Password-free authentication method and system for user terminal

Abstract

The invention discloses a password-free authentication method and system for a user terminal, and the method comprises the steps: responding to an external triggering instruction through the user terminal, switching to a data flow mode, and transmitting a password-free authentication request to a communication gateway; performing header enhancement processing on the password-free authentication request through the communication gateway, generating a target authentication request, and sending the target authentication request to a password-free authentication server; analyzing the target authentication request through the password-free authentication server, generating an analysis result, and obtaining a user identifier corresponding to the user terminal; and if the analysis result meets the authentication condition, returning the access token and a desensitization identifier corresponding to the user identifier to the user terminal through the password-free authentication server. Through combined verification of the number of the IPv4 private network addresses and the number of the IPv6 addresses, the situation that identity information is wrongly recognized due to the fact that a third-party hot spot is accessed is avoided in the password-free authentication process of the user terminal, the identity recognition process of password-free authentication is effectively reinforced, and the accuracy and safety of password-free authentication are guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of password-free authentication, and in particular to a password-free authentication method and system for a user terminal. Background Art

[0002] Password-free number acquisition is an authentication method used by operators based on mobile traffic networks. Its principle is to identify user information (mobile phone number / IMEI, etc.) when the user accesses the operator network gateway, and then encrypt the information and transparently transmit it to the operator authentication system via HTTP / HTTPS. The operator authentication system is then provided to third-party authentication through capability exposure.

[0003] In the existing user terminal password-free authentication process, if the user terminal accesses a third-party hotspot, identity information misidentification may occur easily, and the accuracy and security of the password-free authentication will decrease. Summary of the invention

[0004] The present invention provides a method and system for password-free authentication of a user terminal, which solves the technical problem that in the existing process of password-free authentication of a user terminal, if the user terminal accesses a third-party hotspot, identity information misidentification is likely to occur, and the accuracy and security of the password-free authentication are reduced.

[0005] The present invention provides a password-free authentication method for a user terminal, comprising:

[0006] The user terminal responds to an external trigger command, switches to data traffic mode and sends a password-free authentication request to the communication gateway;

[0007] Performing header enhancement processing on the password-free authentication request through the communication gateway, generating a target authentication request and sending it to the password-free authentication server;

[0008] Parsing the target authentication request through the password-free authentication server, generating a parsing result, and obtaining a user identifier corresponding to the user terminal;

[0009] If the parsing result meets the authentication condition, the access token and the desensitized identifier corresponding to the user identifier are returned to the user terminal through the password-free authentication server.

[0010] Optionally, the step of responding to an external trigger instruction through a user terminal, switching to a data traffic mode and sending a password-free authentication request to a communication gateway includes:

[0011] The user terminal responds to an external trigger instruction, switching the current data communication mode to the data flow mode;

[0012] If the user terminal applies the IPv4 network layer protocol, an IPv4 password-free authentication request is generated by the user terminal using the first IP address allocated by the communication gateway, and sent to the communication gateway;

[0013] If the user terminal applies the IPv6 network layer protocol, an IPv6 password-free authentication request is sent to the communication gateway through the user terminal.

[0014] Optionally, if the password-free authentication request is the IPv4 password-free authentication request, performing header enhancement processing on the password-free authentication request through the communication gateway, generating a target authentication request and sending it to the password-free authentication server, includes:

[0015] Responding to the IPv4 password-free authentication request through the communication gateway, using the second private network IP address and the user identifier corresponding to the user terminal to construct a first header extension field;

[0016] Inserting the first header extension field into the IPv4 password-free authentication request through the communication gateway to generate a target authentication request;

[0017] The target authentication request is sent to the password-free authentication service end through the communication gateway.

[0018] Optionally, parsing the target authentication request through the password-free authentication server, generating a parsing result, and obtaining a user identifier corresponding to the user terminal includes:

[0019] Parsing the target authentication request by the password-free authentication server, and extracting the first IP address and the second IP address as parsing results respectively;

[0020] The password-free authentication service end obtains a user identifier corresponding to the user terminal from the target authentication request.

[0021] Optionally, if the parsing result meets the authentication condition, returning the access token and the desensitized identifier corresponding to the user identifier to the user terminal through the password-free authentication server, including:

[0022] If the first IP address is consistent with the second IP address, determining that the resolution result satisfies the authentication condition;

[0023] The password-free authentication server returns an access token and a desensitized identifier corresponding to the user identifier to the user terminal.

[0024] Optionally, if the password-free authentication request is the IPv6 password-free authentication request, performing header enhancement processing on the password-free authentication request through the communication gateway, generating a target authentication request and sending it to the password-free authentication server, includes:

[0025] Responding to the IPv6 password-free authentication request through the communication gateway to obtain a data stream sent by the user terminal;

[0026] Extracting the number of IPv6 addresses and the user identifier corresponding to the user terminal from the data stream through the communication gateway, and constructing a second header extension field;

[0027] Inserting the second header extension field into the IPv6 password-free authentication request through the communication gateway to generate a target authentication request;

[0028] The target authentication request is sent to the password-free authentication service end through the communication gateway.

[0029] Optionally, parsing the target authentication request through the password-free authentication server, generating a parsing result, and obtaining a user identifier corresponding to the user terminal includes:

[0030] Parsing the target authentication request through the password-free authentication server, and extracting the number of IPv6 addresses as the parsing result;

[0031] The password-free authentication service end obtains a user identifier corresponding to the user terminal from the target authentication request.

[0032] Optionally, if the parsing result meets the authentication condition, returning the access token and the desensitized identifier corresponding to the user identifier to the user terminal through the password-free authentication server, including:

[0033] If the number of IPv6 addresses is a preset value, determining that the parsing result meets the authentication condition;

[0034] The password-free authentication server returns an access token and a desensitized identifier corresponding to the user identifier to the user terminal.

[0035] Optionally, the method further comprises:

[0036] If the parsing result does not meet the authentication condition, the password-free authentication server returns an authentication failure indication to the user terminal.

[0037] The present invention also provides a password-free authentication system for a user terminal, comprising a user terminal, a communication gateway and a password-free authentication server;

[0038] The user terminal comprises:

[0039] A password-free authentication request module, used to respond to an external trigger instruction, switch to a data traffic mode and send a password-free authentication request to a communication gateway;

[0040] The communication gateway comprises:

[0041] A request header enhancement module, used to perform header enhancement processing on the password-free authentication request, generate a target authentication request and send it to the password-free authentication server;

[0042] The password-free authentication server includes:

[0043] A request parsing module, used to parse the target authentication request, generate a parsing result, and obtain a user identifier corresponding to the user terminal;

[0044] The authentication return module is used to return the access token and the desensitized identifier corresponding to the user identifier to the user terminal if the parsing result meets the authentication conditions.

[0045] It can be seen from the above technical solutions that the present invention has the following advantages:

[0046] The present invention responds to an external trigger instruction through a user terminal, switches to a data flow mode and sends a password-free authentication request to a communication gateway; the communication gateway performs header enhancement processing on the password-free authentication request, generates a target authentication request and sends it to a password-free authentication server; the password-free authentication server parses the target authentication request, generates a parsing result, and obtains a user ID corresponding to the user terminal; if the parsing result meets the authentication condition, the password-free authentication server returns an access token and a desensitized ID corresponding to the user ID to the user terminal. By combining and verifying the number of IPv4 private network addresses and IPv6 addresses, the user terminal avoids the situation of misidentification of identity information caused by accessing a third-party hotspot during the process of password-free authentication, effectively strengthening the identity recognition process of the password-free authentication, and ensuring the accuracy and security of the password-free authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 A flowchart of a method for password-free authentication of a user terminal provided by an embodiment of the present invention;

[0049] Figure 2 Schematic diagram of the authentication process of the password-free authentication method under the IPv4 protocol in an embodiment of the present invention;

[0050] Figure 3 Schematic diagram of the authentication process of the password-free authentication method under the IPv6 protocol in an embodiment of the present invention;

[0051] Figure 4 A structural block diagram of a password-free authentication system for a user terminal provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The embodiment of the present invention provides a method and system for password-free authentication of a user terminal, which is used to solve the technical problem that in the existing process of password-free authentication of a user terminal, if the user terminal accesses a third-party hotspot, identity information is easily misidentified, and the accuracy and security of the password-free authentication are reduced.

[0053] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] See also Figure 1 , Figure 1 A flowchart of a password-free authentication method for a user terminal provided in an embodiment of the present invention.

[0055] The present invention provides a password-free authentication method for a user terminal, comprising:

[0056] Step 101, responding to an external trigger instruction through a user terminal, switching to a data traffic mode and sending a password-free authentication request to a communication gateway;

[0057] The external trigger instruction refers to an instruction generated by a trigger action of a user or an external terminal on a user terminal, which is used to trigger the switching of the data communication mode and the sending of a password-free authentication request. The trigger action may be a click of a specific button, typing in an input box, etc.

[0058] The data traffic mode refers to a mode of data transmission through mobile networks such as 4G and 5G. It is different from the WIFI mode, which uses a wireless access point as a central device and multiple wireless clients access the central device for data transmission.

[0059] The user terminal can be a terminal device such as a mobile phone, a computer, a tablet computer, etc., and the user terminal can use data traffic and multiple data modes for data transmission. The user terminal has a corresponding user identifier, such as a mobile phone number.

[0060] In an embodiment of the present application, when the user terminal receives an external trigger instruction, it indicates that password-free authentication is required for the current website, APP or service. The user terminal can respond to the external trigger instruction and switch from the current data communication mode such as WIFI transmission mode to the data traffic mode, and initiate a password-free authentication request to the communication gateway.

[0061] In an example of the present application, step 101 may include the following sub-steps:

[0062] The user terminal responds to an external trigger instruction, switching the current data communication mode to the data flow mode;

[0063] If the user terminal applies the IPv4 network layer protocol, an IPv4 password-free authentication request is generated by the user terminal using the first IP address allocated by the communication gateway and sent to the communication gateway;

[0064] If the user terminal applies the IPv6 network layer protocol, an IPv6 password-free authentication request is sent to the communication gateway through the user terminal.

[0065] In this embodiment, in order to prevent the user terminal from misidentifying identity information due to accessing a third-party hotspot during password-free authentication, the user terminal switches the current data communication mode to the data traffic mode after receiving an external trigger instruction, and specifically, the WiFi switching function can be used to force the user terminal to use data traffic.

[0066] At the same time, the network layer protocol used by the user terminal is judged in real time. If it only applies the IPv4 network layer protocol, the user terminal uses the first IP address assigned by the communication network to initiate an IPv4 password-free authentication request, and sends the IPv4 password-free authentication request to the communication gateway, waiting for further enhanced processing of the request header field.

[0067] It should be noted that both the first IP address and the second IP address are private IP addresses. When multiple user terminals are connected to the Internet through a communication gateway, in order to save public IP address resources and enable multiple devices to share a public IP address to access the Internet, the communication gateway will allocate private IP addresses to internal devices and convert private IP addresses to public IP addresses through NAT technology to communicate with the external network. For example, in some small offices or home networks, there is only one public IP address, but there are multiple computers, mobile phones, tablets and other devices that need to access the Internet. The communication gateway will allocate private IP addresses to these devices. When the device accesses the Internet, the communication gateway converts the private IP address and port number into a public IP address and a different port number to achieve communication with the external server. This allows multiple devices to access the Internet using a public IP address at the same time, improving the utilization rate of public IP addresses. Among them, NAT (Network Address Translation) refers to network address translation, which was proposed in 1994. NAT is a technology used to use private addresses in local networks and switch to global IP addresses when connecting to the Internet. NAT is actually a technology developed to solve the shortage of IPv4 addresses. NAT is designed to translate IP addresses by mapping one external IP address and port to a larger set of internal IP addresses. Basically, NAT uses a traffic table to route traffic from one external (host) IP address and port number to the correct internal IP address associated with an endpoint on the network.

[0068] Step 102, performing header enhancement processing on the password-free authentication request through the communication gateway, generating a target authentication request and sending it to the password-free authentication server;

[0069] In this embodiment, the communication gateway is connected to the user terminal and the password-free authentication server respectively. After the communication gateway receives the password-free authentication request sent by the user terminal, it performs enhanced insertion of the header field according to the password-free authentication request, generates a target authentication request, and sends the target authentication request to the password-free authentication server. The user terminal is authenticated by the password-free authentication server.

[0070] The password-free authentication server refers to a server system used to perform identity authentication on a password-free authentication request of a user terminal.

[0071] In an example of the present application, step 102 may include the following sub-steps:

[0072] Responding to the IPv4 password-free authentication request through the communication gateway, using the second private network IP address and the user identifier corresponding to the user terminal to construct a first header extension field;

[0073] Inserting the first header extension field into the IPv4 password-free authentication request through the communication gateway to generate a target authentication request;

[0074] Send the target authentication request to the password-free authentication server through the communication gateway.

[0075] User identification refers to identification information used to uniquely identify and distinguish users of different user terminals, including but not limited to unique identifiers, telephone numbers, address information, and serial numbers. It can be obtained in a variety of ways, such as extracting specific identification fields from data packets sent by user terminals, or determining user identities and obtaining corresponding user identifications through interaction with other systems.

[0076] like Figure 2 As shown, Figure 2 The figure is a schematic diagram of the authentication process of the password-free authentication method under the IPv4 protocol in an embodiment of the present invention.

[0077] In this embodiment, when the communication gateway receives an IPv4 password-free authentication request, it uses its built-in second private network IP address and the user identifier corresponding to the user terminal to construct a first header extension field and insert it into the original header field of the IPv4 password-free authentication request to generate a target authentication request, thereby achieving header enhancement of the HTTP request and improving the security of the request.

[0078] Finally, the target authentication request is sent to the password-free authentication server through the communication gateway, and the password-free authentication server is waited for to perform password-free authentication on the password-free authentication request.

[0079] In another example of the present application, if the password-free authentication request is an IPv6 password-free authentication request, step 102 may include the following sub-steps:

[0080] Respond to the IPv6 password-free authentication request through the communication gateway and obtain the data stream sent by the user terminal;

[0081] Extracting the number of IPv6 addresses and the user identifier corresponding to the user terminal from the data stream through the communication gateway, and constructing a second header extension field;

[0082] Inserting the second header extension field into the IPv6 password-free authentication request through the communication gateway to generate a target authentication request;

[0083] Send the target authentication request to the password-free authentication server through the communication gateway.

[0084] In the prior art, the TTL value of the user's message is detected by the communication gateway to determine whether the terminal has turned on the mobile hotspot, which is not very accurate. In this example, the gateway device extracts and analyzes the number of source IPv6 addresses used by the user to determine whether the user has turned on the mobile hotspot (connected to multiple terminal devices), and transmits the information on whether the hotspot is turned on to the password-free authentication server, which is highly accurate.

[0085] See also Figure 3 , Figure 3 The figure is a schematic diagram of the authentication process of the password-free authentication method under the IPv6 protocol in an embodiment of the present invention.

[0086] In this embodiment, when the user terminal accesses the communication gateway with an IPv6 password-free authentication request, the communication gateway obtains the data stream sent by the user terminal, and accurately identifies the IPv6 address by analyzing the header information of the data packet. A specific algorithm and data structure can be used to record and count different IPv6 addresses to ensure that no repeated counting is performed. The number of IPv6 addresses and the user identifier corresponding to the user terminal are extracted from the data to construct a second header extension field.

[0087] The communication gateway generates a target authentication request by inserting the second header extension field into the original header field of the IPv6 password-free authentication request to complete the header enhancement of the IPv6 password-free authentication request, and sends the generated target authentication request to the password-free authentication server.

[0088] Step 103, parsing the target authentication request through the password-free authentication server, generating a parsing result, and obtaining a user identifier corresponding to the user terminal;

[0089] In this embodiment, after receiving the target authentication request, the password-free authentication server parses the target authentication request to obtain the user identifier corresponding to the user terminal and the corresponding parsing result, thereby obtaining the data basis for the subsequent password-free authentication.

[0090] In an example of the present application, if the password-free authentication request is an IPv4 password-free authentication request, step 103 may include the following sub-steps:

[0091] Parsing the target authentication request through the password-free authentication server, and extracting the first IP address and the second IP address as parsing results respectively;

[0092] The password-free authentication server obtains the user ID corresponding to the user terminal from the target authentication request.

[0093] like Figure 2 As shown, after receiving the target authentication request, the password-free authentication server parses it. Since the target authentication request is formed by inserting the first header extension field into the IPv4 password-free authentication request, the first IP address can be directly extracted from the IPv4 password-free authentication request part in the target authentication request, and the second IP address and the user identifier corresponding to the user terminal can be extracted from the first header extension field in the target authentication request.

[0094] In another example of the present application, if the password-free authentication request is an IPv6 password-free authentication request, step 103 may include the following sub-steps:

[0095] Parse the target authentication request through the password-free authentication server and extract the number of IPv6 addresses as the parsing result;

[0096] The password-free authentication server obtains the user ID corresponding to the user terminal from the target authentication request.

[0097] like Figure 3 As shown, in this embodiment, after the password-free authentication server receives the target authentication request, it parses the header field of the target authentication request to extract the IPv6 address data and the user identifier corresponding to the user terminal.

[0098] Step 104: If the parsing result meets the authentication condition, the access token and the desensitized identifier corresponding to the user identifier are returned to the user terminal through the password-free authentication server.

[0099] An access token is a security credential widely used in computer systems and network communications. In this embodiment, it is used to verify the identity of a user or client and determine their access rights to specific resources or services. When a user successfully authenticates, the system issues an access token to the user. This token contains information about the user's identity and permissions. When the user subsequently accesses protected resources, he or she needs to present this token to prove his or her identity and permissions.

[0100] A desensitized identifier refers to an identifier used to protect sensitive information, such as a phone number that has been desensitized to protect the user's phone number.

[0101] In an example of the present application, if the password-free authentication request is an IPv4 password-free authentication request, step 104 may include the following sub-steps:

[0102] If the first IP address is consistent with the second IP address, the parsing result is determined to meet the authentication condition;

[0103] The password-free authentication server returns the access token and the desensitized identifier corresponding to the user identifier to the user terminal.

[0104] like Figure 2 As shown, in this embodiment, the password-free authentication server compares the first IP address and the second IP address to determine whether the two are consistent. If they are consistent, it means that the parsing result meets the authentication condition at this time, that is, the user terminal is not connected to the mobile hotspot, and the password-free authentication server can desensitize the user ID and generate a desensitized ID. The password-free authentication server directly returns the access token and the desensitized ID to the user terminal, thereby completing the password-free authentication under the IPv4 protocol. Combined with the verification method of the IPv4 private network address, full-scene coverage can be achieved, solving the accuracy and security issues of the password-free authentication.

[0105] In another example of the present application, if the password-free authentication request is an IPv6 password-free authentication request, step 104 may include the following sub-steps:

[0106] If the number of IPv6 addresses is the preset value, the parsing result is determined to meet the authentication condition;

[0107] The password-free authentication server returns the access token and the desensitized identifier corresponding to the user identifier to the user terminal.

[0108] like Figure 3 As shown, after the password-free authentication server parses the number of IPv6 addresses and the user ID, it determines in real time whether the number of IPv6 addresses is a preset value. If so, it determines that the parsing result meets the authentication condition, that is, the user terminal is not connected to the mobile hotspot. At this time, the password-free authentication server can desensitize the user ID and generate a desensitized ID. The password-free authentication server directly returns the access token and the desensitized ID to the user terminal, thereby determining whether the user terminal is connected to the mobile hotspot through the number of IPv6 addresses extracted from the data stream, solving the hotspot identification problem of the user terminal IPv6 password-free authentication.

[0109] Among them, the preset value can be 1.

[0110] Optionally, the method further comprises the following steps:

[0111] If the parsing result does not meet the authentication conditions, the password-free authentication server returns an authentication failure indication to the user terminal.

[0112] In the specific implementation, if the number of IPv6 addresses is not equal to the preset value, or the first IP address is different from the second IP address, the password-free authentication server determines that the parsing result does not meet the authentication conditions at this time, and returns an authentication failure indication to the user terminal to inform the user that the current password-free authentication has failed.

[0113] In an embodiment of the present application, the user terminal responds to an external trigger instruction, switches to the data traffic mode and sends a password-free authentication request to the communication gateway; the communication gateway performs header enhancement processing on the password-free authentication request, generates a target authentication request and sends it to the password-free authentication server; the password-free authentication server parses the target authentication request, generates a parsing result, and obtains the user ID corresponding to the user terminal; if the parsing result meets the authentication conditions, the password-free authentication server returns the access token and the desensitized ID corresponding to the user ID to the user terminal. By combining and verifying the number of IPv4 private network addresses and IPv6 addresses, the user terminal can avoid the misidentification of identity information caused by accessing a third-party hotspot during the password-free authentication process, effectively strengthening the identity recognition process of the password-free authentication and ensuring the accuracy and security of the password-free authentication.

[0114] See also Figure 4 , Figure 4 A structural block diagram of a password-free authentication system for a user terminal in an embodiment of the present application is shown.

[0115] The present invention also provides a password-free authentication system for a user terminal, comprising a user terminal 401, a communication gateway 402 and a password-free authentication server 403;

[0116] The user terminal 401 includes:

[0117] The password-free authentication request module 4011 is used to respond to an external trigger instruction, switch to the data flow mode and send a password-free authentication request to the communication gateway;

[0118] The communication gateway 402 includes:

[0119] The request header enhancement module 4021 is used to perform header enhancement processing on the password-free authentication request, generate a target authentication request and send it to the password-free authentication server;

[0120] Password-free authentication server 403 includes:

[0121] The request parsing module 4031 is used to parse the target authentication request, generate a parsing result, and obtain a user identifier corresponding to the user terminal;

[0122] The authentication return module 4032 is used to return the access token and the desensitized identifier corresponding to the user identifier to the user terminal if the parsing result meets the authentication condition.

[0123] Optionally, the password-free authentication request module 4011 is specifically used for:

[0124] The user terminal responds to an external trigger instruction, switching the current data communication mode to the data flow mode;

[0125] If the user terminal applies the IPv4 network layer protocol, an IPv4 password-free authentication request is generated by the user terminal using the first IP address allocated by the communication gateway and sent to the communication gateway;

[0126] If the user terminal applies the IPv6 network layer protocol, an IPv6 password-free authentication request is sent to the communication gateway through the user terminal.

[0127] Optionally, if the password-free authentication request is an IPv4 password-free authentication request, the request header enhancement module 4021 is specifically used to:

[0128] Responding to the IPv4 password-free authentication request through the communication gateway, using the second private network IP address and the user identifier corresponding to the user terminal to construct a first header extension field;

[0129] Inserting the first header extension field into the IPv4 password-free authentication request through the communication gateway to generate a target authentication request;

[0130] Send the target authentication request to the password-free authentication server through the communication gateway.

[0131] Optionally, the request parsing module 4031 is specifically used for:

[0132] Parsing the target authentication request through the password-free authentication server, and extracting the first IP address and the second IP address as parsing results respectively;

[0133] The password-free authentication server obtains the user ID corresponding to the user terminal from the target authentication request.

[0134] Optionally, the authentication return module 4032 is specifically used to

[0135] If the first IP address is consistent with the second IP address, the parsing result is determined to meet the authentication condition;

[0136] The password-free authentication server returns the access token and the desensitized identifier corresponding to the user identifier to the user terminal.

[0137] Optionally, if the password-free authentication request is an IPv6 password-free authentication request, the request header enhancement module 4021 is specifically used to:

[0138] Respond to the IPv6 password-free authentication request through the communication gateway and obtain the data stream sent by the user terminal;

[0139] Extracting the number of IPv6 addresses and the user identifier corresponding to the user terminal from the data stream through the communication gateway, and constructing a second header extension field;

[0140] Inserting the second header extension field into the IPv6 password-free authentication request through the communication gateway to generate a target authentication request;

[0141] Send the target authentication request to the password-free authentication server through the communication gateway.

[0142] Optionally, the request parsing module 4031 is specifically used for:

[0143] Parse the target authentication request through the password-free authentication server and extract the number of IPv6 addresses as the parsing result;

[0144] The password-free authentication server obtains the user ID corresponding to the user terminal from the target authentication request.

[0145] Optionally, the authentication return module 4032 is specifically used for:

[0146] If the number of IPv6 addresses is the preset value, the parsing result is determined to meet the authentication condition;

[0147] The password-free authentication server returns the access token and the desensitized identifier corresponding to the user identifier to the user terminal.

[0148] Optionally, the password-free authentication server 403 further includes:

[0149] The prompt return module is used to return an authentication failure indication to the user terminal if the parsing result does not meet the authentication conditions.

[0150] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0151] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0152] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0153] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A password-free authentication method for a user terminal, characterized in that: include: The user terminal responds to an external trigger command, switches to data traffic mode and sends a password-free authentication request to the communication gateway; Performing header enhancement processing on the password-free authentication request through the communication gateway, generating a target authentication request and sending it to the password-free authentication server; Parsing the target authentication request through the password-free authentication server, generating a parsing result, and obtaining a user identifier corresponding to the user terminal; If the parsing result meets the authentication condition, the access token and the desensitized identifier corresponding to the user identifier are returned to the user terminal through the password-free authentication server.

2. The method according to claim 1, characterized in that: The method of responding to an external trigger instruction through a user terminal, switching to a data traffic mode and sending a password-free authentication request to a communication gateway includes: The user terminal responds to an external trigger instruction, switching the current data communication mode to the data flow mode; If the user terminal applies the IPv4 network layer protocol, an IPv4 password-free authentication request is generated by the user terminal using the first IP address allocated by the communication gateway, and sent to the communication gateway; If the user terminal applies the IPv6 network layer protocol, an IPv6 password-free authentication request is sent to the communication gateway through the user terminal.

3. The method according to claim 2, characterized in that If the password-free authentication request is the IPv4 password-free authentication request, performing header enhancement processing on the password-free authentication request through the communication gateway, generating a target authentication request and sending it to the password-free authentication server, includes: Responding to the IPv4 password-free authentication request through the communication gateway, using the second private network IP address and the user identifier corresponding to the user terminal to construct a first header extension field; Inserting the first header extension field into the IPv4 password-free authentication request through the communication gateway to generate a target authentication request; The target authentication request is sent to the password-free authentication service end through the communication gateway.

4. The method according to claim 3, characterized in that The step of parsing the target authentication request through the password-free authentication server, generating a parsing result, and obtaining a user identifier corresponding to the user terminal includes: Parsing the target authentication request by the password-free authentication server, and extracting the first IP address and the second IP address as parsing results respectively; The password-free authentication service end obtains a user identifier corresponding to the user terminal from the target authentication request.

5. The method according to claim 4, characterized in that If the parsing result meets the authentication condition, returning the access token and the desensitized identifier corresponding to the user identifier to the user terminal through the password-free authentication server, including: If the first IP address is consistent with the second IP address, determining that the resolution result satisfies the authentication condition; The password-free authentication server returns an access token and a desensitized identifier corresponding to the user identifier to the user terminal.

6. The method according to claim 2, characterized in that If the password-free authentication request is the IPv6 password-free authentication request, the communication gateway performs header enhancement processing on the password-free authentication request, generates a target authentication request and sends it to the password-free authentication server, including: Responding to the IPv6 password-free authentication request through the communication gateway to obtain a data stream sent by the user terminal; Extracting the number of IPv6 addresses and the user identifier corresponding to the user terminal from the data stream through the communication gateway, and constructing a second header extension field; Inserting the second header extension field into the IPv6 password-free authentication request through the communication gateway to generate a target authentication request; The target authentication request is sent to the password-free authentication service end through the communication gateway.

7. The method according to claim 6, characterized in that The step of parsing the target authentication request through the password-free authentication server, generating a parsing result, and obtaining a user identifier corresponding to the user terminal includes: Parsing the target authentication request through the password-free authentication server, and extracting the number of IPv6 addresses as the parsing result; The password-free authentication service end obtains a user identifier corresponding to the user terminal from the target authentication request.

8. The method according to claim 7, characterized in that If the parsing result meets the authentication condition, returning the access token and the desensitized identifier corresponding to the user identifier to the user terminal through the password-free authentication server, including: If the number of IPv6 addresses is a preset value, determining that the parsing result meets the authentication condition; The password-free authentication server returns an access token and a desensitized identifier corresponding to the user identifier to the user terminal.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: If the parsing result does not meet the authentication condition, the password-free authentication server returns an authentication failure indication to the user terminal.

10. A password-free authentication system for a user terminal, characterized in that: Includes user terminal, communication gateway and password-free authentication server; The user terminal comprises: A password-free authentication request module, used to respond to an external trigger instruction, switch to a data traffic mode and send a password-free authentication request to a communication gateway; The communication gateway comprises: A request header enhancement module, used to perform header enhancement processing on the password-free authentication request, generate a target authentication request and send it to the password-free authentication server; The password-free authentication server includes: A request parsing module, used to parse the target authentication request, generate a parsing result, and obtain a user identifier corresponding to the user terminal; The authentication return module is used to return the access token and the desensitized identifier corresponding to the user identifier to the user terminal if the parsing result meets the authentication conditions.

Images