipment, the device includes: The first acquisition module is used to acquire the encrypted text displayed by the business system that corresponds to the mobile user number book number of the user device. The first processing module is used to decrypt the ciphertext using the user identification card key to obtain a first random code and a second random code; the first random code is generated by the business system during the offline registration phase, and the second random code is generated by the operator management platform during the offline registration phase. The second processing module is used to use the user identification card key to call a preset user identification card authentication algorithm, use the second random code as challenge input, calculate the response output, and obtain the response result. The third processing module is used to obtain a hash result by using the response result, the first random code and the second random code, and based on a preset hash algorithm; The first display module is used to display the hash result.

14. An offline authentication device, characterized in that, The device, applied to a business system, includes: The receiving module is used to receive user-input mobile subscriber number from the user's mobile subscriber book. The query module is used to query the ciphertext and verification hash results that match the mobile user's number in the phone book; The second display module is used to display the ciphertext; The second acquisition module is used to acquire the hash result displayed by the user equipment based on the ciphertext; the hash result is obtained by the user equipment using the response result, the first random code, and the second random code, based on a preset hash algorithm; the first random code and the second random code are obtained by the user equipment using the user identification card key to decrypt the ciphertext; the first random code is generated by the business system during the offline registration stage, the second random code is generated by the operator management platform during the offline registration stage, and the response result is obtained by the user equipment using the user identification card key, calling a preset user identification card authentication algorithm, using the second random code as the challenge input, and calculating the response output. An authentication module is used to authenticate the user equipment based on the hash result and the verification hash result.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the method as described in any one of claims 1-6 and / or any one of claims 7-10.

16. A computer program product, characterized in that, Includes computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is executed in a processor of an electronic device, the processor in the electronic device performs the method as described in any one of claims 1-6 and / or any one of claims 7-10.

Images