A password-free login method, device and readable storage medium

Abstract

The present invention provides a password-free login method, device, and readable storage medium, relating to the field of network technology. The method includes: obtaining a personal identification code (PIN) code entered by a target user when it is not the first time to log in; verifying the PIN code; in response to the PIN code being verified, obtaining a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user; sending the password-free login key to the cloud via an encrypted transmission method; receiving a first token sent by the cloud, the first token being used to indicate that the target user has successfully logged in using the password-free login key. The method, device, and readable storage medium can solve the problems of existing password-free login methods, such as requests that may be intercepted and subjected to replay attacks, or keys that may be brute-force cracked.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a password-free login method, device and readable storage medium. Background Art

[0002] In modern workshops and factories, more and more devices require login and account switching. Facial recognition, like mobile phone login, requires installing cameras or other hardware, which is expensive. Simply storing a key on the client side can be easily intercepted and cracked, so encryption between the client and the cloud is essential. This ensures that the data used for each password-free login is unique and cannot be used even if it is obtained.

[0003] Currently, the mainstream password-free login method is to save a key on the client and pass it to the server to verify consistency during login. However, this method has some security risks, such as the request may be intercepted and subjected to replay attacks, or the key may be cracked by brute force. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the existing technology and provide a password-free login method, device and readable storage medium to solve the problems in the existing password-free login method that requests may be intercepted and subjected to replay attacks, or keys may be cracked by brute force.

[0005] In the first aspect, the present invention provides a password-free login method, which is applied to a device.

[0006] The methods include:

[0007] Obtain the personal identification code (PIN) entered by the target user when it is not the first login;

[0008] Verifying the PIN code;

[0009] In response to the PIN code verification being passed, obtaining a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on a device number of the device and a user identifier of the target user;

[0010] Sending the password-free login key to the cloud via an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code after the verification is passed. If so, generating a first token based on the user identifier and sending it to the device;

[0011] A first token sent by the cloud is received, where the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0012] Furthermore, before obtaining the personal identification code (PIN) input by the target user when the target user logs in for a non-first time, the method further includes:

[0013] Receive the username and password of the target user when logging in for the first time;

[0014] Sending the username and password to the cloud;

[0015] receiving a second token returned by the cloud based on the user name and password;

[0016] Acquire a PIN code set by the target user according to the second token, and associate the PIN code with the user identification of the target user;

[0017] sending a first request for generating a password-free login key to the cloud through the second token, so that the cloud generates the password-free login key according to the first request;

[0018] Receive the password-free login key sent by the cloud.

[0019] Furthermore, the sending of a first request for generating a password-free login key to the cloud through the second token specifically includes:

[0020] generating the biometric identification code according to the device number of the device and the user identification of the target user;

[0021] generating a first character string according to the biometric identification code and a current timestamp;

[0022] encrypting the first character string;

[0023] Signing the encrypted first character string using the private key of the device to generate a first signature;

[0024] Sending the current timestamp, the biometric identification code, the first signature, and the second token to the cloud to request generation of a password-free login key;

[0025] The receiving the password-free login key sent by the cloud specifically includes:

[0026] Receive the K value sent by the cloud, where the K value is generated by the cloud concatenating the biometric identification code with a random number to generate the M value and the corresponding validity period, and then encrypting the M value using the public key of the device, wherein the M value is a symmetric encryption key.

[0027] Furthermore, the step of sending the password-free login key to the cloud via encrypted transmission specifically includes:

[0028] Decrypting the K value based on the private key of the device to obtain the M value;

[0029] Encrypting the biometric identification code using the M value to generate a first ciphertext;

[0030] Concatenate the first ciphertext and the M value to generate a second string;

[0031] Encrypting the second character string using the Message Digest Algorithm Version 5 (MD5) encryption method to generate a third character string;

[0032] Sign the third character string using the private key of the device to generate a second signature;

[0033] The K value, the first ciphertext, the second signature, and the device number are sent to the cloud.

[0034] Furthermore, the method further comprises:

[0035] A second request for deleting the password-free login key is sent to the cloud, the second request carries the first token and the K value, and the second request is used to trigger the cloud to parse the user identifier from the first token, and search for the user identifier corresponding to the received K value, and compare the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0036] In a second aspect, the present invention provides a password-free login method, which is applied to the cloud, and the method includes:

[0037] receiving a target user's password-free login key sent by a device via encrypted transmission, the password-free login key being sent after the device obtains a personal identification code (PIN) entered by the target user when the target user logs in for a non-first time, verifies the PIN, and, in response to passing the PIN verification, obtains the corresponding password-free login key for the target user, wherein the password-free login key is generated based on a biometric identification code generated based on the device number of the device and the user identifier of the target user;

[0038] Verifying the validity period of the password-free login key;

[0039] In response to the verification being passed, it is further determined whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, a first token is generated based on the user identifier and sent to the device; wherein, the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0040] Furthermore, before the receiving device sends the target user's password-free login key in an encrypted transmission manner, the method further includes:

[0041] Receiving the user name and password of the target user when logging in for the first time, sent by the device;

[0042] Returning a second token to the device based on the user name and password, so that the device obtains a PIN code set by the target user according to the second token and associates the PIN code with the user identification of the target user;

[0043] receiving a first request for generating a password-free login key, sent by the device through the second token;

[0044] generating the password-free login key according to the first request;

[0045] The password-free login key is sent to the device.

[0046] Furthermore, the first request carries the current timestamp reported by the device, the biometric identification code, the first signature, and the second token, and generating the password-free login key according to the first request specifically includes:

[0047] Obtaining a user identification of the target user from the biometric identification code;

[0048] comparing the user identification obtained from the biometric identification code with the user identification obtained from the second token to determine whether the two are consistent;

[0049] In response to the two being consistent, determining whether the difference between the current timestamp reported by the device and the current timestamp on the cloud exceeds a preset threshold;

[0050] If the difference between the current timestamp reported by the device and the current timestamp in the cloud does not exceed a preset threshold, the first signature is verified using the public key of the device;

[0051] In response to the first signature verification being successful, the biometric identification code is concatenated with a random number to generate an M value and a corresponding validity period, where the M value is a symmetric encryption key;

[0052] Encrypt the M value using the public key of the device to generate a K value;

[0053] The sending the password-free login key to the device specifically includes:

[0054] The K value is sent to the device.

[0055] Furthermore, the receiving device sends the target user's password-free login key via encrypted transmission, specifically including:

[0056] Receiving the K value, the first ciphertext, the second signature, and the device number sent by the device;

[0057] The verification of the validity period of the password-free login key specifically includes:

[0058] Searching for the corresponding M value according to the received K value;

[0059] According to the validity period corresponding to the found M value, determine whether the M value is within the validity period, and if so, determine that the verification is successful;

[0060] The determining whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generating a first token according to the user identifier and sending the token to the device, specifically includes:

[0061] Finding a corresponding biometric identification code according to the found M value, and encrypting the found biometric identification code using the found M value to obtain a second ciphertext;

[0062] comparing the second ciphertext to the first ciphertext to determine if they are consistent; and if so, verifying the second signature using the public key of the device;

[0063] In response to the second signature verification being successful, determining whether the received device number is consistent with a pre-stored device number corresponding to the device;

[0064] If the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

[0065] Furthermore, the method further comprises:

[0066] receiving a second request sent by the device for deleting the password-free login key, where the second request carries the first token and the K value;

[0067] Parsing a user identifier from the first token;

[0068] Searching for a user identifier corresponding to the received K value;

[0069] The parsed user ID is compared with the found user ID to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0070] In a third aspect, the present invention provides a password-free login device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the password-free login method described in the first or second aspect above.

[0071] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the password-free login method described in the first or second aspect above is implemented.

[0072] The present invention provides a password-free login method, device, and readable storage medium. First, the device obtains a personal identification code (PIN) code entered by a target user when it is not the first time to log in; and verifies the PIN code; and in response to the PIN code verification being passed, obtains a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user; then the device sends the password-free login key to the cloud through an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and after the verification is passed, further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generates a first token based on the user identification and sends it to the device; finally, the device receives the first token sent by the cloud, and the first token is used to indicate that the target user has successfully logged in using the password-free login key. This application binds the password-free login key to the device number and user ID. During the transmission process, the request is sent in an encrypted transmission method, which can prevent the request from being intercepted and subjected to replay attacks or brute force cracking. At the same time, the cloud will verify the relationship between the password-free login key and the biometric identification code every time. In addition, each time the password-free account is switched, the user needs to enter the set PIN code to ensure that it is he who is switching, thereby improving security and solving the problem of existing password-free login methods that the request may be intercepted and subjected to replay attacks, or the key may be brute force cracked. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 This is a flowchart of a password-free login method according to Example 1 of the present invention;

[0074] Figure 2 This is a flowchart of a user's first login and subsequent password-free logins according to an embodiment of the present invention;

[0075] Figure 3A flowchart for generating a password-free login key for a device according to an embodiment of the present invention;

[0076] Figure 4 This is a flowchart of a password-free login according to an embodiment of the present invention;

[0077] Figure 5 This is a flowchart of deleting a password-free login key according to an embodiment of the present invention;

[0078] Figure 6 This is a schematic diagram of the structure of a password-free login device according to embodiment 2 of the present invention;

[0079] Figure 7 This is a structural diagram of a password-free login device according to Example 3 of the present invention. DETAILED DESCRIPTION

[0080] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0081] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0082] It is understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments may be combined with each other.

[0083] It can be understood that, for the convenience of description, the drawings of the present invention only show parts related to the present invention, while parts unrelated to the present invention are not shown in the drawings.

[0084] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0085] It can be understood that the terms "first", "second", etc. in the embodiments of the present invention are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0086] It will be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0087] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented using a hardware-based system that implements the specified functions, or may be implemented using a combination of hardware and computer instructions.

[0088] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0089] Example 1:

[0090] This embodiment provides a password-free login method, which is applied to devices such as Figure 1 As shown, the method includes:

[0091] Step S101: Obtain the PIN (Personal Identification Number) code entered by the target user when it is not the first time to log in;

[0092] In this embodiment, when switching accounts without a password, in order to ensure that it is the person making the switch, the device will pop up a PIN code input box. When the target user enters the PIN code, the device receives the PIN code entered by the target user. The target user will set the corresponding PIN code when logging in for the first time. This step is not the first login for the target user.

[0093] Optionally, before obtaining the personal identification code (PIN) input by the target user when the target user logs in for a non-first time, the method further includes:

[0094] Receive the username and password of the target user when logging in for the first time;

[0095] Sending the username and password to the cloud;

[0096] receiving a second token returned by the cloud based on the user name and password;

[0097] Acquire a PIN code set by the target user according to the second token, and associate the PIN code with the user identification of the target user;

[0098] sending a first request for generating a password-free login key to the cloud through the second token, so that the cloud generates the password-free login key according to the first request;

[0099] Receive the password-free login key sent by the cloud.

[0100] In this embodiment, when a target user logs in for the first time, they enter their username and password. The device logs in to the cloud using the username and password. The cloud returns a second token to the device based on the username and password. The device obtains the PIN code set by the target user based on the second token and associates and stores the PIN code with the target user's user ID or user account. The device sends a first request to the cloud using the second token to generate a password-free login key. The cloud generates the password-free login key based on the first request and sends the password-free login key to the device. The device stores the password-free login key.

[0101] The PIN code set by user A may be 4 to 8 digits, preferably 4 digits. The user identifier is used to uniquely identify a user, for example, the user identifier may be a user ID.

[0102] Optionally, the sending, by using the second token, a first request for generating a password-free login key to the cloud specifically includes:

[0103] generating the biometric identification code according to the device number of the device and the user identification of the target user;

[0104] generating a first character string according to the biometric identification code and a current timestamp;

[0105] encrypting the first character string;

[0106] Signing the encrypted first character string using the private key of the device to generate a first signature;

[0107] Sending the current timestamp, the biometric identification code, the first signature, and the second token to the cloud to request generation of a password-free login key;

[0108] The receiving the password-free login key sent by the cloud specifically includes:

[0109] Receive the K value sent by the cloud, where the K value is generated by the cloud concatenating the biometric identification code with a random number to generate the M value and the corresponding validity period, and then encrypting the M value using the public key of the device, wherein the M value is a symmetric encryption key.

[0110] In this embodiment, the device can perform Base64 encryption on its own device number and the user ID of the target user to generate a biometric identification code (FDI). The biometric identification code can also include other information of the device, such as the device type, device model, etc. Among them, the device number refers to a string similar to UUID (Universally Unique Identifier) ​​that is used to uniquely identify a device.

[0111] In this embodiment, the device may encrypt the first character string by concatenating the biometric identification code and the current timestamp, and then sign the encrypted first character string using the device's private key to generate a first signature, where the device's private key and public key are pre-generated using RSA (Ron Rivest, Adi Shamir, Leonard Adleman, asymmetric encryption algorithm).

[0112] In this embodiment, the device can send the encrypted device public key while sending the current timestamp, biometric identification code, first signature and second token to the cloud. Specifically, the device public key can be encrypted with the cloud public key to obtain the encrypted device public key.

[0113] In this embodiment, after the cloud receives a first request for generating a password-free login key from the device via the second token, it first obtains the user identifier of the target user from the biometric code; then compares the user identifier obtained from the biometric code with the user identifier obtained from the second token to determine whether the two are consistent; in response to the two being consistent, it determines whether the difference between the current timestamp reported by the device and the current timestamp on the cloud exceeds a preset threshold (e.g., 10 seconds); if the difference between the current timestamp reported by the device and the current timestamp on the cloud does not exceed the preset threshold, the first signature is verified using the public key of the device; and in response to the first signature verification being passed, the biometric code is concatenated with a random number to generate an M value and a corresponding validity period, where the M value is a symmetric encryption key; the M value is then encrypted using the public key of the device to generate a K value; and finally, the K value is sent to the device. The device associates the K value with the user identifier and stores it in local storage space so that the corresponding K value can be obtained for subsequent password-free login.

[0114] Step S102: verify the PIN code.

[0115] In this embodiment, the device verifies the PIN code according to the stored association relationship between the PIN code and the user identification. If the PIN code exists locally, the verification is successful.

[0116] Step S103: In response to the PIN code verification being passed, obtaining a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user.

[0117] In this embodiment, the password-free login key is the K value. The device obtains the password-free login key corresponding to the target user based on the association between the PIN code and the user identification, the association between the K value and the user identification, or the pre-stored association between the three.

[0118] It should be noted that the PIN codes of different users on the device cannot be repeated. For subsequent logins, only the PIN code is needed to find the corresponding user's password-free login key.

[0119] Step S104: Send the password-free login key to the cloud via encrypted transmission, so that the cloud can verify the validity period of the password-free login key, and after the verification is passed, further determine whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, generate a first token based on the user identifier and send it to the device.

[0120] It should be noted that a device can store information of multiple users, so the device can store corresponding password-free login keys according to different user IDs and load them when logging in. In order to ensure the security of the password-free login process and prevent packet capture and cracking, the transmission of the password-free login key is also encrypted.

[0121] Optionally, the step of sending the password-free login key to the cloud via encrypted transmission specifically includes:

[0122] Decrypting the K value based on the private key of the device to obtain the M value;

[0123] Encrypting the biometric identification code using the M value to generate a first ciphertext;

[0124] Concatenate the first ciphertext and the M value to generate a second string;

[0125] Encrypting the second character string using the Message Digest Algorithm Version 5 (MD5) encryption method to generate a third character string;

[0126] Sign the third character string using the private key of the device to generate a second signature;

[0127] The K value, the first ciphertext, the second signature, and the device number are sent to the cloud.

[0128] In this embodiment, because the K value is encrypted in the cloud using the device's public key, the device's private key can decrypt it. Since the M value is the symmetric encryption key, the biometric code is encrypted using the M value to generate a first ciphertext. This first ciphertext and the M value are then concatenated to generate a second string. After MD5 encryption, this string cannot be decrypted. Finally, the third string is signed using the device's private key.

[0129] In this embodiment, after the cloud receives the K value, the first ciphertext, the second signature and the device number sent by the device, it first searches for the corresponding M value based on the received K value; based on the validity period corresponding to the found M value, it determines whether the M value is within the validity period. If so, it determines that the verification is successful; otherwise, it determines that the verification is unsuccessful; then, the cloud searches for the corresponding biometric identification code based on the found M value, and uses the found M value to encrypt the found biometric identification code to obtain a second ciphertext; compares whether the second ciphertext is consistent with the first ciphertext, and if so, uses the public key of the device to verify the second signature; in response to the second signature verification being successful, it determines whether the received device number is consistent with the pre-stored device number corresponding to the device; if the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

[0130] It should be noted that when the cloud generates the first token based on the user identifier, it can also generate a refresh token. The subsequent device can use the first token to communicate with the cloud. The token will also have a validity period and can be refreshed with the refresh token.

[0131] Step S105: Receive a first token sent by the cloud, where the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0132] In this embodiment, having the token is equivalent to the target user successfully logging in to the device and having the operation authority.

[0133] Optionally, the method further includes:

[0134] A second request for deleting the password-free login key is sent to the cloud, the second request carries the first token and the K value, and the second request is used to trigger the cloud to parse the user identifier from the first token, and search for the user identifier corresponding to the received K value, and compare the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0135] In this embodiment, the device generally stores the password-free login keys of multiple users. However, due to the limited storage space of the device, it is impossible to add users indefinitely. The device can add or delete the user's password-free login keys according to its own defined policies. Therefore, the cloud also provides an unbinding interface for clearing the cloud user's password-free login keys.

[0136] Specifically, the device carries the first token and K value obtained by the user login to access the unbinding interface of the cloud. After the cloud receives the second request sent by the device to delete the password-free login key, it parses the user identifier from the first token; searches for the user identifier corresponding to the received K value; compares the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0137] It should be noted that the password-free login method provided by the present invention binds the key to the hardware device number, adds key validity verification, and applies AES (Advanced Encryption Standard) and RSA algorithm encryption during transmission to prevent requests from being intercepted and replayed or cracked by brute force. Specifically, it has the following features:

[0138] a) The key stored on the client (i.e., the device) has an expiration date and needs to be regenerated after the expiration date. The server (i.e., the cloud) will verify whether the key has expired during password-free login.

[0139] b) When generating the key for password-free client login, you need to bring the device number of the hardware device. At the same time, you need to report the hardware number every time you log in. The cloud will verify the relationship between the key and the device number every time. Every time you switch to a password-free account, you need to enter the PIN code set by the user to ensure that it is you who is switching.

[0140] In a specific embodiment, taking the target user as user A and the user identifier as user ID as an example, the password-free login method involves two parts: generating a password-free login key on the client (i.e., the device) and password-free login. Figure 2 A flowchart for the user's first login and subsequent password-free logins, including:

[0141] (1) User A enters the user password to log in to the device for the first time.

[0142] (2) The device logs in to the cloud using its username and password.

[0143] (3) The cloud returns token tokenA to the device.

[0144] (4) User A sets a 4-digit PIN (Personal Identification Number).

[0145] (5) The device associates user A’s PIN code with the user ID and saves it.

[0146] (6) The device requests the cloud interface to generate a password-free login key A through tokenA.

[0147] (7) The cloud returns the password-free login key A to the device.

[0148] (8) The device saves the password-free login key A.

[0149] (9) User B enters the user password to log in to the device for the first time.

[0150] (10) The device logs in to the cloud using its username and password.

[0151] (11) The cloud returns token tokenB to the device.

[0152] (12) User B sets a 4-digit PIN code.

[0153] (13) The device associates user B’s PIN code with the user ID and saves it.

[0154] (14) The device requests the cloud interface to generate a password-free login key B through tokenB.

[0155] (15) The cloud returns the password-free login key B to the device.

[0156] (16) The device saves the password-free login key B.

[0157] (17) The user switches to user A's login device.

[0158] (18) The device pops up a PIN code input box.

[0159] (19) The user enters a PIN code.

[0160] (20) The device verifies whether the PIN code is correct.

[0161] (21) The device uses the password-free login key A to log in to the cloud.

[0162] (22) Cloud login is successful and a token is returned to the device.

[0163] like Figure 2 As shown in the figure, after the user logs in for the first time, the device will determine whether there is a local PIN code set by the user. If no PIN code has been set, the user will be prompted to set a 4-digit PIN code, which will then be saved to the device's local cache. Subsequent users will need to enter the PIN code when switching accounts, which will be compared with the local data. If the comparison is successful, the password-free login operation will be performed. It should be noted that as long as the user has set up password-free login and has not unbound the account, the PIN code can be used for password-free login.

[0164] When the user is logged in, the device will automatically request the cloud to generate a password-free login key for the corresponding user. When the user subsequently logs in without a password, the device will find the corresponding password-free login key to log in.

[0165] It should be noted that Figure 2 In the example, tokenA and tokenB are the tokens returned by the cloud when users A and B enter their passwords for the first time. The token returned in the final step is the token returned after password-free login. Their functionality is the same, but the generation method is different, similar to the difference between logging in with a password and logging in with a phone number. The token serves as an authentication check when a user operates a device function; the token verifies that the user is currently logged in.

[0166] 1. The process of generating a password-free login key on the device

[0167] Prerequisite: The cloud generates an RSA key pair, public key pubC and private key priC, and writes public key C to the device for storage. The cloud maintains private key C itself.

[0168] The process of generating a password-free login key for the device is as follows Figure 3 Shown, including:

[0169] (1) The device generates a biometric identification code based on its own device number and user information. It can also include other device information, such as {"deviceType":"device type","uid":"user ID","deviceId":"device id","deviceModel":"device model"}, and then encrypts the above information with Base64 to generate the biometric identification code FDI;

[0170] The device number is a string similar to a UUID (Universally Unique Identifier), for example, XURO021821. The device type, such as a barcode scanner, refers to the type of device. The device model, such as 20241001R, refers to the model of a different batch.

[0171] (2) The device generates a key pair, public key pubA and private key priA, according to the method provided by RSA;

[0172] (3) The device needs to generate a signature string sign. First, it needs to obtain the current timestamp timeA, then concatenate the biometric identification code FDI and the timestamp timeA in step (1) to generate the string unsign, then perform md5 encryption, and finally use the RSA private key priA in step (2) to sign the string unsign to generate the string sign;

[0173] (4) Use the public key pubA generated in step (2) to encrypt the public key pubC issued by the cloud to generate the string pubSign, and then send the current timestamp timeA, biometric identification code FDI, pubSign, sign and the user's token (the first password login to the cloud will return a token, i.e. tokenA) to the cloud for authentication to obtain the key for password-free login;

[0174] (5) The cloud decrypts the FDI information through Base64, obtains the user's device number and user ID (i.e., uid), and obtains the user's id from the user's token. The two id values ​​are compared to see if they are consistent. If they are inconsistent, an error is reported;

[0175] It should be noted that every time you log in, the cloud will generate a token and save the relationship between the token and the user, so you can know which user it is based on the token.

[0176] (6) The cloud needs to obtain the public key generated by the device, and needs to use the cloud's private key pubC to decrypt pubSign and obtain the device's public key pubA;

[0177] (7) Determine whether the timestamp reported by the device differs from the timestamp on the cloud by more than 10 seconds. If it does, the request is intercepted directly. The cloud verifies the signature of the request using pubA in step (6). If the signature is incorrect, an error is reported.

[0178] (8) The biometric identification code FDI is concatenated with a random number to generate the value M, which is the key for symmetric encryption (AES key). At the same time, the validity period of the M value needs to be set and saved in the database;

[0179] For example, FDI is 1324kakdhk, which can be followed by adfkjah, where M is the AES key.

[0180] (9) Use the device's public key pubA to encrypt the M value, generate the K value, and save it;

[0181] (10) The cloud saves the K value and returns the K value and validity period to the device;

[0182] (11) The device saves the validity period and K value, associates them with the user ID and stores them in the local storage space. When logging in without a password, the corresponding K value is used for login.

[0183] 2. Password-free login process

[0184] A device can store information of multiple users, so the device can store the corresponding password-free login key according to different user IDs and load it when logging in. In order to ensure the security of the password-free login process and prevent it from being captured and cracked, the transmission of the password-free login key is also encrypted. Figure 4 The flowchart for password-free login includes:

[0185] (1) The device locally finds the corresponding user's K value by loading the cache. The K value is the password-free login key generated in the above process;

[0186] (2) The device decrypts the K value through priA when generating the password-free login key to obtain the M value. Because the K value is encrypted by the cloud based on pubA provided by the device, priA can be decrypted;

[0187] (3) Encrypt the biometric identifier FDI using the value M to generate the ciphertext F;

[0188] (4) Concatenate the ciphertext F and the M value to generate a string fm, encrypt fm using the md5 encryption method, and generate a string fm5. After being encrypted with md5, it cannot be decrypted. Finally, the string fm5 is signed with the priA generated by the device to generate a signature sign. The signature is verified by the cloud to ensure that the string has not been tampered with during the process.

[0189] (5) Request the cloud login interface with the K value, ciphertext F, signature sign, and device number;

[0190] (6) The cloud finds the M value in the database based on the K value and queries the validity period of the key. If it is expired or the M value cannot be found based on the K value, an error is returned;

[0191] (7) The cloud queries the database for the FDI value based on the queried M value, and encrypts the F value based on the M value to obtain the encrypted data F1. The ciphertext F1 is compared with the ciphertext F data to see if they are consistent. If they are inconsistent, an error is reported.

[0192] The database not only stores the corresponding relationship between the user ID and the K value, but also stores the corresponding relationship between the K value and the FDI value.

[0193] (8) Use the public key pubA to verify the signature sign. If the verification fails, an error is reported.

[0194] (9) Compare the device data in the request header and the cloud storage data to see if they are consistent. If they are inconsistent, an error message will be reported;

[0195] (10) If all the checks are passed, a token and a refresh token refreshToken are generated based on the user ID. The device can then use the token to communicate with the cloud. The token also has an expiration date and needs to be refreshed with refreshToken.

[0196] It should be noted that having a token is equivalent to the user successfully logging in to the device and having operation permissions. The token is generally valid for 2 hours, and the refresh token is generally valid for one month. When the token expires, the device can obtain a new token based on the refresh token. The user is unaware of this. When the user generates a new token, the original token will become invalid.

[0197] 3. Deletion process of password-free login key

[0198] The device generally stores multiple users' password-free login keys. However, due to the limited storage space of the device, it is not possible to add users indefinitely. The device can add or delete users' password-free login keys according to its own defined policies. Therefore, the cloud also provides an unbinding interface for clearing the cloud user's password-free login keys, such as Figure 5 As shown in the figure, the process of deleting the password-free login key includes:

[0199] (1) The device accesses the unbinding interface of the cloud with the token and K value obtained by the user login;

[0200] (2) The cloud parses the user's ID based on the user's token, and finds the user's ID in the database based on the K value. The two IDs are compared to see if they are consistent. If they are inconsistent, an error is reported;

[0201] (3) The data verification is passed and the password-free login key is successfully released.

[0202] Among them, after the password-free login key is successfully released, the device's local cache will clear the data related to the PIN code, and the user will not be able to log in without a password by entering the PIN code.

[0203] It should be noted that the password-free login method provided by the present invention is optimized for the password-free login requirements of hardware devices. It utilizes AES and RSA encryption algorithms to optimize the storage of the password-free login key on the device side, binds the device number to the password-free login key, and sets a validity period for the key to prevent it from being stolen and used arbitrarily. The data generated during each login is signed by the RSA private key in the device cache, so the data is different for each request. Its innovations are:

[0204] 1. When switching accounts, users need to enter a PIN code to confirm their identity, and use the device ID for secondary verification to ensure that it is the current user of the current device who is obtaining the password-free login key and logging in without a password.

[0205] 2. Set an expiration date for the key for password-free login. Each key has a time limit, and the device needs to generate a new key in the cloud regularly, which improves security.

[0206] The key generation combines algorithms such as Base64, AES, and RSA, while utilizing the user's information in the token to prevent the password-free login key from being obtained at will. At the same time, encryption is performed using RSA keys and AES during the login process. Different data is generated and signed each time, preventing malicious interception or brute force cracking during transmission.

[0207] The password-free login method provided by an embodiment of the present invention first obtains the personal identification code (PIN) code entered by the target user when it is not the first login; and verifies the PIN code; and in response to the PIN code verification being passed, obtains the password-free login key corresponding to the target user, wherein the password-free login key is generated based on the biometric identification code, and the biometric identification code is generated based on the device number of the device and the user identification of the target user; then the device sends the password-free login key to the cloud through an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and after the verification is passed, further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generates a first token based on the user identification and sends it to the device; finally, the device receives the first token sent by the cloud, and the first token is used to indicate that the target user has successfully logged in using the password-free login key. This application binds the password-free login key to the device number and user ID. During the transmission process, the request is sent in an encrypted transmission method, which can prevent the request from being intercepted and subjected to replay attacks or brute force cracking. At the same time, the cloud will verify the relationship between the password-free login key and the biometric identification code every time. In addition, each time the password-free account is switched, the user needs to enter the set PIN code to ensure that it is he who is switching, thereby improving security and solving the problem of existing password-free login methods that the request may be intercepted and subjected to replay attacks, or the key may be brute force cracked.

[0208] Example 2:

[0209] like Figure 6 As shown, this embodiment provides a password-free login method, which is applied to the cloud, and the method includes:

[0210] Step S201: receiving a target user's password-free login key sent by a device via encrypted transmission, wherein the password-free login key is obtained by the device from a personal identification code (PIN) input by the target user when the target user logs in for a non-first time, verifies the PIN, and, in response to the PIN verification being passed, obtains the corresponding password-free login key of the target user and sends the key, wherein the password-free login key is generated based on a biometric identification code, which is generated based on the device number of the device and the user ID of the target user;

[0211] In this embodiment, when switching between password-free accounts, in order to ensure that it is the person making the switch, the device will pop up a PIN code input box. When the target user enters the PIN code, the device receives the PIN code entered by the target user. The target user will set the corresponding PIN code when logging in for the first time. After the device obtains the PIN code entered by the target user when it is not the first time logging in, the device verifies the PIN code, and when the PIN code verification passes, obtains the password-free login key corresponding to the target user, and sends the password-free login key to the cloud via encrypted transmission.

[0212] Optionally, before the receiving device transmits the target user's password-free login key in an encrypted manner, the method further includes:

[0213] Receiving the user name and password of the target user when logging in for the first time, sent by the device;

[0214] Returning a second token to the device based on the user name and password, so that the device obtains a PIN code set by the target user according to the second token and associates the PIN code with the user identification of the target user;

[0215] receiving a first request for generating a password-free login key, sent by the device through the second token;

[0216] generating the password-free login key according to the first request;

[0217] The password-free login key is sent to the device.

[0218] In this embodiment, the target user enters a username and password when logging in for the first time, and the device logs in to the cloud using the username and password. The cloud returns a second token to the device based on the username and password. The device obtains the PIN code set by the target user according to the second token, and associates the PIN code with the user identification or user account of the target user for storage. The device sends a first request for generating a password-free login key to the cloud through the second token. The cloud generates the password-free login key according to the first request and sends the password-free login key to the device. The device saves the password-free login key. The PIN code set by user A can be 4 to 8 digits, preferably 4 digits. The user identification is used to uniquely identify a user. For example, the user identification can be a user ID.

[0219] Optionally, the first request carries the current timestamp reported by the device, the biometric identification code, the first signature, and the second token, and generating the password-free login key according to the first request specifically includes:

[0220] Obtaining a user identification of the target user from the biometric identification code;

[0221] comparing the user identification obtained from the biometric identification code with the user identification obtained from the second token to determine whether the two are consistent;

[0222] In response to the two being consistent, determining whether the difference between the current timestamp reported by the device and the current timestamp on the cloud exceeds a preset threshold;

[0223] If the difference between the current timestamp reported by the device and the current timestamp in the cloud does not exceed a preset threshold, the first signature is verified using the public key of the device;

[0224] In response to the first signature verification being successful, the biometric identification code is concatenated with a random number to generate an M value and a corresponding validity period, where the M value is a symmetric encryption key;

[0225] Encrypt the M value using the public key of the device to generate a K value;

[0226] The sending the password-free login key to the device specifically includes:

[0227] The K value is sent to the device.

[0228] In this embodiment, the first request carries the current timestamp reported by the device, the biometric identification code, a first signature, and a second token. The first request is generated by the device according to the device number and the user ID of the target user, generating a first string based on the biometric identification code and the current timestamp, encrypting the first string, and signing the encrypted first string with the device's private key to generate a first signature before sending.

[0229] Optionally, the receiving device sends the target user's password-free login key in an encrypted transmission manner, specifically including:

[0230] Receiving the K value, the first ciphertext, the second signature, and the device number sent by the device;

[0231] The verification of the validity period of the password-free login key specifically includes:

[0232] Searching for the corresponding M value according to the received K value;

[0233] According to the validity period corresponding to the found M value, determine whether the M value is within the validity period, and if so, determine that the verification is successful;

[0234] The determining whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generating a first token according to the user identifier and sending the token to the device, specifically includes:

[0235] Finding a corresponding biometric identification code according to the found M value, and encrypting the found biometric identification code using the found M value to obtain a second ciphertext;

[0236] comparing the second ciphertext to the first ciphertext to determine if they are consistent; and if so, verifying the second signature using the public key of the device;

[0237] In response to the second signature verification being successful, determining whether the received device number is consistent with a pre-stored device number corresponding to the device;

[0238] If the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

[0239] In this embodiment, the cloud receives the K value, the first ciphertext, the second signature, and the device number sent by the device, wherein the first ciphertext is generated by the device decrypting the K value based on the private key of the device to obtain the M value, and then encrypting the biometric identification code using the M value; the second signature is generated by the device concatenating the first ciphertext and the M value to generate a second character string, encrypting the second character string using the Message Digest Algorithm Version 5 MD5 encryption method, and after generating a third character string, signing the third character string using the private key of the device.

[0240] Step S202: Verify the validity period of the password-free login key;

[0241] Step S203: In response to the verification being passed, further determine whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, generate a first token based on the user identifier and send it to the device; wherein, the first token is used to indicate that the target user has successfully logged in using the password-free login key.

[0242] It should be noted that when the cloud generates the first token based on the user identifier, it can also generate a refresh token. The subsequent device can use the first token to communicate with the cloud. The token will also have a validity period and can be refreshed with the refresh token.

[0243] In this embodiment, having the token is equivalent to the target user successfully logging in to the device and having the operation authority.

[0244] Optionally, the method further includes:

[0245] receiving a second request sent by the device for deleting the password-free login key, where the second request carries the first token and the K value;

[0246] Parsing a user identifier from the first token;

[0247] Searching for a user identifier corresponding to the received K value;

[0248] The parsed user ID is compared with the found user ID to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0249] In this embodiment, the device generally stores the password-free login keys of multiple users. However, due to the limited storage space of the device, it is impossible to add users indefinitely. The device can add or delete the user's password-free login keys according to its own defined policies. Therefore, the cloud also provides an unbinding interface for clearing the cloud user's password-free login keys.

[0250] Specifically, the device carries the first token and K value obtained by the user login to access the unbinding interface of the cloud. After the cloud receives the second request sent by the device to delete the password-free login key, it parses the user identifier from the first token; searches for the user identifier corresponding to the received K value; compares the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

[0251] Example 3:

[0252] refer to Figure 7 This embodiment provides a password-free login device, including a memory 21 and a processor 22. The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the password-free login method in Example 1 or Example 2.

[0253] The memory 21 is connected to the processor 22 . The memory 21 may be a flash memory, a read-only memory, or other memory. The processor 22 may be a central processing unit or a single-chip microcomputer.

[0254] Example 4:

[0255] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the password-free login method in the above-mentioned embodiment 1 or embodiment 2 is implemented.

[0256] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0257] To sum up, the password-free login method, device and readable storage medium provided by the embodiments of the present invention first obtain the personal identification code PIN code entered by the target user when it is not the first login; and verify the PIN code; and in response to the PIN code verification being passed, obtain the password-free login key corresponding to the target user, wherein the password-free login key is generated based on the biometric identification code, and the biometric identification code is generated according to the device number of the device and the user identification of the target user; then the device sends the password-free login key to the cloud through an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code after the verification is passed. If so, a first token is generated according to the user identification and sent to the device; finally, the device receives the first token sent by the cloud, and the first token is used to indicate that the target user has successfully logged in using the password-free login key. This application binds the password-free login key to the device number and user ID. During the transmission process, the request is sent in an encrypted transmission method, which can prevent the request from being intercepted and subjected to replay attacks or brute force cracking. At the same time, the cloud will verify the relationship between the password-free login key and the biometric identification code every time. In addition, each time the password-free account is switched, the user needs to enter the set PIN code to ensure that it is he who is switching, thereby improving security and solving the problem of existing password-free login methods that the request may be intercepted and subjected to replay attacks, or the key may be brute force cracked.

[0258] It will be understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present invention, and the present invention is not limited thereto. Those skilled in the art will appreciate that various modifications and improvements can be made without departing from the spirit and substance of the present invention, and such modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A password-free login method, characterized in that: Applied to a device, the method includes: Obtain the personal identification code (PIN) entered by the target user when it is not the first login; Verifying the PIN code; In response to the PIN code verification being passed, obtaining a password-free login key corresponding to the target user, wherein the password-free login key is generated based on a biometric identification code, and the biometric identification code is generated based on a device number of the device and a user identifier of the target user; Sending the password-free login key to the cloud via an encrypted transmission method, so that the cloud verifies the validity period of the password-free login key, and further determines whether the password-free login key is the password-free login key corresponding to the biometric identification code after the verification is passed. If so, generating a first token based on the user identifier and sending it to the device; A first token sent by the cloud is received, where the first token is used to indicate that the target user has successfully logged in using the password-free login key.

2. The method according to claim 1, characterized in that Before obtaining the personal identification code (PIN) input by the target user when the target user logs in for a non-first time, the method further includes: Receive the username and password of the target user when logging in for the first time; Sending the username and password to the cloud; receiving a second token returned by the cloud based on the user name and password; Acquire a PIN code set by the target user according to the second token, and associate the PIN code with the user identification of the target user; sending a first request for generating a password-free login key to the cloud through the second token, so that the cloud generates the password-free login key according to the first request; Receive the password-free login key sent by the cloud.

3. The method according to claim 2, characterized in that The sending, through the second token, a first request for generating a password-free login key to the cloud specifically includes: generating the biometric identification code according to the device number of the device and the user identification of the target user; generating a first character string according to the biometric identification code and a current timestamp; encrypting the first character string; Signing the encrypted first character string using the private key of the device to generate a first signature; Sending the current timestamp, the biometric identification code, the first signature, and the second token to the cloud to request generation of a password-free login key; The receiving the password-free login key sent by the cloud specifically includes: Receive the K value sent by the cloud, where the K value is generated by the cloud concatenating the biometric identification code with a random number to generate the M value and the corresponding validity period, and then encrypting the M value using the public key of the device, wherein the M value is a symmetric encryption key.

4. The method according to claim 3, characterized in that The step of sending the password-free login key to the cloud via encrypted transmission specifically includes: Decrypting the K value based on the private key of the device to obtain the M value; Encrypting the biometric identification code using the M value to generate a first ciphertext; Concatenate the first ciphertext and the M value to generate a second string; Encrypting the second character string using the Message Digest Algorithm Version 5 (MD5) encryption method to generate a third character string; Sign the third character string using the private key of the device to generate a second signature; The K value, the first ciphertext, the second signature, and the device number are sent to the cloud.

5. The method according to claim 3, characterized in that The method further comprises: A second request for deleting the password-free login key is sent to the cloud, the second request carries the first token and the K value, and the second request is used to trigger the cloud to parse the user identifier from the first token, and search for the user identifier corresponding to the received K value, and compare the parsed user identifier with the found user identifier to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

6. A password-free login method, characterized in that: Applied to the cloud, the method includes: receiving a target user's password-free login key sent by a device via encrypted transmission, the password-free login key being sent after the device obtains a personal identification code (PIN) entered by the target user when the target user logs in for a non-first time, verifies the PIN, and, in response to passing the PIN verification, obtains the corresponding password-free login key for the target user, wherein the password-free login key is generated based on a biometric identification code generated based on the device number of the device and the user identifier of the target user; Verifying the validity period of the password-free login key; In response to the verification being passed, it is further determined whether the password-free login key is the password-free login key corresponding to the biometric identification code. If so, a first token is generated based on the user identifier and sent to the device; wherein, the first token is used to indicate that the target user has successfully logged in using the password-free login key.

7. The method according to claim 6, characterized in that Before the receiving device transmits the target user's password-free login key in an encrypted manner, the method further includes: Receiving the user name and password of the target user when logging in for the first time, sent by the device; Returning a second token to the device based on the user name and password, so that the device obtains a PIN code set by the target user according to the second token and associates the PIN code with the user identification of the target user; receiving a first request for generating a password-free login key, sent by the device through the second token; generating the password-free login key according to the first request; The password-free login key is sent to the device.

8. The method according to claim 7, characterized in that The first request carries the current timestamp reported by the device, the biometric identification code, the first signature, and the second token, and generating the password-free login key according to the first request specifically includes: Obtaining a user identification of the target user from the biometric identification code; comparing the user identification obtained from the biometric identification code with the user identification obtained from the second token to determine whether the two are consistent; In response to the two being consistent, determining whether the difference between the current timestamp reported by the device and the current timestamp on the cloud exceeds a preset threshold; If the difference between the current timestamp reported by the device and the current timestamp in the cloud does not exceed a preset threshold, the first signature is verified using the public key of the device; In response to the first signature verification being successful, the biometric identification code is concatenated with a random number to generate an M value and a corresponding validity period, where the M value is a symmetric encryption key; Encrypt the M value using the public key of the device to generate a K value; The sending the password-free login key to the device specifically includes: The K value is sent to the device.

9. The method according to claim 8, characterized in that The target user's password-free login key sent by the receiving device in an encrypted transmission manner specifically includes: Receiving the K value, the first ciphertext, the second signature, and the device number sent by the device; The verification of the validity period of the password-free login key specifically includes: Searching for the corresponding M value according to the received K value; According to the validity period corresponding to the found M value, determine whether the M value is within the validity period, and if so, determine that the verification is successful; The determining whether the password-free login key is the password-free login key corresponding to the biometric identification code, and if so, generating a first token according to the user identifier and sending the token to the device, specifically includes: Finding a corresponding biometric identification code according to the found M value, and encrypting the found biometric identification code using the found M value to obtain a second ciphertext; comparing the second ciphertext to the first ciphertext to determine if they are consistent; and if so, verifying the second signature using the public key of the device; In response to the second signature verification being successful, determining whether the received device number is consistent with a pre-stored device number corresponding to the device; If the received device number is consistent with the pre-stored device number corresponding to the device, a first token is generated according to the user identifier and sent to the device.

10. The method according to claim 8, characterized in that The method further comprises: receiving a second request sent by the device for deleting the password-free login key, where the second request carries the first token and the K value; Parsing a user identifier from the first token; Searching for a user identifier corresponding to the received K value; The parsed user ID is compared with the found user ID to determine whether they are consistent. If they are consistent, the password-free login key is deleted.

11. A password-free login device, characterized in that: It includes a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to implement the password-free login method as described in any one of claims 1 to 5, or to implement the password-free login method as described in any one of claims 6 to 10.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the password-free login method according to any one of claims 1 to 5, or implements the password-free login method according to any one of claims 6 to 10.

Images