Security authentication method and device

Abstract

The embodiment of the invention provides a security authentication method and device, and relates to the technical field of security. Comprising the following steps: receiving a first request message which is sent by a terminal and is used for acquiring a dynamic password, wherein the first request message comprises a first terminal identifier of the terminal; acquiring a first geographic position of the terminal according to the first terminal identifier; and generating a first dynamic password based on the first geographic position, and sending a first response message including the first dynamic password to the terminal. The invention can provide a more convenient, economical and efficient identity authentication method, the cost of identity authentication is saved, carrying of authentication equipment is avoided, the user experience is improved, meanwhile, the first dynamic password can be used for further verifying the geographical location information of an identity authenticator while completing identity authentication, and the user experience is improved. And the non-repudiation and reliability of identity authentication are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of security technology, and in particular to a security authentication method, device, electronic device, storage medium and computer program product. Background Art

[0002] With the development of technology, electronic signature technology has been widely used in various fields as an identity authentication technology. Common electronic signature technologies include digital certificates, two-factor authentication, and identity authentication documents. In addition, dynamic passwords are also widely used as another commonly used identity authentication technology.

[0003] The security authentication technology in the related art has the following two significant deficiencies: 1. Although electronic signature technology can verify the identity information of the identity authenticator to a certain extent, it cannot provide more authentication information, which affects the non-repudiation and reliability of electronic signature technology.

[0004] 2. As for the dynamic password authentication method in related technologies, it usually requires additional hardware equipment to complete, and the user needs to carry the authentication device with him to perform the authentication, which increases the cost of authentication and makes the authentication more cumbersome, affecting the user experience. Summary of the invention

[0005] The purpose of the embodiments of the present disclosure is to provide a method, device, electronic device, storage medium and computer program product for security authentication.

[0006] To solve the above technical problems, the embodiments of the present disclosure are implemented through the following aspects.

[0007] According to a first aspect of an embodiment of the present disclosure, a method for security authentication is provided, the method comprising: receiving a first request message sent by a terminal for obtaining a dynamic password, the first request message including a first terminal identifier of the terminal; obtaining a first geographic location of the terminal according to the first terminal identifier; generating a first dynamic password based on the first geographic location, and sending a first response message including the first dynamic password to the terminal.

[0008] According to a second aspect of an embodiment of the present disclosure, a security authentication device is provided, the device comprising: a receiving module, used to receive a first request message sent by a terminal for obtaining a dynamic password, the first request message including a first terminal identifier of the terminal; an obtaining module, used to obtain a first geographic location of the terminal according to the first terminal identifier; an authentication module, used to generate a first dynamic password based on the first geographic location, and send a first response message including the first dynamic password to the terminal.

[0009] According to a third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is used to execute the steps of the security authentication method described in the first aspect above.

[0010] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple applications, the electronic device performs the steps of the security authentication method described in the first aspect.

[0011] According to a fourth aspect of an embodiment of the present disclosure, a computer program product is provided, wherein the computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the security authentication method described in the first aspect.

[0012] One of the above technical solutions has the following advantages or beneficial effects: a first request message for obtaining a dynamic password sent by a receiving terminal; obtaining a first geographical location of the terminal according to the first terminal identifier; generating a first dynamic password based on the first geographical location, and sending a first response message including the first dynamic password to the terminal. A more convenient and economical and efficient identity authentication method can be provided, which saves the cost of identity authentication, avoids carrying authentication equipment, and improves user experience. At the same time, the first dynamic password can be used to further verify the geographical location information of the identity authenticator while completing the identity authentication, thereby improving the non-repudiation and reliability of the identity authentication.

[0013] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

[0014] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0016] Figure 1 A schematic diagram showing a flow chart of a security authentication method provided by an embodiment of the present disclosure; Figure 2 Another schematic diagram showing a flow chart of a security authentication method provided by an embodiment of the present disclosure; Figure 3 Another schematic diagram showing a flow chart of a security authentication method provided by an embodiment of the present disclosure; Figure 4 Another schematic diagram showing a flow chart of a security authentication method provided by an embodiment of the present disclosure; Figure 5 Another schematic diagram showing a flow chart of a security authentication method provided by an embodiment of the present disclosure; Figure 6 A block diagram of a security authentication device provided by an embodiment of the present application is shown; Figure 7 A schematic diagram of the hardware structure of an electronic device for executing the security authentication method provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions in the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present disclosure.

[0018] The security authentication method in the present application can be executed by a server, a server cluster or a cloud server. The server, server cluster and cloud server may include an authentication server for generating dynamic passwords, and may also include an electronic signature server for identity authentication. The authentication server and the electronic signature server may be located on different servers or may be integrated on the same server. This application does not impose any restrictions on this.

[0019] Figure 1 A schematic diagram showing a flow chart of a security authentication method provided by an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the method may include the following steps: In step S101, a first request message for obtaining a dynamic password sent by a terminal is received.

[0020] The first request message includes a first terminal identifier of the terminal.

[0021] The terminal can be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer), a notebook computer, a personal digital assistant (Personal Digital Assistant, PDA), a handheld computer, a netbook, an ultra-mobile personal computer (Ultra-mobile Personal Computer, UMPC), a mobile Internet device (Mobile Internet Device, MID), an augmented reality (Augmented Reality, AR), a virtual reality (Virtual Reality, VR) device, and this application does not impose any restrictions on this.

[0022] The first terminal identifier can be a terminal identifier in various forms, such as an MDN (Mobile Directory Number), an IMSI (International Mobile Subscriber Identity), or an IMEI (International Mobile Equipment Identity). This application does not limit the form of the terminal and the form of the first terminal identifier.

[0023] In some embodiments, after the first terminal identifier is obtained, the MDN corresponding to the terminal can be obtained according to the first terminal identifier and stored on the server.

[0024] In step S102, a first geographical location of the terminal is acquired according to the first terminal identifier.

[0025] In some possible implementations, the server may communicate with a positioning server in a wireless communication network, and obtain the first geographical location corresponding to the first terminal identifier from the positioning server.

[0026] The positioning server can complete the positioning of the terminal based on any wireless positioning technology in the relevant technology, so as to obtain the first geographical location information of the terminal. For example, the location information of the terminal can be obtained by using technologies such as TDOA (time difference of arrival), TOA (time of arrival), and AGPS (Assisted Global Positioning System).

[0027] It is understandable that the terminal location information obtained by the positioning server is usually location information expressed in the form of longitude and latitude. In some embodiments, after the server obtains the location information expressed in the form of longitude and latitude from the positioning server, it can obtain the first geographical location according to the preset correspondence between longitude and latitude and geographical location. In this embodiment, the first geographical location can be coarse-grained location information expressed by "XX Street, XX District, XX City" or "XX District, XX City".

[0028] In step S103, a first dynamic password is generated based on the first geographical location, and a first response message including the first dynamic password is sent to the terminal.

[0029] In some embodiments, a hash value of a preset number of bits of the first geographic location can be obtained based on a preset hash algorithm, for example, a 32-bit hash value of the first geographic location is obtained, and a first dynamic password is generated based on the 32-bit hash value of the first geographic location.

[0030] After the first dynamic password is generated, a first response message including the first dynamic password may be sent to the terminal.

[0031] By adopting the above technical solution, the terminal can obtain the first dynamic password through interaction with the server, without the need for additional authentication hardware equipment, avoiding the trouble of carrying authentication equipment, and improving the user experience. At the same time, the first dynamic password integrates the first geographic location information, which can further verify the geographic location information of the identity authenticator, complete the identity authentication of the terminal, and improve the non-repudiation and reliability of the identity authentication.

[0032] Figure 2 Another flow chart of the security authentication method provided by the embodiment of the present disclosure is shown as follows: Figure 2 As shown, step S102 may specifically include the following steps: In step S1021, a first dynamic password is generated based on the first geographical location, the second terminal identifier of the terminal, and a first timestamp when the first dynamic password is generated.

[0033] The second terminal identifier is a terminal identifier input by the user during the process of generating the first dynamic password, and may be an MDN.

[0034] In some embodiments, the first dynamic password may be generated based on the following formula 1 according to the first geographical location, the second terminal identifier of the terminal, and the first timestamp when the first dynamic password is generated.

[0035] (one) Wherein, P2 is the second terminal identifier, To obtain the bitwise sum, for example , T1 is the first timestamp when the first dynamic password is generated, L1 is the hash value of the preset number of digits of the first geographical location (the preset number of digits may be 32 bits, for example), K, N1 and N2 are preset constant values, is a modulo operator. In some possible implementations, the values ​​of N1 and N2 may be 10000 and 1000000 respectively.

[0036] It should be noted that the granularity of the first timestamp may be a preset larger time granularity, such as hourly granularity, so that the value of the first timestamp remains unchanged within a longer time range, thus facilitating subsequent dynamic password authentication.

[0037] In some embodiments, when generating the first dynamic password, the server may first match the second terminal identifier with the saved first terminal identifier, and only generate the first dynamic password when the two match successfully.

[0038] By adopting the above technical solution, the terminal can obtain the first dynamic password through interaction with the server, without the need for additional authentication hardware equipment, avoiding the trouble of carrying authentication equipment, and improving user experience. At the same time, the first dynamic password integrates the first geographic location information. The terminal uses the first dynamic password to complete identity authentication, which can further verify the geographic location information of the authenticator, the terminal identification information, and the time interval between generating the dynamic password and identity authentication, further improving the non-repudiation and reliability of identity authentication.

[0039] Figure 3 Another flow chart of the security authentication method provided by the embodiment of the present disclosure is shown as follows: Figure 3 As shown, step S1021 may specifically include the following steps: In step 100, the server generates a first key according to a first encryption algorithm, where the first key includes a first public key and a first private key.

[0040] In some possible implementations, a first key may be generated based on an asymmetric encryption algorithm in any related technology according to the first terminal identifier, wherein the first public key is used to send to the terminal so that the terminal can encrypt when sending the second terminal identifier. The first private key is used to decrypt the encrypted second terminal identifier. The principle of the specific asymmetric encryption algorithm can be found in the records in the related technology, and will not be elaborated here.

[0041] In step 101, a second request message for acquiring a second terminal identifier input by a user is sent to a terminal.

[0042] The second request message includes the first public key.

[0043] In some embodiments, a corresponding temporary token may be sent to the terminal via the second request message, so that the terminal sends a second response message within the validity period of the temporary token.

[0044] In step 102, a second response message sent by the terminal is received.

[0045] The second response message includes a second terminal identifier and a second public key encrypted using the first public key, and the second public key is a public key in a second key generated by the terminal based on a second encryption algorithm.

[0046] In some possible implementations, the second terminal identifier may be an MDN input by a user into the terminal, and the terminal may encrypt the second terminal identifier using the first public key in the second request message. At the same time, the terminal may generate a second key based on a second encryption algorithm, wherein the second key includes a second public key and a second private key, and the second public key is used to send to the server so that the server can encrypt the first dynamic password when sending it. The second private key is used by the terminal to decrypt the encrypted first dynamic password. The first encryption algorithm and the second encryption algorithm may be the same encryption algorithm or different encryption algorithms, and this application does not limit this.

[0047] In some embodiments, the terminal may send the received temporary token in a second response message.

[0048] In step 103, the encrypted second terminal identifier is decrypted using the first private key to obtain the second terminal identifier.

[0049] In some embodiments, the corresponding first terminal identification can be obtained through the temporary token, and the first private key can be found according to the first terminal identification, and the encrypted second terminal identification can be decrypted by the first private key to obtain the decrypted second terminal identification.

[0050] In step 104, when the second terminal identifier and the first terminal identifier match, a first dynamic password is generated based on the first geographic location, the second terminal identifier of the terminal, and a first timestamp when the first dynamic password is generated, and a first response message including the first dynamic password encrypted using the second public key is sent to the terminal.

[0051] In some embodiments, the second terminal identifier may be an MDN input by a user, and the type of the first terminal identifier and the type of the second terminal identifier may be the same or different.

[0052] When performing terminal identifier matching, if the type of the first terminal identifier and the type of the second terminal identifier are the same, then when the first terminal identifier and the second terminal identifier are the same, it can be determined that the second terminal identifier and the first terminal identifier match; when the first terminal identifier and the second terminal identifier are different, it can be determined that the second terminal identifier and the first terminal identifier do not match.

[0053] If the type of the first terminal identifier and the type of the second terminal identifier are different, the terminal identifier corresponding to the first terminal identifier can be obtained according to the type of the second terminal identifier, and whether the first terminal identifier and the second terminal identifier match can be determined by comparing the terminal identifier corresponding to the first terminal identifier and the second terminal identifier.

[0054] For example, when the first terminal identifier type of the terminal is IMSI and the second terminal identifier type is MDN, the corresponding MDN can be obtained according to the first terminal identifier, and the corresponding MDN and the second terminal identifier can be matched through the obtained first terminal identifier.

[0055] In some possible implementations, the server may obtain the terminal identifier corresponding to the first terminal identifier according to the type of the second terminal identifier through an HSS (home subscriber server) of the wireless communication system.

[0056] When the second terminal identifier matches the first terminal identifier, a first dynamic password may be generated based on formula 1, and the first dynamic password may be encrypted using the received second public key and sent to the terminal via a first response message.

[0057] In the case that the second terminal identifier does not match the first terminal identifier, a third response message indicating a failure may be sent to the terminal.

[0058] After receiving the first response message, the terminal may use the second private key to decrypt the encrypted first dynamic password, thereby obtaining the decrypted first dynamic password.

[0059] By adopting the above technical solution, the terminal can obtain the first dynamic password through interaction with the server, without the need for additional authentication hardware equipment, avoiding the trouble of carrying authentication equipment, and improving user experience. At the same time, the first dynamic password integrates the first geographic location information. The terminal uses the first dynamic password to complete identity authentication, which can further verify the geographic location information of the authenticator, the terminal identification information, and the time interval between generating the dynamic password and identity authentication, further improving the non-repudiation and reliability of identity authentication.

[0060] Figure 4 Another flow chart of the security authentication method provided by the embodiment of the present disclosure is shown as follows: Figure 4 As shown, the method may further include the following steps.

[0061] In step S104, a third request message for verifying the dynamic password sent by the terminal is received.

[0062] The third request message includes the first dynamic password. By way of example, the first dynamic password included in the third request message may be the first dynamic password input by the user for security authentication.

[0063] In step S105, the IP address of the web page corresponding to the third request message is obtained, and the second geographical location of the terminal is obtained according to the IP address.

[0064] In some embodiments, the second geographical location of the terminal may be acquired based on a correspondence between a preset IP address segment and a geographical location.

[0065] For example, the server can save a pre-set correspondence between IP address segments and geographic locations, and based on the IP address of the web page corresponding to the third request message, obtain the geographic location corresponding to the address segment where the IP address of the web page corresponding to the third request message is located from the correspondence as the second geographic location.

[0066] In step S106, a second dynamic password is generated based on the second geographical location.

[0067] In some embodiments, the third request message may further include a third terminal identifier. In some possible implementations, the third terminal identifier may be an MDN entered by the user during identity authentication. The second dynamic password may be generated based on the second geographic location, the third terminal identifier, and a second timestamp when the second dynamic password is generated.

[0068] In some possible implementations, the second dynamic password may be generated based on the following formula 2 according to the second geographical location, the third terminal identifier of the terminal, and the second timestamp when the second dynamic password is generated.

[0069] (two) Wherein, P3 is the third terminal identifier, To obtain the bitwise sum, T2 is the second timestamp when the second dynamic password is generated, L2 is the hash value of the preset number of digits of the second geographical location, K, N1 and N2 are preset constant values, is a modulo operator. In some possible implementations, the values ​​of N1 and N2 may be 10000 and 1000000 respectively.

[0070] It can be understood that the parameters in the above formula 1 and formula 2 need to be consistent, including K, N1, N2 (the values ​​of N1 and N2 can be 10000 and 1000000 respectively) and the preset number of bits of the hash value (for example, the preset number of bits can be 32 bits), and the granularity of the first timestamp and the second timestamp also needs to be consistent.

[0071] In step S107, the verification result of the dynamic password is determined according to the matching condition between the first dynamic password and the second dynamic password.

[0072] In some embodiments, if the first dynamic password and the second dynamic password are the same, the verification result of the dynamic password can be determined to be passed. If the first dynamic password and the second dynamic password are different, the verification result of the dynamic password can be determined to be failed.

[0073] For example, taking electronic signature as an example, when the verification result of the dynamic password is confirmed to be passed, the verification result can be associated with the document to be signed, thereby completing the electronic signature of the document to be signed.

[0074] It is understandable that even if the user enters the correct first dynamic password, if the first geographical location and the second geographical location are different, and / or the first timestamp and the second timestamp are different, the first dynamic password and the second dynamic password will still not match. Therefore, when performing identity authentication, the authentication time and authentication location information are further verified, which improves the non-repudiation and reliability of identity authentication.

[0075] Figure 5 Another flow chart of the security authentication method provided by the embodiment of the present disclosure is shown as follows: Figure 5 As shown, the method may further include the following steps.

[0076] In step S108, scene indication information is sent to the terminal.

[0077] The scenario indication information is used to indicate a transformation rule for transforming the first dynamic password when performing dynamic password verification.

[0078] In a specific implementation, the scene indication information may be sent to the terminal via a separate message, or the scene indication information may be sent to the terminal via a first response message. The scene indication information may include one transformation rule or multiple transformation rules. The multiple transformation rules may be a correspondence between preset time periods and transformation rules. For example, the multiple transformation rules may be: time period 1: transformation rule 1, time period 2: transformation rule 2, ..., time period n: transformation rule n; the multiple transformation rules may also be a correspondence between preset conditions and transformation rules. For example, the transformation rules may be: condition 1: transformation rule 1, condition 2: transformation rule 2, ..., condition n: transformation rule n; In some embodiments, the transformation rule comprises a base transformation rule, a digit order transformation rule or a digit transformation rule.

[0079] Among them, the base conversion rule is to perform base conversion on the first dynamic password. For example, if the first dynamic password is 987642 in decimal, the scene indication information may be "enter the first dynamic password in base x" (x may be 8, 10, 16 or 32, for example). At this time, the conversion rule is to perform corresponding base conversion on the first dynamic password. For example, (3610772)8, (987642)10, (F11FA)16, (U4FQ)32. In order to avoid cumbersome operations for users, in some embodiments, when sending the first response message including the first dynamic password, the server may also send the first dynamic password of different bases to the terminal through the first response message, so as to facilitate the user to select and input.

[0080] The digit order conversion rule is to convert the order of the digits of the first dynamic password. For example, if the first dynamic password is 987426 in decimal, the digit order conversion rule may be, for example, digit reversal, that is, the digit order of the first dynamic password is reversed, and the converted first dynamic password is 624789. The digit order conversion rule may also be to sort the first dynamic password according to the digit value. For example, if the first dynamic password is 987426 in decimal, the digit order conversion rule may be, for example, digit value descending order, that is, the digits of the first dynamic password are arranged in descending order according to the digit value, and the converted first dynamic password is 987642.

[0081] The digit conversion rule is to convert the value of at least one digit of the first dynamic password. For example, the digit conversion rule is "add 1 to the fourth digit, and if the value of the fourth digit is 9, convert it to 0", and the first dynamic password is 987426 in decimal, then the converted first dynamic password is 988426.

[0082] In step S109, a fourth request message for verifying the dynamic password sent by the terminal is received.

[0083] The fourth request message includes the third dynamic password.

[0084] For example, the third dynamic password included in the third request message can be a password obtained and input by the user after transforming the first dynamic password according to the transformation rules in the scene indication information, or it can be a password selected and input by the user from first dynamic passwords of different bases according to the transformation rules in the scene indication information.

[0085] In step S110, the IP address of the web page corresponding to the fourth request message is obtained, and the third geographical location of the terminal is obtained according to the IP address.

[0086] This step is similar to step S106 and will not be described in detail here.

[0087] In step S111, a fourth dynamic password is generated based on the third geographical location, and the fourth dynamic password is transformed according to a transformation rule to obtain a fifth dynamic password.

[0088] In some embodiments, a fourth dynamic password can be generated based on a third geographic location, a fourth terminal identifier, and a third timestamp when the fourth dynamic password is generated. The specific steps are similar to step S107 and will not be elaborated here. After the fourth dynamic password is generated, the fourth dynamic password can be transformed according to the transformation rules to obtain a fifth dynamic password so as to match the third dynamic password.

[0089] In step S112, the verification result of the dynamic password is determined according to the matching condition between the third dynamic password and the fifth dynamic password.

[0090] In some embodiments, when the third dynamic password and the fifth dynamic password are the same, the verification result of the dynamic password can be determined to be passed. When the third dynamic password and the fifth dynamic password are different, the verification result of the dynamic password can be determined to be failed.

[0091] By adopting the above technical solution, the generated dynamic password can be flexibly transformed by sending scene indication information, and identity authentication can be performed based on the transformed dynamic password, which can further improve the flexibility of identity authentication.

[0092] Figure 6 A block diagram of a security authentication device provided by an embodiment of the present application is shown, such as Figure 6 As shown, the security authentication device 200 includes: The receiving module 210 is configured to receive a first request message sent by a terminal for obtaining a dynamic password, wherein the first request message includes a first terminal identifier of the terminal; An acquisition module 220, configured to acquire a first geographical location of a terminal according to a first terminal identifier; The authentication module 230 is configured to generate a first dynamic password based on the first geographical location, and send a first response message including the first dynamic password to the terminal.

[0093] Optionally, the authentication module 230 is further configured to generate a first dynamic password based on the first geographical location, a second terminal identifier of the terminal, and a first timestamp when the first dynamic password is generated.

[0094] Optionally, the authentication module 230 is further configured to generate a first key according to a first encryption algorithm, where the first key includes a first public key and a first private key; Sending a second request message for obtaining a second terminal identifier input by a user to the terminal, where the second request message includes the first public key; Receiving a second response message sent by the terminal, the second response message includes a second terminal identifier and a second public key encrypted by the first public key, where the second public key is a public key in a second key generated by the terminal based on a second encryption algorithm; Decrypting the encrypted second terminal identifier using the first private key to obtain the second terminal identifier; If the second terminal identifier matches the first terminal identifier, generating a first dynamic password based on the first geographical location, the second terminal identifier of the terminal, and a first timestamp when the first dynamic password is generated, and sending a first response message including the first dynamic password encrypted with the second public key to the terminal; or In the case that the second terminal identifier does not match the first terminal identifier, a third response message indicating a failure is sent to the terminal.

[0095] Optionally, the receiving module 210 is further configured to receive a third request message sent by the terminal for verifying the dynamic password, where the third request message includes the first dynamic password; The acquisition module 220 is further configured to acquire the IP address of the web page corresponding to the third request message, and acquire the second geographical location of the terminal according to the IP address; The authentication module 230 is further configured to generate a second dynamic password based on the second geographical location; and determine a verification result of the dynamic password according to a matching condition between the first dynamic password and the second dynamic password.

[0096] Optionally, the acquisition module 220 is further configured to acquire a second geographical location of the terminal according to a correspondence between a preset IP address segment and a geographical location.

[0097] Optionally, the authentication module 230 is further configured to generate a second dynamic password based on the second geographical location, the third terminal identifier, and a second timestamp when the second dynamic password is generated.

[0098] Optionally, the authentication module 230 is further used to send scenario indication information to the terminal, where the scenario indication information is used to indicate a transformation rule for transforming the first dynamic password when performing dynamic password verification.

[0099] Optionally, the receiving module 210 is further configured to obtain a fourth request message sent by the terminal for verifying the dynamic password, where the fourth request message includes the third dynamic password; The acquisition module 220 is further configured to acquire an IP address of a web page corresponding to the fourth request message, and acquire a third geographical location of the terminal according to the IP address; The authentication module 230 is further configured to generate a fourth dynamic password based on the third geographical location, and transform the fourth dynamic password according to the transformation rule to obtain a fifth dynamic password; The verification result of the dynamic password is determined according to the matching condition between the third dynamic password and the fifth dynamic password.

[0100] Optionally, the authentication module 230 is further configured to generate a fourth dynamic password based on the third geographical location, the fourth terminal identifier, and a third timestamp when the fourth dynamic password is generated.

[0101] The device 200 provided in the embodiment of the present application can execute each method in the foregoing method embodiment and realize the functions and beneficial effects of each method in the foregoing method embodiment, which will not be repeated here.

[0102] Figure 7 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present disclosure is shown. Figure 7 As shown, at the hardware level, the electronic device includes at least one processor, and optionally includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

[0103] The processor, network interface and memory can be interconnected through an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0104] The memory stores the program. Specifically, the program may include a program code, and the program code includes at least one computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0105] At least one processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a device for locating the target user at the logical level. At least one processor executes the program stored in the memory and specifically performs: the method disclosed in the embodiment shown in the first aspect and realizes the functions and beneficial effects of each method described in the method embodiment above, which will not be repeated here.

[0106] The method disclosed in the embodiment shown in the first aspect of the present disclosure can be applied to at least one processor or implemented by at least one processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware or software instructions in at least one processor. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0107] The electronic device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0108] Of course, in addition to software implementation, the electronic device disclosed in the present invention does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0109] The embodiments of the present disclosure also propose a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by at least one processor, they implement the method disclosed in the embodiment shown in the first aspect and realize the functions and beneficial effects of the various methods described in the previous method embodiments, which will not be repeated here.

[0110] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0111] Furthermore, the embodiments of the present disclosure also provide a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the method disclosed in the embodiment shown in the first aspect and realizes the functions and beneficial effects of the various methods described in the previous method embodiments, which will not be repeated here.

[0112] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the various processes of the method disclosed in the embodiment shown in the first aspect and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0113] In short, the above is only a preferred embodiment of the present disclosure and does not limit the protection scope of the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0114] The systems, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0115] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0116] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0117] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A security authentication method, characterized in that: The method comprises: Receiving a first request message sent by a terminal for obtaining a dynamic password, where the first request message includes a first terminal identifier of the terminal; Acquire a first geographical location of the terminal according to the first terminal identifier; A first dynamic password is generated based on the first geographical location, and a first response message including the first dynamic password is sent to the terminal.

2. The method according to claim 1, characterized in that The generating a first dynamic password based on the first geographical location includes: The first dynamic password is generated based on the first geographical location, a second terminal identifier of the terminal, and a first timestamp when the first dynamic password is generated.

3. The method according to claim 2, characterized in that The generating the first dynamic password based on the first geographical location, the second terminal identifier of the terminal, and a first timestamp when the first dynamic password is generated includes: Generate a first key according to a first encryption algorithm, wherein the first key includes a first public key and a first private key; Sending a second request message for obtaining a second terminal identifier input by a user to the terminal, where the second request message includes the first public key; receiving a second response message sent by a terminal, where the second response message includes a second terminal identifier and a second public key encrypted by the first public key, where the second public key is a public key in a second key generated by the terminal based on a second encryption algorithm; decrypting the encrypted second terminal identifier by using the first private key to obtain the second terminal identifier; If the second terminal identifier matches the first terminal identifier, generating the first dynamic password based on the first geographical location, the second terminal identifier of the terminal, and a first timestamp when the first dynamic password is generated, and sending the first response message including the first dynamic password encrypted by the second public key to the terminal; or In a case where the second terminal identifier does not match the first terminal identifier, a third response message indicating a failure is sent to the terminal.

4. The method according to claim 2, characterized in that: The first formula for generating the first dynamic password is: ； Wherein, P is the second terminal identifier, To obtain the bitwise sum, T1 is the first timestamp when the first dynamic password is generated, L1 is the hash value of the preset number of bits of the first address position, K, N1 and N2 are preset constant values, is the modulo operator.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: receiving a third request message for verifying a dynamic password sent by a terminal, wherein the third request message includes the first dynamic password; Obtaining an IP address of a web page corresponding to the third request message, and obtaining a second geographical location of the terminal according to the IP address; generating a second dynamic password based on the second geographical location; The verification result of the dynamic password is determined according to the matching condition between the first dynamic password and the second dynamic password.

6. The method according to claim 5, characterized in that The acquiring the second geographical location of the terminal according to the IP address includes: The second geographical location of the terminal is obtained according to the correspondence between the preset IP address segment and the geographical location.

7. The method according to claim 5, characterized in that The third request message also includes a third terminal identifier, and the generating a second dynamic password based on the second geographical location includes: The second dynamic password is generated based on the second geographical location, the third terminal identifier, and a second timestamp when the second dynamic password is generated.

8. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Sending scenario indication information to the terminal, where the scenario indication information is used to indicate a transformation rule for transforming the first dynamic password when performing dynamic password verification; receiving a fourth request message for verifying the dynamic password sent by the terminal, wherein the fourth request message includes the third dynamic password; Obtaining an IP address of a webpage corresponding to the fourth request message, and obtaining a third geographical location of the terminal according to the IP address; generating a fourth dynamic password based on the third geographical location, and transforming the fourth dynamic password according to the transformation rule to obtain a fifth dynamic password; The verification result of the dynamic password is determined according to the matching condition between the third dynamic password and the fifth dynamic password.

9. The method according to claim 8, characterized in that The fourth request message also includes a fourth terminal identifier, and the generating a fourth dynamic password based on the third geographical location includes: The fourth dynamic password is generated based on the third geographical location, the fourth terminal identifier, and a third timestamp when the fourth dynamic password is generated.

10. The method according to claim 8, characterized in that The transformation rule includes a base transformation rule, a digit sequence transformation rule or a digit transformation rule.

Images