Password verification method and device for mobile phone application program

Abstract

The invention discloses a password verification method and device for a mobile phone application program, and the method comprises the steps: the mobile phone application program receives a password inputted by a user and an encrypted file uploaded by the user, and uploads the password and the encrypted file to a server; the encrypted file is formed by encrypting a login password by using a preset key by the server when the user sets the login password of the mobile phone application program for the first time, and is issued to the mobile phone application program; the server side sends the encrypted file to the mobile phone application program, deletes the encrypted file and stores the preset key; the encrypted file is stored by a user; the server side is used for decrypting the encrypted character string to obtain a password input by the user; decrypting the encrypted file by using a preset key to obtain a login password; comparing the password input by the user and the login password obtained by decryption, and determining whether password verification is passed or not according to a comparison result; and issuing the information whether the password verification is passed or not to the mobile phone application program. According to the invention, the security of password storage of the mobile phone application program can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of password verification, and in particular to a password verification method and device for a mobile phone application. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] Currently, there are two solutions for password verification. Solution 1: Store the password locally on the terminal. Solution 2: Store the password on the server. In Solution 1, the password is stored locally through the terminal program, which may be cracked. For example, if the terminal is lost, the password may be cracked by someone maliciously. The security factor is low, and when the terminal logs in with the password, the terminal will be in a long login state, and there is a risk of the password being bypassed. In Solution 2, although the password can be encrypted and stored on the server, the server data is still at risk of being leaked. Summary of the invention

[0004] The embodiment of the present invention provides a password verification method for a mobile phone application, which is used to improve the security of password login of the mobile phone application and the security of password storage of the mobile phone application. The method is applied to the mobile phone application, and the method includes:

[0005] Receive the user's login request;

[0006] Prompt the user to enter a password and upload the login request to the server, so that the server: generates a dynamic token based on the login request and feeds the dynamic token back to the mobile application;

[0007] Receive dynamic token and password entered by user;

[0008] Encrypt the dynamic token and the password entered by the user to form an encrypted string;

[0009] The user is presented with a function entry for uploading an encrypted file; the encrypted file is generated when the user sets the login password of the mobile application for the first time, and the server encrypts the login password using a preset key and sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user;

[0010] Receive encrypted files uploaded by users through the function portal;

[0011] Upload the encrypted string and encrypted file to the server, so that the server: uses the dynamic token to decrypt the encrypted string to obtain the password entered by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password entered by the user with the login password, and determines whether the password verification is passed according to the comparison result; sends the information of whether the password verification is passed to the mobile application;

[0012] Clean up the upload path information.

[0013] In one embodiment, the dynamic token and the password input by the user are encrypted to form an encrypted string, including: based on the symmetric encryption AES (Advanced Encryption Standard, referred to as AES) algorithm, the dynamic token and the password input by the user are encrypted to obtain an encrypted string.

[0014] In one embodiment, the dynamic token is a time-based one-time password algorithm obtained by hashing a timestamp and a random number.

[0015] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

[0016] In one embodiment, after receiving the encrypted file uploaded by the user through the function portal, the password verification method of the mobile phone application further includes: cleaning up the upload path information.

[0017] In one embodiment, the password input by the user is a gesture password; the dynamic token and the password input by the user are encrypted to form an encrypted string, including: converting the gesture password into a digital sequence, concatenating the digital sequence with the user name to obtain a first string; encrypting the dynamic token and the first string to form an encrypted string.

[0018] The embodiment of the present invention provides a password verification method for a mobile phone application, which is used to improve the security of mobile phone application password login and the security of mobile phone application password storage. The method is applied to a server, and the method includes:

[0019] When receiving a login request from a user uploaded by the mobile application, a dynamic token is generated, and the dynamic token is fed back to the mobile application, so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string;

[0020] Receive the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is formed by encrypting the login password of the mobile application using a preset key when the user sets the login password of the mobile application for the first time, the server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user;

[0021] Use the dynamic token to decrypt the encrypted string and get the password entered by the user;

[0022] Use the preset key to decrypt the encrypted file and get the login password;

[0023] Compare the decrypted password entered by the user with the login password, and determine whether the password verification is successful based on the comparison result;

[0024] The information on whether the password verification is passed is sent to the mobile application.

[0025] In one embodiment, the encrypted file is obtained as follows:

[0026] When a user sets a login password for a mobile application for the first time, the login password uploaded by the user is received; a preset key is generated using multiple specified user information; the specified user information includes one or any combination of the following: user name, user email address, user registration date, user IP address; based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file.

[0027] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information.

[0028] In one embodiment, the preset key is obtained by hashing multiple pieces of specified user information in the following manner:

[0029] Input multiple specified user information into the pseudo-random function RPF, perform hash operation using the output of RPF, and obtain a hash value; repeatedly perform the following steps until the preset number of iterations is reached to obtain the preset key:

[0030] The hash value is input into RPF and the hash operation is performed using the output of RPF.

[0031] In one embodiment, the encrypted string is decrypted using a dynamic token to obtain a password input by a user, including: based on an AES algorithm, the encrypted string is decrypted using a dynamic token to obtain the password input by the user.

[0032] The embodiment of the present invention provides a password verification device for a mobile phone application, which is used to improve the security of password login of the mobile phone application and the security of password storage of the mobile phone application. The device is applied to the mobile phone application, and the device includes:

[0033] A login request receiving module, used to receive a user's login request;

[0034] The password receiving module is used to prompt the user to enter the password and upload the login request to the server, so that the server: generates a dynamic token according to the login request and feeds the dynamic token back to the mobile application; receives the dynamic token and the password entered by the user;

[0035] The encrypted string processing module is used to encrypt the dynamic token and the password input by the user to form an encrypted string;

[0036] The encrypted file receiving module is used to show the user the function entrance for uploading encrypted files; the encrypted file is generated by the server using a preset key to encrypt the login password of the mobile application when the user sets the login password of the mobile application for the first time and sends it to the mobile application; the server deletes the encrypted file after sending it to the mobile application and saves the preset key; the encrypted file is saved by the user; and the encrypted file uploaded by the user through the function entrance is received;

[0037] The data upload module is used to upload the encrypted string and the encrypted file to the server, so that the server: uses the dynamic token to decrypt the encrypted string to obtain the password entered by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password entered by the user with the login password, and determines whether the password verification is passed according to the comparison result; and sends the information of whether the password verification is passed to the mobile phone application;

[0038] The path cleaning module is used to clean up the upload path information.

[0039] The embodiment of the present invention provides a password verification device for a mobile phone application, which is used to improve the security of mobile phone application password login and the security of mobile phone application password storage. The device is applied to a server, and the device includes:

[0040] The dynamic token generation module is used to generate a dynamic token upon receiving a login request from a user uploaded by the mobile application, and feed the dynamic token back to the mobile application so that the mobile application: encrypts the dynamic token and the password input by the user to form an encrypted string;

[0041] The data receiving module is used to receive the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is formed by encrypting the login password of the mobile application using a preset key when the user sets the login password of the mobile application for the first time. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user;

[0042] The encrypted string decryption module is used to decrypt the encrypted string using the dynamic token to obtain the password entered by the user;

[0043] A login password decryption module is used to decrypt the encrypted file using a preset key to obtain the login password;

[0044] A comparison processing module is used to compare the password input by the user and the login password obtained by decryption, and determine whether the password verification is passed according to the comparison result;

[0045] The data sending module is used to send the information whether the password verification is passed to the mobile application.

[0046] An embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the password verification method for the mobile phone application when executing the computer program.

[0047] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the password verification method for the mobile phone application is implemented.

[0048] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the password verification method of the mobile phone application is implemented.

[0049] In the embodiment of the present invention, when the user sets the login password of the mobile application for the first time, the server uses the preset key to encrypt the login password to form an encrypted file, and sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and only saves the preset key; the encrypted file is saved by the user; the user can set the save address of the encrypted file at will, locally or in the cloud, and outsiders cannot know it. When the user logs in to the mobile application later, the encrypted file is uploaded to the server, and the password entered by the user is encrypted and uploaded to the server. The server decrypts the encrypted file to obtain the login password set by the user for the first time and the password entered by the user for this login, and the password verification for this login is realized through comparison. Compared with the technical solution in the prior art in which passwords are saved locally or on the server side through a program, in the embodiment of the present invention, encrypted files are saved by user-defined means, and the upload path information is immediately cleaned up after uploading the encrypted file. The server side only saves the preset key for decryption. There is neither the possibility of the local program being cracked and causing the local password to be lost, nor the possibility of the password being lost on the server side. In addition, the password verification is completed through local upload and server verification each time the user logs in, which reduces the risk of password leakage, improves the security of mobile application password storage, and also improves the security of mobile application password login. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0051] Figure 1 A flowchart of a password verification method for a mobile phone application program applied to a mobile phone application program according to an embodiment of the present invention;

[0052] Figure 2 A flowchart of a password verification method for a mobile phone application applied to a server in an embodiment of the present invention;

[0053] Figure 3 A diagram showing a specific example of a password verification method for a mobile phone application applied to a server in an embodiment of the present invention;

[0054] Figure 4 A diagram showing a specific example of a password verification method for a mobile phone application in an embodiment of the present invention;

[0055] Figure 5 A schematic diagram of a password verification device for a mobile phone application in an embodiment of the present invention;

[0056] Figure 6 A schematic diagram of a password verification device for a mobile phone application program applied to a terminal in an embodiment of the present invention;

[0057] Figure 7 Schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0058] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0059] The acquisition, transmission, storage, use, and processing of data in the technical solutions in the embodiments of the present invention are in compliance with the relevant provisions of national laws and regulations.

[0060] It should be noted that in the embodiments of the present invention, certain software, components, models and other existing solutions in the industry may be mentioned, which should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present invention, but it does not mean that the applicant has or will necessarily use the solution.

[0061] Figure 1FIG. 1 is a flow chart of a password verification method for a mobile phone application in an embodiment of the present invention, as shown in FIG. Figure 1 As shown, the method includes:

[0062] Step 101: Receive a user's login request;

[0063] Step 102: prompt the user to enter a password and upload a login request to the server, so that the server: generates a dynamic token according to the login request and feeds the dynamic token back to the mobile application;

[0064] Step 103: receiving a dynamic token and a password input by a user;

[0065] Step 104: Encrypt the dynamic token and the password input by the user to form an encrypted string;

[0066] Step 105, showing the user a function entry for uploading an encrypted file; the encrypted file is generated by the server using a preset key to encrypt the login password when the user sets the login password of the mobile application for the first time and sent to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user;

[0067] Step 106: receiving the encrypted file uploaded by the user through the function portal;

[0068] Step 107, upload the encrypted string and the encrypted file to the server, so that the server: uses the dynamic token to decrypt the encrypted string to obtain the password input by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password input by the user with the login password, and determines whether the password verification is passed according to the comparison result; sends the information of whether the password verification is passed to the mobile phone application;

[0069] Step 108: Clean up the upload path information.

[0070] from Figure 1 It can be seen from the shown process that in the embodiment of the present invention, the encrypted file is saved by the user, and the upload path information is cleaned up immediately after the encrypted file is uploaded. The server only saves the preset key for decryption. There is no possibility of local password loss due to cracking of the local program, and there is no situation where the password is lost on the server. In addition, the password verification is completed through local upload and server verification at each login, which reduces the risk of password leakage, improves the security of mobile phone application password storage, and also improves the security of mobile phone application password login.

[0071] The following is a detailed explanation of the password verification method for a mobile phone application in an embodiment of the present invention applied to a mobile phone application.

[0072] In step 101, the mobile phone application receives a user's login request. For example, the user clicks on the login page and clicks on the login name input box. The mobile phone application detects that the input box on the login page is selected and determines that the user is logging in.

[0073] In step 102, the mobile phone application prompts the user for the password through a pop-up window, for example, showing the user the password input method, including gesture password, numeric password, fingerprint, etc. At the same time, the login request is uploaded to the server through a dedicated SDK interface.

[0074] After receiving the login request, the server generates a dynamic token and feeds the dynamic token back to the mobile application.

[0075] In one embodiment, the dynamic token is a time-based one-time password algorithm obtained by hashing a timestamp and a random number.

[0076] Furthermore, the dynamic token is composed of a random number and a timestamp and then encrypted by AES with a fixed key. The dynamic token has a validity period, and the dynamic token becomes invalid after a set time (e.g., 30 seconds, 60 seconds).

[0077] In step 103 and step 104, after receiving the dynamic token and the password input by the user, the mobile application encrypts the dynamic token and the password input by the user to form an encrypted string.

[0078] In one embodiment, encrypting the dynamic token and the password input by the user to form an encrypted string may include: encrypting the dynamic token and the password input by the user based on a symmetric encryption AES algorithm to obtain an encrypted string.

[0079] During implementation, the first step is to generate a 256-bit security key K and a random 16-byte initialization vector IV.

[0080] The second step is to combine the dynamic token and the password input by the user into a byte stream according to a preset rule, wherein the preset rule is, for example, to sequentially insert the password input by the user between two characters of the dynamic token from left to right to obtain a string, and then convert it into a byte stream.

[0081] The third step is to divide the byte stream into multiple blocks P1, P2, ..., P n , the size of each block can be customized by the user.

[0082] Step 4: Use the security key K, initialization vector IV and multiple blocks P1, P2, ..., P n Encryption. The specific steps are:

[0083] 1) For the first block P1, use the initialization vector IV to perform an XOR operation with it, and the XOR operation result is C1'.

[0084] 2) Use the AES encryption algorithm to encrypt the XOR operation result C1' to obtain the block ciphertext C1:

[0085] C1=AES(K,C1')

[0086] In the formula, AES() represents the AES encryption algorithm function.

[0087] 3) For each subsequent block P n , using the block ciphertext C of the previous block n Instead of performing XOR operation, the XOR operation result is encrypted using the AES encryption algorithm, and finally all the block ciphertexts C1, C2...C n .

[0088] 4) All block ciphertexts C1, C2...C n Concatenate together to form the encrypted string C.

[0089] In step 105, the mobile application displays a function entry for uploading encrypted files to the user.

[0090] The function entry is, for example, an interface in an interface that supports users to click to upload.

[0091] The encrypted file is saved by the user, and the user can dispose of the encrypted file at will, for example, save it locally, in a cloud disk, or in other applications. The encrypted file saves the login password of the mobile application set by the user when logging in for the first time.

[0092] In one embodiment, the encrypted file is formed by encrypting the login password by the server using a preset key, for example, based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file. After the server sends the encrypted file to the mobile phone application, it immediately deletes the encrypted file and only saves the preset key.

[0093] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

[0094] By generating a preset key through multiple specified user information, the security of mobile application login can be further improved.

[0095] In step 106, the mobile application receives the encrypted file uploaded by the user through the function portal.

[0096] In the embodiment of the present invention, after receiving the encrypted file uploaded by the user through the function portal, the upload path information is immediately cleared.

[0097] After the user enters the password for this login in the mobile application and uploads the encrypted file, the upload path information is cleared. In this way, other people cannot log in to the application based on the historical upload path when using the mobile terminal, further improving the storage security and login security of the encrypted file.

[0098] After the mobile application uploads the encrypted string and encrypted file to the server, the server: uses the dynamic token to decrypt the encrypted string to obtain the password entered by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password entered by the user and the login password, and determines whether the password verification is passed based on the comparison result; and sends the information on whether the password verification is passed to the mobile application.

[0099] The user can directly see the password verification result on the mobile application. If the password verification is successful, the user can log in to the application directly. If the password verification fails, the user will be prompted that the password verification has failed and must re-enter the password, and the number of times the password can be re-entered can be set.

[0100] In one embodiment, the number of times to re-enter the password can be set according to the age of the user. For example, an elderly person may re-enter the password more times, while a young person may re-enter the password less times.

[0101] In one embodiment, the password input by the user is a gesture password.

[0102] Step 104 encrypts the dynamic token and the password input by the user to form an encrypted string, which may include the following steps: Step 1, converting the gesture password into a digital sequence, and concatenating the digital sequence with the user name to obtain a first string; Step 2, encrypting the dynamic token and the first string to form an encrypted string.

[0103] In this example, the user name is introduced into the encrypted string to further improve the security of application login.

[0104] In one embodiment, after receiving the encrypted file uploaded by the user through the function portal, the password verification method of the mobile application may further include:

[0105] Step 1: receiving an encrypted file update request input by a user through an encrypted file update interface;

[0106] Step 2: prompt the user to enter biometric information, and receive the biometric information entered by the user; the biometric information includes face information, fingerprint information, pupil information, voice information, etc.;

[0107] Step 3: Upload the biometric information to the server, so that the server can: authenticate the user based on the biometric information; when the authentication is successful, send a message of successful authentication to the mobile application;

[0108] Step 4: upon receiving a message indicating that the identity authentication is passed, the encrypted file update request is uploaded to the server, so that the server: updates the preset key according to the encrypted file update request, encrypts the login password with the updated preset key to form an updated encrypted file, sends the updated encrypted file to the mobile phone application, deletes the updated encrypted file, and saves the updated preset key;

[0109] Step 5: Receive the updated encrypted file sent by the server;

[0110] Step 6: Provide the updated encrypted file to the user through the encrypted file update interface.

[0111] In this example, the encrypted file update interface is displayed to the user. Considering security issues and the possibility that the user may forget the encrypted file storage location, the embodiment of the present invention can support the user to regenerate a new encrypted file after verifying the identity, which can improve security and user experience.

[0112] Corresponding to the method on the mobile phone application side, an embodiment of the present invention also provides a password verification method for the mobile phone application applied to the server side. Figure 2 FIG. 1 is a flow chart of a password verification method for a mobile phone application program applied to a server in an embodiment of the present invention. Figure 2 As shown, the method includes:

[0113] Step 201: upon receiving a login request from a user uploaded by a mobile application, a dynamic token is generated, and the dynamic token is fed back to the mobile application, so that the mobile application: encrypts the dynamic token and the password input by the user to form an encrypted string;

[0114] Step 202: receiving the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is formed by encrypting the login password using a preset key when the user sets the login password of the mobile application for the first time, the server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user;

[0115] Step 203: Decrypt the encrypted string using the dynamic token to obtain the password input by the user;

[0116] Step 204: Decrypt the encrypted file using the preset key to obtain the login password;

[0117] Step 205: Compare the decrypted password input by the user with the login password, and determine whether the password verification is successful based on the comparison result;

[0118] Step 206: Send the information on whether the password verification is passed to the mobile phone application.

[0119] When a user logs in to the application, the server generates a dynamic token based on the user's login request uploaded by the mobile application and feeds the dynamic token back to the mobile application.

[0120] In one embodiment, a time-based one-time password algorithm utilizes a timestamp and a random number hash operation to obtain a dynamic token.

[0121] For example, the dynamic token generation process may include the following steps:

[0122] Step 1, get the current timestamp: Get the current timestamp, usually expressed as the number of seconds since the Unix epoch (January 1, 1970 00:00:00 UTC).

[0123] Step 2, Generate Random Number: Generate a random number as an additional factor to increase the randomness of the token. This random number is long enough to ensure its uniqueness.

[0124] Step 3, combine the timestamp and random number: combine the timestamp and random number into a string. You can simply concatenate them or use some agreed method (such as JSON format).

[0125] Step 4, hash operation: Use a strong hash function (such as SHA-256 hash algorithm, SHA-512 hash algorithm) to perform a hash operation on the combined string to obtain a hash value. The output of the hash function is a fixed-length string, usually expressed in hexadecimal form.

[0126] Step 5, generate a dynamic token: the hash value can be used directly as the dynamic token, or a part of it can be intercepted as the dynamic token.

[0127] The encrypted file is created when the server encrypts the login password using a preset key when the user logs in for the first time to set the login password.

[0128] Figure 3 FIG. 1 is a specific example diagram of a password verification method for a mobile phone application program applied to a server in an embodiment of the present invention. Figure 3 As shown, the encrypted file is obtained in the manner described in steps 301 to 303 below.

[0129] Step 301, when a user sets a login password for a mobile application for the first time, receiving the login password uploaded by the user.

[0130] Step 302, generate a preset key using multiple designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, user IP address.

[0131] Step 303: Based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file.

[0132] Further, step 303 may include the following steps:

[0133] Step 1, data preparation: according to the preset rules, the login password uploaded by the user and the preset key are combined into a string, the byte length of the combined string is checked, and data is padded if necessary to ensure that its length meets the requirements of block encryption (for example, it needs to be padded to a multiple of 16 bytes). For example, the preset rule is: intersperse the login password uploaded by the user from left to right between two characters of the preset key.

[0134] Step 2: Generate an initialization vector OV.

[0135] Step 3, encrypt data: Use the AES encryption algorithm to encrypt the plaintext data obtained in step 1, and package the initialization vector OV and the encrypted data into an encrypted file.

[0136] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information.

[0137] For example, the preset key is obtained by hashing multiple designated user information according to the following steps 1, 2 and 2.1.

[0138] Step 1: Input multiple designated user information into a pseudorandom function RPF (Pseudorandom Function, PRF), perform a hash operation, and obtain a hash value.

[0139] Step 2: Repeat step 2.1 until the preset number of iterations is reached to obtain the preset key:

[0140] Step 2.1: Input the hash value into RPF and perform the hash operation.

[0141] During implementation, a random number is generated in advance, and multiple specified user information of the random number is input into RPF to obtain a random output, and then the random output is passed as input to a hash function to perform a hash operation, and the hash operation is repeated, and the final output is used as the preset key. In this case, the security of the preset key can be improved, and then the security of application login can be improved.

[0142] In one embodiment, decrypting the encrypted string using the dynamic token to obtain the password input by the user may include: decrypting the encrypted string using the dynamic token based on the AES algorithm to obtain the password input by the user.

[0143] When implemented, the decryption process of the password entered by the user is the reverse operation of the encryption process on the mobile application side.

[0144] The first step is to split the encrypted string C into multiple blocks C1, C2...C n .

[0145] The second step is to decrypt each block: Use the AES decryption algorithm to decrypt each block C1, C2...C n :

[0146] D i '=AES -1 (K,C i )

[0147] In the formula, AES -1 () represents the AES decryption algorithm function.

[0148] The third step is to remove XOR: for i=1, use the initialization vector IV and D1' to perform XOR algorithm to obtain the plaintext block P1; for i>1, use the previous plaintext block P i-1 With D i 'Perform XOR algorithm; finally get all plaintext blocks P1, P2, ..., P n .

[0149] Step 4: All plaintext blocks P1, P2, ..., P n Connect together to form a byte stream.

[0150] The fifth step is to split the byte stream according to preset rules to obtain the dynamic token and the password entered by the user.

[0151] The sixth step is to verify the validity period of the dynamic token. When the dynamic token is within the validity period, the subsequent verification is performed using the password entered by the user.

[0152] In one embodiment, considering security issues and the possibility that the user may forget the encrypted file storage location, the user is given an opportunity to reset and update the encrypted file. After the information on whether the password verification is passed is sent to the mobile phone application, the method may further include:

[0153] When receiving an encrypted file update request, updating the preset key;

[0154] Encrypting the login password using the updated preset key to form an updated encrypted file;

[0155] Send the updated encrypted file to the mobile application, delete the updated encrypted file, and save the updated preset key.

[0156] It should be noted that before receiving the encrypted file update request, the user identity has been verified, and the encrypted file update is performed after confirming that it is the user himself who is operating; this can improve security and user experience at the same time.

[0157] Figure 4 FIG. 1 is a specific example diagram of a password verification method for a mobile phone application in an embodiment of the present invention. Figure 4 As shown, the method includes:

[0158] Step 401: When the mobile terminal sets or resets the gesture password for the first time, it requests a dynamic token from the server. After the user enters the gesture password, the gesture password and user name are encrypted by the dynamic token through AES to generate an encrypted string, and the terminal sends the encrypted string to the server.

[0159] Step 402: The server pre-assigns a preset key to the user and stores the preset key in the server database. The server uses the dynamic token to decrypt the encrypted string when the gesture password is first set, obtains the plain text of the gesture password, and then uses the preset key to encrypt the plain text of the gesture password to generate an encrypted file.

[0160] Step 403: The server sends the encrypted file to the terminal, prompting the user to properly save the encrypted file and upload the encrypted file at the same time when logging in using the gesture password.

[0161] Step 404: The user selects a gesture password to verify his identity. For example, after the user draws the gesture password, the terminal converts the gesture password into a digital sequence and concatenates it with the user name to obtain PAU (password and username). The terminal uses the dynamic token to encrypt the PAU to generate an encrypted string.

[0162] Step 405, the terminal prompts the user to upload the encrypted file. If the user does not upload, the verification process will be exited. If the user uploads an encrypted file, the encrypted file and the encrypted string will be sent to the server. The server uses the dynamic token to decrypt the encrypted string and the preset key to decrypt the encrypted file. The gesture password plaintext obtained from the two is compared. If the comparison is consistent, the verification is passed.

[0163] In the embodiment of the present invention, after the terminal is lost, the user cannot obtain the encrypted file, because only the user knows the storage address of the encrypted file, thereby improving the security of password storage and reducing the risk of leakage. In addition, the encrypted file cannot reversely crack the password. The password verification process is completed on the server, but the user needs to upload the encrypted file to perform the password verification. The server does not store the password, and the local does not know the storage location of the encrypted file, which greatly reduces the risk of password leakage.

[0164] The gesture password described in the embodiment of the present invention will not become invalid because the terminal user changes the terminal. When the user uses a new terminal, the terminal will obtain user information from the server. If the user has enabled the gesture password, the terminal mobile phone application will guide the user to perform the gesture password verification process.

[0165] The embodiment of the present invention also provides a password verification device for a mobile phone application, as described in the following embodiment. Since the principle of solving the problem by the device is similar to the password verification method for a mobile phone application, the implementation of the device can refer to the implementation of the password verification method for a mobile phone application, and the repeated parts will not be repeated.

[0166] Figure 5 FIG. 1 is a schematic diagram of a password verification device for a mobile phone application in an embodiment of the present invention, as shown in FIG. Figure 5 As shown, the device 500 includes a login request receiving module 501, a password receiving module 502, an encrypted string processing module 503, an encrypted file receiving module 504, and a data uploading module 505.

[0167] The login request receiving module 501 is used to receive a login request from a user.

[0168] The password receiving module 502 is used to prompt the user to enter a password and upload a login request to the server so that the server: generates a dynamic token based on the login request and feeds the dynamic token back to the mobile application; receives the dynamic token and the password entered by the user.

[0169] The encrypted string processing module 503 is used to encrypt the dynamic token and the password input by the user to form an encrypted string.

[0170] The encrypted file receiving module 504 is used to display the function entrance for uploading encrypted files to the user; the encrypted file is generated by the server using a preset key to encrypt the login password and send it to the mobile application when the user sets the login password of the mobile application for the first time; the server deletes the encrypted file after sending the encrypted file to the mobile application and saves the preset key; the encrypted file is saved by the user; and the encrypted file uploaded by the user through the function entrance is received.

[0171] The data upload module 505 is used to upload the encrypted string and the encrypted file to the server, so that the server: uses the dynamic token to decrypt the encrypted string to obtain the password input by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password input by the user with the login password, and determines whether the password verification is passed according to the comparison result; and sends the information of whether the password verification is passed to the mobile phone application;

[0172] The path cleaning module 506 is used to clean up the upload path information.

[0173] In one embodiment, the encrypted string processing module 503 is specifically used to: encrypt the dynamic token and the password input by the user based on the AES algorithm to obtain an encrypted string.

[0174] In one embodiment, the dynamic token is a time-based one-time password algorithm obtained by hashing a timestamp and a random number.

[0175] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

[0176] In one embodiment, the password input by the user is a gesture password. The encrypted string processing module 503 is specifically used to: convert the gesture password into a digital sequence, concatenate the digital sequence with the user name to obtain a first string; and encrypt the dynamic token and the first string to form an encrypted string.

[0177] In one embodiment, the device 500 may further include: an encrypted file request update module.

[0178] The encrypted file request update module is specifically used for:

[0179] After the encrypted file receiving module 504 receives the encrypted file uploaded by the user through the function entry, it receives the encrypted file update request input by the user through the encrypted file update interface;

[0180] Prompting the user to enter biometric information, and receiving the biometric information entered by the user;

[0181] Upload the biometric information to the server so that the server can: authenticate the user based on the biometric information; when the authentication is successful, send a message of successful authentication to the mobile application;

[0182] When receiving a message that the identity authentication is passed, the encrypted file update request is uploaded to the server, so that the server: updates the preset key according to the encrypted file update request, encrypts the login password with the updated preset key to form an updated encrypted file, sends the updated encrypted file to the mobile phone application, deletes the updated encrypted file, and saves the updated preset key;

[0183] Receive the updated encrypted file sent by the server;

[0184] The updated encrypted file is provided to the user through the encrypted file update interface.

[0185] The embodiment of the present invention also provides a password verification device for a mobile phone application applied to a terminal, as described in the following embodiment. Since the principle of solving the problem by the device is similar to the password verification method for a mobile phone application applied to a terminal, the implementation of the device can refer to the implementation of the password verification method for a mobile phone application applied to a terminal, and the repeated parts will not be repeated.

[0186] Figure 6 Schematic diagram of a password verification device for a mobile phone application program applied to a terminal in an embodiment of the present invention. Figure 6 As shown, the device 600 includes a dynamic token generation module 601, a data receiving module 602, an encrypted string decryption module 603, a login password decryption module 604, a comparison processing module 605, and a data sending module 606.

[0187] The dynamic token generation module 601 is used to generate a dynamic token upon receiving a user login request uploaded by a mobile application, and feed the dynamic token back to the mobile application so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string.

[0188] The data receiving module 602 is used to receive encrypted files and encrypted strings uploaded by the mobile phone application; the encrypted file is formed by encrypting the login password using a preset key when the user sets the login password of the mobile phone application for the first time. The server sends the encrypted file to the mobile phone application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user.

[0189] The encrypted string decryption module 603 is used to decrypt the encrypted string using the dynamic token to obtain the password input by the user.

[0190] The login password decryption module 604 is used to decrypt the encrypted file using a preset key to obtain the login password.

[0191] The comparison processing module 605 is used to compare the decrypted password input by the user with the login password, and determine whether the password verification is passed according to the comparison result.

[0192] The data sending module 606 is used to send information on whether the password verification is passed to the mobile phone application.

[0193] In one embodiment, the encrypted file is obtained as follows: when the user sets the login password of the mobile application for the first time, the login password uploaded by the user is received; a preset key is generated using multiple specified user information; the specified user information includes one or any combination of the following: user name, user email address, user registration date, user IP address; based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file.

[0194] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information.

[0195] In one embodiment, the preset key is obtained by hashing multiple designated user information in the following manner: multiple designated user information is input into a pseudo-random function RPF, and a hash operation is performed using the output of the RPF to obtain a hash value; the following steps are repeatedly performed until a preset number of iterations is reached to obtain the preset key:

[0196] The hash value is input into RPF and the hash operation is performed using the output of RPF.

[0197] In one embodiment, the encrypted string decryption module 603 is specifically used to: decrypt the encrypted string using a dynamic token based on the AES algorithm to obtain the password input by the user.

[0198] In one embodiment, the device 600 may further include: an encrypted file update module;

[0199] The encrypted file update module is used to: update the preset key when receiving an encrypted file update request; encrypt the login password with the updated preset key to form an updated encrypted file; send the updated encrypted file to the mobile phone application, and at the same time, delete the updated encrypted file and save the updated preset key.

[0200] Figure 7 Schematic diagram of a computer device in an embodiment of the present invention. Figure 7 As shown, an embodiment of the present invention further provides a computer device 700, including a processor 701, a memory 702, and a computer program 703 stored in the memory 702 and executable on the processor 701, wherein the processor 701 implements the password verification method of the above-mentioned mobile phone application when executing the computer program 703.

[0201] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the password verification method for the mobile phone application is implemented.

[0202] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the password verification method of the mobile phone application is implemented.

[0203] In the embodiment of the present invention, when the user sets the login password of the mobile application for the first time, the server uses the preset key to encrypt the login password to form an encrypted file, and sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and only saves the preset key; the encrypted file is saved by the user; the user can set the storage address of the encrypted file at will, locally or in the cloud, and outsiders cannot know it. Later, when the user logs in to the mobile application, the encrypted file is uploaded to the server, and the password entered by the user is encrypted and uploaded to the server. The server decrypts the encrypted file to obtain the login password set by the user for the first time and the password entered by the user for this login, and the password verification for this login is realized by comparison. Compared with the technical solution in the prior art in which the password is saved locally or on the server through the program, in the embodiment of the present invention, the encrypted file is saved by the user, and the server only saves the preset key for decryption. There is no possibility of the local program being cracked and causing the local password to be lost, and there is no situation where the password is lost on the server. In addition, the password verification is completed by local upload and server verification at each login, which reduces the risk of password leakage, improves the security of mobile application password storage, and also improves the security of mobile application password login.

[0204] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0205] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0206] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0207] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0208] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A password verification method for a mobile phone application, characterized in that: Applied to mobile applications, including: Receive the user's login request; Prompt the user to enter a password and upload the login request to the server, so that the server: generates a dynamic token based on the login request and feeds the dynamic token back to the mobile application; Receive dynamic token and password entered by user; Encrypt the dynamic token and the password entered by the user to form an encrypted string; The user is presented with a function entry for uploading an encrypted file; the encrypted file is generated when the user sets the login password of the mobile application for the first time, and the server encrypts the login password using a preset key and sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user; Receive encrypted files uploaded by users through the function portal; Upload the encrypted string and encrypted file to the server, so that the server: uses the dynamic token to decrypt the encrypted string to obtain the password entered by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password entered by the user with the login password, and determines whether the password verification is passed according to the comparison result; sends the information of whether the password verification is passed to the mobile application; Clean up the upload path information.

2. The password verification method for a mobile phone application as claimed in claim 1, characterized in that: Encrypt the dynamic token and the password entered by the user to form an encrypted string, including: Based on the symmetric encryption AES algorithm, the dynamic token and the password entered by the user are encrypted to obtain an encrypted string.

3. The password verification method for a mobile phone application as claimed in claim 2, characterized in that: The dynamic token is a one-time password algorithm based on time, and is obtained by hashing a timestamp and a random number.

4. The password verification method for a mobile phone application as claimed in claim 1, characterized in that: The preset key is obtained by hashing multiple pieces of designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

5. The password verification method for a mobile phone application as claimed in claim 1, characterized in that: After receiving the encrypted file uploaded by the user through the function portal, it also includes: Receiving an encrypted file update request input by a user through an encrypted file update interface; Prompting the user to enter biometric information, and receiving the biometric information entered by the user; Upload the biometric information to the server so that the server can: authenticate the user based on the biometric information; when the authentication is successful, send a message of successful authentication to the mobile application; When receiving a message that the identity authentication is passed, the encrypted file update request is uploaded to the server, so that the server: updates the preset key according to the encrypted file update request, encrypts the login password with the updated preset key to form an updated encrypted file, sends the updated encrypted file to the mobile phone application, deletes the updated encrypted file, and saves the updated preset key; Receive the updated encrypted file sent by the server; The updated encrypted file is provided to the user through the encrypted file update interface.

6. The password verification method for a mobile phone application as claimed in claim 1, characterized in that: The password input by the user is a gesture password; Encrypt the dynamic token and the password entered by the user to form an encrypted string, including: Convert the gesture password into a numeric sequence, and concatenate the numeric sequence with the user name to obtain a first character string; The dynamic token and the first character string are encrypted to form an encrypted character string.

7. A password verification method for a mobile phone application, characterized in that: Applied to the server, including: When receiving a login request from a user uploaded by the mobile application, a dynamic token is generated, and the dynamic token is fed back to the mobile application, so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string; Receive the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is formed by encrypting the login password of the mobile application using a preset key when the user sets the login password of the mobile application for the first time, the server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user; Use the dynamic token to decrypt the encrypted string and get the password entered by the user; Use the preset key to decrypt the encrypted file and get the login password; Compare the decrypted password entered by the user with the login password, and determine whether the password verification is successful based on the comparison result; The information on whether the password verification is passed is sent to the mobile application.

8. The password verification method for a mobile phone application as claimed in claim 7, characterized in that: The encrypted file is obtained as follows: When a user sets a login password for a mobile application for the first time, receive the login password uploaded by the user; Generate a preset key using multiple designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, user IP address; Based on the AES algorithm, the login password and preset key uploaded by the user are encrypted to form an encrypted file.

9. The password verification method for a mobile phone application as claimed in claim 8, characterized in that: After the information on whether the password verification is passed is sent to the mobile application, it also includes: When receiving an encrypted file update request, updating the preset key; Encrypting the login password using the updated preset key to form an updated encrypted file; Send the updated encrypted file to the mobile application, delete the updated encrypted file, and save the updated preset key.

10. The password verification method for a mobile phone application as claimed in claim 8, characterized in that: The preset key is obtained by hashing multiple pieces of designated user information.

11. The password verification method for a mobile phone application as claimed in claim 9, characterized in that: The preset key is obtained by hashing multiple specified user information in the following manner: Input multiple specified user information into the pseudo-random function RPF, perform hash operation using the output of RPF, and obtain a hash value; Repeat the following steps until the preset number of iterations is reached to obtain the preset key: The hash value is input into RPF and the hash operation is performed using the output of RPF.

12. The password verification method for a mobile phone application as claimed in claim 7, characterized in that: Use the dynamic token to decrypt the encrypted string and get the password entered by the user, including: Based on the AES algorithm, the dynamic token is used to decrypt the encrypted string to obtain the password entered by the user.

13. A password verification device for a mobile phone application, characterized in that: Applied to mobile applications, including: A login request receiving module, used to receive a user's login request; The password receiving module is used to prompt the user to enter the password and upload the login request to the server, so that the server: generates a dynamic token according to the login request and feeds the dynamic token back to the mobile application; receives the dynamic token and the password entered by the user; The encrypted string processing module is used to encrypt the dynamic token and the password input by the user to form an encrypted string; The encrypted file receiving module is used to show the user the function entrance for uploading encrypted files; the encrypted file is generated by the server using a preset key to encrypt the login password of the mobile application when the user sets the login password of the mobile application for the first time and sends it to the mobile application; the server deletes the encrypted file after sending it to the mobile application and saves the preset key; the encrypted file is saved by the user; and the encrypted file uploaded by the user through the function entrance is received; The data upload module is used to upload the encrypted string and the encrypted file to the server, so that the server: uses the dynamic token to decrypt the encrypted string to obtain the password entered by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password entered by the user with the login password, and determines whether the password verification is passed according to the comparison result; and sends the information of whether the password verification is passed to the mobile phone application; The path cleaning module is used to clean up the upload path information.

14. A password verification device for a mobile phone application, characterized in that: Applied to the server, including: The dynamic token generation module is used to generate a dynamic token upon receiving a login request from a user uploaded by the mobile application, and feed the dynamic token back to the mobile application so that the mobile application: encrypts the dynamic token and the password input by the user to form an encrypted string; The data receiving module is used to receive the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is formed by encrypting the login password of the mobile application using a preset key when the user sets the login password of the mobile application for the first time. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user; The encrypted string decryption module is used to decrypt the encrypted string using the dynamic token to obtain the password entered by the user; A login password decryption module is used to decrypt the encrypted file using a preset key to obtain the login password; A comparison processing module is used to compare the password input by the user and the login password obtained by decryption, and determine whether the password verification is passed according to the comparison result; The data sending module is used to send the information whether the password verification is passed to the mobile application.

15. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 12 is implemented.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

17. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images