An identity authentication method, system, device and medium for maintaining login status of application

Abstract

The present invention provides an identity authentication method, system, device and medium for maintaining a login state of an application, belonging to the field of information security. The invention performs complex and multi-faceted identity authentication on the user at the first login, thereby ensuring the accuracy of the user's identity, and the user carries an access password that can identify the user's identity each time the user accesses the back-end interface. The access password is set with an expiration date, and the password becomes invalid after being used once, thereby increasing the difficulty of the request being intercepted; when the user's access password expires, a visa-free authentication operation can be performed, thereby eliminating the need for a tedious and complex identity authentication process for the user, and the visa-free authentication is based on the unique information of the mobile device and the pass token obtained after the user's identity authentication is successful, and such an operation ensures the security of the login.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to an identity authentication method, system, device and medium for maintaining a login state by using the authentication method. Background Art

[0002] With the continuous development of mobile terminal devices such as smartphones and tablets, mobile App applications have covered people's lives, work, and study, and the usage time has far exceeded that of computers; due to the portability, rich application, and real-time online nature of mobile terminals, its use is different from that of computers.

[0003] When using an application on a computer, the user's identity is usually verified by operations such as username and password, SMS verification code, etc. After use, the application will be exited, and the next time it is used, it needs to be logged in again. However, for mobile terminals, it can be used at any time and any place, and the duration of each use is very arbitrary. Therefore, if the user is required to perform cumbersome authentication such as username and password, SMS verification or biometric information recognition every time, this will reduce the user experience. Based on this demand, the present invention proposes a safe and practical solution that can keep the application logged in on the mobile terminal for a long time. Summary of the invention

[0004] In order to solve the problem that existing mobile applications require frequent security authentication when used, which reduces the user experience, the present invention provides an identity authentication method for keeping the application logged in, specifically an identity authentication method for keeping the application logged in for a long time on a mobile device. This method can ensure that users enjoy a more convenient user experience in a more secure environment on the mobile terminal.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] An identity authentication method for keeping an application logged in, comprising the following steps:

[0007] Obtain the user identity information and unique feature information of the mobile device, perform user login verification through the identity information, create a non-valid pass token after the verification is passed, and generate a valid single-access authentication password; at the same time, establish a mapping relationship between the pass token, user identity information and unique feature information of the mobile device, establish a mapping relationship between the single-access authentication password and the user identity information, and return the pass token and single-access authentication password after the mapping relationship is established to the mobile terminal;

[0008] Receive an access request from a mobile user carrying a single access authentication password, and verify the single access authentication password;

[0009] If the single-access authentication password is verified, the request is allowed to access the interface normally, and a new single-access authentication password is generated when the information is returned. The previous single-access authentication password becomes invalid, and the new single-access authentication password is used as the password carried in subsequent requests;

[0010] If the single-access authentication password expires, the password expiration information will be fed back to the mobile terminal, and the mobile terminal will receive the visa-free authentication request sent to the server after receiving the expiration information, and perform visa-free authentication. The visa-free authentication is performed by issuing a new visa-free token and a new authentication password.

[0011] Preferably, the visa-free authentication request is an authentication request issued by the mobile terminal after receiving the password expiration information fed back by the server and collecting the unique feature information of the mobile device and the pass token corresponding to the unique feature information of the mobile device.

[0012] Preferably, after generating the single-access authentication password, the method further includes setting a validity period of the single-access authentication password, wherein the unit of the validity period is minutes.

[0013] Preferably, the receiving of the access request from the mobile user carrying the single access authentication password and verifying the single access authentication password specifically includes:

[0014] If the visa-free authentication is passed, a new pass token will be generated to replace the old pass token; a new valid single-access authentication password will be generated, and the new pass token and new pass password will be fed back to the mobile terminal; after receiving it, the mobile terminal will update the pass token in the local application storage space and use the new single-access authentication password to make a new interface request;

[0015] If the visa-free authentication fails, the pass token will be invalidated, the application will be completely logged out, and the user will be asked to re-authenticate to confirm that the current operation is indeed the user himself. After the verification is passed, a new pass token and single-access authentication password will be issued;

[0016] If the authentication password is incorrect, the backend pass token and authentication password will all become invalid, the application will log out, and the user will be required to re-authenticate.

[0017] Preferably, the unique characteristic information of the mobile device includes IMEI, MEID, Android ID, MAC address, Serial Number and device baseband number.

[0018] Preferably, the user login verification through identity information is specifically one or more of username and password verification, user biometric identification verification or SMS verification, and the user biometric identification verification is facial recognition verification or fingerprint recognition verification.

[0019] Preferably, after the mobile terminal obtains the pass token and the single-access authentication password, it saves the pass token to the application storage space of the mobile terminal and prohibits other applications from accessing it. When subsequent users access the server, they must carry the single-access authentication password to access the server interface.

[0020] The present invention also provides an identity authentication system for maintaining a login state of an application, comprising:

[0021] The password generation module is used to obtain the mobile terminal user identity information and the unique characteristic information of the mobile device, perform user login verification through the identity information, create a non-valid pass token after the verification is passed, and generate a valid single-access authentication password; at the same time, a mapping relationship is established between the pass token, the user identity information and the unique characteristic information of the mobile device, and a mapping relationship is established between the single-access authentication password and the user identity information, and the pass token and the single-access authentication password after the mapping relationship is established are returned to the mobile terminal;

[0022] A password verification module is used to receive an access request from a mobile user carrying a single access authentication password and verify the single access authentication password;

[0023] If the single-access authentication password is verified, the request is allowed to access the interface normally, and a new single-access authentication password is generated when the information is returned. The previous single-access authentication password becomes invalid, and the new single-access authentication password is used as the password carried in subsequent requests;

[0024] If the single-access authentication password expires, the password expiration information will be fed back to the mobile terminal, and the mobile terminal will receive the visa-free authentication request sent to the server after receiving the expiration information, and perform visa-free authentication. The visa-free authentication is performed by issuing a new visa-free token and a new authentication password.

[0025] The present invention also provides a computer device, comprising a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement any one of the steps in the identity authentication method for maintaining a logged-in state for the application.

[0026] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is loaded by a processor, it can execute any one of the steps in the identity authentication method for maintaining a logged-in state for the application.

[0027] The identity authentication method for maintaining a logged-in application provided by the present invention has the following beneficial effects:

[0028] The present invention performs user login verification through identity information at the first login, thus ensuring the accuracy of the user's identity, and each time the user accesses the back-end interface, the user carries an access password that can identify the user's identity. The access password is set with an expiration date and becomes invalid after being used once, thus increasing the difficulty of the request being intercepted; when the user's access password expires, a visa-free authentication operation can be performed, thus eliminating the need for a tedious and complicated identity authentication process for the user, and the visa-free authentication is based on the unique information of the mobile device and the pass token obtained after the user's identity authentication is successful, thus ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiment of the present invention and its design scheme, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 This is a flow chart of an identity authentication method for maintaining a logged-in state for an application in Example 1 of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the technical solution of the present invention and implement it, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.

[0032] The present invention provides an identity authentication method for maintaining a login state for an application, specifically an identity authentication method for maintaining a login state for a long time on a mobile terminal device, the method is applied on a server side, and comprises the following steps:

[0033] Obtain the user identity information and unique feature information of the mobile device, perform user login verification through the identity information, create a non-valid pass token after the verification is passed, and generate a valid single-access authentication password; at the same time, establish a mapping relationship between the pass token, user identity information and unique feature information of the mobile device, establish a mapping relationship between the single-access authentication password and the user identity information, and return the pass token and single-access authentication password after the mapping relationship is established to the mobile terminal. The unique feature information of the mobile device in the present invention includes IMEI, MEID, Android ID, MAC address, SerialNumber and device baseband number. The present invention performs user login verification through identity information, specifically one or more of username and password verification, user biometric identification verification or SMS verification, and the user biometric identification verification is facial recognition verification or fingerprint recognition verification.

[0034] Receive an access request from a mobile user carrying a single-access authentication password, and verify the single-access authentication password.

[0035] If the single-access authentication password is verified, the request is allowed to access the interface normally, and a new single-access authentication password is generated when the information is returned. The previous single-access authentication password becomes invalid, and the new single-access authentication password is used as the password carried in subsequent requests.

[0036] If the single-access authentication password expires, the password expiration information is fed back to the mobile terminal, and the mobile terminal receives the visa-free authentication request sent to the server after receiving the expiration information, and performs visa-free authentication, which is performed by issuing a new visa-free token and a new authentication password. The visa-free authentication request in the present invention is an authentication request issued by the mobile terminal after receiving the password expiration information fed back by the server, collecting the unique feature information of the mobile device and the pass token corresponding to the unique feature information of the mobile device.

[0037] Furthermore, after the single access authentication password is generated, the validity period of the single access authentication password is set, and the unit of the validity period is minutes.

[0038] Receive access requests from mobile users with a single access authentication password and verify the single access authentication password, including:

[0039] If the visa-free authentication is passed, a new pass token will be generated to replace the old pass token; a new valid single-access authentication password will be generated, and the new pass token and new pass password will be fed back to the mobile terminal; after receiving it, the mobile terminal will update the pass token in the local application storage space and use the new single-access authentication password to make a new interface request.

[0040] If the visa-free authentication fails, the pass token will be invalidated, the application will completely log out, and enter the login interface, requiring the user to re-authenticate to confirm that the current operation is indeed the user himself. After the verification is passed, a new pass token and single-access authentication password will be issued.

[0041] If the authentication password is incorrect, the backend pass token and authentication password will all become invalid, the application will log out, and the user will be required to re-authenticate.

[0042] After obtaining the pass token and the single-access authentication password on the mobile terminal, the present invention also saves the pass token to the application storage space of the mobile terminal and prohibits other applications from accessing it. When subsequent users access the server, they must carry the single-access authentication password to access the server interface.

[0043] Below, a method for identity authentication for maintaining a long-term login state on a mobile terminal device provided by the present invention is further described through a specific embodiment.

[0044] Example 1

[0045] This embodiment provides an identity authentication method for maintaining a long-term login state on a mobile device. Figure 1 As shown, the following steps are included:

[0046] Step 1. When a user logs in to an app on a mobile device for the first time, a complex and multi-dimensional user authentication operation (for example, a combination of user name and password, SMS verification code, facial recognition, fingerprint recognition, etc.) can be used. After the backend successfully authenticates the user's identity, it will collect the device's unique information (for example, IMEI, MEID, Android ID, MAC address, Serial Number, and device baseband number, etc.) on the mobile device and send it to the server. The server will create a pass token (without validity period) and establish a mapping relationship between the pass token and the mobile device's unique information and user identity information records submitted by the user; at the same time, a single-access authentication password (with validity period) is generated, and the single-access authentication password is also mapped to the user's identity information. The server returns the pass token and the single-access authentication password to the mobile device.

[0047] Step 2: After the mobile terminal successfully logs in, it receives the pass token and single-access authentication password from the backend. The pass token will first be saved in the mobile terminal application storage space (which is prohibited from being accessed by other applications). Then the user will carry the single-access authentication password to access the server in subsequent operations.

[0048] Step 3: After receiving the user request, the server will first verify the user's single access authentication password.

[0049] If the password access verification is successful, the user identity information is obtained based on the password and subsequent normal processing is performed. After the processing is completed, the server will feedback the response data and the new single-access authentication password (the old password is invalid, and the new password replaces the old password and establishes a mapping relationship with the user identity information) to the mobile terminal.

[0050] If the password verification times out, the mobile terminal will be asked to automatically initiate a visa-free verification request. When initiating the visa-free verification request, the mobile terminal will collect the unique information of the mobile device and the pass token as request parameters to initiate a request to the server; the server will verify the unique information of the mobile device and the pass token submitted in the request.

[0051] (1) If the access token and the unique information of the mobile device are consistent with the records, a new access token is generated to replace the old access token, and a new valid single-access authentication password (with an expiration date) is generated and fed back to the mobile terminal. After the mobile terminal receives the new access token and the single-access authentication password, it will first replace the old access token with the new access token, and then use the new single-access authentication password to access the server interface for normal operations.

[0052] (2) If the unique information of the pass token and mobile device is inconsistent with the records, it means that the user may have been attacked by hackers. The backend will invalidate all the pass tokens and single-access authentication passwords, clear all information that keeps the user logged in, and require the user to perform complex and multi-dimensional user identity authentication operations again. After successful verification, the subsequent operations will be carried out according to step 1.

[0053] (3) If the password is incorrect, it means that the user's identity information may be leaked. The server will invalidate and clear all pass tokens and single-access authentication passwords, keep all user login information, and require the user to perform a complex and multi-dimensional user identity authentication operation again. After successful verification, the server will proceed to step 1.

[0054] The present invention also provides an identity authentication system for maintaining a login state. The system is applied on a server side and comprises a password generation module and a password verification module.

[0055] Specifically, the password generation module is used to obtain the mobile user identity information and the unique characteristic information of the mobile device, perform user login verification through the identity information, create a pass token with no validity period after the verification is passed, and generate a single-access authentication password with a validity period; at the same time, a mapping relationship is established between the pass token, user identity information and the unique characteristic information of the mobile device, and a mapping relationship is established between the single-access authentication password and the user identity information, and the pass token and single-access authentication password after the mapping relationship is established are returned to the mobile terminal.

[0056] The password verification module is used to receive an access request from a mobile user carrying a single access authentication password and verify the single access authentication password.

[0057] If the single-access authentication password is verified, the request is allowed to access the interface normally, and a new single-access authentication password is generated when the information is returned. The previous single-access authentication password becomes invalid, and the new single-access authentication password is used as the password carried in subsequent requests.

[0058] If the single-access authentication password expires, the password expiration information will be fed back to the mobile terminal, and the mobile terminal will receive the visa-free authentication request sent to the server after receiving the expiration information, and perform visa-free authentication. The visa-free authentication is performed by issuing a new visa-free token and a new authentication password.

[0059] In this embodiment, user identity authentication, password authentication and visa-free authentication are all performed on the application server, and user identity authentication, password authentication and visa-free authentication constitute the authentication module. After the password is verified, the backend interface is accessed to access the application service cluster.

[0060] Each module in the above-mentioned identity authentication system for keeping the login state of the application can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0061] The present invention also provides a computer device, including a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps in the embodiment of the identity authentication method for keeping the application logged in. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0062] Furthermore, the present invention also provides a non-temporary computer-readable storage medium containing instructions, and a computer program is stored on the storage medium. For example, a memory containing instructions, the above instructions can be executed by a processor of a computer device to complete the above method. For example, a non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a tape, a floppy disk, and an optical data storage device. When the computer program is executed by the processor, the steps in the embodiment of the identity authentication method for maintaining the login state of the application can be implemented. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0063] The invention performs a complex and multi-faceted identity authentication on the user at the first login, thus ensuring the accuracy of the user's identity. Each time the user accesses the back-end interface, the user carries an access token that can identify the user's identity. The access token is set with an expiration date and becomes invalid after being used once, thus increasing the difficulty of the request being intercepted. When the user's access password expires, a visa-free authentication operation can be performed, thus eliminating the need for a tedious and complicated identity authentication process for the user. The visa-free authentication is based on the unique information of the mobile device and the pass token obtained after the user's identity authentication is successful. Such an operation ensures the security of the login.

[0064] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0065] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0066] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory generate an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0067] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to generate a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0068] It should be pointed out that the specific implementation methods described above can enable those skilled in the art to understand the invention more comprehensively, but do not limit the invention in any way. Therefore, although the invention has been described in detail in this specification and embodiments, those skilled in the art should understand that the invention can still be modified or replaced by equivalents; and all technical solutions and improvements that do not deviate from the spirit and scope of the invention are included in the protection scope of the patent for the invention. Any figure mark in the claims should not be regarded as limiting the claims involved. Any simple change or equivalent replacement of the technical solution that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention belongs to the protection scope of the present invention.

Claims

1. An identity authentication method for keeping an application logged in, characterized in that: The following steps are involved: Obtain the user identity information and unique feature information of the mobile device, perform user login verification through the identity information, create a non-valid pass token after the verification is passed, and generate a valid single-access authentication password; at the same time, establish a mapping relationship between the pass token, user identity information and unique feature information of the mobile device, establish a mapping relationship between the single-access authentication password and the user identity information, and return the pass token and single-access authentication password after the mapping relationship is established to the mobile terminal; Receive an access request from a mobile user carrying a single access authentication password, and verify the single access authentication password; If the single-access authentication password is verified, the request is allowed to access the interface normally, and a new single-access authentication password is generated when the information is returned. The previous single-access authentication password becomes invalid, and the new single-access authentication password is used as the password carried in subsequent requests; If the single-access authentication password expires, the password expiration information is fed back to the mobile terminal, and the mobile terminal receives the visa-free authentication request sent to the server after receiving the expiration information, and performs visa-free authentication. The visa-free authentication is performed by issuing a new visa-free token and a new authentication password; The visa-free authentication request is an authentication request issued by the mobile terminal after receiving the password expiration information fed back by the server, collecting the unique feature information of the mobile device and the pass token corresponding to the unique feature information of the mobile device. The server will verify the unique information of the mobile device and the pass token submitted in the request; If the visa-free authentication is passed, a new pass token will be generated to replace the old one; Generate a new valid single-access authentication password, and feed back a new pass token and a new pass password to the mobile terminal; After receiving the password, the mobile terminal updates the pass token in the local application storage space and uses the new single-access authentication password to make a new interface request; If the visa-free authentication fails, the pass token will be invalidated, the application will be completely logged out, and the user will be asked to re-authenticate to confirm that the current operation is indeed the user himself. After the verification is passed, a new pass token and single-access authentication password will be issued; If the authentication password is incorrect, the backend pass token and authentication password will all become invalid, the application will log out, and the user will be required to re-authenticate.

2. The identity authentication method for keeping the application logged in according to claim 1, characterized in that: After the single access authentication password is generated, the validity period of the single access authentication password is set, and the unit of the validity period is minutes.

3. The identity authentication method for keeping the application logged in according to claim 1, characterized in that: The unique characteristic information of the mobile device includes IMEI, MEID, Android ID, MAC address, SerialNumber and device baseband number.

4. The identity authentication method for keeping the application logged in according to claim 1, characterized in that: The user login verification through identity information is specifically one or more of username and password verification, user biometric identification verification or SMS verification, and the user biometric identification verification is facial recognition verification or fingerprint recognition verification.

5. The identity authentication method for keeping the application logged in according to claim 1, characterized in that: It also includes that after the mobile terminal obtains the pass token and the single-access authentication password, the pass token is saved in the application storage space of the mobile terminal and other applications are prohibited from accessing it. When subsequent users access the server, they must carry the single-access authentication password to access the server interface.

6. An identity authentication system in which an application remains logged in, characterized in that: include: The password generation module is used to obtain the mobile terminal user identity information and the unique characteristic information of the mobile device, perform user login verification through the identity information, create a non-valid pass token after the verification is passed, and generate a valid single-access authentication password; at the same time, a mapping relationship is established between the pass token, the user identity information and the unique characteristic information of the mobile device, and a mapping relationship is established between the single-access authentication password and the user identity information, and the pass token and the single-access authentication password after the mapping relationship is established are returned to the mobile terminal; A password verification module is used to receive an access request from a mobile user carrying a single access authentication password and verify the single access authentication password; If the single-access authentication password is verified, the request is allowed to access the interface normally, and a new single-access authentication password is generated when the information is returned. The previous single-access authentication password becomes invalid, and the new single-access authentication password is used as the password carried in subsequent requests; If the single-access authentication password expires, the password expiration information is fed back to the mobile terminal, and the mobile terminal receives the visa-free authentication request sent to the server after receiving the expiration information, and performs visa-free authentication. The visa-free authentication is performed by issuing a new visa-free token and a new authentication password; The visa-free authentication request is an authentication request issued by the mobile terminal after receiving the password expiration information fed back by the server, collecting the unique feature information of the mobile device and the pass token corresponding to the unique feature information of the mobile device. The server will verify the unique information of the mobile device and the pass token submitted in the request; If the visa-free authentication is passed, a new pass token will be generated to replace the old one; Generate a new valid single-access authentication password, and feed back a new pass token and a new pass password to the mobile terminal; After receiving the password, the mobile terminal updates the pass token in the local application storage space and uses the new single-access authentication password to make a new interface request; If the visa-free authentication fails, the pass token will be invalidated, the application will be completely logged out, and the user will be asked to re-authenticate to confirm that the current operation is indeed the user himself. After the verification is passed, a new pass token and single-access authentication password will be issued; If the authentication password is incorrect, the backend pass token and authentication password will all become invalid, the application will log out, and the user will be required to re-authenticate.

7. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is loaded into a processor, it can execute the steps of the method according to any one of claims 1 to 5.

Images