Multi-factor authentication method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a multi-factor authentication method and device, equipment and a storage medium, and relates to the technical field of computers, and when terminal equipment receives an application code plaintext sent by an application system and a first user identifier of an operation user in the application system, the application code plaintext is encrypted into an application code ciphertext; and sending the application code ciphertext and the first user identifier to a multi-factor authentication platform. After the multi-factor authentication platform decrypts and verifies the application code ciphertext by means of the identity authentication platform, the first user identifier and the second user identifier of the operation user on the multi-factor authentication platform are bound, so that a credible connection relationship is established among the application system, the multi-factor authentication platform and the identity authentication platform; therefore, the application system can call the multi-factor authentication platform and the identity authentication platform to encrypt and transmit the secret key based on the binding relationship, and performs multi-factor authentication on the login request of the terminal equipment by adopting the secret key, so that the secret key is prevented from being leaked in the communication process, and the accuracy and information security of multi-factor authentication are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a multi-factor authentication method, apparatus, device, and storage medium. Background Art

[0002] Multi-Factor Authentication (MFA) is an authentication mechanism used when logging in or accessing resources. The computer system requires the user to provide a combination of two or more different authentications to verify the user's identity and log in. MFA provides a high-security authentication method because even if one authentication is compromised, unauthorized users will not be able to access the computer system if they cannot meet the second authentication requirement.

[0003] Under the relevant technology, after the user applies for MFA authentication to the application system, the application system will return the key to the user. When the user logs into the application system, he needs to generate a dynamic password based on the key and log in to the application system based on the dynamic password.

[0004] However, during the above verification process, the key is usually transmitted in plain text between the user end and the application system, which may lead to key leakage during the communication process, thereby affecting the accuracy of multi-factor authentication and the security of information. Summary of the invention

[0005] The embodiments of the present application provide a multi-factor authentication method, apparatus, device and storage medium for improving the accuracy of multi-factor authentication and the security of information.

[0006] On the one hand, an embodiment of the present application provides a multi-factor authentication method, which is applied to an application system, including:

[0007] Receive a multi-factor authentication binding application sent by a terminal device that has been connected to the identity authentication platform;

[0008] Returning the plain text of the application code and the first user identifier of the operating user in the application system to the terminal device, so that the terminal device encrypts the plain text of the application code into a ciphertext of the application code, and sends the ciphertext of the application code and the first user identifier to the multi-factor authentication platform;

[0009] Receiving the application code plaintext, the first user identifier, and the second user identifier of the operating user on the multi-factor authentication platform, which are obtained by decrypting the application code ciphertext through the identity authentication platform and sent by the multi-factor authentication platform;

[0010] When the plain text verification of the application code passes, establishing a binding relationship between the first user identifier and the second user identifier;

[0011] The multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit a key based on the binding relationship, and the key is used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0012] On the one hand, an embodiment of the present application provides a multi-factor authentication method, which is applied to a multi-factor authentication platform, including:

[0013] Receive an application code ciphertext and a first user ID of an operating user in an application system sent by a terminal device that has accessed the identity authentication platform, wherein the application code ciphertext is obtained by encrypting the application code plaintext by the terminal device, and the application code plaintext and the first user ID are returned by the application system when the terminal device sends a multi-factor authentication binding application to the application system;

[0014] Decrypting the ciphertext of the application code through the identity authentication platform to obtain the plaintext of the application code;

[0015] The plain text of the application code, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform are sent to the application system, so that when the application system passes the plain text verification of the application code, a binding relationship between the first user identifier and the second user identifier is established; and based on the binding relationship, the multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit a key, and the key is used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0016] On the one hand, an embodiment of the present application provides a multi-factor authentication method, which is applied to a terminal device that has been connected to an identity authentication platform, including:

[0017] Send a multi-factor authentication binding application to the application system;

[0018] Receiving the plain text of the application code returned by the application system and the first user identifier of the operating user in the application system;

[0019] Encrypting the application code plaintext to obtain the application code ciphertext;

[0020] The application code ciphertext and the first user identifier are sent to the multi-factor authentication platform, so that the multi-factor authentication platform decrypts the application code ciphertext through the identity authentication platform to obtain the application code plaintext; the application code plaintext, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform are sent to the application system; when the application system verifies the application code plaintext, a binding relationship between the first user identifier and the second user identifier is established; and based on the binding relationship, the multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit keys, and the keys are used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0021] On the one hand, an embodiment of the present application provides a multi-factor authentication device, which is applied to an application system, including:

[0022] A first receiving module is used to receive a multi-factor authentication binding application sent by a terminal device that has been connected to the identity authentication platform;

[0023] A first sending module, used for returning a plain text application code and a first user identifier of an operating user in the application system to the terminal device, so that the terminal device encrypts the plain text application code into a ciphertext application code, and sends the ciphertext application code and the first user identifier to the multi-factor authentication platform;

[0024] The first receiving module is further configured to receive the application code plaintext, the first user identifier, and the second user identifier of the operating user on the multi-factor authentication platform, which is obtained by decrypting the application code ciphertext on the identity authentication platform and sent by the multi-factor authentication platform;

[0025] A processing module, configured to establish a binding relationship between the first user identifier and the second user identifier when the plain text verification of the application code passes;

[0026] The processing module is further used to call the multi-factor authentication platform and the identity authentication platform to encrypt and transmit a key based on the binding relationship, and use the key to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0027] On the one hand, an embodiment of the present application provides a multi-factor authentication device, which is applied to a multi-factor authentication platform, including:

[0028] A second receiving module is used to receive an application code ciphertext and a first user identifier of an operating user in an application system sent by a terminal device that has accessed the identity authentication platform, wherein the application code ciphertext is obtained by encrypting the application code plaintext by the terminal device, and the application code plaintext and the first user identifier are returned by the application system when the terminal device sends a multi-factor authentication binding application to the application system;

[0029] An authentication module, used to decrypt the ciphertext of the application code through the identity authentication platform to obtain the plaintext of the application code;

[0030] The second sending module is used to send the plain text of the application code, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform to the application system, so that when the application system passes the plain text verification of the application code, a binding relationship between the first user identifier and the second user identifier is established; and based on the binding relationship, the multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit a key, and the key is used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0031] On the one hand, an embodiment of the present application provides a multi-factor authentication device, which is applied to a terminal device that has been connected to an identity authentication platform, including:

[0032] The third sending module is used to send a multi-factor authentication binding application to the application system;

[0033] A third receiving module is used to receive the plain text of the application code returned by the application system and the first user identifier of the operating user in the application system;

[0034] An encryption module, used to encrypt the application code plain text to obtain the application code ciphertext;

[0035] The third sending module is also used to send the application code ciphertext and the first user identifier to the multi-factor authentication platform, so that the multi-factor authentication platform decrypts the application code ciphertext through the identity authentication platform to obtain the application code plaintext; sends the application code plaintext, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform to the application system; when the application system verifies the application code plaintext, establishes a binding relationship between the first user identifier and the second user identifier; and based on the binding relationship, calls the multi-factor authentication platform and the identity authentication platform to encrypt and transmit keys, and uses the keys to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0036] On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned multi-factor authentication method when executing the program.

[0037] On the one hand, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program is run on the computer device, the computer device executes the steps of the above-mentioned multi-factor authentication method.

[0038] On the one hand, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned multi-factor authentication method.

[0039] In the embodiment of the present application, the terminal device completes device access in advance on the identity authentication platform. When the terminal device receives the plain text application code sent by the application system and the first user ID of the operating user in the application system, it encrypts the plain text application code into a ciphertext application code, and sends the ciphertext application code and the first user ID to the multi-factor authentication platform to apply for multi-factor authentication binding. After the multi-factor authentication platform decrypts and verifies the ciphertext application code with the help of the identity authentication platform, it allows the first user ID to bind with the second user ID of the operating user in the multi-factor authentication platform, so that the multi-factor authentication platform, the application system and the identity authentication platform establish a trusted connection relationship. Therefore, the application system can call the multi-factor authentication platform and the identity authentication platform to encrypt and transmit the key based on the binding relationship, and use the key to perform multi-factor authentication on the login request of the terminal device to obtain the authentication result, thereby avoiding the leakage of the key during the communication process, thereby greatly improving the accuracy of multi-factor authentication and the security of information. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0041] Figure 1 A schematic diagram of a system architecture provided in an embodiment of the present application;

[0042] Figure 2 A schematic diagram of a multi-factor authentication method provided in an embodiment of the present application Figure 1 ;

[0043] Figure 3 A schematic diagram of a multi-factor authentication method provided in an embodiment of the present application Figure 2 ;

[0044] Figure 4 A schematic diagram of a multi-factor authentication method provided in an embodiment of the present application Figure 3 ;

[0045] Figure 5 A schematic diagram of a multi-factor authentication device provided in an embodiment of the present application Figure 1 ;

[0046] Figure 6 A schematic diagram of a multi-factor authentication device provided in an embodiment of the present application Figure 2 ;

[0047] Figure 7 A schematic diagram of a multi-factor authentication device provided in an embodiment of the present application Figure 3 ;

[0048] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and beneficial effects of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0050] refer to Figure 1 , which is a system architecture diagram applicable to an embodiment of the present application, the system architecture at least includes a terminal device 101, an identity authentication platform 102, a multi-factor authentication platform 103, and an application system 104.

[0051] The number of terminal devices 101 may be one or more, and the number of multi-factor authentication platforms 103 and application systems 104 may also be one or more. This application does not specifically limit the number of terminal devices 101, multi-factor authentication platforms 103 and application systems 104.

[0052] The terminal device 101 is pre-installed with a business application and a multi-factor authentication application, wherein the business application and the multi-factor authentication application can be two independent applications. In this case, the business application and the multi-factor authentication application can be installed on different terminal devices respectively, or they can be installed on the same terminal device. The multi-factor authentication application can also be embedded in the business application, and this application does not make specific restrictions on this. The terminal device 101 can be a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent voice interaction device, an intelligent vehicle-mounted device, etc., but is not limited thereto.

[0053] The multi-factor authentication platform 103, also known as the MFA scenario platform, is the background server of the multi-factor authentication application. The factor authentication platform 103 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0054] Application system 104 is the backend server for business applications. Application system 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It may also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), as well as big data and artificial intelligence platforms.

[0055] Any two devices in the terminal device 101, the identity authentication platform 102, the multi-factor authentication platform 103, and the application system 104 can be directly or indirectly connected via wired or wireless communication; this application does not impose any limitation on this.

[0056] based on Figure 1 The system architecture diagram shown in the figure, the embodiment of the present application provides a process of a multi-factor authentication method, such as Figure 2 As shown, the process of the method is interactively executed by the terminal device, the identity authentication platform, the multi-factor authentication platform, and the application system, and includes the following steps:

[0057] Step 201: The terminal device sends a multi-factor authentication binding application to the application system.

[0058] Specifically, the terminal device is pre-installed with a business application and a multi-factor authentication application. The operating user can operate in the business application to select an application system from multiple application systems for login.

[0059] For example, when the business application is a payment application, the payment application provides multiple payment channels, each payment channel corresponds to an application system. The operating user can select a payment channel in the payment application to select an application system from multiple application systems for login.

[0060] Before multi-factor authentication, the terminal device completes device access on the identity authentication platform in advance, and the identity authentication platform issues a working key (i.e., initialization of the working key). The application system needs to access the multi-factor authentication platform, provide application system information, and obtain the communication key of the multi-factor authentication platform API.

[0061] In some embodiments, before the terminal device sends a multi-factor authentication binding application to the application system, the terminal device sends an authentication request carrying login information to the application system, wherein the login information includes a user name and a password. The application system authenticates the login information and returns an authentication pass message to the terminal device when the authentication passes.

[0062] Step 202: The terminal device receives the plain text application code returned by the application system and the first user identifier of the operating user in the application system.

[0063] Specifically, the application system generates a plain text application code, and returns the plain text application code, the application system identifier, and the first user identifier to the terminal device.

[0064] Step 203: The terminal device encrypts the plain text of the application code to obtain a cipher text of the application code.

[0065] Specifically, the user enters the plain text of the application code, the application system identifier, and the first user identifier into the multi-factor authentication application. Specifically, the plain text of the application code, the application system identifier, and the first user identifier can be entered by scanning a code or the like. The multi-factor authentication application in the terminal device uses the working key of the terminal device to encrypt the plain text of the application code to obtain the ciphertext of the application code. The working key of the terminal device is issued by the identity authentication platform when the terminal device accesses the identity authentication platform. The working key stored in the terminal device and the working key stored in the identity authentication platform are symmetric keys.

[0066] Step 204: The terminal device sends the encrypted application code and the first user identifier to the multi-factor authentication platform.

[0067] Specifically, the terminal device sends the application code ciphertext, the application system identifier and the first user identifier to the multi-factor authentication platform.

[0068] Step 205: The multi-factor authentication platform decrypts the ciphertext of the application code through the identity authentication platform to obtain the plaintext of the application code.

[0069] Specifically, the multi-factor authentication platform sends the device identification of the terminal device and the application code ciphertext to the identity authentication platform. The identity authentication platform obtains the initialized working key based on the device identification of the terminal device. The initialized working key is used to decrypt the application code ciphertext, obtain the application code plaintext, and return the application code plaintext to the multi-factor authentication platform.

[0070] In step 206, the multi-factor authentication platform sends the plain text of the application code, the first user identifier, and the second user identifier of the operating user on the multi-factor authentication platform to the application system.

[0071] Specifically, the multi-factor authentication platform and the application system belong to a server-to-server interface, which performs data transmission and verification through an encryption key and HTTPS method agreed upon in advance by both parties to ensure the security of data transmission.

[0072] Step 207: When the application system passes the plain text verification of the application code, a binding relationship between the first user identifier and the second user identifier is established.

[0073] In step 208, the application system calls the multi-factor authentication platform and the identity authentication platform based on the binding relationship to encrypt and transmit the key, and uses the key to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0074] In the embodiment of the present application, the terminal device completes device access in advance on the identity authentication platform. When the terminal device receives the plain text application code sent by the application system and the first user ID of the operating user in the application system, it encrypts the plain text application code into a ciphertext application code, and sends the ciphertext application code and the first user ID to the multi-factor authentication platform to apply for multi-factor authentication binding. After the multi-factor authentication platform decrypts and verifies the ciphertext application code with the help of the identity authentication platform, it allows the first user ID to bind with the second user ID of the operating user in the multi-factor authentication platform, so that the multi-factor authentication platform, the application system and the identity authentication platform establish a trusted connection relationship. Therefore, the application system can call the multi-factor authentication platform and the identity authentication platform to encrypt and transmit the key based on the binding relationship, and use the key to perform multi-factor authentication on the login request of the terminal device to obtain the authentication result, thereby avoiding the leakage of the key during the communication process, thereby greatly improving the accuracy and security of multi-factor authentication.

[0075] In some embodiments, the relevant technology uses a time-based one-time password (TOTP) for multi-factor authentication. There are two main authentication methods. The first is that after the user applies for MFA authentication, the application system will send the key to the user, and the user will enter the key into a local application that supports TOTP. When the user logs into the system, the local application is used to generate a dynamic password. This is the MFA authentication method of most websites. The second is that the application system loads the key into a dynamic password device, and when the device is provided to the user, the device serial number is bound to the user account. When the user logs in, the dynamic password device needs to be used to obtain a dynamic password. This method is mostly used for applications with high security requirements such as personal online banking.

[0076] However, in the first solution, TOTP is transmitted in plain text such as QR code or Base32. If the key is not properly stored during the communication process or by the user, it may lead to key leakage. In the second solution, each device can only be used for one account in one application system. If there are many application systems or accounts, the user needs to keep multiple dynamic password devices and needs to record the corresponding relationship between the dynamic password device and the application system and account by himself, which brings a lot of inconvenience to the user.

[0077] In view of this, after establishing the binding relationship between the first user identifier and the second user identifier, the present application adopts the following implementation method, based on the binding relationship, calling the multi-factor authentication platform and the identity authentication platform to encrypt and transmit the key, and using the key to perform multi-factor authentication on the login request of the terminal device, such as Figure 3 As shown, the following steps are included:

[0078] Step 301: Based on the binding relationship, the application system calls the multi-factor authentication platform and the identity authentication platform to issue an encryption key to the terminal device.

[0079] Specifically, the encryption key may be a TOTP ciphertext or another type of encrypted key.

[0080] In some embodiments, the process of the application system issuing encryption keys includes the following steps 3011 to 3016.

[0081] Step 3011: The terminal device sends a key application carrying a first user identifier to the application system.

[0082] Step 3012: The application system obtains the second user identifier bound to the first user identifier from the binding relationship.

[0083] Step 3013: The application system sends the second user identifier and the generated key plaintext to the multi-factor authentication platform.

[0084] Specifically, the application system sends the key in plain text to the multi-factor authentication platform through an interface provided by the multi-factor authentication platform.

[0085] Step 3014: When the multi-factor authentication platform successfully verifies the second user identification, it sends the key plaintext to the identity authentication platform.

[0086] Step 3015: The identity authentication platform encrypts the key plaintext to obtain the encryption key.

[0087] Specifically, the identity authentication platform not only obtains the key plaintext, but also obtains the second user identification. When the second user identification is verified, the key plaintext is encrypted using the working key to obtain the encryption key.

[0088] Step 3016: The identity authentication platform sends the encryption key to the terminal device.

[0089] Step 302: The terminal device decrypts the encryption key to obtain the key plaintext.

[0090] Specifically, when the terminal device accesses the identity authentication platform, the working key issued by the identity authentication platform decrypts the encryption key to obtain the key plaintext, wherein the working key stored in the terminal device and the working key stored in the identity authentication platform are symmetric keys.

[0091] The terminal device stores the key plaintext in a trusted execution environment or a secure element. In a specific implementation, the environment in which the key plaintext is stored can be determined according to the device type of the terminal device. When the device type of the terminal device supports a trusted execution environment, the key plaintext is stored in the trusted execution environment. When the device type of the terminal device supports a secure element, the key plaintext is stored in the secure element. When the device type of the terminal device supports other secure environments, the key plaintext is stored in other secure environments, thereby improving the security of the key.

[0092] Step 303: The terminal device sends a login request carrying login information to the application system.

[0093] Step 304: When the application system successfully authenticates the login information, it returns a multi-factor authentication instruction.

[0094] Step 305: The terminal device generates a dynamic password based on the key plaintext.

[0095] Specifically, the terminal device obtains the key plaintext from the trusted execution environment or the security element, and generates a dynamic password based on the key plaintext.

[0096] Step 306: The application system sends a dynamic password to the terminal device.

[0097] Step 307: The application system authenticates the dynamic password and obtains an authentication result.

[0098] Specifically, the application system parses the key plaintext (such as TOTP) from the dynamic password. When the decrypted key plaintext is consistent with the key plaintext sent to the terminal device, the authentication result is passed, otherwise the authentication result is failed.

[0099] When the authentication result is passed, the login request is completed and a login success message is returned. When the authentication result is not passed, the login request is terminated and a login failure message is returned.

[0100] In the embodiment of the present application, the key used for multi-factor authentication is encrypted and transmitted through the multi-factor authentication platform and the identity authentication platform, and the key is stored in a secure environment such as TEE, which effectively prevents key leakage, thereby improving the accuracy and security of multi-factor authentication. Secondly, a terminal device can save the plaintext key corresponding to the accounts of multiple application systems. Compared with the method of encapsulating keys with dynamic password devices, it improves the convenience of use and is more conducive to large-scale promotion.

[0101] In some embodiments, the relevant technology performs multi-factor authentication based on SMS verification codes. First, the user's mobile phone number needs to be bound to the user account. When the user accesses the application system, the application system generates a one-time verification code and sends it to the user's mobile phone via SMS as a dynamic password for login.

[0102] However, there are varying degrees of delay in sending SMS verification codes. Users need to wait for a while before receiving the verification code. In the case of SMS network congestion, the verification code may be invalid when the user receives it, resulting in a poor user experience. In addition, if a user has installed a fake application on their phone, the user's SMS verification code may be intercepted by malware, which is less secure.

[0103] In view of this, after establishing the binding relationship between the first user identifier and the second user identifier, the present application adopts the following implementation method, based on the binding relationship, calling the multi-factor authentication platform and the identity authentication platform to encrypt and transmit the key, and using the key to perform multi-factor authentication on the login request of the terminal device, such as Figure 4 As shown, the following steps are included:

[0104] Step 401: The terminal device sends a login request carrying login information to the application system.

[0105] Specifically, the login information includes a user name and a password.

[0106] Step 402: When the application system authenticates the login information, the application system obtains the second user identifier from the binding relationship based on the first user identifier associated with the login information.

[0107] Specifically, when the application system authenticates the login information, it initiates an online multi-factor authentication process.

[0108] Step 403: The application system sends the second user identifier and the application system identifier to the multi-factor authentication platform.

[0109] Step 404: When the multi-factor authentication platform successfully verifies the second user identification, a serial number and an online key are generated.

[0110] The serial number is used to characterize the uniqueness of the online key and avoid repeated authentication of the online key.

[0111] Step 405: The multi-factor authentication platform sends an authentication application carrying the application system identifier, serial number and online key to the identity authentication platform.

[0112] Step 406: The identity authentication platform sends the authentication application to the terminal device.

[0113] Step 407: The terminal device signs the online key to obtain a signature result.

[0114] In some embodiments, the terminal device signs the online key in response to a confirmation operation on the authentication application in the multi-factor authentication application to obtain a signature result.

[0115] Specifically, the confirmation method is implemented by a multi-factor authentication application, such as user click, fingerprint recognition, facial recognition, PIN code, etc.

[0116] After the user confirms, the private key of the terminal device is used to sign the online key to obtain the signature result. The private key of the terminal device is the working key issued by the identity authentication platform when the terminal device is connected to the identity authentication platform. The private key stored in the terminal device and the public key stored in the identity authentication platform are asymmetric keys.

[0117] Step 408: The terminal device sends the signature result to the multi-factor authentication platform.

[0118] Step 409: The multi-factor authentication platform sends the signature result to the identity authentication platform.

[0119] Specifically, in addition to sending the signature result to the multi-factor authentication platform, the terminal device also sends the application system identifier and serial number. The multi-factor authentication platform verifies the received serial number and application system identifier, and when the verification passes, sends a signature verification request to the identity authentication platform, in which the signature verification request carries the terminal device identifier and signature result.

[0120] Step 410: The identity authentication platform verifies the signature result to obtain an authentication result.

[0121] Step 411: The identity authentication platform returns the authentication result.

[0122] Specifically, the identity authentication platform uses the public key to verify the signature result. If the verification is passed, the authentication result of passing the authentication is returned. If the verification is not passed, the authentication result of not passing the authentication is returned.

[0123] Step 412: The multi-factor authentication platform sends the authentication result to the application system.

[0124] Specifically, in addition to sending the authentication result, the multi-factor authentication platform also sends the second user ID and serial number. When the authentication result is passed, the login request is completed and a login success message is returned. When the authentication result is not passed, the login request is terminated and a login failure message is returned.

[0125] In the embodiment of the present application, when a user logs in the application system, the application system initiates an online multi-factor authentication process to the designated operating user through the multi-factor authentication platform, the multi-factor authentication platform generates an online key, and pushes it to the terminal device bound to the multi-factor authentication application through the identity authentication platform. If the operating user confirms to log in to the application system, the multi-factor authentication application is confirmed in the multi-factor authentication application, and the multi-factor authentication application uses the private key in the terminal device to sign the online key and send it to the multi-factor authentication platform. After the identity authentication platform verifies the signature, the authentication result is returned to the application system. The issuance of the online key is realized through the multi-factor authentication platform and the identity authentication platform, which improves the security of the online key. Secondly, compared with the SMS verification code method, the delay of the verification code issuance is reduced, thereby improving the user experience. In addition, after the online key is issued to the terminal device, the operating user needs to confirm (i.e., verify again) in the multi-factor authentication application before the subsequent signature and verification process will be executed. In this way, even if the online key is intercepted by malware, the security of the multi-factor authentication can be guaranteed.

[0126] Based on the same technical concept, the present application embodiment provides a schematic diagram of the structure of a multi-factor authentication device, which is applied to an application system, such as Figure 5 As shown, the multi-factor authentication device 500 includes:

[0127] The first receiving module 501 is used to receive a multi-factor authentication binding application sent by a terminal device that has been connected to the identity authentication platform;

[0128] A first sending module 502, configured to return a plain text application code and a first user identifier of the operating user in the application system to the terminal device, so that the terminal device encrypts the plain text application code into a ciphertext application code, and sends the ciphertext application code and the first user identifier to the multi-factor authentication platform;

[0129] The first receiving module 501 is further configured to receive the application code plaintext, the first user identifier, and the second user identifier of the operating user on the multi-factor authentication platform, which are obtained by decrypting the application code ciphertext on the identity authentication platform.

[0130] Processing module 503, used for establishing a binding relationship between the first user identifier and the second user identifier when the plain text verification of the application code passes;

[0131] The processing module 503 is further configured to call the multi-factor authentication platform and the identity authentication platform to encrypt and transmit a key based on the binding relationship, and use the key to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0132] Optionally, the first receiving module 501 is further configured to receive an authentication request carrying login information sent by a terminal device that has accessed the identity authentication platform before receiving a multi-factor authentication binding application sent by the terminal device;

[0133] The processing module 503 is further configured to authenticate the login information and return an authentication success message to the terminal device when the authentication succeeds.

[0134] Optionally, the first sending module 502 is specifically configured to:

[0135] The application code plaintext, the application system identifier and the first user identifier are returned to the terminal device so that the terminal device encrypts the application code plaintext to obtain the application code ciphertext, and sends the application code ciphertext, the application system identifier and the first user identifier to the multi-factor authentication platform.

[0136] Optionally, the processing module 503 is specifically configured to:

[0137] Based on the binding relationship, calling the multi-factor authentication platform and the identity authentication platform to issue an encryption key to the terminal device;

[0138] Receiving a login request carrying login information sent by the terminal device;

[0139] When the login information is authenticated, a multi-factor authentication instruction is returned to enable the terminal device to generate a dynamic password based on a key plaintext, where the key plaintext is obtained by the terminal device decrypting the encryption key;

[0140] The dynamic password sent by the terminal device is received, and the dynamic password is authenticated to obtain the authentication result.

[0141] Optionally, the processing module 503 is specifically configured to:

[0142] Receiving a key application carrying the first user identifier sent by the terminal device;

[0143] Acquire the second user identifier bound to the first user identifier from the binding relationship;

[0144] The second user identification and the generated key are sent in plain text to the multi-factor authentication platform, so that when the multi-factor authentication platform verifies the second user identification, the key plain text is encrypting through the identity authentication platform to obtain an encryption key, and the encryption key is sent to the terminal device.

[0145] Optionally, the terminal device stores the key in plain text in a trusted execution environment or a secure element.

[0146] Optionally, the processing module 503 is specifically configured to:

[0147] Receiving a login request carrying login information sent by the terminal device;

[0148] When the login information is authenticated, based on the first user identifier associated with the login information, the second user identifier is obtained from the binding relationship;

[0149] Sending the second user identifier and the application system identifier to the multi-factor authentication platform, so that when the multi-factor authentication platform verifies the second user identifier, it generates a serial number and an online key; and sending the authentication application carrying the application system identifier, the serial number and the online key to the terminal device through the identity authentication platform;

[0150] Receive an authentication result sent by the multi-factor authentication platform, where the authentication result is obtained by the multi-factor authentication platform through verifying a signature result by the identity authentication platform; the signature result is obtained by the terminal device signing the online key and sending it to the multi-factor authentication platform.

[0151] Optionally, the signature result is obtained by the terminal device signing the online key in response to a confirmation operation on the authentication application in a multi-factor authentication application.

[0152] Based on the same technical concept, the present application embodiment provides a schematic diagram of the structure of a multi-factor authentication device, which is applied to a multi-factor authentication platform, such as Figure 6 As shown, the multi-factor authentication device 600 includes:

[0153] The second receiving module 601 is used to receive the application code ciphertext and the first user identification of the operating user in the application system sent by the terminal device that has accessed the identity authentication platform, wherein the application code ciphertext is obtained by the terminal device encrypting the application code plaintext, and the application code plaintext and the first user identification are returned by the application system when the terminal device sends a multi-factor authentication binding application to the application system;

[0154] The authentication module 602 is used to decrypt the ciphertext of the application code through the identity authentication platform to obtain the plaintext of the application code;

[0155] The second sending module 603 is used to send the plain text of the application code, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform to the application system, so that when the application system passes the plain text verification of the application code, a binding relationship between the first user identifier and the second user identifier is established; and based on the binding relationship, the multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit the key, and the key is used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0156] Based on the same technical concept, the embodiment of the present application provides a structural diagram of a multi-factor authentication device, which is applied to a terminal device that has been connected to an identity authentication platform, such as Figure 7 As shown, the multi-factor authentication device 700 includes:

[0157] The third sending module 701 is used to send a multi-factor authentication binding application to the application system;

[0158] The third receiving module 702 is used to receive the plain text of the application code returned by the application system and the first user identifier of the operating user in the application system;

[0159] The encryption module 703 is used to encrypt the plain text of the application code to obtain the cipher text of the application code;

[0160] The third sending module 701 is also used to send the application code ciphertext and the first user identifier to the multi-factor authentication platform, so that the multi-factor authentication platform decrypts the application code ciphertext through the identity authentication platform to obtain the application code plaintext; sends the application code plaintext, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform to the application system; when the application system verifies the application code plaintext, establishes a binding relationship between the first user identifier and the second user identifier; and calls the multi-factor authentication platform and the identity authentication platform to encrypt and transmit keys based on the binding relationship, and uses the keys to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

[0161] In the embodiment of the present application, the terminal device completes device access in advance on the identity authentication platform. When the terminal device receives the plain text application code sent by the application system and the first user ID of the operating user in the application system, it encrypts the plain text application code into a ciphertext application code, and sends the ciphertext application code and the first user ID to the multi-factor authentication platform to apply for multi-factor authentication binding. After the multi-factor authentication platform decrypts and verifies the ciphertext application code with the help of the identity authentication platform, it allows the first user ID to bind with the second user ID of the operating user in the multi-factor authentication platform, so that the multi-factor authentication platform, the application system and the identity authentication platform establish a trusted connection relationship. Therefore, the application system can call the multi-factor authentication platform and the identity authentication platform to encrypt and transmit the key based on the binding relationship, and use the key to perform multi-factor authentication on the login request of the terminal device to obtain the authentication result, thereby avoiding the leakage of the key during the communication process, thereby greatly improving the accuracy of multi-factor authentication and the security of information.

[0162] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0163] Based on the same technical concept, the embodiment of the present application provides a computer device, which can be Figure 1 Any device shown, such as Figure 8 As shown, it includes at least one processor 801 and a memory 802 connected to the at least one processor. The specific connection medium between the processor 801 and the memory 802 is not limited in the embodiment of the present application. Figure 8 For example, the processor 801 and the memory 802 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0164] In the embodiment of the present application, the memory 802 stores instructions that can be executed by at least one processor 801, and the at least one processor 801 can perform the steps of the above-mentioned multi-factor authentication method by executing the instructions stored in the memory 802.

[0165] Among them, the processor 801 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and realize multi-factor authentication by running or executing instructions stored in the memory 802 and calling data stored in the memory 802. Optionally, the processor 801 may include one or more processing units, and the processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0166] Processor 801 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0167] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 802 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0168] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned multi-factor authentication method.

[0169] Based on the same inventive concept, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned multi-factor authentication method.

[0170] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0171] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer device or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer readable memory capable of directing a computer device or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer device or other programmable data processing device so that a series of operation steps are executed on the computer device or other programmable device to produce a process implemented by the computer device, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0174] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0175] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A multi-factor authentication method, characterized in that: Applied to application systems, including: Receive a multi-factor authentication binding application sent by a terminal device that has been connected to the identity authentication platform; Returning the plain text of the application code and the first user identifier of the operating user in the application system to the terminal device, so that the terminal device encrypts the plain text of the application code into a ciphertext of the application code, and sends the ciphertext of the application code and the first user identifier to the multi-factor authentication platform; Receiving the application code plaintext, the first user identifier, and the second user identifier of the operating user on the multi-factor authentication platform, which are obtained by decrypting the application code ciphertext through the identity authentication platform and sent by the multi-factor authentication platform; When the plain text verification of the application code passes, establishing a binding relationship between the first user identifier and the second user identifier; The multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit a key based on the binding relationship, and the key is used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

2. The method according to claim 1, characterized in that Before receiving the multi-factor authentication binding application sent by the terminal device that has been connected to the identity authentication platform, the method further includes: Receiving an authentication request carrying login information sent by the terminal device; The login information is authenticated, and when the authentication is successful, an authentication success message is returned to the terminal device.

3. The method according to claim 1, characterized in that The step of returning the plain text of the application code and the first user identifier of the operating user in the application system to the terminal device, so that the terminal device encrypts the plain text of the application code into a ciphertext of the application code, and sends the ciphertext of the application code and the first user identifier to the multi-factor authentication platform, includes: The application code plaintext, the application system identifier and the first user identifier are returned to the terminal device so that the terminal device encrypts the application code plaintext to obtain the application code ciphertext, and sends the application code ciphertext, the application system identifier and the first user identifier to the multi-factor authentication platform.

4. The method according to any one of claims 1 to 3, characterized in that: The step of calling the multi-factor authentication platform and the identity authentication platform to encrypt and transmit a key based on the binding relationship, and using the key to perform multi-factor authentication on a login request of the terminal device to obtain an authentication result includes: Based on the binding relationship, calling the multi-factor authentication platform and the identity authentication platform to issue an encryption key to the terminal device; Receiving a login request carrying login information sent by the terminal device; When the login information is authenticated, a multi-factor authentication instruction is returned to enable the terminal device to generate a dynamic password based on a key plaintext, where the key plaintext is obtained by the terminal device decrypting the encryption key; The dynamic password sent by the terminal device is received, and the dynamic password is authenticated to obtain the authentication result.

5. The method according to claim 4, characterized in that The calling the multi-factor authentication platform and the identity authentication platform to issue an encryption key to the terminal device based on the binding relationship includes: Receiving a key application carrying the first user identifier sent by the terminal device; Acquire the second user identifier bound to the first user identifier from the binding relationship; The second user identification and the generated key are sent in plain text to the multi-factor authentication platform, so that when the multi-factor authentication platform verifies the second user identification, the key plain text is encrypting through the identity authentication platform to obtain an encryption key, and the encryption key is sent to the terminal device.

6. The method according to claim 4, characterized in that The terminal device stores the key in plain text in a trusted execution environment or a secure element.

7. The method according to any one of claims 1 to 3, characterized in that: The step of calling the multi-factor authentication platform and the identity authentication platform to encrypt and transmit a key based on the binding relationship, and using the key to perform multi-factor authentication on a login request of the terminal device to obtain an authentication result includes: Receiving a login request carrying login information sent by the terminal device; When the login information is authenticated, based on the first user identifier associated with the login information, the second user identifier is obtained from the binding relationship; Sending the second user identifier and the application system identifier to the multi-factor authentication platform, so that when the multi-factor authentication platform verifies the second user identifier, it generates a serial number and an online key; and sending the authentication application carrying the application system identifier, the serial number and the online key to the terminal device through the identity authentication platform; Receive an authentication result sent by the multi-factor authentication platform, where the authentication result is obtained by the multi-factor authentication platform through verifying a signature result by the identity authentication platform; the signature result is obtained by the terminal device signing the online key and sending it to the multi-factor authentication platform.

8. The method according to claim 7, characterized in that The signature result is obtained by the terminal device signing the online key in response to a confirmation operation on the authentication application in a multi-factor authentication application.

9. A multi-factor authentication method, characterized in that: Applied to multi-factor authentication platforms, including: Receive an application code ciphertext and a first user ID of an operating user in an application system sent by a terminal device that has accessed the identity authentication platform, wherein the application code ciphertext is obtained by encrypting the application code plaintext by the terminal device, and the application code plaintext and the first user ID are returned by the application system when the terminal device sends a multi-factor authentication binding application to the application system; Decrypting the ciphertext of the application code through the identity authentication platform to obtain the plaintext of the application code; The plain text of the application code, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform are sent to the application system, so that when the application system passes the plain text verification of the application code, a binding relationship between the first user identifier and the second user identifier is established; and based on the binding relationship, the multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit a key, and the key is used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

10. A multi-factor authentication method, characterized in that: Applicable to terminal devices that have been connected to the identity authentication platform, including: Send a multi-factor authentication binding application to the application system; Receiving the plain text of the application code returned by the application system and the first user identifier of the operating user in the application system; Encrypting the application code plaintext to obtain the application code ciphertext; The application code ciphertext and the first user identifier are sent to the multi-factor authentication platform, so that the multi-factor authentication platform decrypts the application code ciphertext through the identity authentication platform to obtain the application code plaintext; the application code plaintext, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform are sent to the application system; when the application system verifies the application code plaintext, a binding relationship between the first user identifier and the second user identifier is established; and based on the binding relationship, the multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit keys, and the keys are used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

11. A multi-factor authentication device, characterized in that: Applied to application systems, including: A first receiving module is used to receive a multi-factor authentication binding application sent by a terminal device that has been connected to the identity authentication platform; A first sending module, used for returning a plain text application code and a first user identifier of an operating user in the application system to the terminal device, so that the terminal device encrypts the plain text application code into a ciphertext application code, and sends the ciphertext application code and the first user identifier to the multi-factor authentication platform; The first receiving module is further configured to receive the application code plaintext, the first user identifier, and the second user identifier of the operating user on the multi-factor authentication platform, which is obtained by decrypting the application code ciphertext on the identity authentication platform and sent by the multi-factor authentication platform; A processing module, configured to establish a binding relationship between the first user identifier and the second user identifier when the plain text verification of the application code passes; The processing module is further used to call the multi-factor authentication platform and the identity authentication platform to encrypt and transmit a key based on the binding relationship, and use the key to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

12. A multi-factor authentication device, characterized in that: Applied to multi-factor authentication platforms, including: A second receiving module is used to receive an application code ciphertext and a first user identifier of an operating user in an application system sent by a terminal device that has accessed the identity authentication platform, wherein the application code ciphertext is obtained by encrypting the application code plaintext by the terminal device, and the application code plaintext and the first user identifier are returned by the application system when the terminal device sends a multi-factor authentication binding application to the application system; An authentication module, used to decrypt the ciphertext of the application code through the identity authentication platform to obtain the plaintext of the application code; The second sending module is used to send the plain text of the application code, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform to the application system, so that when the application system passes the plain text verification of the application code, a binding relationship between the first user identifier and the second user identifier is established; and based on the binding relationship, the multi-factor authentication platform and the identity authentication platform are called to encrypt and transmit a key, and the key is used to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

13. A multi-factor authentication device, characterized in that: Applicable to terminal devices that have been connected to the identity authentication platform, including: The third sending module is used to send a multi-factor authentication binding application to the application system; A third receiving module is used to receive the plain text of the application code returned by the application system and the first user identifier of the operating user in the application system; An encryption module, used to encrypt the application code plain text to obtain the application code ciphertext; The third sending module is also used to send the application code ciphertext and the first user identifier to the multi-factor authentication platform, so that the multi-factor authentication platform decrypts the application code ciphertext through the identity authentication platform to obtain the application code plaintext; sends the application code plaintext, the first user identifier and the second user identifier of the operating user on the multi-factor authentication platform to the application system; when the application system verifies the application code plaintext, establishes a binding relationship between the first user identifier and the second user identifier; and based on the binding relationship, calls the multi-factor authentication platform and the identity authentication platform to encrypt and transmit keys, and uses the keys to perform multi-factor authentication on the login request of the terminal device to obtain an authentication result.

14. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

15. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device. When the computer program is run on the computer device, the computer device executes the steps of any method described in claims 1 to 10.

16. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer device, the computer device is caused to execute the steps of the method according to any one of claims 1 to 10.

Images