Secret-free login method and device and readable storage medium

Abstract

The invention provides a password-free login method and device and a readable storage medium, and relates to the technical field of networks, and the method comprises the steps: obtaining a personal identification code pin code inputted by a target user when the target user does not log in for the first time; the pin code is verified; in response to the fact that the pin code passes verification, a password-free login key corresponding to the target user is obtained, the password-free login key is generated based on a biological identification code, and the biological identification code is generated according to the device number of the device and the user identifier of the target user; sending the password-free login key to a cloud in an encryption transmission mode; and receiving a first token sent by the cloud, wherein the first token is used for indicating the target user to successfully log in by using the password-free login key. According to the method, the device and the readable storage medium, the problem that a request may be intercepted and encounters a replay attack or a secret key may be cracked violently in an existing password-free login method can be solved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a password-free login method, device and readable storage medium. Background Art

[0002] In modern workshops and factories, more and more devices require login and account switching. If face login is required like mobile phones, cameras or other hardware need to be installed, which is expensive. If the client simply stores a key, it is easy to be intercepted and cracked, so encryption between the client and the cloud is particularly necessary to ensure that the data for each password-free login is different and cannot be used even if it is obtained.

[0003] Currently, the mainstream password-free login method is to save a key on the client and pass the key to the server to verify whether it is consistent when logging in. However, this method has some security risks. For example, the request may be intercepted and subjected to replay attacks, or the key may be cracked by brute force. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a password-free login method, device and readable storage medium in response to the above-mentioned deficiencies in the prior art, so as to solve the problems in the existing password-free login method that requests may be intercepted and subjected to replay attacks, or keys may be cracked by brute force.

[0005] In the first aspect, the present invention provides a password-free login method, which is applied to a device.

[0006] The methods include:

[0007] Get the personal identification code PIN entered by the target user when it is not the first time to log in;

[0008] Verifying the PIN code;

[0009] In response to the PIN code verification being passed, obtaining a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on a device number of the device and a user identifier of the target user;

[0010] Sending the password-free login key to the cloud in an encrypted transmission manner, so that the cloud verifies the validity period of the password-free login key, and further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code after the verification is passed, and if so, generates a first token according to the user identifier and sends it to the device;

[0011] A first token sent by the cloud is received, where the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0012] Furthermore, before obtaining the personal identification code (PIN) input by the target user when not logging in for the first time, the method further includes:

[0013] Receive the user name and password of the target user when logging in for the first time;

[0014] Sending the username and password to the cloud;

[0015] Receive a second token returned by the cloud based on the user name and password;

[0016] Acquire a PIN code set by the target user according to the second token, and associate the PIN code with a user identification of the target user;

[0017] Sending a first request for generating a password-free login key to the cloud through the second token, so that the cloud generates the password-free login key according to the first request;

[0018] Receive the password-free login key sent by the cloud.

[0019] Furthermore, sending a first request for generating a password-free login key to the cloud through the second token specifically includes:

[0020] generating the biometric identification code according to the device number of the device and the user identification of the target user;

[0021] Generate a first character string according to the biometric identification code and a current timestamp;

[0022] Encrypting the first character string;

[0023] Using the private key of the device to sign the encrypted first character string to generate a first signature;

[0024] Sending the current timestamp, the biometric identification code, the first signature and the second token to the cloud to request generation of a password-free login key;

[0025] The receiving the password-free login key sent by the cloud specifically includes:

[0026] Receive the K value sent by the cloud, where the K value is generated by the cloud concatenating the biometric identification code with a random number to generate an M value and a corresponding validity period, and then encrypting the M value using the public key of the device, wherein the M value is a symmetric encryption key.

[0027] Furthermore, the step of sending the password-free login key to the cloud via encrypted transmission specifically includes:

[0028] Decrypting the K value based on the private key of the device to obtain the M value;

[0029] Encrypting the biometric identification code using the M value to generate a first ciphertext;

[0030] Concatenate the first ciphertext and the M value to generate a second character string;

[0031] Encrypt the second character string using the message digest algorithm version 5 MD5 encryption method to generate a third character string;

[0032] Sign the third character string using the private key of the device to generate a second signature;

[0033] The K value, the first ciphertext, the second signature, and the device number are sent to the cloud.

[0034] Furthermore, the method further comprises:

[0035] A second request for deleting the password-free login key is sent to the cloud, the second request carries the first token and the K value, the second request is used to trigger the cloud to parse the user identifier from the first token, and search for the user identifier corresponding to the received K value, and compare the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, deleting the password-free login key.

[0036] In a second aspect, the present invention provides a password-free login method, which is applied to the cloud, and the method comprises:

[0037] The receiving device sends a target user's password-free login key in an encrypted transmission manner, wherein the password-free login key is obtained by the device after obtaining a personal identification code (PIN) input by the target user when the target user logs in for a non-first time, and verifying the PIN, and obtaining the password-free login key corresponding to the target user in response to the PIN verification being passed, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user;

[0038] Verifying the validity period of the password-free login key;

[0039] In response to the verification being successful, it is further determined whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, a first token is generated based on the user identifier and sent to the device; wherein the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0040] Furthermore, before the receiving device sends the target user's password-free login key in an encrypted transmission manner, the method further includes:

[0041] Receiving the user name and password of the target user when logging in for the first time, sent by the device;

[0042] Returning a second token to the device based on the user name and password, so that the device obtains a PIN code set by the target user according to the second token, and associates the PIN code with a user identification of the target user;

[0043] receiving a first request for generating a password-free login key sent by the device through the second token;

[0044] generating the password-free login key according to the first request;

[0045] The password-free login key is sent to the device.

[0046] Furthermore, the first request carries the current timestamp reported by the device, the biometric identification code, the first signature, and the second token, and generating the password-free login key according to the first request specifically includes:

[0047] Obtaining a user identification of the target user from the biometric identification code;

[0048] comparing the user identification obtained from the biometric identification code with the user identification obtained from the second token to determine whether the two are consistent;

[0049] In response to the two being consistent, determining whether the difference between the current timestamp reported by the device and the current timestamp on the cloud exceeds a preset threshold;

[0050] If the difference between the current timestamp reported by the device and the current timestamp on the cloud does not exceed a preset threshold, the first signature is verified using the public key of the device;

[0051] In response to the first signature verification being passed, the biometric identification code is concatenated with a random number to generate an M value and a corresponding validity period, where the M value is a key for symmetric encryption;

[0052] Encrypt the M value using the public key of the device to generate a K value;

[0053] The sending the password-free login key to the device specifically includes:

[0054] The K value is sent to the device.

[0055] Furthermore, the target user's password-free login key sent by the receiving device in an encrypted transmission manner specifically includes:

[0056] Receiving the K value, the first ciphertext, the second signature and the device number sent by the device;

[0057] The verifying the validity period of the password-free login key specifically includes:

[0058] Searching for a corresponding M value according to the received K value;

[0059] According to the validity period corresponding to the found M value, determine whether the M value is within the validity period, and if so, determine that the verification is passed;

[0060] The determining whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generating a first token according to the user identifier and sending the token to the device specifically includes:

[0061] Finding a corresponding biometric identification code according to the found M value, and encrypting the found biometric identification code using the found M value to obtain a second ciphertext;

[0062] comparing whether the second ciphertext is consistent with the first ciphertext, and if they are consistent, verifying the second signature using the public key of the device;

[0063] In response to the second signature verification being passed, determining whether the received device number is consistent with a pre-stored device number corresponding to the device;

[0064] If the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

[0065] Furthermore, the method further comprises:

[0066] receiving a second request sent by the device for deleting the password-free login key, where the second request carries the first token and the K value;

[0067] parsing a user identifier from the first token;

[0068] Find the user ID corresponding to the received K value;

[0069] The parsed user ID is compared with the found user ID to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0070] In a third aspect, the present invention provides a password-free login device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the password-free login method described in the first aspect or the second aspect above.

[0071] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the password-free login method described in the first aspect or the second aspect is implemented.

[0072] The present invention provides a password-free login method, device and readable storage medium. First, the device obtains the personal identification code PIN code entered by the target user when it is not the first login; and verifies the PIN code; and in response to the PIN code verification passing, obtains the password-free login key corresponding to the target user, wherein the password-free login key is generated based on the biometric identification code, and the biometric identification code is generated according to the device number of the device and the user identification of the target user; then the device sends the password-free login key to the cloud through an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code after the verification passes, and if so, generates a first token according to the user identification and sends it to the device; finally, the device receives the first token sent by the cloud, and the first token is used to indicate that the target user has successfully logged in using the password-free login key. This application binds the password-free login key to the device number and user ID. During the transmission process, the request is sent in an encrypted transmission method, so as to prevent the request from being intercepted and subjected to replay attacks or brute force cracking. At the same time, the cloud will verify the relationship between the password-free login key and the biometric code every time. In addition, each time the password-free account is switched, the user needs to enter the set pin code to ensure that it is he who is switching, thereby improving security and solving the problems of existing password-free login methods that the request may be intercepted and subjected to replay attacks, or the key may be brute force cracked. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 This is a flow chart of a password-free login method according to Embodiment 1 of the present invention;

[0074] Figure 2 This is a flowchart of the first login and subsequent password-free login of a user in an embodiment of the present invention;

[0075] Figure 3A flow chart of generating a password-free login key for a device according to an embodiment of the present invention;

[0076] Figure 4 This is a flowchart of a password-free login according to an embodiment of the present invention;

[0077] Figure 5 This is a flowchart of deleting a password-free login key according to an embodiment of the present invention;

[0078] Figure 6 This is a schematic diagram of the structure of a password-free login device according to Embodiment 2 of the present invention;

[0079] Figure 7 This is a schematic diagram of the structure of a password-free login device according to Example 3 of the present invention. DETAILED DESCRIPTION

[0080] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0081] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0082] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0083] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0084] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0085] It can be understood that the terms "first", "second", etc. in the embodiments of the present invention are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0086] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0087] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0088] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0089] Embodiment 1:

[0090] This embodiment provides a password-free login method, which is applied to a device such as Figure 1 As shown, the method includes:

[0091] Step S101: Obtain the PIN (Personal Identification Number) code entered by the target user when it is not the first time to log in;

[0092] In this embodiment, when switching accounts without a password, in order to ensure that it is the person making the switch, the device will pop up a PIN code input box. When the target user enters the PIN code, the device receives the PIN code entered by the target user. The target user will set the corresponding PIN code when logging in for the first time. This step is not the first login for the target user.

[0093] Optionally, before obtaining a personal identification code (PIN) input by the target user when the target user logs in for a non-first time, the method further includes:

[0094] Receive the user name and password of the target user when logging in for the first time;

[0095] Sending the username and password to the cloud;

[0096] Receive a second token returned by the cloud based on the user name and password;

[0097] Acquire a PIN code set by the target user according to the second token, and associate the PIN code with a user identification of the target user;

[0098] Sending a first request for generating a password-free login key to the cloud through the second token, so that the cloud generates the password-free login key according to the first request;

[0099] Receive the password-free login key sent by the cloud.

[0100] In this embodiment, the target user enters a user name and password when logging in for the first time, and the device logs in to the cloud using the user name and password. The cloud returns a second token to the device based on the user name and password. The device obtains the pin code set by the target user according to the second token, and associates and stores the pin code with the user identification or user account of the target user. The device sends a first request for generating a password-free login key to the cloud through the second token, and the cloud generates the password-free login key according to the first request; and sends the password-free login key to the device. The device saves the password-free login key.

[0101] The pin code set by user A may be 4 to 8 digits, preferably 4 digits. The user identifier is used to uniquely identify a user, for example, the user identifier may be a user ID.

[0102] Optionally, sending a first request for generating a password-free login key to the cloud through the second token specifically includes:

[0103] generating the biometric identification code according to the device number of the device and the user identification of the target user;

[0104] Generate a first character string according to the biometric identification code and a current timestamp;

[0105] Encrypting the first character string;

[0106] Using the private key of the device to sign the encrypted first character string to generate a first signature;

[0107] Sending the current timestamp, the biometric identification code, the first signature and the second token to the cloud to request generation of a password-free login key;

[0108] The receiving the password-free login key sent by the cloud specifically includes:

[0109] Receive the K value sent by the cloud, where the K value is generated by the cloud concatenating the biometric identification code with a random number to generate an M value and a corresponding validity period, and then encrypting the M value using the public key of the device, wherein the M value is a symmetric encryption key.

[0110] In this embodiment, the device can perform Base64 encryption on its own device number and the user ID of the target user to generate a biometric identification code (FDI). The biometric identification code may also include other information of the device, such as the device type, device model, etc. Among them, the device number refers to a string similar to UUID (Universally Unique Identifier) ​​and is used to uniquely identify a device.

[0111] In this embodiment, by concatenating the biometric identification code and the current timestamp to generate a first character string, the device can encrypt the first character string using MD5 (Message-Digest Algorithm 5), and then use the device's private key to sign the encrypted first character string to generate a first signature, wherein the device's private key and public key are pre-generated using RSA (Ron Rivest, Adi Shamir, Leonard Adleman, asymmetric encryption algorithm).

[0112] In this embodiment, the device can send the encrypted device public key while sending the current timestamp, biometric identification code, first signature and second token to the cloud. Specifically, the public key of the device can be encrypted with the public key of the cloud to obtain the encrypted device public key.

[0113] In this embodiment, after the cloud receives the first request for generating a password-free login key sent by the device through the second token, it first obtains the user identification of the target user from the biometric identification code; then compares the user identification obtained from the biometric identification code with the user identification obtained from the second token to determine whether the two are consistent; in response to the consistency of the two, it determines whether the difference between the current timestamp reported by the device and the current timestamp of the cloud exceeds a preset threshold (for example, 10s); if the difference between the current timestamp reported by the device and the current timestamp of the cloud does not exceed the preset threshold, the first signature is verified using the public key of the device; and in response to the first signature verification passing, the biometric identification code is concatenated with a random number to generate an M value and a corresponding validity period, and the M value is a symmetric encryption key; the M value is then encrypted using the public key of the device to generate a K value; and finally, the K value is sent to the device. The device associates the K value with the user identification and stores it in the local storage space, so that the corresponding K value can be obtained for login in the subsequent password-free login.

[0114] Step S102: verify the pin code.

[0115] In this embodiment, the device verifies the PIN code according to the stored association relationship between the PIN code and the user identification, and the verification passes if the PIN code exists locally.

[0116] Step S103: In response to the pin code verification being passed, obtaining a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user.

[0117] In this embodiment, the password-free login key is the K value. The device obtains the password-free login key corresponding to the target user based on the association between the pin code and the user identification, the association between the K value and the user identification, or the pre-stored association between the three.

[0118] It should be noted that the PIN codes of different users on the device cannot be repeated. For subsequent logins, only the PIN code is needed to find the corresponding user's password-free login key.

[0119] Step S104: Send the password-free login key to the cloud via encrypted transmission, so that the cloud can verify the validity period of the password-free login key, and after the verification is passed, further determine whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, generate a first token based on the user identifier and send it to the device.

[0120] It should be noted that information of multiple users can be stored on one device, so the device can store corresponding password-free login keys according to different user IDs and load them when logging in. In order to ensure the security of the password-free login process and prevent it from being captured and cracked, the transmission of the password-free login key is also encrypted.

[0121] Optionally, sending the password-free login key to the cloud in an encrypted transmission manner specifically includes:

[0122] Decrypting the K value based on the private key of the device to obtain the M value;

[0123] Encrypt the biometric identification code using the M value to generate a first ciphertext;

[0124] Concatenate the first ciphertext and the M value to generate a second character string;

[0125] Encrypt the second character string using the message digest algorithm version 5 MD5 encryption method to generate a third character string;

[0126] Sign the third character string using the private key of the device to generate a second signature;

[0127] The K value, the first ciphertext, the second signature, and the device number are sent to the cloud.

[0128] In this embodiment, because the K value is encrypted by the cloud according to the public key of the device, the private key of the device can be decrypted. Since the M value is a symmetric encryption key, the biometric identification code is encrypted using the M value to generate a first ciphertext, and then the first ciphertext and the M value are concatenated to generate a second string, which cannot be decrypted after being encrypted with MD5, and finally the third string is signed with the private key generated by the device.

[0129] In this embodiment, after the cloud receives the K value, the first ciphertext, the second signature and the device number sent by the device, it first searches for the corresponding M value according to the received K value; based on the validity period corresponding to the found M value, it determines whether the M value is within the validity period. If so, it determines that the verification is successful; otherwise, it determines that the verification is unsuccessful; then, the cloud searches for the corresponding biometric identification code according to the found M value, and uses the found M value to encrypt the found biometric identification code to obtain a second ciphertext; compares whether the second ciphertext is consistent with the first ciphertext, and if so, uses the public key of the device to verify the second signature; in response to the second signature verification being successful, it determines whether the received device number is consistent with the pre-stored device number corresponding to the device; if the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

[0130] It should be noted that when the cloud generates the first token based on the user identifier, it can also generate a refresh token. The subsequent device can use the first token to communicate with the cloud. The token will also have a validity period and can be refreshed with the refresh token.

[0131] Step S105: receiving a first token sent by the cloud, where the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0132] In this embodiment, having the token is equivalent to the target user successfully logging in to the device and having the operation authority.

[0133] Optionally, the method further comprises:

[0134] A second request for deleting the password-free login key is sent to the cloud, the second request carries the first token and the K value, the second request is used to trigger the cloud to parse the user identifier from the first token, and search for the user identifier corresponding to the received K value, and compare the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, deleting the password-free login key.

[0135] In this embodiment, the device generally stores the password-free login keys of multiple users. However, due to the limited storage space of the device, it is impossible to add users indefinitely. The device can add or delete the user's password-free login keys according to its own defined policies. Therefore, the cloud also provides an unbinding interface for clearing the cloud user's password-free login keys.

[0136] Specifically, the device carries the first token and K value obtained by the user login to access the unbinding interface of the cloud. After the cloud receives the second request sent by the device to delete the password-free login key, it parses the user identifier from the first token; searches for the user identifier corresponding to the received K value; compares the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, delete the password-free login key.

[0137] It should be noted that the password-free login method provided by the present invention binds the key to the hardware device number and adds key validity verification. In the transmission process, AES (Advanced Encryption Standard) and RSA algorithm encryption are applied to prevent the request from being intercepted for replay attack or brute force cracking. Specifically, it has the following characteristics:

[0138] a) The key saved by the client (i.e. the device) has an expiration date and needs to be regenerated beyond the expiration date. The server (i.e. the cloud) will check whether the key has expired when logging in without a password;

[0139] b) When generating the key for password-free client login, you need to bring the device number of the hardware device. At the same time, you need to report the hardware number every time you log in. The cloud will verify the relationship between the key and the device number every time. Every time you switch the password-free account, you need to enter the pin code set by the user to ensure that it is you who is switching.

[0140] In a specific embodiment, taking the target user as user A and the user identifier as user ID as an example, the password-free login method involves two parts: generation of a password-free login key of a client (ie, a device) and password-free login. Figure 2 A flowchart for the user's first login and subsequent password-free logins, including:

[0141] (1) User A enters the user password to log in to the device for the first time.

[0142] (2) The device logs in to the cloud using its username and password.

[0143] (3) The cloud returns token tokenA to the device.

[0144] (4) User A sets a 4-digit PIN (Personal Identification Number).

[0145] (5) The device associates user A’s PIN code with the user ID and saves it.

[0146] (6) The device requests the cloud interface to generate a password-free login key A through tokenA.

[0147] (7) The cloud returns the password-free login key A to the device.

[0148] (8) The device saves the password-free login key A.

[0149] (9) User B enters the user password to log in to the device for the first time.

[0150] (10) The device logs in to the cloud using its username and password.

[0151] (11) The cloud returns token B to the device.

[0152] (12) User B sets a 4-digit PIN code.

[0153] (13) The device associates user B’s PIN code with the user ID and saves it.

[0154] (14) The device requests the cloud interface to generate password-free login key B through tokenB.

[0155] (15) The cloud returns the password-free login key B to the device.

[0156] (16) The device saves the password-free login key B.

[0157] (17) The user switches to user A’s login device.

[0158] (18) The device pops up a PIN code input box.

[0159] (19) The user enters a PIN code.

[0160] (20) The device verifies whether the PIN code is correct.

[0161] (21) The device uses password-free login key A to log in to the cloud.

[0162] (22) Cloud login is successful and a token is returned to the device.

[0163] like Figure 2 As shown in the figure, after the user logs in for the first time, the device will determine whether there is a local pin code set by the user. If no pin code has been set, the user will be prompted to set a 4-digit pin code, which will then be saved in the local cache of the device. When the user subsequently switches accounts, they need to enter the pin code first and compare it with the local data. If the comparison is successful, the password-free login operation will be performed. It should be noted that as long as the user has set up password-free login and has not unbound the account, the pin code can be used for password-free login.

[0164] When the user is logged in, the device will automatically request the cloud to generate a password-free login key for the corresponding user. When the user logs in without a password later, he will find the corresponding password-free login key to log in.

[0165] It should be noted that Figure 2 In the example, tokenA and tokenB are the tokens returned by the cloud when user A and user B enter their passwords for the first time; the token in the last step is the token returned after password-free login. The functions are the same, but the generation method is different, just like the difference between password login and mobile phone number login. The role of token is an authentication verification when the user operates the device function. The token proves that the user is currently logged in.

[0166] 1. The process of generating a password-free login key on the device

[0167] Prerequisite: The cloud generates an RSA key pair, public key pubC and private key priC, and writes the public key C to the device for storage, while the private key C is maintained by the cloud itself.

[0168] The process of generating a password-free login key for the device is as follows: Figure 3 As shown, including:

[0169] (1) The device generates a biometric code based on its own device number and user information, which can also include other device information, such as {"deviceType":"device type","uid":"user ID","deviceId":"device id","deviceModel":"device model"}, and then encrypts the above information with Base64 to generate a biometric code FDI;

[0170] The device number is a string similar to a UUID (Universal Unique Identifier), for example: XURO021821. The device type, such as a barcode scanner, refers to the type of device. The device model, such as 20241001R, refers to the model of different batches.

[0171] (2) The device generates a key pair, public key pubA and private key priA, according to the method provided by RSA;

[0172] (3) The device needs to generate a signature string sign. First, it needs to obtain the current timestamp timeA, then concatenate the biometric identification code FDI and the timestamp timeA in step (1) to generate the string unsign, then perform md5 encryption, and finally use the RSA private key priA in step (2) to sign the string unsign to generate the string sign;

[0173] (4) Use the public key pubA generated in step (2) to encrypt the public key pubC sent by the cloud to generate the string pubSign, and then send the current timestamp timeA, biometric identification code FDI, pubSign, sign and the user's token (the first password login to the cloud will return a token, i.e. tokenA) to the cloud for authentication to obtain the key for password-free login;

[0174] (5) The cloud decrypts the FDI information through Base64, obtains the user's device number and user ID (i.e., uid), and obtains the user's id from the user's token, and compares whether the values ​​of the two ids are consistent. If they are inconsistent, an error is reported;

[0175] It should be noted that every time you log in, the cloud will generate a token and save the relationship between the token and the user, so you can know which user it is based on the token.

[0176] (6) The cloud needs to obtain the public key actively generated by the device, and needs to use the cloud's private key pubC to decrypt pubSign and obtain the device's public key pubA;

[0177] (7) Determine whether the timestamp reported by the device differs from the timestamp on the cloud by more than 10 seconds. If so, the request is intercepted directly. The cloud verifies the signature of the request using pubA in step (6). If the signature is incorrect, an error is reported.

[0178] (8) The above biometric identification code FDI is concatenated with a random number to generate the value M, which is the key for symmetric encryption (AES key). At the same time, the validity period needs to be set for the M value and saved in the database;

[0179] For example, FDI is 1324kakdhk, which can be followed by adfkjah, where M is the AES key.

[0180] (9) Use the device's public key pubA to encrypt the M value, generate the K value, and save it;

[0181] (10) The cloud saves the K value and returns the K value and validity period to the device;

[0182] (11) The device saves the validity period and K value, associates them with the user ID and stores them in the local storage space. When logging in without a password, the device uses the corresponding K value to log in.

[0183] 2. Password-free login process

[0184] A device can store information of multiple users, so the device can store corresponding password-free login keys according to different user IDs and load them when logging in. In order to ensure the security of the password-free login process and prevent it from being captured and cracked, the transmission of the password-free login key is also encrypted. Figure 4 The flowchart for password-free login includes:

[0185] (1) The device finds the K value of the corresponding user by loading the cache locally. The K value is the password-free login key generated in the above process;

[0186] (2) The device decrypts the K value through priA when generating the password-free login key to obtain the M value. Because the K value is encrypted by the cloud based on pubA provided by the device, priA can be decrypted;

[0187] (3) Encrypt the biometric identifier FDI using the value M to generate the ciphertext F;

[0188] (4) Concatenate the ciphertext F and M values ​​to generate a string fm, encrypt fm using the md5 encryption method, and generate a string fm5. After being encrypted with md5, it cannot be decrypted. Finally, the string fm5 is signed using the priA generated by the device to generate a signature sign, which is then verified by the cloud to ensure that the string has not been tampered with during the process.

[0189] (5) Request the cloud login interface with the K value, ciphertext F, signature sign, and device number;

[0190] (6) The cloud finds the M value in the database based on the K value and queries the validity period of the key. If it has expired or the M value cannot be found based on the K value, an error is returned;

[0191] (7) The cloud queries the database for the FDI value based on the queried M value, and encrypts the F value based on the M value to obtain the encrypted data F1. The ciphertext F1 is compared with the ciphertext F data to see if they are consistent. If they are inconsistent, an error is reported.

[0192] The database not only stores the corresponding relationship between the user ID and the K value, but also stores the corresponding relationship between the K value and the FDI value.

[0193] (8) Use the public key pubA to verify the signature sign. If the verification fails, an error is reported;

[0194] (9) Compare the device data in the request header and the cloud storage data to see if they are consistent. If they are inconsistent, an error is reported;

[0195] (10) If all verifications are passed, a token and refresh token refreshToken are generated based on the user ID. The device can subsequently use the token to communicate with the cloud. The token also has an expiration date and needs to be refreshed with refreshToken.

[0196] It should be noted that having a token is equivalent to the user successfully logging in to the device and having operation permissions. The token is generally valid for 2 hours, and the refresh token is generally valid for one month. When the token expires, the device can obtain a new token based on the refresh token, and the user is unaware of it. When the user generates a new token, the original token will become invalid.

[0197] 3. Deletion process of password-free login key

[0198] The device generally stores multiple users' password-free login keys. However, due to the limited storage space of the device, it is impossible to add users indefinitely. The device can add or delete users' password-free login keys according to its own defined policies. Therefore, the cloud also provides an unbinding interface to clear the cloud user's password-free login keys, such as Figure 5 As shown in the figure, the process of deleting the password-free login key includes:

[0199] (1) The device accesses the unbinding interface of the cloud with the token and K value obtained by the user login;

[0200] (2) The cloud parses the user's ID based on the user's token, and finds the user's ID in the database based on the K value, and compares the two IDs to see if they are consistent. If they are inconsistent, an error is reported;

[0201] (3) The data verification passed and the password-free login key was successfully released.

[0202] Among them, after the password-free login key is successfully released, the device's local cache will clear the data related to the PIN code, and the user will not be able to log in without a password by entering the PIN code.

[0203] It should be noted that the password-free login method provided by the present invention is optimized for the password-free login requirements of hardware devices, and uses AES and RSA encryption algorithms to optimize the storage of the password-free login key on the device side, and uses the device number of the device to bind the password-free login key. At the same time, the validity period of the key is set to prevent it from being stolen and used at will. The data generated each time you log in is signed by the RSA private key in the device cache, so the data is different each time you request. Its innovations are:

[0204] 1. When switching accounts, users need to enter a PIN code to confirm their identity, and use the device number for secondary verification to ensure that the password-free login key is obtained and the password-free login is performed by the current user of the current device.

[0205] 2. Set an validity period for the key for password-free login. Each key has a time limit, and the device needs to generate a new key in the cloud regularly to improve security.

[0206] The key generation combines Base64, AES, RSA and other algorithms, and utilizes the user's information in the token to prevent the password-free login key from being obtained at will. At the same time, it is encrypted using RSA keys and AES during the login process. Different data is generated and signed each time to prevent malicious interception or brute force cracking during transmission.

[0207] The password-free login method provided by an embodiment of the present invention first obtains, by a device, a personal identification code (PIN) input by a target user when it is not the first time logging in; and verifies the PIN code; and in response to the PIN code verification being passed, obtains a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user; then the device sends the password-free login key to the cloud via an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and after the verification is passed, further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generates a first token based on the user identification and sends it to the device; finally, the device receives the first token sent by the cloud, and the first token is used to indicate that the target user has successfully logged in using the password-free login key. This application binds the password-free login key to the device number and user ID. During the transmission process, the request is sent in an encrypted transmission method, so as to prevent the request from being intercepted and subjected to replay attacks or brute force cracking. At the same time, the cloud will verify the relationship between the password-free login key and the biometric code every time. In addition, each time the password-free account is switched, the user needs to enter the set pin code to ensure that it is he who is switching, thereby improving security and solving the problems of existing password-free login methods that the request may be intercepted and subjected to replay attacks, or the key may be brute force cracked.

[0208] Embodiment 2:

[0209] like Figure 6 As shown, this embodiment provides a password-free login method, which is applied to the cloud, and the method includes:

[0210] Step S201: receiving a target user's password-free login key sent by a device in an encrypted transmission manner, wherein the password-free login key is obtained by the device from a personal identification code (PIN) input by the target user when the target user logs in for a non-first time, and the PIN is verified, and in response to the PIN being verified, the password-free login key corresponding to the target user is obtained and sent, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user;

[0211] In this embodiment, when switching between password-free accounts, in order to ensure that it is the person himself who makes the switch, the device will pop up a PIN code input box. When the target user enters the PIN code, the device receives the PIN code entered by the target user, where the target user sets the corresponding PIN code when logging in for the first time. After the device obtains the PIN code entered by the target user when it is not the first time logging in, the device verifies the PIN code, and when the PIN code verification passes, obtains the password-free login key corresponding to the target user, and sends the password-free login key to the cloud via encrypted transmission.

[0212] Optionally, before the receiving device sends the target user's password-free login key in an encrypted transmission manner, the method further includes:

[0213] Receiving the user name and password of the target user when logging in for the first time, sent by the device;

[0214] Returning a second token to the device based on the user name and password, so that the device obtains a PIN code set by the target user according to the second token, and associates the PIN code with a user identification of the target user;

[0215] receiving a first request for generating a password-free login key sent by the device through the second token;

[0216] generating the password-free login key according to the first request;

[0217] The password-free login key is sent to the device.

[0218] In this embodiment, the target user enters a username and password when logging in for the first time, and the device logs in to the cloud using the username and password. The cloud returns a second token to the device based on the username and password. The device obtains the pin code set by the target user according to the second token, and stores the pin code in association with the user identification or user account of the target user. The device sends a first request for generating a password-free login key to the cloud through the second token, and the cloud generates the password-free login key according to the first request; and sends the password-free login key to the device. The device saves the password-free login key. Among them, the pin code set by user A can be 4 to 8 digits, preferably 4 digits. The user identification is used to uniquely identify a user. For example, the user identification can be a user ID.

[0219] Optionally, the first request carries the current timestamp reported by the device, the biometric identification code, the first signature, and the second token, and generating the password-free login key according to the first request specifically includes:

[0220] Obtaining a user identification of the target user from the biometric identification code;

[0221] comparing the user identification obtained from the biometric identification code with the user identification obtained from the second token to determine whether the two are consistent;

[0222] In response to the two being consistent, determining whether the difference between the current timestamp reported by the device and the current timestamp on the cloud exceeds a preset threshold;

[0223] If the difference between the current timestamp reported by the device and the current timestamp on the cloud does not exceed a preset threshold, the first signature is verified using the public key of the device;

[0224] In response to the first signature verification being passed, the biometric identification code is concatenated with a random number to generate an M value and a corresponding validity period, where the M value is a key for symmetric encryption;

[0225] Encrypt the M value using the public key of the device to generate a K value;

[0226] The sending the password-free login key to the device specifically includes:

[0227] The K value is sent to the device.

[0228] In this embodiment, the first request carries the current timestamp reported by the device, the biometric identification code, the first signature, and the second token. The first request is generated by the device according to the device number of the device and the user ID of the target user, and after generating a first string according to the biometric identification code and the current timestamp, the first string is encrypted, and the encrypted first string is signed with the private key of the device to generate a first signature and then sent.

[0229] Optionally, the receiving device sends the target user's password-free login key in an encrypted transmission manner, specifically including:

[0230] Receiving the K value, the first ciphertext, the second signature and the device number sent by the device;

[0231] The verifying the validity period of the password-free login key specifically includes:

[0232] Searching for a corresponding M value according to the received K value;

[0233] According to the validity period corresponding to the found M value, determine whether the M value is within the validity period, and if so, determine that the verification is passed;

[0234] The determining whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generating a first token according to the user identifier and sending the token to the device specifically includes:

[0235] Finding a corresponding biometric identification code according to the found M value, and encrypting the found biometric identification code using the found M value to obtain a second ciphertext;

[0236] comparing whether the second ciphertext is consistent with the first ciphertext, and if they are consistent, verifying the second signature using the public key of the device;

[0237] In response to the second signature verification being passed, determining whether the received device number is consistent with a pre-stored device number corresponding to the device;

[0238] If the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

[0239] In this embodiment, the cloud receives the K value, the first ciphertext, the second signature and the device number sent by the device, wherein the first ciphertext is generated by the device decrypting the K value based on the private key of the device to obtain the M value, and then encrypting the biometric identification code with the M value; the second signature is generated by the device concatenating the first ciphertext and the M value to generate a second character string, and encrypting the second character string using the message digest algorithm version 5 MD5 encryption method, and after generating the third character string, the third character string is signed using the private key of the device.

[0240] Step S202: verifying the validity period of the password-free login key;

[0241] Step S203: In response to the verification being successful, further determine whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, generate a first token based on the user identifier and send it to the device; wherein the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0242] It should be noted that when the cloud generates the first token based on the user identifier, it can also generate a refresh token. The subsequent device can use the first token to communicate with the cloud. The token will also have a validity period and can be refreshed with the refresh token.

[0243] In this embodiment, having the token is equivalent to the target user successfully logging in to the device and having the operation authority.

[0244] Optionally, the method further comprises:

[0245] receiving a second request sent by the device for deleting the password-free login key, where the second request carries the first token and the K value;

[0246] parsing a user identifier from the first token;

[0247] Find the user ID corresponding to the received K value;

[0248] The parsed user ID is compared with the found user ID to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0249] In this embodiment, the device generally stores the password-free login keys of multiple users. However, due to the limited storage space of the device, it is impossible to add users indefinitely. The device can add or delete the user's password-free login keys according to its own defined policies. Therefore, the cloud also provides an unbinding interface for clearing the cloud user's password-free login keys.

[0250] Specifically, the device carries the first token and K value obtained by the user login to access the unbinding interface of the cloud. After the cloud receives the second request sent by the device to delete the password-free login key, it parses the user identifier from the first token; searches for the user identifier corresponding to the received K value; compares the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, delete the password-free login key.

[0251] Embodiment 3:

[0252] refer to Figure 7 This embodiment provides a password-free login device, including a memory 21 and a processor 22. The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the password-free login method in Example 1 or Example 2.

[0253] The memory 21 is connected to the processor 22. The memory 21 may be a flash memory, a read-only memory or other memory. The processor 22 may be a central processing unit or a single-chip microcomputer.

[0254] Embodiment 4:

[0255] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the password-free login method in the above-mentioned embodiment 1 or embodiment 2 is implemented.

[0256] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0257] To summarize, the password-free login method, device and readable storage medium provided by the embodiments of the present invention first obtain, by the device, a personal identification code (PIN) input by the target user when it is not the first login; and verify the PIN code; and in response to the PIN code verification being passed, obtain the password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user; then the device sends the password-free login key to the cloud via an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and after the verification is passed, further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generates a first token based on the user identification and sends it to the device; finally, the device receives the first token sent by the cloud, and the first token is used to indicate that the target user has successfully logged in using the password-free login key. This application binds the password-free login key to the device number and user ID. During the transmission process, the request is sent in an encrypted transmission method, so as to prevent the request from being intercepted and subjected to replay attacks or brute force cracking. At the same time, the cloud will verify the relationship between the password-free login key and the biometric code every time. In addition, each time the password-free account is switched, the user needs to enter the set pin code to ensure that it is he who is switching, thereby improving security and solving the problems of existing password-free login methods that the request may be intercepted and subjected to replay attacks, or the key may be brute force cracked.

[0258] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A password-free login method, characterized in that: Applied to a device, the method comprises: Get the personal identification code PIN entered by the target user when it is not the first time to log in; Verifying the pin code; In response to the PIN code verification being passed, obtaining a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on a device number of the device and a user identifier of the target user; Sending the password-free login key to the cloud in an encrypted transmission manner, so that the cloud verifies the validity period of the password-free login key, and further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code after the verification is passed, and if so, generates a first token according to the user identifier and sends it to the device; A first token sent by the cloud is received, where the first token is used to indicate that the target user has successfully logged in using the password-free login key.

2. The method according to claim 1, characterized in that: Before obtaining the personal identification code (PIN) input by the target user when not logging in for the first time, the method further includes: Receive the user name and password of the target user when logging in for the first time; Sending the username and password to the cloud; Receive a second token returned by the cloud based on the user name and password; Acquire a PIN code set by the target user according to the second token, and associate the PIN code with a user identification of the target user; Sending a first request for generating a password-free login key to the cloud through the second token, so that the cloud generates the password-free login key according to the first request; Receive the password-free login key sent by the cloud.

3. The method according to claim 2, characterized in that The sending, by using the second token, a first request for generating a password-free login key to the cloud specifically includes: generating the biometric identification code according to the device number of the device and the user identification of the target user; Generate a first character string according to the biometric identification code and a current timestamp; Encrypting the first character string; Using the private key of the device to sign the encrypted first character string to generate a first signature; Sending the current timestamp, the biometric identification code, the first signature and the second token to the cloud to request generation of a password-free login key; The receiving the password-free login key sent by the cloud specifically includes: Receive the K value sent by the cloud, where the K value is generated by the cloud concatenating the biometric identification code with a random number to generate an M value and a corresponding validity period, and then encrypting the M value using the public key of the device, wherein the M value is a symmetric encryption key.

4. The method according to claim 3, characterized in that The step of sending the password-free login key to the cloud in an encrypted transmission manner specifically includes: Decrypting the K value based on the private key of the device to obtain the M value; Encrypting the biometric identification code using the M value to generate a first ciphertext; Concatenate the first ciphertext and the M value to generate a second character string; Encrypt the second character string using the message digest algorithm version 5 MD5 encryption method to generate a third character string; Sign the third character string using the private key of the device to generate a second signature; The K value, the first ciphertext, the second signature, and the device number are sent to the cloud.

5. The method according to claim 3, characterized in that: The method further comprises: A second request for deleting the password-free login key is sent to the cloud, the second request carries the first token and the K value, the second request is used to trigger the cloud to parse the user identifier from the first token, and search for the user identifier corresponding to the received K value, and compare the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, deleting the password-free login key.

6. A password-free login method, characterized in that: Applied to the cloud, the method includes: The receiving device sends a target user's password-free login key in an encrypted transmission manner, wherein the password-free login key is obtained by the device after obtaining a personal identification code (PIN) input by the target user when the target user logs in for a non-first time, and verifying the PIN, and obtaining the password-free login key corresponding to the target user in response to the PIN verification being passed, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user; Verifying the validity period of the password-free login key; In response to the verification being successful, it is further determined whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, a first token is generated based on the user identifier and sent to the device; wherein the first token is used to indicate that the target user has successfully logged in using the password-free login key.

7. The method according to claim 6, characterized in that Before the receiving device transmits the target user's password-free login key in an encrypted manner, the method further includes: Receiving the user name and password of the target user when logging in for the first time, sent by the device; Returning a second token to the device based on the user name and password, so that the device obtains a PIN code set by the target user according to the second token, and associates the PIN code with a user identification of the target user; receiving a first request for generating a password-free login key sent by the device through the second token; generating the password-free login key according to the first request; The password-free login key is sent to the device.

8. The method according to claim 7, characterized in that The first request carries the current timestamp reported by the device, the biometric identification code, the first signature, and the second token, and generating the password-free login key according to the first request specifically includes: Obtaining a user identification of the target user from the biometric identification code; comparing the user identification obtained from the biometric identification code with the user identification obtained from the second token to determine whether the two are consistent; In response to the two being consistent, determining whether the difference between the current timestamp reported by the device and the current timestamp on the cloud exceeds a preset threshold; If the difference between the current timestamp reported by the device and the current timestamp on the cloud does not exceed a preset threshold, the first signature is verified using the public key of the device; In response to the first signature verification being passed, the biometric identification code is concatenated with a random number to generate an M value and a corresponding validity period, where the M value is a key for symmetric encryption; Encrypt the M value using the public key of the device to generate a K value; The sending the password-free login key to the device specifically includes: The K value is sent to the device.

9. The method according to claim 8, characterized in that The target user's password-free login key sent by the receiving device in an encrypted transmission manner specifically includes: Receiving the K value, the first ciphertext, the second signature and the device number sent by the device; The verifying the validity period of the password-free login key specifically includes: Searching for a corresponding M value according to the received K value; According to the validity period corresponding to the found M value, determine whether the M value is within the validity period, and if so, determine that the verification is passed; The determining whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generating a first token according to the user identifier and sending the token to the device specifically includes: Finding a corresponding biometric identification code according to the found M value, and encrypting the found biometric identification code using the found M value to obtain a second ciphertext; comparing whether the second ciphertext is consistent with the first ciphertext, and if they are consistent, verifying the second signature using the public key of the device; In response to the second signature verification being passed, determining whether the received device number is consistent with a pre-stored device number corresponding to the device; If the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

10. The method according to claim 8, characterized in that The method further comprises: receiving a second request sent by the device for deleting the password-free login key, where the second request carries the first token and the K value; parsing a user identifier from the first token; Find the user ID corresponding to the received K value; The parsed user ID is compared with the found user ID to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

11. A password-free login device, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the password-free login method as described in any one of claims 1-5, or to implement the password-free login method as described in any one of claims 6-10.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the password-free login method according to any one of claims 1 to 5 is implemented, or the password-free login method according to any one of claims 6 to 10 is implemented.

Images