Dynamic authentication method, device, electronic device and storage medium

Abstract

A dynamic authentication method, device, electronic device and storage medium, comprising: obtaining a certificate to be authenticated of a software client in a terminal; performing a legal verification on the status of the certificate to be authenticated, and if the status is legal, continuing to run the software client; otherwise, the software client displays a request to cancel the installation and a request to obtain the certificate on a visual interface; if the request to obtain the certificate is responded to, a dynamic code acquisition instruction is generated and sent to the software client; otherwise, the software client is stopped; the software client receives and executes the dynamic code acquisition instruction to generate a dynamic machine code; based on the dynamic machine code, the certificate to be authenticated is generated; and the certificate to be authenticated is distributed to the terminal; the present invention improves the unpredictability and tamper-proofness of the software authentication process by sequentially weighting each identifier and performing weighted asymmetric encryption, thereby improving the network security performance in the software management process.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically to a dynamic authentication method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of information technology, a large amount of software is deployed on the local servers of terminal devices. When the software is initially installed and run, its local server will send an authentication certificate to the third-party server of the software company. When the authentication certificate is passed, the third-party server allows the software to be installed. However, the traditional authentication method is single, the authentication information is solidified, and there is a lack of dynamic authentication process, which can easily result in only one local server passing the authentication of other local servers, greatly reducing the reliability of authentication. In addition, the encryption method of the traditional authentication process is simple or there is no encryption process at all, which leads to the leakage of software device information and malicious interception of requests, which in turn leads to the cracking and tampering of authentication information, resulting in network security issues such as authentication confusion and invalid management. Summary of the invention

[0003] This embodiment provides a dynamic authentication method, device, electronic device and storage medium, and explores how to solve the problems of single traditional authentication method, solidified authentication information, lack of dynamic authentication process, and easy to cause only one local server to pass the authentication of other local servers, which greatly reduces the reliability of authentication. In addition, the encryption method of the traditional authentication process is simple or there is no encryption process at all, which leads to the leakage of information of software devices and malicious interception of requests, which in turn leads to the cracking and tampering of authentication information, resulting in network security problems such as authentication confusion and invalid management.

[0004] In a first aspect, the present invention provides a dynamic authentication method, which is applied to a server side, the method comprising:

[0005] Obtain the certificate to be authenticated of the software client in the terminal;

[0006] Performing a legal verification on the status of the certificate to be authenticated, and if the status is legal, continuing to run the software client; otherwise, the software client displays a request to cancel the installation and a request to obtain the certificate on a visual interface;

[0007] If the certificate acquisition request is responded, a dynamic code acquisition instruction is generated and sent to the software client; otherwise, the software client is stopped;

[0008] The software client receives and executes the dynamic code acquisition instruction to generate a dynamic machine code;

[0009] generating the certificate to be authenticated according to the dynamic machine code;

[0010] Distribute the certificate to be authenticated to the terminal.

[0011] In some embodiments, obtaining a certificate to be authenticated of a software client in a terminal includes:

[0012] Running a software installation program, the software installation program sends a software registration request to the server;

[0013] Receiving the software registration request, the server generates a certificate acquisition instruction and sends it to the software client;

[0014] The software client receives the certificate acquisition instruction and sends the certificate to be authenticated to the server.

[0015] In some embodiments, the status of the certificate to be authenticated is verified to be legal. If the status is legal, the software client continues to run; otherwise, the software client displays a request to cancel the installation and a request to obtain the certificate on a visual interface; including:

[0016] Receiving the certificate to be authenticated obtained from the terminal;

[0017] Verifying the status of the certificate to be authenticated to obtain a verification result;

[0018] The verification result includes: the status of the certificate to be authenticated is legal, the server generates a verification pass instruction and sends it to the software client to continue running the software client;

[0019] The verification result also includes: if the status of the certificate to be authenticated is illegal, the server generates a verification failure instruction and sends it to the software client. After receiving the verification failure instruction, the software client generates a request to cancel the installation and a request to obtain the certificate, and displays them on the visual interface of the terminal.

[0020] In some embodiments, if a request for obtaining a certificate is responded to, a dynamic code obtaining instruction is generated and sent to a software client; otherwise, the software client is stopped from running; including:

[0021] Respond to the certificate acquisition request in the visual interface, and the software client sends the responded certificate acquisition request to the server;

[0022] The server generates a dynamic code acquisition instruction according to the certificate acquisition request after the response, and sends it to the software client;

[0023] The software client responds to the installation cancellation request on the visual interface, and according to the installation cancellation request after the response, exits the software installation program to stop running the software client.

[0024] In some embodiments, the software client receives and executes the dynamic code acquisition instruction to generate dynamic machine code; including:

[0025] The software client obtains multiple unique identifiers of the terminal;

[0026] splicing the multiple unique identifiers in a first predefined structure to generate a composite identifier;

[0027] Asymmetrically encrypt the composite identifier to generate the dynamic machine code.

[0028] In some embodiments, generating the certificate to be authenticated according to the dynamic machine code includes:

[0029] Receive dynamic machine code obtained from the software client;

[0030] Decrypt the dynamic machine code to obtain a decrypted composite identifier;

[0031] Get the note information;

[0032] The certificate to be authenticated is generated according to the remark information and the decrypted composite identifier.

[0033] In some embodiments, generating the certificate to be authenticated according to the remark information and the decrypted composite identifier includes:

[0034] Combining the remark information and the decrypted composite identifier to generate a message to be signed;

[0035] Generate a fixed-length summary based on the message to be signed;

[0036] Encrypting the fixed-length digest to generate a digital signature;

[0037] The message to be signed, the fixed-length digest and the digital signature are encapsulated in a second predefined structure to obtain the certificate to be authenticated.

[0038] Compared with the prior art, a dynamic authentication method of the present invention generates a dynamic machine code in real time by adopting multiple unique identifiers of the terminal, so it has strong real-time performance; and by sequentially weighting and weighted asymmetric encryption of each identifier, the unpredictability and tamper-proofness of the software authentication process are improved, thereby improving the network security performance in the software management process.

[0039] In a second aspect, the present invention provides a dynamic authentication device, comprising:

[0040] An acquisition module is used to obtain the certificate to be authenticated of the software client in the terminal;

[0041] A verification module, used to verify the legality of the status of the certificate to be authenticated. If the status is legal, the software client continues to run; otherwise, the software client displays a request to cancel the installation and a request to obtain the certificate on a visual interface;

[0042] The request response module is used to generate a dynamic code acquisition instruction and send it to the software client if responding to the certificate acquisition request; otherwise, stop running the software client;

[0043] A machine code generation module is used for the software client to receive and execute the dynamic code acquisition instruction to generate a dynamic machine code;

[0044] A certificate generation module, used to generate the certificate to be authenticated according to the dynamic machine code;

[0045] The certificate distribution module is used to distribute the certificate to be authenticated to the terminal.

[0046] In a third aspect, the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores at least one computer executable instruction, and the processor is configured to run the computer executable instruction, and when the computer executable instruction is run by the processor, a dynamic authentication method described in the first aspect is implemented.

[0047] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements a dynamic authentication method as described in the first aspect.

[0048] Compared with the prior art, the beneficial effects of the dynamic authentication device, electronic device and storage medium of the present invention are the same as the beneficial effects of the above-mentioned dynamic authentication method, so they are not repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flow chart of a dynamic authentication method in an embodiment of the present invention;

[0050] Figure 2 A structural block diagram of a dynamic authentication device in an embodiment of the present invention;

[0051] Figure 3 A diagram of an electronic device in an embodiment of the present invention; DETAILED DESCRIPTION

[0052] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0053] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with general skills in the technical field to which this application belongs. The words "one", "a", "the", "these" and the like in this application do not indicate a quantitative limitation, and they may be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone. Generally, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0054] First, the prior art and related concepts involved in the embodiments of the present invention are described:

[0055] Asymmetric national commercial encryption algorithm: in this embodiment, it is commercial encryption algorithm No. 2 (SM2); a public key encryption algorithm based on elliptic curve cryptography (ECC).

[0056] refer to Figures 1 to 3 In an embodiment of the present invention, a dynamic authentication method is provided. Figure 1 It is a flow chart of a dynamic authentication method of the present invention, which includes:

[0057] Step S1, obtaining the certificate to be authenticated of the software client in the terminal;

[0058] The step S1 specifically includes:

[0059] Running a software installation program, the software installation program sends a software registration request to the server;

[0060] Receiving the software registration request, the server generates a certificate acquisition instruction and sends it to the software client;

[0061] The software client receives the certificate acquisition instruction and sends the certificate to be authenticated to the server.

[0062] Exemplarily, the terminal is a machine device used to install a software client, including but not limited to a computer, a physical server, etc.; the terminal is used to run the software client, wherein the software client has a built-in software installation program, a certificate to be authenticated, and a dynamic machine code generator; when the software installation program is running, the certificate to be authenticated is sent to the server.

[0063] The server side may be a management center for managing the software deployed on the terminal. The management center has a visual operation management interface for viewing the software deployment status, software authentication status, and issuance of certificates to be authenticated.

[0064] The process also includes:

[0065] Step S2: verify the legality of the status of the certificate to be authenticated. If the status is legal, continue to run the software client; otherwise, the software client displays a request to cancel the installation and a request to obtain the certificate on a visual interface.

[0066] The step S2 specifically includes:

[0067] Receiving the certificate to be authenticated obtained from the terminal;

[0068] Verifying the status of the certificate to be authenticated to obtain a verification result;

[0069] The verification result includes: the status of the certificate to be authenticated is legal, the server generates a verification pass instruction and sends it to the software client to continue running the software client;

[0070] The verification result also includes: if the status of the certificate to be authenticated is illegal, the server generates a verification failure instruction and sends it to the software client. After receiving the verification failure instruction, the software client generates a request to cancel the installation and a request to obtain the certificate, and displays them on the visual interface of the terminal.

[0071] Exemplarily, after the server obtains the certificate to be authenticated from the terminal, it verifies the status of the certificate to be authenticated and obtains a verification result; the server can obtain the certificate actively through the operation management interface of the management center, or the software installation program can send the certificate to be authenticated to the management center during the initial installation. Manually triggering verification helps ensure that the source of the software is safe and reliable and avoid potential security threats.

[0072] Furthermore, the status of the certificate to be authenticated refers to the situation displayed by the certificate to be authenticated during the verification process, for example:

[0073] Validity period: The certificate has clear effective and expiration dates. If the current date of the certificate is not within its validity period, it is considered illegal.

[0074] Revocation status: For example, when the private key is leaked or the terminal is no longer trusted, the management center (server) may have revoked the certificate.

[0075] Certificate signature: The server verifies that the signature is correct.

[0076] Certificate Information: The identifier contained in the certificate must match the endpoint requesting authentication.

[0077] Key strength: The certificate's encryption algorithm and key length may also affect its validity.

[0078] When the server verifies these conditions, it will get two verification results.

[0079] First, the certificate status is legal; it means that all conditions are met, the server confirms that the certificate is valid, generates a verification instruction and sends it to the software client, allowing the software client to continue to perform subsequent operations, such as starting the application or completing the installation.

[0080] The second is that the certificate status is illegal; it means that the certificate fails a certain condition, and the server will generate a verification failure instruction, prompting the software client that there is a problem with the certificate. The software client then provides a dialog box option to allow the user to cancel the installation or obtain a new certificate in a visual interface.

[0081] The process also includes:

[0082] Step S3: If the certificate acquisition request is responded to, a dynamic code acquisition instruction is generated and sent to the software client; otherwise, the software client is stopped.

[0083] The step S3 specifically includes:

[0084] Respond to the certificate acquisition request in the visual interface, and the software client sends the responded certificate acquisition request to the server;

[0085] The server generates a dynamic code acquisition instruction according to the certificate acquisition request after the response, and sends it to the software client;

[0086] The software client responds to the installation cancellation request on the visual interface, and according to the installation cancellation request after the response, exits the software installation program to stop running the software client.

[0087] Exemplarily, responding to the request to obtain a certificate in the visual interface means that the software user clicks the dialog box at the terminal, indicating that he is willing to obtain a new certificate to continue the installation. The software client sends the response to the request to obtain a certificate to the management center, and the management center generates a dynamic code acquisition instruction based on the request to obtain a certificate. The dynamic code acquisition instruction requires the software client to obtain a dynamic machine code in some way. Alternatively, the software client stops the installation according to the request to cancel the installation after the response.

[0088] The process also includes:

[0089] Step S4: the software client receives and executes the dynamic code acquisition instruction to generate a dynamic machine code;

[0090] The step S4 specifically includes:

[0091] The software client obtains multiple unique identifiers of the terminal;

[0092] splicing the multiple unique identifiers in a first predefined structure to generate a composite identifier;

[0093] Asymmetrically encrypt the composite identifier to generate the dynamic machine code.

[0094] Exemplarily, the dynamic code acquisition instruction is generated by the server and sent to the software client. After receiving the dynamic code acquisition instruction, the software client calls the dynamic machine code generator to execute the dynamic code acquisition instruction to generate a dynamic machine code. The execution steps of the dynamic code acquisition instruction are:

[0095] The software client obtains multiple unique identifiers of the terminal, and splices the multiple unique identifiers in a first predefined structure to generate a composite identifier; the composite identifier is then operated through an asymmetric national commercial encryption algorithm (SM2 algorithm) to obtain the dynamic machine code. Therefore, each generated dynamic machine code can effectively protect the multiple unique identifiers of the terminal from being tampered with and leaked during the transmission process.

[0096] Exemplarily, multiple unique identifiers of a terminal represent a series of fixed attributes on the terminal, and the fixed attributes remain unchanged during the life cycle of the terminal and are difficult to be modified externally. The fixed attributes may include:

[0097] CPU ID: Central Processing Unit Identification, a unique identifier assigned by the hardware manufacturer when the processor is produced.

[0098] MAC: The physical address of the network interface card (NIC). Every network device has a unique MAC address.

[0099] UUID: Universally Unique Identifier. The operating system will generate a globally unique ID during installation.

[0100] BIOS: Version information of the basic input and output system, which can be used as a feature of the terminal.

[0101] ITS, Installation Timestamp, is the timestamp when the terminal first starts the software installation program. It can be used to generate a change identifier.

[0102] Splicing into a composite identifier according to a first predefined structure involves splicing the multiple unique identifiers according to the first predefined structure to generate a composite identifier.

[0103] Specifically, the steps of splicing the first predefined structure in this embodiment are:

[0104] ① Weighting: assign a preset sequence weight to each unique identifier, and then sort them according to the sequence weight to get the first string . Its mathematical expression is: is a set of n unique identifiers, W is a set of sequence weights, and Respectively represent identifiers and their order weights; is a permutation function such that ; Therefore, the first string The associated formula is:

[0105] ;

[0106] ;

[0107] ;

[0108] in, Represents the string concatenation operation;

[0109] Exemplarily, the order weight is pre-assigned by the server in the software client. Specifically, given a set of unique identifiers, the set of unique identifiers includes CPU ID, MAC, UUID, BIOS version and installation timestamp, the order weight is listed as follows:

[0110] CPU ID: 5

[0111] MAC : 4

[0112] UUID: 3

[0113] BIOS: 2

[0114] ITS:1.

[0115] In this order-weighted list, the CPU ID will come first in the composite identifier, followed by the MAC address, and so on, until the installation timestamp comes last.

[0116] Of course, the specific values ​​of these weights are determined according to the requirements and security policies of the system designer. The distribution of sequential weights may be different in different scenarios and applications.

[0117] ②Add the current timestamp: in the first string Add the current timestamp to the end to get the second string ,Right now: ; Where T is the current timestamp to ensure that the second string generated each time is unique;

[0118] ③Use hash function For the second string Perform hash processing to obtain a hash value of fixed length ;

[0119] ④In a fixed-length hash value Add random salt value , and obtain the composite identifier D. The association formula of the composite identifier D is:

[0120]

[0121] In summary, the process of obtaining the composite identifier can be represented by a function F, which accepts the identifier set I, the sequence weight set W, the current timestamp T and the random salt value T as input, and outputs the composite identifier. The associated formula is:

[0122]

[0123] Furthermore, the composite identifier is then sent to the asymmetric national commercial encryption algorithm (SM2) for encryption, and finally forms a dynamic machine code, which is then sent back to the server.

[0124] Exemplarily, the asymmetric national commercial encryption algorithm of this embodiment is the SM2 algorithm, which performs asymmetric encryption on the composite identifier based on elliptic curve cryptography (ECC). The specific encryption process is as follows:

[0125] The server generates an ECC key pair, including a private key k and a public key P. The private key k is a randomly selected large integer, and the public key P is calculated by point multiplication. Generate, where G is a known base point on the elliptic curve. Due to the discrete logarithm problem on the elliptic curve, it is very difficult to deduce the private key k from the public key P, and the private key k needs to be kept strictly confidential and used by the server, while the public key P can be publicly distributed and distributed by the server to the software client.

[0126] The specific steps are:

[0127] Randomly select an integer r that is less than the order of the elliptic curve;

[0128] Calculation Point ;

[0129] Then calculate the point ,because ,so, ;

[0130] Use a symmetric encryption algorithm (such as AES) and a temporary key K to encrypt the composite identifier D to obtain the ciphertext C; the associated formula is: , Enc means using encryption algorithm;

[0131] Using the x coordinate of point S, create a shared key ; The associated formula is: , Hash means using a hash function, i.e. a shared key Based on coordinates Derived through a hash function;

[0132] Using a shared key Encrypt the temporary key K to obtain the encrypted ciphertext ; Its associated formula is: ;

[0133] The final dynamic machine code consists of three parts: the coordinates of point R, the key-encrypted ciphertext K' and the data ciphertext C; its mathematical expression is:

[0134]

[0135] It indicates that the composite identifier D is encrypted by the SM2 algorithm to obtain a dynamic machine code.

[0136] After obtaining the dynamic machine code, the software client sends it back to the server.

[0137] The dynamic machine code is processed by the SM2 algorithm to ensure that even if the spliced ​​composite identifier is intercepted, the real content cannot be directly interpreted, thereby protecting the privacy and security of the terminal. The final dynamic machine code not only contains the unique identification of the terminal, but also undergoes high-intensity encryption processing to ensure security and tamper-proof during transmission.

[0138] The process also includes:

[0139] Step S5: Generate the certificate to be authenticated according to the dynamic machine code;

[0140] The step S5 specifically includes:

[0141] Receive dynamic machine code obtained from the software client;

[0142] Decrypt the dynamic machine code to obtain a decrypted composite identifier;

[0143] Get the note information;

[0144] The certificate to be authenticated is generated according to the remark information and the decrypted composite identifier.

[0145] Exemplarily, after the server obtains the dynamic machine code from the software client, it uses the private key k paired with the dynamic machine code to decrypt the dynamic machine code to obtain the composite identifier obtained based on the aforementioned terminal. The decryption steps are specifically:

[0146] First, the server uses its stored private key k to decrypt point R. Since point R is generated by private key k and a random number r, the server can use its private key k to recover the random number r and then calculate point S;

[0147] Second, the server uses the x coordinate of point S to create a shared key ;

[0148] Again, using a shared key To decrypt the encrypted ciphertext , recover the temporary key K;

[0149] Finally, the temporary key K is used to decrypt the ciphertext C to obtain the decrypted composite identifier D.

[0150] Further, generating the certificate to be authenticated according to the remark information and the decrypted composite identifier includes:

[0151] Combining the remark information and the decrypted composite identifier to generate a message to be signed;

[0152] Generate a fixed-length summary based on the message to be signed;

[0153] Encrypting the fixed-length digest to generate a digital signature;

[0154] The message to be signed, the fixed-length digest and the digital signature are encapsulated in a second predefined structure to obtain the certificate to be authenticated.

[0155] Exemplarily, the remark information refers to the remark information about the software terminal filled in by the authentication system administrator of the management center; for example, the software name, version, validity period, publisher information, etc.

[0156] The decrypted composite identifier D is combined with the remarks information provided by the authentication system administrator to form a message to be signed;

[0157] Hash the message to be signed to generate a fixed-length summary;

[0158] Use the private key k to encrypt the summary and obtain a digital signature;

[0159] The message to be signed, the digest and the digital signature are encapsulated according to the second predefined data structure to obtain the authentication certificate; wherein the second predefined data structure adopts one of the standard formats of JSON (JavaScript Object Notation) or XML (eXtensible Markup Language) or ASN.1 (Abstract Syntax Notation One). That is to say, this embodiment adopts JSON or XML or ASN.1 to combine the message to be signed, the digest and the digital signature into a structured data packet, and the structured data packet serves as the certificate to be authenticated in this embodiment.

[0160] The process also includes:

[0161] Step S6, distribute the certificate to be authenticated to the terminal. Distributing the certificate to be authenticated to the terminal means that one of the data sources of the certificate to be authenticated is the unique identifier of the terminal. Therefore, the certificate to be authenticated is distributed to the software client of the terminal through network transmission or certificate transfer storage. After that, run the software installation program again to execute steps S1 and S2, and then obtain the verification result that the status of the certificate to be authenticated is legal.

[0162] A dynamic authentication method in this embodiment generates a dynamic machine code in real time by using multiple unique identifiers of the terminal, so it has strong real-time performance; and through sequential weighting and weighted asymmetric encryption of each identifier, the unpredictability and tamper-proofness of the software authentication process are improved, thereby improving the network security performance in the software management process.

[0163] The embodiment of the present invention also provides a dynamic authentication device, which is used to implement the above method embodiment, and the description has been made no further. The terms "module", "unit", "subunit" and the like used below can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware is also possible and conceivable.

[0164] like Figure 2 As shown, Figure 2 It is a structural block diagram of a dynamic authentication device of the present invention, the device comprising:

[0165] The acquisition module 101 is used to obtain the to-be-authenticated certificate of the software client in the terminal;

[0166] Verification module 102, used to verify the legality of the status of the certificate to be authenticated. If the status is legal, continue to run the software client; otherwise, the software client displays a request to cancel the installation and a request to obtain the certificate on a visual interface;

[0167] The request response module 103 is used to generate a dynamic code acquisition instruction and send it to the software client if responding to the certificate acquisition request; otherwise, stop running the software client;

[0168] The machine code generation module 104 is used for the software client to receive and execute the dynamic code acquisition instruction to generate a dynamic machine code;

[0169] The certificate generation module 105 is used to generate the certificate to be authenticated according to the dynamic machine code;

[0170] The certificate distribution module 106 is used to distribute the certificate to be authenticated to the terminal.

[0171] In the above device, the certificate to be authenticated of the software client in the terminal is obtained through the obtaining module 101;

[0172] Through the verification module 102, the software client continues to run, or the software client displays the cancellation of the installation request and the request to obtain the certificate on the visual interface; through the request response module 103, a dynamic code acquisition instruction is generated, or the software client stops running; through the machine code generation module 104, a dynamic machine code is generated; through the certificate generation module 105, a certificate to be authenticated is generated; through the certificate distribution module 106, the certificate to be authenticated is distributed to the terminal. This solves the problem that the traditional authentication method lacks dynamic authentication and is prone to information being cracked and tampered.

[0173] like Figure 3As shown, an embodiment of the present invention further provides an electronic device, which includes a memory 230 and a processor 210, wherein the memory 230 stores at least one computer executable instruction, and the processor 210 is configured to run the computer executable instruction, and when the computer executable instruction is run by the processor 210, the above-mentioned dynamic authentication method is implemented.

[0174] The electronic device may include a processor 210, a communication interface 220, a memory 230, and a communication bus 240, wherein the processor 210, the communication interface 220, and the memory 230 communicate with each other through the communication bus 240. The processor 210 may call the logic instructions in the memory 230 to execute a dynamic authentication method disclosed in this embodiment.

[0175] In addition, the logic instructions in the above-mentioned memory 230 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0176] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0177] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0178] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dynamic authentication method, which is applied to a server, characterized in that: The method comprises: Obtain the certificate to be authenticated of the software client in the terminal; Performing a legal verification on the status of the certificate to be authenticated, and if the status is legal, continuing to run the software client; otherwise, the software client displays a request to cancel the installation and a request to obtain the certificate on a visual interface; If the certificate acquisition request is responded, a dynamic code acquisition instruction is generated and sent to the software client; otherwise, the software client is stopped; The software client receives and executes the dynamic code acquisition instruction to generate a dynamic machine code; The software client receives and executes the dynamic code acquisition instruction to generate a dynamic machine code; including: The software client obtains multiple unique identifiers of the terminal; splicing the multiple unique identifiers in a first predefined structure to generate a composite identifier; The multiple unique identifiers are concatenated in a first predefined structure to generate a composite identifier, including: Assigning a preset sequence weight to each unique identifier, and then sorting them according to the sequence weight to obtain a first string; Add the current timestamp to the end of the first string to get the second string; Using a hash function to hash the second string to obtain a hash value of a fixed length; Adding a random salt value to a hash value of a fixed length to obtain the composite identifier; Asymmetrically encrypting the composite identifier to generate the dynamic machine code; generating the certificate to be authenticated according to the dynamic machine code; Generating the certificate to be authenticated according to the dynamic machine code; comprising: Receive dynamic machine code obtained from the software client; Decrypt the dynamic machine code to obtain a decrypted composite identifier; Get the note information; generating the certificate to be authenticated according to the remark information and the decrypted composite identifier; Distribute the certificate to be authenticated to the terminal.

2. A dynamic authentication method according to claim 1, characterized in that: Obtain the certificate to be authenticated of the software client in the terminal; including: Running a software installation program, the software installation program sends a software registration request to the server; Receiving the software registration request, the server generates a certificate acquisition instruction and sends it to the software client; The software client receives the certificate acquisition instruction and sends the certificate to be authenticated to the server.

3. A dynamic authentication method according to claim 1, characterized in that: Performing a legal verification on the status of the certificate to be authenticated, and if the status is legal, continuing to run the software client; Otherwise, the software client displays a request to cancel the installation and obtain a certificate on the visual interface; including: Receiving the certificate to be authenticated obtained from the terminal; Verifying the status of the certificate to be authenticated to obtain a verification result; The verification result includes: the status of the certificate to be authenticated is legal, the server generates a verification pass instruction and sends it to the software client to continue running the software client; The verification result also includes: if the status of the certificate to be authenticated is illegal, the server generates a verification failure instruction and sends it to the software client. After receiving the verification failure instruction, the software client generates a request to cancel the installation and a request to obtain the certificate, and displays them on the visual interface of the terminal.

4. A dynamic authentication method according to claim 2, characterized in that: If a certificate acquisition request is responded to, a dynamic code acquisition instruction is generated and sent to the software client; Otherwise, stop running the software client; including: Respond to the certificate acquisition request in the visual interface, and the software client sends the responded certificate acquisition request to the server; The server generates a dynamic code acquisition instruction according to the certificate acquisition request after the response, and sends it to the software client; The software client responds to the installation cancellation request on the visual interface, and according to the installation cancellation request after the response, exits the software installation program to stop running the software client.

5. A dynamic authentication method according to claim 1, characterized in that: Generate the certificate to be authenticated according to the remark information and the decrypted composite identifier; including: Combining the remark information and the decrypted composite identifier to generate a message to be signed; Generate a fixed-length summary based on the message to be signed; Encrypting the fixed-length digest to generate a digital signature; The message to be signed, the fixed-length digest and the digital signature are encapsulated in a second predefined structure to obtain the certificate to be authenticated.

6. A dynamic certificate generation device, characterized in that: include: An acquisition module is used to obtain the certificate to be authenticated of the software client in the terminal; A verification module, used to verify the legality of the status of the certificate to be authenticated, and if the status is legal, continue to run the software client; Otherwise, the software client displays a request to cancel the installation and a request to obtain a certificate on the visual interface; The request response module is used to generate a dynamic code acquisition instruction in response to the certificate acquisition request and send it to the software client; Otherwise, stop running the software client; A machine code generation module is used for the software client to receive and execute the dynamic code acquisition instruction to generate a dynamic machine code; The software client receives and executes the dynamic code acquisition instruction to generate a dynamic machine code; including: The software client obtains multiple unique identifiers of the terminal; splicing the multiple unique identifiers in a first predefined structure to generate a composite identifier; The multiple unique identifiers are concatenated in a first predefined structure to generate a composite identifier, including: Assigning a preset sequence weight to each unique identifier, and then sorting them according to the sequence weight to obtain a first string; Add the current timestamp to the end of the first string to get the second string; Using a hash function to hash the second string to obtain a hash value of a fixed length; Adding a random salt value to a hash value of a fixed length to obtain the composite identifier; Asymmetrically encrypting the composite identifier to generate the dynamic machine code; A certificate generation module, used to generate the certificate to be authenticated according to the dynamic machine code; Generating the certificate to be authenticated according to the dynamic machine code; comprising: Receive dynamic machine code obtained from the software client; Decrypt the dynamic machine code to obtain a decrypted composite identifier; Get the note information; generating the certificate to be authenticated according to the remark information and the decrypted composite identifier; The certificate distribution module is used to distribute the certificate to be authenticated to the terminal.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores at least one computer executable instruction, the processor is configured to execute the computer executable instruction, and the computer executable instruction, when executed by the processor, implements a dynamic authentication method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: A computer program is stored on a computer-readable storage medium, and when the computer program is executed by a processor, a dynamic authentication method according to any one of claims 1 to 5 is implemented.

Images