Application login method and device, electronic equipment and storage medium

Abstract

The invention provides an application login method and device, electronic equipment and a storage medium, and relates to the field of artificial intelligence such as application management, intelligent equipment and network security. The method comprises the following steps: in response to a detected login operation for a registered account of a target application, obtaining input first biological characteristic information; performing first authentication on the first biological characteristic information; in response to determining that the first authentication is passed, sending authentication information to the server; the login operation is executed in response to authentication passing information returned by the server side, and the authentication passing information is returned after the server side carries out second authentication on the login operation according to the authentication information and determines that the authentication passes. By applying the scheme of the invention, the processing efficiency can be improved, and the security of the target application account can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, and in particular to an application login method, device, electronic device and storage medium in the fields of application management, smart devices and network security. Background Art

[0002] With the development of technology, Virtual Private Network (VPN) has become a common network security protocol that can help users establish encrypted channels on public networks and protect data security and privacy. Summary of the invention

[0003] The present disclosure provides an application login method, device, electronic device and storage medium.

[0004] An application login method, comprising:

[0005] In response to detecting a login operation for a registered account of the target application, obtaining input first biometric information;

[0006] Performing a first authentication on the first biometric information;

[0007] In response to determining that the first authentication is passed, sending authentication information to the server;

[0008] In response to obtaining the authentication pass information returned by the server, a login operation is performed, wherein the authentication pass information is returned by the server after performing a second authentication on the login operation according to the authentication information and determining that the authentication is passed.

[0009] An application login method, comprising:

[0010] Acquire authentication information sent by a client of the target application, the authentication information being sent to the server after the client determines that a first authentication of first biometric information has passed, the first biometric information being input first biometric information acquired by the client in response to detecting a login operation for a registered account of the target application;

[0011] A second authentication is performed on the login operation according to the authentication information, and in response to determining that the second authentication is successful, authentication success information is returned to the client for the client to perform the login operation.

[0012] An application login device, comprising: a feature acquisition module and a login verification module;

[0013] The feature acquisition module is used to acquire input first biometric feature information in response to detecting a login operation for a registered account of the target application;

[0014] The login verification module is used to perform a first authentication on the first biometric information, send authentication information to the server in response to determining that the first authentication is successful, and perform a login operation in response to obtaining the authentication success information returned by the server. The authentication success information is returned by the server after performing a second authentication on the login operation based on the authentication information and determining that the authentication is successful.

[0015] An application login device, comprising: an information acquisition module and a security authentication module;

[0016] The information acquisition module is used to acquire authentication information sent by a client of the target application, wherein the authentication information is sent to the server after the client determines that a first authentication of first biometric information has passed, and the first biometric information is the input first biometric information acquired by the client in response to detecting a login operation for a registered account of the target application;

[0017] The security authentication module is used to perform a second authentication on the login operation according to the authentication information, and in response to determining that the second authentication is successful, return authentication success information to the client for the client to perform the login operation.

[0018] An electronic device, comprising:

[0019] at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the method described above.

[0022] A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method as described above.

[0023] A computer program product comprises a computer program / instruction, wherein the computer program / instruction implements the method described above when executed by a processor.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0026] Figure 1 This is a flowchart of the first embodiment of the application login method disclosed in the present invention;

[0027] Figure 2 A flowchart of a method embodiment of the registration operation process disclosed in the present invention;

[0028] Figure 3 This is a flow chart of a method embodiment of the login process disclosed in the present invention;

[0029] Figure 4 This is a flow chart of the second embodiment of the application login method disclosed in the present invention;

[0030] Figure 5 This is a schematic diagram of the composition structure of the first embodiment 500 of the application login device disclosed in the present invention;

[0031] Figure 6 This is a schematic diagram of the structure of the second embodiment 600 of the application login device disclosed in the present invention;

[0032] Figure 7 This is a schematic diagram of the structure of the third embodiment 700 of the application login device described in the present disclosure;

[0033] Figure 8 This is a schematic diagram of the structure of the fourth embodiment 800 of the application login device described in the present disclosure;

[0034] Fig. 9 A schematic block diagram of an electronic device 900 that can be used to implement an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0035] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0036] In addition, it should be understood that the term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0037] Figure 1 This is a flow chart of the first embodiment of the application login method disclosed in the present invention. Figure 1 As shown, the following specific implementation methods are included.

[0038] In step 101, in response to detecting a login operation for a registered account of a target application, input first biometric information is obtained.

[0039] In step 102, a first authentication is performed on the first biometric information.

[0040] In step 103, in response to determining that the first authentication is successful, authentication information is sent to the server.

[0041] In step 104, in response to obtaining the authentication pass information returned by the server, a login operation is performed, and the authentication pass information is returned after the server performs a second authentication on the login operation according to the authentication information and determines that the authentication is passed.

[0042] Currently, when a user needs to log in to an application connected to a VPN, such as an internal enterprise application, the implementation method is usually complicated. For example, when a user needs to log in to an internal enterprise application installed on a computer, he can first request a QR code image from a third party and show it to the user. After that, the user can use the code scanning function of another application installed on the mobile phone to scan the code to log in. The implementation process is relatively complicated, which increases the time cost and reduces the processing efficiency. Moreover, since the login requires the help of a third party and another application, it is difficult to guarantee the stability of the business.

[0043] By adopting the scheme described in the above method embodiment, the target application can be logged in conveniently and quickly by inputting the first biometric information, thereby reducing time costs, improving processing efficiency, and improving business stability, etc. Moreover, the login operation will only be performed after it is determined that the first authentication of the first biometric information and the second authentication of the current login operation are passed, that is, multiple verifications are performed, thereby improving the security of the target application account, etc.

[0044] In some embodiments of the present disclosure, the target application may be an application connected to a VPN network. Figure 1 The execution subject of the illustrated method embodiment may be a client of the target application.

[0045] Detecting a login operation for a registered account of the target application may refer to determining that a registered user has issued a login request, such as determining that the user has opened the target application.

[0046] Accordingly, the first biometric information input by the user can be obtained. There is no limitation on what kind of biometric information the first biometric information is. In some embodiments of the present disclosure, the first biometric information may be a fingerprint or a face. That is, the scheme described in the present disclosure is applicable to different biometric information. The following takes fingerprint as an example for explanation. In addition, whether it is biometric information such as fingerprint or face, it can be obtained after the user's authorization, that is, the biometric information can be obtained when the user allows the acquisition of the biometric information and knows the subsequent use of the acquired biometric information.

[0047] A login interface may be displayed to the user, such as the default login method being the fingerprint login method, or, if the default login method is another login method, such as the code scanning login method, the user may switch to the fingerprint login method through the operation interface, and then the user may input (enter) the first biometric information, i.e., the first fingerprint, according to the prompt content corresponding to the fingerprint login method. There is no restriction on how the user inputs the first fingerprint, for example, the first fingerprint may be input using the fingerprint entry function on the target device. The target device is an electronic device installed with the target application, such as a computer.

[0048] Furthermore, the first authentication may be performed on the acquired first biometric information. In some embodiments of the present disclosure, the first biometric information may be compared with the pre-saved second biometric information. In response to determining that the first biometric information is consistent with the second biometric information, it may be determined that the first authentication is passed. Conversely, if they are inconsistent, it may be determined that the first authentication is not passed. When it is determined that the first authentication is not passed, there is no restriction on how to proceed. For example, the user may be required to re-enter the first biometric information or the user may be directly prompted that the login failed.

[0049] For the sake of distinction, the acquired biometric information and the pre-stored biometric information are respectively referred to as the first biometric information and the second biometric information.

[0050] By comparing the two, the first authentication of the first biometric information can be conveniently and accurately achieved, thus laying a good foundation for subsequent processing.

[0051] In some embodiments of the present disclosure, the second biometric information may be biometric information input for logging into the target application during a registration operation for the target application.

[0052] If the user wishes to use the fingerprint login function described in the present invention, he or she must first bind the fingerprint and login account through the registration process. After the binding is successful, the fingerprint can be used to log in to the target application, which greatly improves convenience.

[0053] Specifically, after determining that the user opens the target application, the user may first be required to perform a login operation, such as requesting a QR code image from a third party and displaying it to the user, so that the user can use the scanning function of another application installed on the mobile phone to scan the code and log in.

[0054] Furthermore, a fingerprint entry guidance page may be displayed to the user to guide the user to enter the second biometric characteristic information, and the second biometric characteristic information may be saved.

[0055] Alternatively, in some embodiments of the present disclosure, during the execution of a registration operation, in response to obtaining the input of the third biometric information, a login account input interface is displayed, and the login account entered for the login account input interface is obtained. In response to determining that the login account is consistent with the login account obtained when the login is successful during the registration operation, the third biometric information can be determined as the second biometric information and saved. Otherwise, if they are inconsistent, the third biometric information may not be saved, and an error prompt may be given to the user, etc. The specific method is not limited, for example, the user may be asked to log in again, etc.

[0056] Through the above processing, secondary verification of the user identity can be achieved, thereby ensuring that the login account and the second biometric information correspond to the same user, thereby further improving the security of the target application and VPN network.

[0057] In some embodiments of the present disclosure, during the registration operation, a key pair corresponding to the target device may also be generated, the key pair including a public key and a private key. The target device is an electronic device installed with the target application. The device identification (ID) and public key of the target device are sent to the server, and a token (secret) returned by the server is obtained. The secret is a secret corresponding to the target device generated by the server. Through this process, preliminary preparations can be made for subsequent security authentication.

[0058] There is no restriction on how to generate the public key and private key corresponding to the target device. For example, an asymmetric encryption (RSA, Rivest-Shamir-Adleman) algorithm may be used to generate the public key and private key.

[0059] Afterwards, the device identification and public key of the target device can be sent to the server, which can be the background authentication server corresponding to the target application. Accordingly, the server can use a predetermined algorithm to generate a secret corresponding to the target device and return the generated secret. In addition, the server can also save the acquired device identification, public key and generated secret accordingly.

[0060] Correspondingly, for the client, the secret returned by the server, the private key generated by itself (which may also include the public key) and the second biometric information will be saved.

[0061] In some embodiments of the present disclosure, the client can encrypt the second biometric information, secret, private key and other information through the Advanced Encryption Standard (AES) algorithm and save them to the keychain of the target device, thereby preventing the information from being illegally obtained, thereby improving the security of the information.

[0062] Combined with the above introduction, Figure 2 This is a flow chart of an embodiment of the registration operation process described in the present disclosure. Figure 2 As shown, the following specific implementation methods are included.

[0063] In step 201, a registration operation process is performed, and in response to determining that the login is successful, the input third biometric feature information is obtained.

[0064] In step 202, the login account input interface is displayed, the login account input for the login account input interface is obtained, and the login account is compared with the login account obtained when the login is successful to see if they are consistent. If so, step 203 is executed, otherwise, the process ends.

[0065] In step 203, the third biometric characteristic information is determined as the second biometric characteristic information, and the second biometric characteristic information is encrypted by an AES algorithm and then saved in the Keychain of the target device.

[0066] In step 204, a key pair corresponding to the target device is generated, including a public key and a private key.

[0067] In step 205, the device identification and public key of the target device are sent to the server, and the secret returned by the server is obtained.

[0068] In step 206, the secret and private key are encrypted using the AES algorithm and saved in the Keychain of the target device, and the process ends.

[0069] Through the above processing, the registration operation process is completed, and the user can subsequently log in to the target application by entering the first biometric information. Accordingly, in response to detecting a login operation for a registered account for the target application, the first biometric information input by the user can be obtained, and the first biometric information can be authenticated first. In response to determining that the first authentication is successful, the authentication information can be sent to the server for a second authentication. In response to obtaining the authentication success information returned by the server, the login operation can be performed.

[0070] In some embodiments of the present disclosure, sending authentication information to the server may include: generating a first one-time key (TOTP, Time-base One-Time Password) according to a secret (stored in the Keychain), encrypting the first TOTP and the device identification of the target device by means of a private key (stored in the Keychain) to obtain authentication information, and sending the authentication information to the server; in addition, authentication success information may include: authentication success information generated when the server determines that the generated second TOTP is consistent with the first TOTP, the second TOTP is generated by the server according to the secret, the secret is the secret corresponding to the target device determined by the server after decrypting the authentication information using the public key to obtain the device identification, and the first TOTP is obtained by the server after decrypting the authentication information using the public key.

[0071] There is no restriction on how to generate TOTP based on secret. For example, a traditional generation method can be used, that is, the secret and the current time are combined together through a hash function to obtain the required TOTP.

[0072] The client can encrypt the generated first TOTP and the device identification of the target device with a private key to obtain authentication information and send it to the server. Correspondingly, the server will use the locally stored public key to decrypt the authentication information to obtain the first TOTP and the device identification of the target device. After that, the server can determine the secret corresponding to the device identification according to the stored correspondence, that is, determine the secret corresponding to the target device (locally stored on the server), and then use the secret to generate the second TOTP in the same way as the client, and compare the first TOTP with the second TOTP. If the two are consistent, it can be determined that the second authentication is passed and the authentication pass information can be returned. Otherwise, the authentication failure information can be returned.

[0073] Through the above processing, the second authentication of the login operation can be achieved with the help of the public key, private key, device identification and secret of the target device stored by both the client and the server, thereby further improving the security of the target application and the VPN network.

[0074] In some embodiments of the present disclosure, in response to obtaining authentication success information returned by the server, the client may also detect the credibility of the device environment of the target device, and in response to determining that the device environment is a credible device environment, it may be determined that the login is successful.

[0075] That is to say, after determining that both the first authentication and the second authentication are passed, the credibility of the device environment of the target device can be further tested according to a predetermined strategy, thereby further improving the security of the target application and the VPN network.

[0076] For example, it can detect whether the required anti-virus software is installed on the target device, whether the firewall is turned on, and whether some blacklisted software that poses security risks is installed on the target device. If the detection passes, that is, the device environment is determined to be a trusted device environment, then it can be determined that the login is successful. Otherwise, it can be determined that the detection has failed, and there is no restriction on subsequent processing. For example, the login process can be directly ended, or the user can be notified to repair the device environment to make it comply with the predetermined policy.

[0077] Combined with the above introduction, Figure 3 This is a flow chart of a method embodiment of the login process described in the present disclosure. Figure 3 As shown, the following specific implementation methods are included.

[0078] In step 301, in response to detecting a login operation for a registered account of a target application, input first biometric information is obtained.

[0079] In step 302, it is determined whether the first authentication of the first biometric information is passed. If so, step 303 is executed, otherwise, the process ends.

[0080] For example, the first biometric information may be compared with the second biometric information stored in the Keychain, and in response to determining that the first biometric information is consistent with the second biometric information, it may be determined that the first authentication is successful.

[0081] In step 303, a first TOTP is generated according to the secret stored in the Keychain.

[0082] In step 304, the first TOTP and the device identification of the target device are encrypted using the private key stored in the Keychain to obtain authentication information, and the authentication information is sent to the server.

[0083] In step 305, the authentication result returned by the server is obtained, and it is determined whether the authentication result is authentication passed or authentication failed. If the authentication is passed, step 306 is executed; if the authentication is failed, the process ends.

[0084] In step 306, the credibility of the device environment of the target device is tested to determine whether the test is passed. If so, step 307 is executed, otherwise, the process ends.

[0085] In step 307, it is determined that the login is successful and the process ends.

[0086] That is, in response to determining that the device environment is a trusted device environment, it can be determined that the login is successful and the process can be terminated.

[0087] The above mainly describes the solution of the present disclosure from the client side, and the following further describes the solution of the present disclosure from the server side.

[0088] Figure 4 This is a flow chart of the second embodiment of the application login method described in the present disclosure. Figure 4 As shown, the following specific implementation methods are included.

[0089] In step 401, authentication information sent by the client of the target application is obtained, and the authentication information is sent to the server after the client determines that the first authentication of the first biometric information is passed. The first biometric information is the input first biometric information obtained by the client in response to detecting a login operation for a registered account of the target application.

[0090] In step 402, a second authentication is performed on the login operation according to the authentication information, and in response to determining that the second authentication is successful, authentication success information is returned to the client for the client to determine to perform the login operation.

[0091] By adopting the scheme described in the above method embodiment, the user can log in to the target application conveniently and quickly by inputting the first biometric information, thereby reducing time cost, improving processing efficiency and improving business stability, etc. Moreover, the login operation will only be performed after it is determined that the first authentication of the first biometric information and the second authentication of the current login operation are passed, that is, multiple verifications are performed, thereby improving the security of the target application account, etc.

[0092] In some embodiments of the present disclosure, before obtaining the authentication information sent by the client of the target application, the device identification and public key of the target device sent by the client when performing the registration operation process can also be obtained. The target device is an electronic device with the target application installed. The public key is the public key in the key pair generated by the client for the target device. The key pair also includes a private key. In addition, a secret corresponding to the target device can also be generated and returned to the client.

[0093] In some embodiments of the present disclosure, the authentication information may include: after the client generates a first TOTP according to the secret, the generated first TOTP and the device identification of the target device are encrypted by a private key to obtain the authentication information; accordingly, performing a second authentication on the login operation according to the authentication information may include: decrypting the authentication information using a public key to obtain the first TOTP and the device identification therein, determining the secret corresponding to the target device using the device identification, and generating a second TOTP according to the determined secret; in response to determining that the first TOTP is consistent with the second TOTP, determining that the second authentication is passed; otherwise, determining that the second authentication is failed.

[0094] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the described order of actions, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present disclosure. In addition, for parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0095] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.

[0096] Figure 5 FIG. 5 is a schematic diagram of the composition structure of the first embodiment 500 of the application login device described in the present disclosure. Figure 5 As shown, it includes: a feature acquisition module 501 and a login verification module 502.

[0097] The feature acquisition module 501 is used to acquire input first biometric feature information in response to detecting a login operation for a registered account of a target application.

[0098] The login verification module 502 is used to perform a first authentication on the first biometric information, send authentication information to the server in response to determining that the first authentication is successful, and execute a login operation in response to obtaining the authentication success information returned by the server. The authentication success information is returned by the server after performing a second authentication on the login operation based on the authentication information and determining that the authentication is successful.

[0099] By adopting the scheme described in the above-mentioned device embodiment, the user can log in to the target application conveniently and quickly by inputting the first biometric information, thereby reducing time cost, improving processing efficiency and improving business stability, etc. Moreover, the login operation will only be performed after it is determined that the first authentication of the first biometric information and the second authentication of the current login operation are passed, that is, multiple verifications are performed, thereby improving the security of the target application account, etc.

[0100] In some embodiments of the present disclosure, the login verification module 502 may compare the first biometric information with the pre-saved second biometric information. In response to determining that the first biometric information is consistent with the second biometric information, it may be determined that the first authentication is successful. Otherwise, if they are inconsistent, it may be determined that the first authentication is unsuccessful.

[0101] In addition, in some embodiments of the present disclosure, the second biometric information may be biometric information input for logging into the target application during a registration operation for the target application.

[0102] Accordingly, Figure 6 FIG. 6 is a schematic diagram of the structure of the second embodiment 600 of the application login device described in the present disclosure. Figure 6 As shown, it includes: a feature acquisition module 501, a login verification module 502 and a first registration module 503.

[0103] The first registration module 503 is used to execute the registration operation process, and during the registration operation process, in response to obtaining the input third biometric information, display a login account input interface, obtain the login account input for the login account input interface, and in response to determining that the login account is consistent with the login account obtained when the login is successful during the registration operation, determine the third biometric information as the second biometric information.

[0104] In addition, in some embodiments of the present disclosure, the first registration module 503 can also generate a key pair corresponding to the target device, and the key pair includes a public key and a private key. The target device is an electronic device installed with a target application, and the device ID and public key of the target device can be sent to the server. In addition, the secret returned by the server can also be obtained, and the secret is the secret corresponding to the target device generated by the server.

[0105] In some embodiments of the present disclosure, the second biometric information, the secret token and the private key may all be encrypted by an AES algorithm and stored in the key chain of the target device.

[0106] in addition, Figure 5 and Figure 6The way in which the login verification module 502 shown in sends authentication information to the server may include: generating a first TOTP according to a secret, encrypting the first TOTP and the device identification of the target device by means of a private key to obtain authentication information, and sending the authentication information to the server; in addition, the authentication success information obtained by the login verification module 502 may include: the authentication success information generated when the server determines that the generated second TOTP is consistent with the first TOTP, the second TOTP is generated by the server according to the secret, the secret is the secret corresponding to the target device determined by the server after decrypting the authentication information using the public key to obtain the device identification, and the first TOTP is obtained after the server decrypts the authentication information using the public key.

[0107] In some embodiments of the present disclosure, the login verification module 502 may further detect the credibility of the device environment of the target device, and in response to determining that the device environment is a credible device environment, it may be determined that the current login is successful.

[0108] In addition, in some embodiments of the present disclosure, the target application may include: an application connected to a VPN network.

[0109] Figure 7 FIG. 7 is a schematic diagram of the composition structure of the third embodiment 700 of the application login device described in the present disclosure. Figure 7 As shown, it includes: an information acquisition module 701 and a security authentication module 702.

[0110] The information acquisition module 701 is used to obtain authentication information sent by the client of the target application. The authentication information is sent to the server after the client determines that the first authentication of the first biometric information is passed. The first biometric information is the input first biometric information obtained by the client in response to detecting a login operation for a registered account of the target application.

[0111] The security authentication module 702 is used to perform a second authentication on the login operation according to the authentication information, and in response to determining that the second authentication is successful, return authentication success information to the client for the client to perform the login operation.

[0112] By adopting the scheme described in the above-mentioned device embodiment, the user can log in to the target application conveniently and quickly by inputting the first biometric information, thereby reducing time cost, improving processing efficiency and improving business stability, etc. Moreover, the login operation will only be performed after it is determined that the first authentication of the first biometric information and the second authentication of the current login operation are passed, that is, multiple verifications are performed, thereby improving the security of the target application account, etc.

[0113] Figure 8FIG. 8 is a schematic diagram of the structure of the fourth embodiment 800 of the application login device described in the present disclosure. Figure 8 As shown, it includes: an information acquisition module 701, a security authentication module 702 and a second registration module 703.

[0114] The second registration module 703 is used to obtain the device identification and public key of the target device sent by the client when performing the registration operation process. The target device is an electronic device with a target application installed. The public key is the public key in the key pair corresponding to the target device generated by the client. The key pair also includes a private key. In addition, a secret corresponding to the target device can also be generated and returned to the client.

[0115] In addition, in some embodiments of the present disclosure, the authentication information may include: after the client generates the first TOTP according to the secret, the authentication information obtained by encrypting the first TOTP and the device identification of the target device with a private key, Figure 7 and Figure 8 The security authentication module 702 shown in the figure performs a second authentication on the login operation according to the authentication information, which may include: decrypting the authentication information using a public key to obtain the first TOTP and device identification therein, determining the secret corresponding to the target device using the device identification, and generating a second TOTP according to the secret, and in response to determining that the first TOTP is consistent with the second TOTP, determining that the second authentication is passed, otherwise, determining that the second authentication is not passed.

[0116] The specific working processes of the above-mentioned device embodiments can refer to the relevant descriptions in the above-mentioned method embodiments and will not be repeated here.

[0117] The solution disclosed in the present disclosure can be applied to the field of artificial intelligence, especially in the fields of application management, intelligent devices and network security. Artificial intelligence is a discipline that studies how computers can simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, planning, etc.). It has both hardware-level and software-level technologies. Artificial intelligence hardware technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, and big data processing. Artificial intelligence software technologies mainly include computer vision technology, speech recognition technology, natural language processing technology, machine learning / deep learning, big data processing technology, knowledge graph technology, and other major directions.

[0118] The fingerprints and faces in the embodiments of this disclosure are not for a specific user and cannot reflect the personal information of a specific user. In the technical solution of this disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good customs.

[0119] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0120] Fig. 9 A schematic block diagram of an electronic device 900 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0121] like Fig. 9 As shown, the device 900 includes a computing unit 901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 902 or a computer program loaded from a storage unit 908 to a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the device 900 can also be stored. The computing unit 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0122] A number of components in the device 900 are connected to the I / O interface 905, including: an input unit 906, such as a keyboard, a mouse, etc.; an output unit 907, such as various types of displays, speakers, etc.; a storage unit 908, such as a disk, an optical disk, etc.; and a communication unit 909, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 909 allows the device 900 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0123] The computing unit 901 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI, Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSP, Digital Signal Processing), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 901 performs the various methods and processes described above, such as the methods described in the present disclosure. For example, in some embodiments, the methods described in the present disclosure may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 908. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 900 via the ROM 902 and / or the communication unit 909. When the computer program is loaded into the RAM 903 and executed by the computing unit 901, one or more steps of the methods described in the present disclosure may be performed. Alternatively, in other embodiments, the computing unit 901 may be configured to execute the method described in the present disclosure in any other appropriate manner (for example, by means of firmware).

[0124] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard parts (ASSPs), system on chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0125] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0126] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory (EPROM, Electronically Programmable Read-Only Memory), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM, Compact Disc Read-Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0127] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0128] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by digital data communication (e.g., a communication network) in any form or medium. Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0129] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0130] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0131] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for logging into an application. include: In response to detecting a login operation for a registered account of the target application, obtaining input first biometric information; Performing a first authentication on the first biometric information; In response to determining that the first authentication is passed, sending authentication information to the server; In response to obtaining the authentication pass information returned by the server, a login operation is performed, wherein the authentication pass information is returned by the server after performing a second authentication on the login operation according to the authentication information and determining that the authentication is passed.

2. The method according to claim 1, in, The first authentication of the first biometric information includes: comparing the first biometric information with the second biometric information; In response to determining that the first biometric information is consistent with the second biometric information, it is determined that the first authentication is successful.

3. The method according to claim 2, in, The second biometric feature information is biometric feature information input during a registration operation for the target application and used to log in to the target application.

4. The method according to claim 3, further comprising: include: During the registration operation, in response to obtaining the input third biometric information, displaying a login account input interface; Obtaining a login account inputted into the login account input interface; In response to determining that the login account is consistent with the login account obtained when the login is successful during the registration operation, the third biometric characteristic information is determined as the second biometric characteristic information.

5. The method according to claim 3, further comprising: include: Generate a key pair corresponding to a target device, the key pair including a public key and a private key, the target device being an electronic device on which the target application is installed; Sending the device identification of the target device and the public key to the server; Obtain a token returned by the server, where the token is a token generated by the server and corresponding to the target device.

6. The method according to claim 5, in, The second biometric information, the token and the private key are encrypted by an Advanced Encryption Standard algorithm and then stored in the key chain of the target device.

7. The method according to claim 5, in, The sending of authentication information to the server includes: generating a first one-time key according to the token; Encrypting the first one-time key and the device identification by using the private key to obtain the authentication information; Sending the authentication information to the server; The authentication success information includes: the authentication success information generated when the second one-time key generated by the server is determined to be consistent with the first one-time key, the second one-time key is generated by the server according to the token, the token is the token corresponding to the target device determined by the server after decrypting the authentication information with the public key to obtain the device identification, and the first one-time key is obtained by the server after decrypting the authentication information with the public key.

8. The method according to claim 1, in, The execution of the login operation includes: Testing the credibility of a device environment of a target device, wherein the target device is an electronic device on which the target application is installed; In response to determining that the device environment is a trusted device environment, it is determined that the login is successful.

9. The method according to any one of claims 1 to 8, in, The target application includes: an application connected to a virtual private network.

10. An application login method, include: Acquire authentication information sent by a client of the target application, the authentication information being sent to the server after the client determines that a first authentication of first biometric information has passed, the first biometric information being input first biometric information acquired by the client in response to detecting a login operation for a registered account of the target application; A second authentication is performed on the login operation according to the authentication information, and in response to determining that the second authentication is successful, authentication success information is returned to the client for the client to perform the login operation.

11. The method according to claim 10, further comprising: include: Before obtaining the authentication information sent by the client of the target application, obtain the device identification and public key of the target device sent by the client when performing the registration operation process. The target device is an electronic device installed with the target application. The public key is the public key in the key pair corresponding to the target device generated by the client. The key pair also includes a private key. A token corresponding to the target device is generated and returned to the client.

12. The method according to claim 11, in, The authentication information includes: after the client generates a first one-time key according to the token, the authentication information is obtained by encrypting the first one-time key and the device identification with the private key; The second authentication of the login operation based on the authentication information includes: using the public key to decrypt the authentication information to obtain the first one-time key and the device identification, using the device identification to determine the token corresponding to the target device, generating a second one-time key based on the token, and in response to determining that the first one-time key is consistent with the second one-time key, determining that the second authentication is passed.

13. An application login device, Includes: Features Get module and login verification module; The feature acquisition module is used to acquire input first biometric feature information in response to detecting a login operation for a registered account of the target application; The login verification module is used to perform a first authentication on the first biometric information, send authentication information to the server in response to determining that the first authentication is successful, and perform a login operation in response to obtaining the authentication success information returned by the server. The authentication success information is returned by the server after performing a second authentication on the login operation based on the authentication information and determining that the authentication is successful.

14. The device according to claim 13, in, The login verification module compares the first biometric information with pre-saved second biometric information, and in response to determining that the first biometric information is consistent with the second biometric information, determines that the first authentication is successful.

15. The device according to claim 14, in, The second biometric feature information is biometric feature information input during a registration operation for the target application and used to log in to the target application.

16. The device according to claim 15, further comprising: include: The first registration module is used to execute the registration operation process, and during the execution of the registration operation, in response to obtaining the input third biometric information, display a login account input interface, obtain the login account input for the login account input interface, and in response to determining that the login account is consistent with the login account obtained when the login is successful during the registration operation, determine the third biometric information as the second biometric information.

17. The device according to claim 16, in, The first registration module is further used to generate a key pair corresponding to the target device, the key pair including a public key and a private key. The target device is an electronic device installed with the target application, the device identification of the target device and the public key are sent to the server, and a token returned by the server is obtained, wherein the token is a token generated by the server and corresponding to the target device.

18. The device according to claim 17, in, The second biometric information, the token and the private key are encrypted by an Advanced Encryption Standard algorithm and then stored in the key chain of the target device.

19. The device according to claim 17, in, The login verification module generates a first one-time key according to the token, encrypts the first one-time key and the device identification by using the private key to obtain the authentication information, and sends the authentication information to the server; The authentication success information includes: the authentication success information generated when the second one-time key generated by the server is determined to be consistent with the first one-time key, the second one-time key is generated by the server according to the token, the token is the token corresponding to the target device determined by the server after decrypting the authentication information with the public key to obtain the device identification, and the first one-time key is obtained by the server after decrypting the authentication information with the public key.

20. The device according to claim 13, in, The login verification module is further used to detect the credibility of the device environment of the target device after obtaining the authentication pass information returned by the server. The target device is an electronic device installed with the target application. In response to determining that the device environment is a trusted device environment, it is determined that the login is successful.

21. The device according to any one of claims 13 to 20, in, The target application includes: an application connected to a virtual private network.

22. An application login device, include: Information acquisition module and security authentication module; The information acquisition module is used to acquire authentication information sent by a client of the target application, wherein the authentication information is sent to the server after the client determines that a first authentication of first biometric information has passed, and the first biometric information is the input first biometric information acquired by the client in response to detecting a login operation for a registered account of the target application; The security authentication module is used to perform a second authentication on the login operation according to the authentication information, and in response to determining that the second authentication is successful, return authentication success information to the client for the client to perform the login operation.

23. The device according to claim 22, further comprising: include: The second registration module is used to obtain the device identification and public key of the target device sent by the client when performing the registration operation process. The target device is an electronic device installed with the target application. The public key is the public key in the key pair corresponding to the target device generated by the client. The key pair also includes a private key. A token corresponding to the target device is generated and returned to the client.

24. The device according to claim 23, in, The authentication information includes: after the client generates a first one-time key according to the token, the authentication information is obtained by encrypting the first one-time key and the device identification with the private key; The security authentication module uses the public key to decrypt the authentication information to obtain the first one-time key and the device identifier, uses the device identifier to determine the token corresponding to the target device, generates a second one-time key based on the token, and in response to determining that the first one-time key is consistent with the second one-time key, determines that the second authentication is passed.

25. An electronic device, include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 12.

26. A non-transitory computer-readable storage medium storing computer instructions, in, The computer instructions are used to make a computer execute the method according to any one of claims 1 to 12.

27. A computer program product, comprising a computer program / instruction, which implements the method according to any one of claims 1 to 12 when executed by a processor.

Images