Password verification method and device for mobile phone application

Abstract

The present invention discloses a password verification method and device for a mobile phone application. The method comprises: the mobile phone application receives a password entered by a user and an uploaded encrypted file, and uploads the encrypted file to a server; when the user first sets a login password for the mobile phone application, the server encrypts the login password using a preset key and sends the encrypted file to the mobile phone application; after sending the encrypted file to the mobile phone application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user; the server decrypts the encrypted string to obtain the password entered by the user; decrypts the encrypted file using the preset key to obtain the login password; compares the decrypted password entered by the user with the login password, and determines whether the password verification is successful based on the comparison result; and sends information on whether the password verification is successful to the mobile phone application. The present invention can improve the security of password storage in mobile phone applications.

Description

Technical Field

[0001] The present invention relates to the technical field of password verification, and in particular to a password verification method and device for a mobile phone application. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. No statement herein is admitted to be prior art by virtue of its inclusion in this section.

[0003] Currently, there are two approaches to password verification. Option 1 stores the password locally on the terminal. Option 2 stores the password on the server. In Option 1, the password is stored locally by the terminal program, which can be cracked. For example, if the terminal is lost, the password could be maliciously cracked, resulting in low security. Furthermore, when a terminal logs in using a password, the terminal remains in a persistent login state, creating the risk of password bypass. In Option 2, while the password can be encrypted and stored on the server, the server data still faces the risk of being leaked. Summary of the Invention

[0004] An embodiment of the present invention provides a password verification method for a mobile phone application, which is used to improve the security of password login for a mobile phone application and the security of password storage for a mobile phone application. The method is applied to a mobile phone application and includes:

[0005] Receive the user's login request;

[0006] Prompt the user to enter a password and upload the login request to the server, so that the server can: generate a dynamic token based on the login request and feed the dynamic token back to the mobile application;

[0007] Receive dynamic token and password entered by user;

[0008] Encrypt the dynamic token and the password entered by the user to form an encrypted string;

[0009] The user is presented with a function entry for uploading an encrypted file; the encrypted file is generated by the server using a preset key to encrypt the login password when the user first sets the login password for the mobile application and then sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user;

[0010] Receive encrypted files uploaded by users through the function portal;

[0011] Upload the encrypted string and encrypted file to the server, so that the server can: decrypt the encrypted string using the dynamic token to obtain the password entered by the user; decrypt the encrypted file using the preset key to obtain the login password; compare the decrypted password entered by the user with the login password, and determine whether the password verification is successful based on the comparison result; and send the information on whether the password verification is successful to the mobile application;

[0012] Clean up the upload path information.

[0013] In one embodiment, the dynamic token and the password input by the user are encrypted to form an encrypted string, including: encrypting the dynamic token and the password input by the user based on the symmetric encryption AES (Advanced Encryption Standard, referred to as AES) algorithm to obtain an encrypted string.

[0014] In one embodiment, the dynamic token is a time-based one-time password algorithm obtained by hashing a timestamp and a random number.

[0015] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

[0016] In one embodiment, after receiving the encrypted file uploaded by the user through the function portal, the password verification method of the mobile phone application further includes: cleaning up the upload path information.

[0017] In one embodiment, the password input by the user is a gesture password; the dynamic token and the password input by the user are encrypted to form an encrypted string, including: converting the gesture password into a digital sequence, concatenating the digital sequence with the user name to obtain a first string; and encrypting the dynamic token and the first string to form an encrypted string.

[0018] An embodiment of the present invention provides a password verification method for a mobile phone application, which is used to improve the security of password login for a mobile phone application and the security of password storage for a mobile phone application. The method is applied to a server and includes:

[0019] Upon receiving a login request from a user uploaded by a mobile application, a dynamic token is generated and fed back to the mobile application so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string;

[0020] Receive an encrypted file and encrypted string uploaded by a mobile application; the encrypted file is generated by encrypting the login password of the mobile application using a preset key when the user first sets the login password of the mobile application. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user;

[0021] Use the dynamic token to decrypt the encrypted string and get the password entered by the user;

[0022] Use the preset key to decrypt the encrypted file and get the login password;

[0023] Compare the decrypted password entered by the user with the login password, and determine whether the password verification is successful based on the comparison result;

[0024] The information on whether the password verification is passed is sent to the mobile application.

[0025] In one embodiment, the encrypted file is obtained as follows:

[0026] When a user sets a login password for a mobile application for the first time, the login password uploaded by the user is received; a preset key is generated using multiple specified user information; the specified user information includes one or any combination of the following: user name, user email address, user registration date, user IP address; based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file.

[0027] In one embodiment, the preset key is obtained by hashing information of multiple specified users.

[0028] In one embodiment, the preset key is obtained by hashing multiple pieces of specified user information in the following manner:

[0029] Input multiple specified user information into the pseudo-random function RPF, perform a hash operation using the output of RPF, and obtain a hash value. Repeat the following steps until the preset number of iterations is reached to obtain the preset key:

[0030] The hash value is input into RPF, and the hash operation is performed using the output of RPF.

[0031] In one embodiment, the encrypted string is decrypted using a dynamic token to obtain the password input by the user, including: based on the AES algorithm, the encrypted string is decrypted using the dynamic token to obtain the password input by the user.

[0032] An embodiment of the present invention provides a password verification device for a mobile phone application, which is used to improve the security of password login for a mobile phone application and the security of password storage for a mobile phone application. The device is applied to a mobile phone application and includes:

[0033] A login request receiving module, used to receive a user's login request;

[0034] The password receiving module is used to prompt the user to enter the password and upload the login request to the server, so that the server can: generate a dynamic token based on the login request and feed the dynamic token back to the mobile application; receive the dynamic token and the password entered by the user;

[0035] The encryption string processing module is used to encrypt the dynamic token and the password input by the user to form an encrypted string;

[0036] The encrypted file receiving module is used to display the function entry for uploading encrypted files to the user; the encrypted file is generated by the server using a preset key to encrypt the login password of the mobile application when the user first sets the login password of the mobile application and sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user; and the encrypted file uploaded by the user through the function entry is received;

[0037] The data upload module is used to upload the encrypted string and encrypted file to the server, so that the server can: decrypt the encrypted string using the dynamic token to obtain the password entered by the user; decrypt the encrypted file using the preset key to obtain the login password; compare the decrypted password entered by the user with the login password, and determine whether the password verification is passed based on the comparison result; and send the information on whether the password verification is passed to the mobile application;

[0038] The path cleaning module is used to clean up the upload path information.

[0039] An embodiment of the present invention provides a password verification device for a mobile phone application, which is used to improve the security of mobile phone application password login and the security of mobile phone application password storage. The device is applied to a server and includes:

[0040] The dynamic token generation module is used to generate a dynamic token upon receiving a login request from a user uploaded by the mobile application, and feed the dynamic token back to the mobile application so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string;

[0041] The data receiving module is used to receive the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is generated by encrypting the login password of the mobile application using a preset key when the user first sets the login password of the mobile application. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user;

[0042] The encrypted string decryption module is used to decrypt the encrypted string using the dynamic token to obtain the password entered by the user;

[0043] The login password decryption module is used to decrypt the encrypted file using the preset key to obtain the login password;

[0044] A comparison processing module is used to compare the decrypted password input by the user with the login password, and determine whether the password verification is passed based on the comparison result;

[0045] The data sending module is used to send information on whether the password verification is passed to the mobile application.

[0046] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the password verification method for the mobile phone application when executing the computer program.

[0047] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the password verification method for the mobile phone application is implemented.

[0048] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the password verification method for the mobile phone application.

[0049] In an embodiment of the present invention, when a user first sets a login password for a mobile application, the server encrypts the login password using a preset key to create an encrypted file and sends it to the mobile application. After sending the encrypted file to the mobile application, the server deletes the encrypted file and only saves the preset key. The encrypted file is saved by the user and can be saved in a location they wish, either locally or in the cloud, which is hidden from outsiders. Subsequently, when the user logs into the mobile application, the encrypted file is uploaded to the server, along with the encrypted password entered by the user and uploaded to the server. The server then decrypts the encrypted file to obtain the user's first login password and the password entered by the user for the current login. Password verification for the current login is then performed by comparing the encrypted file. Compared with the technical solution in the prior art in which passwords are saved locally or on the server through a program, in the embodiment of the present invention, the encrypted file is saved by the user, and the upload path information is immediately cleared after uploading the encrypted file. The server only saves the preset key for decryption. There is no possibility of the local program being cracked and causing the local password to be lost, nor is there a situation where the password is lost on the server. Moreover, the password verification is completed through local upload and server verification each time the user logs in, which reduces the risk of password leakage, improves the security of mobile application password storage, and also improves the security of mobile application password login. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0051] Figure 1 Schematic diagram of a flow chart of a password verification method for a mobile phone application in accordance with an embodiment of the present invention;

[0052] Figure 2 Schematic diagram of a password verification method for a mobile phone application applied to a server in an embodiment of the present invention;

[0053] Figure 3 This is a diagram showing a specific example of a password verification method for a mobile phone application applied to a server in an embodiment of the present invention;

[0054] Figure 4 A diagram illustrating a specific example of a password verification method for a mobile phone application according to an embodiment of the present invention;

[0055] Figure 5 Schematic diagram of a password verification device for a mobile phone application according to an embodiment of the present invention;

[0056] Figure 6 Schematic diagram of a password verification device for a mobile phone application applied to a terminal according to an embodiment of the present invention;

[0057] Figure 7 Schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0058] To make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0059] The acquisition, transmission, storage, use, and processing of data in the technical solutions in the embodiments of the present invention comply with the relevant provisions of national laws and regulations.

[0060] It should be noted that in the embodiments of the present invention, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary and their purpose is only to illustrate the feasibility of implementing the technical solution of the present invention, but it does not mean that the applicant has or will necessarily use the solution.

[0061] Figure 1FIG. 1 is a flow chart of a password verification method for a mobile phone application according to an embodiment of the present invention, as shown in FIG. Figure 1 As shown, the method includes:

[0062] Step 101: Receive a user's login request;

[0063] Step 102: prompt the user to enter a password and upload a login request to the server, so that the server: generates a dynamic token based on the login request and feeds the dynamic token back to the mobile application;

[0064] Step 103: Receive the dynamic token and the password entered by the user;

[0065] Step 104: Encrypt the dynamic token and the password input by the user to form an encrypted string;

[0066] Step 105: Displaying the user with a function entry for uploading an encrypted file; the encrypted file is generated when the user first sets a login password for the mobile application by encrypting the login password using a preset key by the server and sending it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user;

[0067] Step 106: Receive the encrypted file uploaded by the user through the function portal;

[0068] Step 107: Upload the encrypted string and the encrypted file to the server, so that the server: decrypts the encrypted string using the dynamic token to obtain the password entered by the user; decrypts the encrypted file using the preset key to obtain the login password; compares the decrypted password entered by the user with the login password, and determines whether the password verification is successful based on the comparison result; and sends the information on whether the password verification is successful to the mobile phone application;

[0069] Step 108: Clear the upload path information.

[0070] from Figure 1 As can be seen from the shown process, in the embodiment of the present invention, the encrypted file is saved by the user's custom method, and the upload path information is immediately cleared after the encrypted file is uploaded. The server only saves the preset key for decryption. There is no possibility of the local program being cracked and causing the local password to be lost, and there is no situation where the password is lost on the server. In addition, the password verification is completed through local upload and server verification each time the user logs in, which reduces the risk of password leakage, improves the security of mobile application password storage, and also improves the security of mobile application password login.

[0071] The following is a detailed explanation of the password verification method for a mobile phone application in accordance with an embodiment of the present invention.

[0072] In step 101, the mobile application receives a user's login request. For example, the user opens a login page and clicks on the login name input box. The mobile application detects that the input box on the login page is selected and determines that the user is logging in.

[0073] In step 102, the mobile application prompts the user for the password through a pop-up window, for example, showing the user the password input method, including gesture password, numeric password, fingerprint, etc. At the same time, the login request is uploaded to the server through a dedicated SDK interface.

[0074] After receiving the login request, the server generates a dynamic token and feeds the dynamic token back to the mobile application.

[0075] In one embodiment, the dynamic token is a time-based one-time password algorithm obtained by hashing a timestamp and a random number.

[0076] Furthermore, the dynamic token is composed of a random number and a timestamp, which are then encrypted with a fixed key using AES. The dynamic token has an expiration date, and after a set time (e.g., 30 seconds, 60 seconds), the dynamic token becomes invalid.

[0077] In step 103 and step 104, after receiving the dynamic token and the password input by the user, the mobile application encrypts the dynamic token and the password input by the user to form an encrypted string.

[0078] In one embodiment, encrypting the dynamic token and the password input by the user to form an encrypted string may include: encrypting the dynamic token and the password input by the user based on a symmetric encryption AES algorithm to obtain an encrypted string.

[0079] During implementation, the first step is to generate a 256-bit security key K and a random 16-byte initialization vector IV.

[0080] The second step is to combine the dynamic token and the password entered by the user into a byte stream according to a preset rule. The preset rule may be, for example, to sequentially insert the password entered by the user between two characters of the dynamic token from left to right to obtain a string, which is then converted into a byte stream.

[0081] The third step is to divide the byte stream into multiple blocks P1, P2, ..., P n , the size of each block can be customized by the user.

[0082] The fourth step is to use the security key K, the initialization vector IV and multiple blocks P1, P2, ..., P n Encryption. The specific steps are:

[0083] 1) For the first block P1, use the initialization vector IV to perform an XOR operation on it, and the XOR operation result is C1'.

[0084] 2) Use the AES encryption algorithm to encrypt the XOR operation result C1' to obtain the block ciphertext C1:

[0085] C1=AES(K,C1')

[0086] Wherein, AES() represents the AES encryption algorithm function.

[0087] 3) For each subsequent block P n , using the block ciphertext C of the previous block n Instead of performing XOR operation, the XOR operation result is encrypted using AES encryption algorithm, and finally all the block ciphertexts C1, C2...C are obtained. n .

[0088] 4) All block ciphertexts C1, C2...C n Concatenate together to form the encrypted string C.

[0089] In step 105, the mobile application displays a function entry for uploading encrypted files to the user.

[0090] The function entry is, for example, an interface in an interface that supports users to click to upload.

[0091] The encrypted file is saved by the user, and the user can dispose of the encrypted file at will, for example, save it locally, in a cloud disk, or in other applications. The encrypted file saves the login password of the mobile application set by the user when logging in for the first time.

[0092] In one embodiment, the encrypted file is generated by encrypting the login password using a preset key on the server side. For example, the encrypted file is generated by encrypting the login password uploaded by the user and the preset key using the AES algorithm. After sending the encrypted file to the mobile application, the server side immediately deletes the encrypted file and only stores the preset key.

[0093] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

[0094] By generating a preset key through multiple specified user information, the security of mobile application login can be further improved.

[0095] In step 106, the mobile application receives the encrypted file uploaded by the user through the function portal.

[0096] In the embodiment of the present invention, after receiving the encrypted file uploaded by the user through the function portal, the upload path information is immediately cleared.

[0097] After the user enters the password for this login in the mobile application and uploads the encrypted file, the upload path information is cleared. In this way, other people cannot log in to the application based on the historical upload path when using the mobile terminal, further improving the storage security and login security of the encrypted file.

[0098] After the mobile application uploads the encrypted string and encrypted file to the server, the server: uses the dynamic token to decrypt the encrypted string to obtain the password entered by the user; uses the preset key to decrypt the encrypted file to obtain the login password; compares the decrypted password entered by the user with the login password, and determines whether the password verification is successful based on the comparison result; and sends the information on whether the password verification is successful to the mobile application.

[0099] Users can directly see the password verification results on the mobile application. If the password verification is successful, they can log in to the application directly. If the password verification fails, the user will be prompted that the password verification failed and must re-enter the password, and the number of times the password can be re-entered can be set.

[0100] In one embodiment, the number of times to re-enter the password can be set according to the age of the user. For example, the elderly can re-enter the password more times, while the young can re-enter the password less times.

[0101] In one embodiment, the password input by the user is a gesture password.

[0102] Step 104 encrypts the dynamic token and the password entered by the user to form an encrypted string, which may include the following steps: Step 1, converting the gesture password into a digital sequence, and concatenating the digital sequence with the user name to obtain a first string; Step 2, encrypting the dynamic token and the first string to form an encrypted string.

[0103] In this example, the user name is introduced into the encrypted string to further improve the security of application login.

[0104] In one embodiment, after receiving the encrypted file uploaded by the user through the function portal, the password verification method of the mobile application may further include:

[0105] Step 1: Receive an encrypted file update request input by a user through an encrypted file update interface;

[0106] Step 2: prompt the user to enter biometric information and receive the biometric information entered by the user; biometric information includes face information, fingerprint information, pupil information, voice information, etc.;

[0107] Step 3: Upload the biometric information to the server, so that the server can authenticate the user based on the biometric information; if the authentication is successful, send a message to the mobile application;

[0108] Step 4: Upon receiving a message indicating that the identity verification is successful, the server uploads an encrypted file update request to the server, so that the server: updates the preset key according to the encrypted file update request, encrypts the login password using the updated preset key to form an updated encrypted file, sends the updated encrypted file to the mobile application, deletes the updated encrypted file, and saves the updated preset key;

[0109] Step 5: Receive the updated encrypted file sent by the server;

[0110] Step 6: Provide the updated encrypted file to the user through the encrypted file update interface.

[0111] In this example, the encrypted file update interface is displayed to the user. Considering security issues and the possibility that the user may forget the encrypted file storage location, the embodiment of the present invention can support the user to regenerate a new encrypted file after verifying his identity, which can improve security and user experience.

[0112] Corresponding to the method on the mobile phone application side, an embodiment of the present invention also provides a password verification method for the mobile phone application applied to the server side. Figure 2 FIG. 1 is a flow chart of a password verification method for a mobile phone application in an embodiment of the present invention, which is applied to a server. Figure 2 As shown, the method includes:

[0113] Step 201: upon receiving a user login request uploaded by a mobile application, a dynamic token is generated and fed back to the mobile application, so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string;

[0114] Step 202: Receive the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is generated by encrypting the login password of the mobile application using a preset key when the user first sets the login password of the mobile application. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user.

[0115] Step 203: Decrypt the encrypted string using the dynamic token to obtain the password entered by the user;

[0116] Step 204: Decrypt the encrypted file using the preset key to obtain the login password;

[0117] Step 205: Compare the decrypted password input by the user with the login password, and determine whether the password verification is successful based on the comparison result.

[0118] Step 206: Send information on whether the password verification is passed to the mobile phone application.

[0119] When a user logs in to the application, the server generates a dynamic token based on the user's login request uploaded by the mobile application and feeds the dynamic token back to the mobile application.

[0120] In one embodiment, a time-based one-time password algorithm utilizes a timestamp and a random number hash operation to obtain a dynamic token.

[0121] For example, the dynamic token generation process may include the following steps:

[0122] Step 1, get the current timestamp: Get the current timestamp, usually expressed as the number of seconds since the Unix epoch (January 1, 1970 00:00:00 UTC).

[0123] Step 2, Generate Random Number: Generate a random number as an additional factor to increase the randomness of the token. This random number is long enough to ensure its uniqueness.

[0124] Step 3: Combine the timestamp and random number: Combine the timestamp and random number into a string. This can be done by simply concatenating them or using a standard format (such as JSON).

[0125] Step 4, Hash operation: Use a strong hash function (such as SHA-256 hash algorithm, SHA-512 hash algorithm) to perform a hash operation on the combined string to obtain a hash value. The output of the hash function is a fixed-length string, usually expressed in hexadecimal form.

[0126] Step 5: Generate a dynamic token: You can directly use the hash value as the dynamic token, or intercept a part of it as the dynamic token.

[0127] The encrypted file is created when the user logs in for the first time and sets the login password. The server encrypts the login password using a preset key.

[0128] Figure 3 FIG. 1 is a specific example diagram of a password verification method for a mobile phone application applied to a server in an embodiment of the present invention. Figure 3 As shown, the encrypted file is obtained in the manner described in steps 301 to 303 below.

[0129] Step 301: When a user sets a login password for a mobile application for the first time, the login password uploaded by the user is received.

[0130] Step 302: Generate a preset key using multiple designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

[0131] Step 303: Based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file.

[0132] Furthermore, step 303 may include the following steps:

[0133] Step 1, Data Preparation: According to the preset rules, the user's uploaded login password and the preset key are combined into a string. The byte length of the combined string is checked, and data padding is performed if necessary to ensure that its length meets the requirements of block encryption (for example, it needs to be padded to a multiple of 16 bytes). The preset rule is, for example, to sequentially insert the user's uploaded login password from left to right between two characters of the preset key.

[0134] Step 2: Generate an initialization vector OV.

[0135] Step 3: Encrypt data: Use the AES encryption algorithm to encrypt the plaintext data obtained in step 1, and package the initialization vector OV and the encrypted data into an encrypted file.

[0136] In one embodiment, the preset key is obtained by hashing information of multiple specified users.

[0137] For example, the preset key is obtained by hashing multiple pieces of designated user information according to the following steps 1, 2, and 2.1.

[0138] Step 1: Input multiple specified user information into a pseudorandom function (RPF), perform a hash operation, and obtain a hash value.

[0139] Step 2: Repeat step 2.1 until the preset number of iterations is reached and the preset key is obtained:

[0140] Step 2.1: Input the hash value into RPF and perform the hash operation.

[0141] During implementation, a random number is pre-generated. This random number, combined with the specified user information, is fed into the RPF to generate a random output. This random output is then passed as input to a hash function for hashing. This hashing operation is repeated, and the resulting output serves as the pre-set key. This improves the security of the pre-set key, and thus the security of application logins.

[0142] In one embodiment, decrypting the encrypted string using the dynamic token to obtain the password input by the user may include: decrypting the encrypted string using the dynamic token based on the AES algorithm to obtain the password input by the user.

[0143] When implemented, the decryption process of the password entered by the user is the reverse operation of the encryption process on the mobile application side.

[0144] The first step is to split the encrypted string C into multiple blocks C1, C2...C n .

[0145] The second step is to decrypt each block: use the AES decryption algorithm to decrypt each block C1, C2...C n :

[0146] D i =AES -1 (K, C i )

[0147] Where, AES -1 () represents the AES decryption algorithm function.

[0148] The third step is to remove XOR: for i=1, use the initialization vector IV and D1' to perform XOR algorithm to obtain the plaintext block P1; for i>1, use the previous plaintext block P i-1 With D i 'Perform XOR algorithm; finally get all plaintext blocks P1, P2, ..., P n .

[0149] Step 4: All plaintext blocks P1, P2, ..., P n Connected together to form a byte stream.

[0150] The fifth step is to split the byte stream according to the preset rules to obtain the dynamic token and the password entered by the user.

[0151] The sixth step is to verify the validity period of the dynamic token. When the dynamic token is valid, the subsequent verification is performed using the password entered by the user.

[0152] In one embodiment, considering security issues and the possibility that the user may forget the encrypted file storage location, the user is given an opportunity to reset or update the encrypted file. After the information on whether the password verification is passed is sent to the mobile application, the method may further include:

[0153] When receiving an encrypted file update request, update the preset key;

[0154] Encrypting the login password using the updated preset key to form an updated encrypted file;

[0155] Send the updated encrypted file to the mobile application, delete the updated encrypted file, and save the updated preset key.

[0156] It should be noted that before receiving the encrypted file update request, the user identity has been verified. After confirming that it is the user himself who is operating, the encrypted file update is performed; this can improve security and user experience at the same time.

[0157] Figure 4 FIG. 1 is a diagram showing a specific example of a password verification method for a mobile phone application according to an embodiment of the present invention. Figure 4 As shown, the method includes:

[0158] Step 401: When the mobile terminal sets or resets the gesture password for the first time, it requests a dynamic token from the server. After the user enters the gesture password, the gesture password and user name are encrypted by the dynamic token through AES to generate an encrypted string, and the terminal sends the encrypted string to the server.

[0159] In step 402, the server pre-assigns a preset key to the user and stores it in the server database. The server decrypts the encrypted string from the initial gesture password setting using the dynamic token to obtain the plaintext gesture password. The server then encrypts the plaintext gesture password using the preset key to generate an encrypted file.

[0160] Step 403: The server sends the encrypted file to the terminal, prompting the user to properly save the encrypted file and upload the encrypted file when logging in using the gesture password.

[0161] Step 404: The user selects a gesture password to verify his / her identity. For example, after the user draws the gesture password, the terminal converts the gesture password into a numeric sequence and concatenates it with the user name to obtain a PAU (password and username). The terminal uses a dynamic token to encrypt the PAU to generate an encrypted string.

[0162] Step 405: The terminal prompts the user to upload the encrypted file. If the user does not upload, the verification process will be exited. If the user uploads an encrypted file, the encrypted file and the encrypted string will be sent to the server. The server will use the dynamic token to decrypt the encrypted string and the preset key to decrypt the encrypted file. The gesture password plaintext obtained from the two will be compared. If the comparison is consistent, the verification is passed.

[0163] In this embodiment of the present invention, if the terminal is lost, the user cannot access the encrypted file because only the user knows the storage address of the encrypted file. This improves the security of password storage and reduces the risk of leakage. Furthermore, the encrypted file cannot be reverse-engineered. The password verification process is completed on the server, but the user must upload the encrypted file for password verification. The server does not store the password and the encrypted file storage location is unknown locally, greatly reducing the risk of password leakage.

[0164] The gesture password described in the embodiment of the present invention will not become invalid even if the terminal user changes the terminal. When the user uses the new terminal, the terminal will obtain user information from the server. If the user has enabled the gesture password, the terminal mobile phone application will guide the user to complete the gesture password verification process.

[0165] The present invention also provides a mobile phone application password verification device, as described in the following embodiments. Because the principles of this device are similar to those of the mobile phone application password verification method, the implementation of this device can be referenced to the implementation of the mobile phone application password verification method, and any repetitions will not be repeated.

[0166] Figure 5 FIG. 1 is a schematic diagram of a password verification device for a mobile phone application according to an embodiment of the present invention. Figure 5 As shown, the device 500 includes a login request receiving module 501 , a password receiving module 502 , an encrypted string processing module 503 , an encrypted file receiving module 504 , and a data uploading module 505 .

[0167] The login request receiving module 501 is used to receive a login request from a user.

[0168] The password receiving module 502 is used to prompt the user to enter a password and upload the login request to the server so that the server: generates a dynamic token according to the login request and feeds the dynamic token back to the mobile application; receives the dynamic token and the password entered by the user.

[0169] The encrypted string processing module 503 is used to encrypt the dynamic token and the password input by the user to form an encrypted string.

[0170] The encrypted file receiving module 504 is used to display the functional entry for uploading encrypted files to the user; the encrypted file is generated when the user first sets the login password for the mobile application by the server using a preset key to encrypt the login password and send it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user; and the encrypted file uploaded by the user through the functional entry is received.

[0171] The data upload module 505 is used to upload the encrypted string and encrypted file to the server, so that the server can: decrypt the encrypted string using the dynamic token to obtain the password entered by the user; decrypt the encrypted file using the preset key to obtain the login password; compare the decrypted password entered by the user with the login password, and determine whether the password verification is successful based on the comparison result; and send the information on whether the password verification is successful to the mobile phone application;

[0172] The path cleaning module 506 is used to clean up the upload path information.

[0173] In one embodiment, the encrypted string processing module 503 is specifically configured to: encrypt the dynamic token and the password input by the user based on the AES algorithm to obtain an encrypted string.

[0174] In one embodiment, the dynamic token is a time-based one-time password algorithm obtained by hashing a timestamp and a random number.

[0175] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information; the designated user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

[0176] In one embodiment, the password input by the user is a gesture password. The encrypted string processing module 503 is specifically configured to: convert the gesture password into a numeric sequence, concatenate the numeric sequence with the user name to obtain a first string; and encrypt the dynamic token and the first string to form an encrypted string.

[0177] In one embodiment, the apparatus 500 may further include: an encrypted file update request module.

[0178] The encrypted file request update module is specifically used to:

[0179] After the encrypted file receiving module 504 receives the encrypted file uploaded by the user through the function entrance, it receives the encrypted file update request input by the user through the encrypted file update interface;

[0180] Prompting the user to enter biometric information and receiving the biometric information entered by the user;

[0181] Upload the biometric information to the server, so that the server can: authenticate the user based on the biometric information; when the authentication is successful, send a message of authentication success to the mobile application;

[0182] Upon receiving a message indicating that the authentication is successful, the encrypted file update request is uploaded to the server, so that the server: updates the preset key according to the encrypted file update request, encrypts the login password with the updated preset key to form an updated encrypted file, sends the updated encrypted file to the mobile application, deletes the updated encrypted file, and saves the updated preset key;

[0183] Receive the updated encrypted file sent by the server;

[0184] The updated encrypted file is provided to the user through the encrypted file update interface.

[0185] The present invention also provides a password verification device for a mobile phone application, which is applied to a terminal, as described in the following embodiments. Since the principles of this device are similar to those of the password verification method for a mobile phone application, the implementation of this device can refer to the implementation of the password verification method for a mobile phone application, and any repetitions will not be repeated.

[0186] Figure 6 Schematic diagram of a password verification device for a mobile phone application in a terminal according to an embodiment of the present invention. Figure 6 As shown, the device 600 includes a dynamic token generation module 601, a data receiving module 602, an encrypted string decryption module 603, a login password decryption module 604, a comparison processing module 605, and a data sending module 606.

[0187] The dynamic token generation module 601 is used to generate a dynamic token when receiving a user login request uploaded by the mobile application, and feed the dynamic token back to the mobile application so that the mobile application can encrypt the dynamic token and the password entered by the user to form an encrypted string.

[0188] The data receiving module 602 is used to receive encrypted files and encrypted strings uploaded by the mobile application; the encrypted file is formed by encrypting the login password of the mobile application using a preset key when the user first sets the login password of the mobile application. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user.

[0189] The encrypted string decryption module 603 is used to decrypt the encrypted string using the dynamic token to obtain the password input by the user.

[0190] The login password decryption module 604 is used to decrypt the encrypted file using a preset key to obtain the login password.

[0191] The comparison processing module 605 is used to compare the decrypted password input by the user with the login password, and determine whether the password verification is passed based on the comparison result.

[0192] The data sending module 606 is used to send information on whether the password verification is passed to the mobile phone application.

[0193] In one embodiment, the encrypted file is obtained as follows: when a user sets a login password for a mobile application for the first time, the login password uploaded by the user is received; a preset key is generated using information of multiple specified users; the specified user information includes one or any combination of the following: user name, user email address, user registration date, user IP address; based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file.

[0194] In one embodiment, the preset key is obtained by hashing information of multiple specified users.

[0195] In one embodiment, the preset key is obtained by hashing multiple pieces of designated user information in the following manner: inputting the multiple pieces of designated user information into a pseudo-random function (RPF), performing a hash operation using the output of the RPF, and obtaining a hash value; and repeatedly performing the following steps until a preset number of iterations is reached to obtain the preset key:

[0196] The hash value is input into RPF, and the hash operation is performed using the output of RPF.

[0197] In one embodiment, the encrypted string decryption module 603 is specifically configured to: decrypt the encrypted string using a dynamic token based on the AES algorithm to obtain the password input by the user.

[0198] In one embodiment, the apparatus 600 may further include: an encrypted file update module;

[0199] The encrypted file update module is used to: update the preset key when receiving an encrypted file update request; encrypt the login password using the updated preset key to form an updated encrypted file; send the updated encrypted file to the mobile phone application, and at the same time, delete the updated encrypted file and save the updated preset key.

[0200] Figure 7 Schematic diagram of a computer device according to an embodiment of the present invention. Figure 7 As shown, an embodiment of the present invention further provides a computer device 700, including a processor 701, a memory 702, and a computer program 703 stored in the memory 702 and executable on the processor 701, wherein the processor 701 implements the password verification method for the above-mentioned mobile phone application when executing the computer program 703.

[0201] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the password verification method for the mobile phone application is implemented.

[0202] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the password verification method for the mobile phone application.

[0203] In an embodiment of the present invention, when a user first sets a login password for a mobile application, the server encrypts the login password using a preset key to create an encrypted file and sends it to the mobile application. After sending the encrypted file to the mobile application, the server deletes the encrypted file and only stores the preset key. The encrypted file is saved by the user and can be saved locally or in the cloud, which is invisible to outsiders. Later, when the user logs into the mobile application, the encrypted file is uploaded to the server. The encrypted file is also encrypted and uploaded to the server. The server decrypts the encrypted file to obtain the user's first login password and the password entered by the user for the current login. The server then compares the encrypted file to verify the password for the current login. Compared to existing solutions in which passwords are stored locally or on the server by the program, in the embodiment of the present invention, the encrypted file is stored by the user, and the server only stores the preset key used for decryption. This eliminates the possibility of local password loss due to cracking of the local program, and the possibility of password loss on the server. Furthermore, password verification is performed simultaneously during each login through local upload and server verification, reducing the risk of password leakage and improving the security of mobile application password storage and password login.

[0204] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0205] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0206] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0207] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0208] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A password verification method for a mobile phone application, characterized in that: Applied to mobile applications, including: Receive the user's login request; Prompt the user to enter a password and upload the login request to the server, so that the server can: generate a dynamic token based on the login request and feed the dynamic token back to the mobile application; Receive dynamic token and password entered by user; Encrypt the dynamic token and the password entered by the user to form an encrypted string; The user is presented with a function entry for uploading an encrypted file; the encrypted file is generated by the server using a preset key to encrypt the login password when the user first sets the login password for the mobile application and then sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user; Receive encrypted files uploaded by users through the function portal; Upload the encrypted string and encrypted file to the server, so that the server can: decrypt the encrypted string using the dynamic token to obtain the password entered by the user; decrypt the encrypted file using the preset key to obtain the login password; compare the decrypted password entered by the user with the login password, and determine whether the password verification is successful based on the comparison result; and send the information on whether the password verification is successful to the mobile application; Clean up the upload path information.

2. The password verification method for a mobile phone application according to claim 1, wherein: Encrypt the dynamic token and the password entered by the user to form an encrypted string, including: Based on the symmetric encryption AES algorithm, the dynamic token and the password entered by the user are encrypted to obtain an encrypted string.

3. The password verification method for a mobile phone application according to claim 2, wherein: The dynamic token is a one-time password algorithm based on time, and is obtained by hashing a timestamp and a random number.

4. The password verification method for a mobile phone application according to claim 1, wherein: The preset key is obtained by hashing multiple pieces of specified user information; the specified user information includes one or any combination of the following: user name, user email address, user registration date, and user IP address.

5. The password verification method for a mobile phone application according to claim 1, wherein: After receiving the encrypted file uploaded by the user through the function entrance, it also includes: Receive an encrypted file update request input by a user through an encrypted file update interface; Prompting the user to enter biometric information and receiving the biometric information entered by the user; Upload the biometric information to the server, so that the server can: authenticate the user based on the biometric information; when the authentication is successful, send a message of authentication success to the mobile application; Upon receiving a message indicating that the authentication is successful, the encrypted file update request is uploaded to the server, so that the server: updates the preset key according to the encrypted file update request, encrypts the login password with the updated preset key to form an updated encrypted file, sends the updated encrypted file to the mobile application, deletes the updated encrypted file, and saves the updated preset key; Receive the updated encrypted file sent by the server; The updated encrypted file is provided to the user through the encrypted file update interface.

6. The password verification method for a mobile phone application according to claim 1, wherein: The password input by the user is a gesture password; Encrypt the dynamic token and the password entered by the user to form an encrypted string, including: Convert the gesture password into a numeric sequence, and concatenate the numeric sequence with the user name to obtain a first character string; The dynamic token and the first character string are encrypted to form an encrypted character string.

7. A password verification method for a mobile phone application, characterized in that: Applied to the server, including: Upon receiving a login request from a user uploaded by a mobile application, a dynamic token is generated and fed back to the mobile application so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string; Receive an encrypted file and encrypted string uploaded by a mobile application; the encrypted file is generated by encrypting the login password of the mobile application using a preset key when the user first sets the login password of the mobile application. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user; Use the dynamic token to decrypt the encrypted string and get the password entered by the user; Use the preset key to decrypt the encrypted file and get the login password; Compare the decrypted password entered by the user with the login password, and determine whether the password verification is successful based on the comparison result; The information on whether the password verification is passed is sent to the mobile application.

8. The password verification method for a mobile phone application according to claim 7, wherein: The encrypted file is obtained as follows: When a user sets a login password for a mobile application for the first time, receive the login password uploaded by the user; Generate a preset key using multiple specified user information; the specified user information includes one or any combination of the following: user name, user email address, user registration date, user IP address; Based on the AES algorithm, the login password uploaded by the user and the preset key are encrypted to form an encrypted file.

9. The password verification method for a mobile phone application according to claim 8, wherein: After the information on whether the password verification is passed is sent to the mobile application, it also includes: When receiving an encrypted file update request, update the preset key; Encrypting the login password using the updated preset key to form an updated encrypted file; Send the updated encrypted file to the mobile application, delete the updated encrypted file, and save the updated preset key.

10. The password verification method for a mobile phone application according to claim 8, wherein: The preset key is obtained by hashing multiple pieces of specified user information.

11. The password verification method for a mobile phone application according to claim 9, wherein: The preset key is obtained by hashing multiple specified user information in the following manner: Input multiple specified user information into the pseudo-random function RPF, perform a hash operation using the output of the RPF, and obtain a hash value; Repeat the following steps until the preset number of iterations is reached and the preset key is obtained: The hash value is input into RPF, and the hash operation is performed using the output of RPF.

12. The password verification method for a mobile phone application according to claim 7, wherein: Use the dynamic token to decrypt the encrypted string and get the password entered by the user, including: Based on the AES algorithm, the encrypted string is decrypted using a dynamic token to obtain the password entered by the user.

13. A password verification device for a mobile phone application, characterized in that: Applied to mobile applications, including: A login request receiving module, used to receive a user's login request; The password receiving module is used to prompt the user to enter the password and upload the login request to the server, so that the server can: generate a dynamic token based on the login request and feed the dynamic token back to the mobile application; receive the dynamic token and the password entered by the user; The encryption string processing module is used to encrypt the dynamic token and the password input by the user to form an encrypted string; The encrypted file receiving module is used to display the function entry for uploading encrypted files to the user; the encrypted file is generated by the server using a preset key to encrypt the login password of the mobile application when the user first sets the login password of the mobile application and sends it to the mobile application; after sending the encrypted file to the mobile application, the server deletes the encrypted file and saves the preset key; the encrypted file is saved by the user; and the encrypted file uploaded by the user through the function entry is received; The data upload module is used to upload the encrypted string and encrypted file to the server, so that the server can: decrypt the encrypted string using the dynamic token to obtain the password entered by the user; decrypt the encrypted file using the preset key to obtain the login password; compare the decrypted password entered by the user with the login password, and determine whether the password verification is passed based on the comparison result; and send the information on whether the password verification is passed to the mobile application; The path cleaning module is used to clean up the upload path information.

14. A password verification device for a mobile phone application, characterized in that: Applied to the server, including: The dynamic token generation module is used to generate a dynamic token upon receiving a login request from a user uploaded by the mobile application, and feed the dynamic token back to the mobile application so that the mobile application: encrypts the dynamic token and the password entered by the user to form an encrypted string; The data receiving module is used to receive the encrypted file and encrypted string uploaded by the mobile application; the encrypted file is generated by encrypting the login password of the mobile application using a preset key when the user first sets the login password of the mobile application. The server sends the encrypted file to the mobile application, deletes the encrypted file, and saves the preset key; the encrypted file is saved by the user; The encrypted string decryption module is used to decrypt the encrypted string using the dynamic token to obtain the password entered by the user; The login password decryption module is used to decrypt the encrypted file using the preset key to obtain the login password; A comparison processing module is used to compare the decrypted password input by the user with the login password, and determine whether the password verification is passed based on the comparison result; The data sending module is used to send information on whether the password verification is passed to the mobile application.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 12 is implemented.

16. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

17. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images