Password-free authentication method and system, electronic equipment and storage medium

Abstract

The invention discloses a password-free authentication method and system, electronic equipment and a storage medium. The method comprises the following steps: acquiring a first pre-authorization request; the first pre-authorization request is constructed by a preset service platform according to a second pre-authorization request initiated by a preset client and target data; generating preset security credential data according to the first pre-authorization request, and binding the preset security credential data with the access token; the preset security credential data comprises preset small block data and preset key data; generating encrypted data according to the preset security credential data and the access token, and returning the encrypted data to the preset client; obtaining a first authorization request sent by a preset client; the first authorization request comprises an authentication code and is generated by preset small block data, preset key data and a preset random secret code; and when it is determined that the preset small block data and the preset random secret code pass verification, returning the target data to the preset client. According to the embodiment of the invention, the reliability and security of password-free authentication can be improved. The method can be widely applied to the technical field of network security.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a password-free authentication method, system, electronic device and storage medium. Background Art

[0002] Password-free authentication greatly improves the convenience of identity authentication. For example, password-free number acquisition is an authentication method based on mobile traffic networks. It identifies user information in the gateway on the operator's network side when the user accesses it, and transmits it to the corresponding authentication system for authentication after encryption. Then, the authentication system is provided to third parties for authentication through capability opening. However, in related technologies, the security of password-free authentication is difficult to guarantee and its reliability is low.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a password-free authentication method, system, electronic device and storage medium, which can effectively improve the reliability and security of password-free authentication.

[0005] To achieve the above purpose, an embodiment of the present application provides a password-free authentication method, which includes the following steps:

[0006] Obtaining a first pre-authorization request; wherein the first pre-authorization request is constructed by a preset service platform according to a second pre-authorization request initiated by a preset client and target data;

[0007] Generate preset security credential data according to the first pre-authorization request, and bind the preset security credential data to the access token; wherein the preset security credential data includes preset small block data and preset key data;

[0008] generating encrypted data according to the preset security credential data and the access token, so as to return the encrypted data to the preset client;

[0009] Obtaining a first authorization request sent by the preset client; wherein the first authorization request includes an authentication code, and the authentication code is generated by the preset small block data, preset key data, and a preset random code;

[0010] When it is determined that the preset small block of data and the preset random code have passed the verification, the target data is returned to the preset client.

[0011] In some embodiments, generating preset security credential data according to the first pre-authorization request and binding the preset security credential data to the access token includes:

[0012] In response to the first pre-authorization request, generating a random Advanced Encryption Standard key and a random small block of data;

[0013] The random Advanced Encryption Standard key and the random small block of data are bound to the access token.

[0014] In some embodiments, generating encrypted data according to the preset security credential data and the access token includes:

[0015] The preset security credential data and the access token are encrypted using a preset symmetric encryption algorithm to generate the encrypted data.

[0016] In some embodiments, before performing the step of obtaining the first authorization request sent by the preset client, the method further includes:

[0017] When it is determined that the preset client has received the encrypted data, the encrypted data is decrypted by using the preset symmetric encryption algorithm to obtain the access token, the preset small block of data, and the preset key data;

[0018] Generate the preset random code according to a preset generation rule;

[0019] Splicing the preset random code with the preset small block data to obtain preset spliced ​​data;

[0020] The preset splicing data is encrypted by using the preset key data to obtain the authentication code;

[0021] The first authorization request is constructed according to the authentication code and the access token.

[0022] In some embodiments, when it is determined that the preset small block of data and the preset random code pass verification, returning the target data to the preset client includes:

[0023] Acquire the preset key data through the access token, so as to decrypt the authentication code through the preset key data to obtain the preset small block data and the preset random code;

[0024] Performing a consistency check on the preset small block of data to obtain a first check result;

[0025] Verifying the preset random code according to a preset generation rule to obtain a second verification result;

[0026] When it is determined that both the first verification result and the second verification result pass, the target data is returned to the preset client.

[0027] In some embodiments, generating the preset random code by using a preset generation rule includes:

[0028] A preset number of target values ​​are randomly selected from a preset data set according to the preset generation rule, so as to construct the preset random code through the target values; wherein the preset data bits of the preset random code satisfy a preset check condition, and the preset check condition includes an odd check condition or an even check condition.

[0029] In some embodiments, the randomly selecting a preset number of target values ​​from a preset data set according to the preset generation rule to construct the preset random code through the target values ​​includes:

[0030] randomly selecting a first number of first target integers from the first data set according to the preset generation rule to construct a first number sequence;

[0031] Randomly selecting a second number of second target integers from the second data set according to the preset generation rule to construct a second number sequence; wherein the sum of the second target integers in the second number sequence is an odd number;

[0032] The preset random code is constructed according to the first number series and the second number series.

[0033] To achieve the above purpose, another aspect of the embodiment of the present application provides a password-free authentication system, the system comprising:

[0034] The first module is used to obtain a first pre-authorization request; wherein the first pre-authorization request is constructed by a preset service platform according to a second pre-authorization request initiated by a preset client and target data;

[0035] A second module is used to generate preset security credential data according to the first pre-authorization request, and bind the preset security credential data to the access token; wherein the preset security credential data includes preset small block data and preset key data;

[0036] A third module is used to generate encrypted data according to the preset security credential data and the access token, so as to return the encrypted data to the preset client;

[0037] A fourth module is used to obtain a first authorization request sent by the preset client; wherein the first authorization request includes an authentication code, and the authentication code is generated by the preset small block data, the preset key data and the preset random code;

[0038] The fifth module is used to return the target data to the preset client when it is determined that the preset small block data and the preset random code have passed the verification.

[0039] To achieve the above object, another aspect of an embodiment of the present application provides an electronic device, the electronic device comprising:

[0040] at least one processor;

[0041] at least one memory for storing at least one program;

[0042] When the at least one program is executed by the at least one processor, the at least one processor implements the above method.

[0043] To achieve the above objective, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0044] The embodiments of the present application include at least the following beneficial effects: The present application provides a method, system, electronic device and storage medium for password-free authentication. The scheme obtains a first pre-authorization request, which is constructed according to the second pre-authorization request and target data when the preset service platform determines that it has received a second pre-authorization request initiated by a preset client. Then, the embodiment of the present invention generates preset security credential data according to the first authorization request, and binds the preset security credential data to the access token. Among them, the preset security credential data in the embodiment of the present invention includes preset small blocks of data and preset key data. Further, the embodiment of the present invention generates encrypted data according to the preset security credential data and the access token to return the encrypted data to the preset client. Further, the embodiment of the present invention obtains the first authorization request sent by the preset client. Among them, the first authorization request includes an authentication code, which is generated by the preset small block of data, the preset key data and the preset random code. Finally, when it is determined that the preset small block of data and the preset random code are verified, the embodiment of the present invention returns the target data to the preset client to achieve password-free authentication. It is easy to understand that the embodiment of the present invention effectively improves the reliability and security of password-free authentication by adding a preset small block of data to the preset security credential and generating a preset random code through a preset client, thereby combining the preset small block of data and the preset random code for double verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is a flowchart of the steps of the password-free authentication method provided by an embodiment of the present invention;

[0046] Figure 2 It is a flowchart of steps for generating preset security credential data according to a first authorization request and binding the preset security credential data with an access token provided by an embodiment of the present invention;

[0047] Figure 3is a flowchart of the steps of a preset client constructing a first authorization request provided by an embodiment of the present invention;

[0048] Figure 4 It is a flowchart of the steps of returning target data to a preset client when it is determined that the preset small block data and the preset random code have passed the verification provided by an embodiment of the present invention;

[0049] Figure 5 is a flowchart of steps for generating a preset random code by using a preset generation rule provided by an embodiment of the present invention;

[0050] Figure 6 A flowchart of randomly selecting a preset number of target values ​​from a preset data set according to the preset generation rule to construct a preset random code through the target values ​​is provided in an embodiment of the present invention;

[0051] Figure 7 It is a schematic diagram of the process of traditional password-free number acquisition provided by an embodiment of the present invention;

[0052] Figure 8 It is a flowchart of password-free number acquisition using a password-free authentication method provided by an embodiment of the present invention;

[0053] Fig. 9 It is a structural diagram of a password-free authentication system provided in an embodiment of the present application;

[0054] Fig.10 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0056] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0057] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0059] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0060] Code: A unique number used by a specific group or device for specific communication or identification purposes.

[0061] Small piece of data (cookie): also known as a small text file, refers to the data stored on the local terminal (Client Side) in order to identify the user, usually encrypted.

[0062] Advanced Encryption Standard (AES): is a symmetric encryption algorithm used for data protection. AES uses a fixed-size key (usually 128 bits, 192 bits, or 256 bits) for data encryption and decryption. Random keys mean that when performing encryption operations, the key is randomly generated, making the encryption process more secure.

[0063] XXTea (Corrected Block TEA): is a lightweight symmetric encryption algorithm, which belongs to the block encryption method. It is mainly used to encrypt smaller data blocks and is suitable for resource-constrained environments.

[0064] Password-free authentication greatly improves the convenience of identity authentication. For example, password-free number acquisition is an authentication method based on mobile traffic networks. It identifies user information in the gateway on the operator's network side when the user accesses it, and transmits it to the corresponding authentication system for authentication after encryption. Then, the authentication system is provided to third parties for authentication through capability opening. However, in related technologies, the security of password-free authentication is difficult to guarantee and its reliability is low.

[0065] In view of this, a method, system, electronic device and storage medium for password-free authentication are provided in the embodiment of the present application. The scheme obtains a first pre-authorization request, which is constructed according to the second pre-authorization request and the target data when the preset service platform determines that it has received a second pre-authorization request initiated by the preset client. Then, the embodiment of the present invention generates preset security credential data according to the first authorization request, and binds the preset security credential data to the access token. Among them, the preset security credential data in the embodiment of the present invention includes preset small blocks of data and preset key data. Further, the embodiment of the present invention generates encrypted data according to the preset security credential data and the access token to return the encrypted data to the preset client. Further, the embodiment of the present invention obtains the first authorization request sent by the preset client. Among them, the first authorization request includes an authentication code, which is generated by preset small blocks of data, preset key data and preset random secret codes. Finally, when it is determined that the preset small blocks of data and the preset random secret codes are verified, the embodiment of the present invention returns the target data to the preset client to realize password-free authentication, which effectively improves the reliability and security of password-free authentication.

[0066] The password-free authentication method provided in the embodiment of the present application relates to the field of network security technology. The password-free authentication method provided in the embodiment of the present application can be applied to a terminal, can also be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured to provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms and other basic cloud computing services. The server can also be a node server in the blockchain network; the software can be an application that implements the password-free authentication method, etc., but is not limited to the above forms.

[0067] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0068] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0069] Figure 1 is an optional flowchart of the password-free authentication method provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S110 to S150.

[0070] Step S110: Obtain a first pre-authorization request, wherein the first pre-authorization request is constructed by the preset service platform according to the second pre-authorization request initiated by the preset client and the target data.

[0071] Step S120: Generate preset security credential data according to the first authorization request, and bind the preset security credential data to the access token, wherein the preset security credential data includes preset small block data and preset key data.

[0072] Step S130: Generate encrypted data according to the preset security credential data and the access token, and return the encrypted data to the preset client.

[0073] Step S140: Obtain a first authorization request sent by a preset client, wherein the first authorization request includes an authentication code, and the authentication code is generated by a preset small block of data, preset key data, and a preset random code.

[0074] Step S150: When it is determined that the preset small block of data and the preset random code have passed the verification, the target data is returned to the preset client.

[0075] During the working process of this specific embodiment, the embodiment of the present invention first obtains a first pre-authorization request. Specifically, in the embodiment of the present invention, the first pre-authorization request is generated by a preset service platform and sent to a preset server, such as an account server, so that the preset server obtains the corresponding first pre-authorization request. Among them, in the embodiment of the present invention, when the preset client needs to perform password-free authentication, the preset client sends a second pre-authorization request to the preset service platform. For example, the client SDK forces the use of data traffic through the WIFI switching function to initiate a pre-authorization request, that is, a second pre-authorization request. Correspondingly, when the preset service platform, such as the operator's large network platform, receives the second authorization request sent by the preset client, the received second authorization request and the corresponding target data are combined to construct a first pre-authorization request, and sent to the preset server. For example, after receiving the second pre-authorization request sent by the preset client, the corresponding operator's large network platform inserts the corresponding target data, such as the user's mobile phone number, into the second pre-authorization request to obtain header enhancement data, that is, the first pre-authorization request. Next, the embodiment of the present invention generates preset security credential data according to the first pre-authorization request, and binds the preset security credential data to the access token. Specifically, the preset security credential data in the embodiment of the present invention includes preset small blocks of data (cookies) and preset key data. Accordingly, when the preset server, such as the account server, receives the first pre-authorization request, it decrypts the first pre-authorization request to obtain the corresponding target data. At the same time, the preset server responds to the first pre-authorization request, generates preset key data and preset small blocks of data (cookies), and binds them to the corresponding access token. Further, the embodiment of the present invention generates encrypted data based on the generated preset security credential data and access token to return the encrypted data to the preset client. Specifically, in the embodiment of the present invention, after generating the preset security credential, the preset server encrypts the preset security credential and the bound token with the corresponding key to obtain encrypted data, and then sends the encrypted encrypted data to the preset client.

[0076] Further, the embodiment of the present invention obtains a first authorization request initiated by a preset client. Specifically, in the embodiment of the present invention, after receiving the encrypted data returned by the preset server, the preset client sends the first authorization request to the preset server. In the embodiment of the present invention, the first authorization request includes an authentication code. Accordingly, the authentication code is generated by a preset small block of data (cookie), a preset key data, and a preset random password. When the preset client receives the encrypted data returned by the preset server, the encrypted data is decrypted by the corresponding key to obtain an access token, a preset small block of data (cookie), and a preset key data. At the same time, the preset client generates a preset random password according to a preset generation rule, so as to construct an authentication code according to the preset small block of data (cookie), the preset key data, and the preset random password obtained by decryption. Accordingly, in the embodiment of the present invention, the preset client initiates an authorization request to the preset server according to the authentication code and the access token obtained by decryption, that is, the first authorization request. Finally, after the preset server receives the first authorization request, the preset small block of data and the preset random password are verified. When it is determined that the preset small block of data (cookie) and the preset random password are both verified, the embodiment of the present invention returns the target data to the preset client to complete the password-free authentication. Specifically, after receiving the first authorization request, the preset server determines the corresponding preset small block data (cookie) and the preset random code through the access token and the authentication code, and then verifies the preset small block data (cookie) and the preset random code. Accordingly, when the double verification passes, that is, the preset small block data (cookie) and the preset random code are both verified, the preset server returns the target data obtained during the pre-authorization to the preset client, thereby realizing password-free authentication. Accordingly, the embodiment of the present invention effectively improves the reliability and security of password-free authentication by adding a method of double authentication using a preset small block data (cookie) and a preset random code.

[0077] Reference Figure 2 In some embodiments of the present invention, generating preset security credential data according to the first pre-authorization request and binding the preset security credential data to the access token include but are not limited to the following steps:

[0078] Step S210: In response to the first pre-authorization request, a random Advanced Encryption Standard key and a random small block of data are generated.

[0079] Step S220: Bind the random Advanced Encryption Standard key and the random small block of data to the access token.

[0080] In this specific embodiment, the preset server in the embodiment of the present invention generates a random advanced encryption standard key and a random small block of data in response to the first pre-authorization request, and then binds the random advanced encryption standard key and the random small block of data to the access token. Specifically, after receiving the first pre-authorization request, the preset server in the embodiment of the present invention, such as the account server, responds to the pre-authorization request and generates a random advanced encryption standard (AES) key and a random cookie, that is, a random small block of data. Among them, the random advanced encryption standard key in the embodiment of the present invention is used to encrypt and decrypt data. In the embodiment of the present invention, the random advanced encryption standard key is a fixed-size key, such as 128 bits, 192 bits or 256 bits, etc., which can be set according to the specific application scenario. Then, the embodiment of the present invention binds the generated random AES key and random cookie to the corresponding access token to enhance security.

[0081] In some embodiments of the present invention, generating encrypted data according to preset security credential data and access token includes but is not limited to the following steps:

[0082] The preset security credential data and access token are encrypted using a preset symmetric encryption algorithm to generate encrypted data.

[0083] In this specific embodiment, the embodiment of the present invention encrypts the preset security credential data and the bound access token produced by the preset symmetric encryption algorithm to construct encrypted data. Specifically, the preset symmetric encryption algorithm in the embodiment of the present invention refers to an encryption algorithm that uses the same secret key for encryption and decryption, such as the XXTea encryption algorithm, the AES encryption algorithm, and the DES encryption algorithm. Among them, the sender uses the key to encrypt the plaintext into ciphertext, and the receiver uses the same key to decrypt the ciphertext. Exemplarily, the embodiment of the present invention uses the application key XXTea to encrypt the access token, the preset secret key data, and the preset small block data, generates encrypted data, and sends the encrypted data to the preset client.

[0084] Reference Figure 3 In some embodiments of the present invention, before executing to obtain the first authorization request sent by the preset client, the password-free authentication method provided by the embodiment of the present invention further includes but is not limited to the following steps:

[0085] Step S310: When it is determined that the preset client receives the encrypted data, the encrypted data is decrypted using a preset symmetric encryption algorithm to obtain an access token, preset small block data, and preset key data.

[0086] Step S320: Generate a preset random code using a preset generation rule.

[0087] Step S330: splicing the preset random code with the preset small block data to obtain preset spliced ​​data.

[0088] Step S340: Encrypt the preset splicing data using the preset key data to obtain an authentication code.

[0089] Step S350: construct a first authorization request based on the authentication code and the access token.

[0090] In this specific embodiment, when it is determined that the preset client receives the encrypted data, the embodiment of the present invention decrypts the encrypted data through a preset symmetric encryption algorithm to obtain an access token, a preset small block of data, and a preset key data. Specifically, after the preset server sends the encrypted data to the preset client, the preset client decrypts the encrypted data through a preset encryption algorithm to extract the access token, the preset small block of data, and the preset key data in the encrypted data. For example, in the embodiment of the present invention, the preset client uses the application key XXTea to decrypt the access token, the random aes key (preset key data), and the random cookie (preset small block of data). Then, the embodiment of the present invention generates a preset random code through a preset generation rule, and then splices the preset random code with the preset small block of data to obtain the preset spliced ​​data. Specifically, the preset generation rule in the embodiment of the present invention refers to a pre-agreed rule, such as the number of bits of the generated random code, the generation condition rule, etc. The preset client generates a preset random code (cipher) according to the pre-agreed generation rule, that is, the preset generation rule. Then, the embodiment of the present invention splices the generated preset random code (cipher) with the random cookie (preset small block of data) as the encrypted content to obtain the preset spliced ​​data. Furthermore, the embodiment of the present invention encrypts the preset spliced ​​data by using the preset key data to obtain the authentication code, and then constructs the first authorization request based on the authentication code and the access token. Specifically, the embodiment of the present invention encrypts the preset spliced ​​data obtained by decryption using the preset key data, such as a random AES key, to obtain the authentication code. Then, the preset client in the embodiment of the present invention carries the encrypted authentication code and the access token to initiate the authorization request, that is, constructs the first authorization request.

[0091] Reference Figure 4 In some embodiments of the present invention, when it is determined that the preset small block of data and the preset random code have passed the verification, the target data is returned to the preset client, including but not limited to the following steps:

[0092] Step S410: Obtain preset key data through the access token to decrypt the authentication code through the preset key data to obtain preset small block data and a preset random code.

[0093] Step S420: Perform consistency check on the preset small block data to obtain a first check result.

[0094] Step S430: verifying the preset random code according to the preset generation rule to obtain a second verification result.

[0095] Step S440: When it is determined that both the first verification result and the second verification result pass, the target data is returned to the preset client.

[0096] In this specific embodiment, the embodiment of the present invention first obtains the preset key data through the access token to decrypt the authentication code through the preset key data, thereby obtaining the preset small block data and the preset random code. Specifically, the preset server in the embodiment of the present invention, such as the account server, extracts the preset key data generated by the pre-authorization, such as the random AES key, according to the access token carried in the first authorization request after receiving the first authorization request. Then, the preset server decrypts the authentication code by extracting the preset key data to obtain the preset small block data and the preset random code. Further, the embodiment of the present invention performs a consistency check on the preset small block data to obtain a first verification result, and verifies the preset code according to the preset generation rule to obtain a second verification result. Specifically, in the embodiment of the present invention, the preset server compares the random cookie value stored in the pre-session state of the random cookie (preset small block data) obtained by decryption to determine whether the two are consistent. When it is determined that the two are consistent, it means that the first authorization request is valid, that is, the first verification result is passed. Accordingly, the preset generation rule in the embodiment of the present invention is a pre-agreed code generation rule, including the number of code bits, the parity of the code, etc., such as generating a 16-bit preset random code, and the sum of the values ​​of the last seven digits is an odd number. Therefore, the embodiment of the present invention verifies the preset random code according to the preset generation rule to determine whether the preset random code meets the preset generation rule and obtains a second verification result. When it is determined that the preset random code meets the preset generation rule, it means that the preset random code is valid, that is, the second verification result is passed. Correspondingly, when it is determined that both the first verification result and the second verification result are passed, the preset server in the embodiment of the present invention returns the target data obtained in the pre-authorization process to the preset client to complete the password-free authentication process. It is easy to understand that the embodiment of the present invention can effectively improve the security of data and alleviate the problems of data leakage and data tampering by performing double verification on the preset small block data and the preset random code.

[0097] Combination Figure 3 , refer to Figure 5 In some embodiments of the present invention, a preset random code is generated by a preset generation rule, including but not limited to the following steps:

[0098] Step S510: randomly selecting a preset number of target values ​​from a preset data set according to a preset generation rule to construct a preset random code through the target values, wherein the preset data bits of the preset random code meet a preset check condition, and the preset check condition includes an odd check condition or an even check condition.

[0099] In this specific embodiment, the embodiment of the present invention first randomly selects a preset number of target values ​​through a preset data set according to a preset generation rule, so as to construct a preset random code according to the selected target values. Specifically, the preset data set in the embodiment of the present invention refers to a pre-constructed data pool for generating a preset random code, such as an integer data pool including 1 to 9. Accordingly, the preset number in the embodiment of the present invention is determined according to the preset random code bit number in the preset generation rule. For example, the embodiment of the present invention randomly selects a preset number of values, such as 16, in the preset data set as the target value according to the preset production rule. Among them, the preset generation rule in the embodiment of the present invention includes that the preset data bits of the preset random code meet the preset check condition, and the preset check condition includes an odd check condition or an even check condition. For example, in the embodiment of the present invention, the odd check condition includes that the sum of the values ​​on the preset data bits is an odd number, and the even check condition includes that the sum of the values ​​on the preset data bits is an even number. Accordingly, after the embodiment of the present invention randomly selects the preset number of target values, the preset random code is constructed according to the corresponding preset check condition. For example, the sum of the target values ​​on the last 5 bits of the preset random code is an odd number. Therefore, in the process of checking the preset random code, whether the preset random code is valid is determined by checking whether each value on the preset data bit meets the preset checking condition.

[0100] Reference Figure 6 In some embodiments of the present invention, a preset number of target values ​​are randomly selected from a preset data set according to a preset generation rule to construct a preset random code through the target values, including but not limited to the following steps:

[0101] Step S610: randomly selecting a first number of first target integers from a first data set according to a preset generation rule to construct a first number sequence.

[0102] Step S620: randomly selecting a second number of second target integers from the second data set according to a preset generation rule to construct a second number sequence, wherein the sum of the second target integers in the second number sequence is an odd number.

[0103] Step S630: constructing a preset random code according to the first number sequence and the second number sequence.

[0104] In this specific embodiment, the embodiment of the present invention first randomly selects a first number of first target integers from the first data set according to a preset generation rule to construct a first number sequence, and randomly selects a second number of second target integers from the second data set according to a preset generation rule to construct a second number sequence, and then constructs a preset random code according to the first number sequence and the second number sequence. Specifically, the first data set in the embodiment of the present invention includes a positive integer data set, such as an integer set from 1 to 9. Among them, the embodiment of the present invention divides the preset random code into two parts, including a first number sequence and a second number sequence, such as dividing a 16-bit preset random code into the first nine-bit part (first number sequence) and the last seven-bit part (second number sequence). Correspondingly, in the embodiment of the present invention, a first number of values ​​are randomly selected from the first data set as the first target integer, for example, 9 values ​​are randomly selected from 1 to 9 as the first target integer, and the first number sequence is constructed. At the same time, in the embodiment of the present invention, the second data set includes an odd number data set, such as the second data set includes odd numbers from 1 to 9, such as 1, 3, 5, 7, 9. Correspondingly, the embodiment of the present invention randomly selects a second number of values ​​from the second data set as the second target integer, and the sum of these values ​​is an odd number. For example, the embodiment of the present invention randomly selects 7 digits from 1, 3, 5, 7, and 9 as the second target integer to construct a second number sequence, so that the sum of the values ​​of the last 7 digits must be an odd number. Accordingly, when performing verification, the preset server can determine whether the preset random code is valid by verifying whether the sum of the last seven digits is an odd number. Finally, the embodiment of the present invention combines the first number sequence and the second number sequence to construct a preset random code. For example, the embodiment of the present invention uses each value of the first number sequence as the first several digits of the preset random code, and uses each value of the second number sequence as the last several digits of the preset random code, thereby generating a preset random code.

[0105] The following describes the solution of the embodiment of the present invention in detail in conjunction with a specific password-free authentication scenario:

[0106] For example, Figure 7 As shown, Figure 7A flowchart of the traditional password-free number acquisition process provided by an embodiment of the present invention. Specifically, the client first makes a pre-authorization request. After the preset service platform receives the pre-authorization request, it inserts the header enhancement data and sends it to the preset server. Then, the preset server returns the encrypted data and uses the key XXTea to encrypt the access token. Correspondingly, the client decrypts the access token using the key XXTea, and initiates an authorization request with the access token. Finally, after the preset server passes the verification, it returns the mobile phone number to the client, completing the password-free number acquisition process. Among them, the preset server, such as the account server, does not carry a random cookie in the encrypted data returned. At the same time, when the client initiates the authorization request, the client does not generate the secret code ciper, nor does it encrypt it into the authentication code parameter through aes after splicing it with the random cookie. And if Figure 8 As shown, Figure 8 A schematic diagram of the process flow of password-free number acquisition for the password-free authentication method for applications provided in an embodiment of the present invention. Specifically, in an embodiment of the present invention, the client SDK forces the use of data traffic through the WIFI switching function, initiates a pre-authorization request, and then the preset service platform inserts the header enhancement data containing the user's mobile phone number and sends it to the preset server, such as the account server. Next, the preset server receives the pre-authorization request, decrypts the preset service platform header enhancement data to obtain the user's mobile phone number. Then, the preset server responds to the client's pre-authorization request, generates a random AES key and a random cookie, binds the access token, and uses the application key XXTea to encrypt the access token, the random AES key and the random cookie, and returns the encrypted data to the client. Further, the client gets the encrypted data returned by the pre-authorization request, and uses the application key XXTea to decrypt the access token, the random AES key and the random cookie. Correspondingly, the embodiment of the present invention randomly generates a secret code cipher splicing random cookies as encrypted content according to the agreed rules, and encrypts it into an authentication code through a random AES key, and initiates an authorization request with the access token and the authentication code. Finally, the preset server receives the authorization request, takes out the AES key generated by the pre-authorization according to the access token, and decrypts the authentication code through the AES key. Next, check the consistency of the random cookie and the cipher rule (such as the sum of the values ​​of the last 7 digits of the 16-digit cipher is an odd number). If the double check passes, the pre-authorized user mobile phone number is returned to the client.

[0107] It is easy to understand that in the embodiment of the present invention, the client randomly generates the password cipher according to the agreed rules, and the server only verifies the rules but not the data, which has both flexibility and confidentiality. At the same time, the digital password generated by the client, such as a 16-digit digital password, has the first 9 digits randomly generated from 1-9, and the last 7 digits randomly generated from 1, 3, 5, 7, 9, and the sum of the values ​​of the last 7 digits must be an odd number. Therefore, the preset server only verifies whether the sum of the last 7 digits is an odd number, and the first 9 digits are not judged, which effectively improves the verification efficiency. In addition, in the embodiment of the present invention, the password cipher and cookie are randomly generated, and double security verification is performed to maximize data security and alleviate the problems of data leakage and data tampering. Accordingly, in the embodiment of the present invention, the random cookie returned by the preset server is used as the encrypted content, and the password cipher generated by the client according to the agreed rules is spliced, which has double protection in the security mechanism. The attacker needs to steal the random cookie returned by the server and crack the generation rule of the client password cipher before he has the opportunity to assemble the authentication code parameters required to obtain the mobile phone number, which effectively improves the reliability and security of the password-free authentication.

[0108] See also Fig. 9 The embodiment of the present application also provides a password-free authentication system, which can implement the above-mentioned password-free authentication method, and the system includes:

[0109] The first module 710 is used to obtain a first pre-authorization request, wherein the first pre-authorization request is constructed by a preset service platform according to a second pre-authorization request initiated by a preset client and target data.

[0110] The second module 720 is used to generate preset security credential data according to the first pre-authorization request, and bind the preset security credential data to the access token. The preset security credential data includes preset small block data and preset key data.

[0111] The third module 730 is used to generate encrypted data according to the preset security credential data and the access token, so as to return the encrypted data to the preset client.

[0112] The fourth module 740 is used to obtain a first authorization request sent by a preset client, wherein the first authorization request includes an authentication code, and the authentication code is generated by a preset small block of data, preset key data, and a preset random code.

[0113] The fifth module 750 is used to return the target data to the preset client when it is determined that the preset small block data and the preset random code have passed the verification.

[0114] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0115] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned password-free authentication method when executing the computer program. The electronic device can be any smart terminal including a tablet computer, a car computer, etc.

[0116] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0117] See also Fig.10 , Fig.10 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0118] The processor 810 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0119] The memory 820 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 820 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 820, and the processor 810 calls and executes the password-free authentication method of the embodiment of this application;

[0120] Input / output interface 830, used to implement information input and output;

[0121] The communication interface 840 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0122] bus 850 , which transmits information between the various components of the device (e.g., processor 810 , memory 820 , input / output interface 830 , and communication interface 840 );

[0123] The processor 810 , the memory 820 , the input / output interface 830 and the communication interface 840 are connected to each other in communication within the device via a bus 850 .

[0124] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned password-free authentication method is implemented.

[0125] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0126] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0127] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0128] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0129] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0131] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0132] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0133] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0134] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0135] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0136] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0137] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A password-free authentication method, characterized in that: The method comprises the following steps: Obtaining a first pre-authorization request; wherein the first pre-authorization request is constructed by a preset service platform according to a second pre-authorization request initiated by a preset client and target data; Generate preset security credential data according to the first pre-authorization request, and bind the preset security credential data to the access token; wherein the preset security credential data includes preset small block data and preset key data; generating encrypted data according to the preset security credential data and the access token, so as to return the encrypted data to the preset client; Obtaining a first authorization request sent by the preset client; wherein the first authorization request includes an authentication code, and the authentication code is generated by the preset small block data, preset key data, and a preset random code; When it is determined that the preset small block of data and the preset random code have passed the verification, the target data is returned to the preset client.

2. The method according to claim 1, characterized in that The generating preset security credential data according to the first pre-authorization request, and binding the preset security credential data with the access token, comprises: In response to the first pre-authorization request, generating a random Advanced Encryption Standard key and a random small block of data; The random Advanced Encryption Standard key and the random small block of data are bound to the access token.

3. The method according to claim 1, characterized in that The generating encrypted data according to the preset security credential data and the access token includes: The preset security credential data and the access token are encrypted using a preset symmetric encryption algorithm to generate the encrypted data.

4. The method according to claim 3, characterized in that Before executing the step of obtaining the first authorization request sent by the preset client, the method further includes: When it is determined that the preset client has received the encrypted data, the encrypted data is decrypted by using the preset symmetric encryption algorithm to obtain the access token, the preset small block of data, and the preset key data; Generate the preset random code according to a preset generation rule; Splicing the preset random code with the preset small block data to obtain preset spliced ​​data; The preset splicing data is encrypted by using the preset key data to obtain the authentication code; The first authorization request is constructed according to the authentication code and the access token.

5. The method according to claim 1, characterized in that When it is determined that the preset small block of data and the preset random code have passed the verification, returning the target data to the preset client includes: Acquire the preset key data through the access token, so as to decrypt the authentication code through the preset key data to obtain the preset small block data and the preset random code; Performing a consistency check on the preset small block of data to obtain a first check result; Verifying the preset random code according to a preset generation rule to obtain a second verification result; When it is determined that both the first verification result and the second verification result pass, the target data is returned to the preset client.

6. The method according to claim 4, characterized in that The step of generating the preset random code by using a preset generation rule includes: A preset number of target values ​​are randomly selected from a preset data set according to the preset generation rule, so as to construct the preset random code through the target values; wherein the preset data bits of the preset random code satisfy a preset check condition, and the preset check condition includes an odd check condition or an even check condition.

7. The method according to claim 6, characterized in that The step of randomly selecting a preset number of target values ​​from a preset data set according to the preset generation rule to construct the preset random code through the target values ​​includes: randomly selecting a first number of first target integers from the first data set according to the preset generation rule to construct a first number sequence; Randomly selecting a second number of second target integers from the second data set according to the preset generation rule to construct a second number sequence; wherein the sum of the second target integers in the second number sequence is an odd number; The preset random code is constructed according to the first number series and the second number series.

8. A password-free authentication system, characterized in that: The system comprises: The first module is used to obtain a first pre-authorization request; wherein the first pre-authorization request is constructed by a preset service platform according to a second pre-authorization request initiated by a preset client and target data; A second module is used to generate preset security credential data according to the first pre-authorization request, and bind the preset security credential data to the access token; wherein the preset security credential data includes preset small block data and preset key data; A third module is used to generate encrypted data according to the preset security credential data and the access token, so as to return the encrypted data to the preset client; A fourth module is used to obtain a first authorization request sent by the preset client; wherein the first authorization request includes an authentication code, and the authentication code is generated by the preset small block data, the preset key data and the preset random code; The fifth module is used to return the target data to the preset client when it is determined that the preset small block data and the preset random code have passed the verification.

9. An electronic device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images