Login authentication method, electronic equipment and storage medium

Abstract

The invention discloses a login authentication method, electronic equipment and a storage medium, and the login authentication method comprises the steps: determining whether a user biological characteristic authentication result is locally stored in response to a received user biological characteristic authentication requirement; in response to a locally stored user biological feature authentication result, sending first response information to the server; in response to the received user account positioning field information and algorithm information sent by the server based on the first response information, determining user information matched with the user account positioning field information from information stored in association with the user biological feature authentication result, and obtaining target information; and sending the target information to the server. By locally storing the biological feature authentication result of the user, the user can log in various third-party applications without feeling when performing one-time identity authentication, so that the user operation is simplified, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the technical field of login authentication, and in particular to a login authentication method, an electronic device and a storage medium. Background Art

[0002] The current car-mounted native applications use the car-mounted account system, but with the enrichment of the third-party application ecosystem in the application market, the login authentication of third-party applications has gradually become an issue that affects the user experience. This is because third-party applications currently have their own independent account systems, using methods such as scanning codes, face recognition, and verification codes for login authentication. Different applications have their own account systems, and different account systems are difficult to integrate. This means that every time you use a third-party car-mounted application, you have to log in to the corresponding third-party account, which is cumbersome and not conducive to user experience.

[0003] In view of this, this application is hereby filed. Summary of the invention

[0004] A brief summary of one or more aspects is given below to provide a basic understanding of these aspects. This summary is not an exhaustive overview of all conceived aspects, and is neither intended to identify the key or critical elements of all aspects nor to define the scope of any or all aspects. Its only purpose is to give some concepts of one or more aspects in a simplified form as a prelude to a more detailed description that will be given later.

[0005] The present application provides a login authentication method, an electronic device, and a storage medium. By locally storing the user's biometric authentication results, the user can perform an identity authentication once and then log in to a variety of third-party applications without any sense, thereby simplifying user operations and improving the user experience.

[0006] In a first aspect, the present application provides a login authentication method, which is applied to a terminal device and comprises the following steps:

[0007] In response to receiving a user biometric authentication request, determining whether a user biometric authentication result is stored locally, wherein the user biometric authentication request is sent by a server of the target application;

[0008] In response to the user biometric authentication result being stored locally, sending a first response message to the server;

[0009] In response to receiving the user account location field information and algorithm information sent by the server based on the first response information, determining user information matching the user account location field information from the information stored in association with the user biometric authentication result, and processing the user information based on the algorithm information to obtain target information;

[0010] The target information is sent to the server, so that the server determines a login authentication result based on the target information.

[0011] Furthermore, it also includes:

[0012] In response to the user biometric authentication result not being stored locally, prompting the user to enter biometric information;

[0013] The biometric information entered by the user is compared with the pre-stored biometric features, and the user biometric authentication result is determined based on the comparison result. When the user biometric authentication result is passed, the user biometric authentication result is associated with the user information and stored.

[0014] Furthermore, before the response to receiving the user's biometric authentication request, the method further includes:

[0015] In response to receiving a trigger operation based on the target application, sending an access request to a server of the target application;

[0016] In response to receiving the system security verification request sent by the server, a system security verification operation is performed.

[0017] Further, in response to receiving a trigger operation based on the target application, sending an access request to a server of the target application includes:

[0018] In response to receiving a trigger operation based on the target application, determining whether a token matching the target application is stored locally;

[0019] In response to locally storing a token matching the target application, sending a first access request including the token to a server of the target application;

[0020] In response to not storing a token matching the target application locally, sending a second access request to a server of the target application.

[0021] Further, in response to receiving the system security verification request sent by the server, performing a system security verification operation includes:

[0022] In response to receiving the system security verification requirement sent by the server, the platform configuration register and the event log are read, the read data is signed, the signed data is obtained, and the signed data and the certificate used for the signature are sent to the server as a second response message, so that the server verifies whether the local system of the target application is secure, wherein when the server verifies that the local system of the target application is secure, the user biometric authentication requirement is sent.

[0023] Furthermore, it also includes:

[0024] A token of the target application is received, and the token is associated with the target application and the user information and stored.

[0025] In a second aspect, the present application also provides a login authentication method, which is applied to a server, including:

[0026] In response to receiving an access request from a target application, determining whether login authentication is required based on the access request;

[0027] In response to the need for login authentication, sending a user biometric authentication request to a terminal device on which the target application is installed, wherein upon receiving the user biometric authentication request, the terminal device determines whether a user biometric authentication result is stored locally, and if the user biometric authentication result is stored locally, sends a first response message to the server;

[0028] In response to receiving the first response information sent by the terminal device, sending the user account location field information and the algorithm information to the terminal device, wherein when the terminal device receives the user account location field information and the algorithm information, it determines the user information matching the user account location field information from the information stored in association with the user biometric authentication result, processes the user information based on the algorithm information, obtains the target information, and sends the target information to the service end;

[0029] In response to receiving the target information sent by the terminal device, a unique user account is determined based on the target information, and a login authentication result is determined according to a status of the unique user account.

[0030] Furthermore, in response to the need for login authentication, before sending a user biometric authentication request to the terminal device where the target application is installed, the method further includes:

[0031] In response to the need for login authentication, a system security verification requirement is sent to the terminal device, wherein upon receiving the system security verification requirement, the terminal device reads the platform configuration register and the event log, signs the read data, obtains the signed data, and sends the signed data and the certificate used for the signature as the second response information to the server;

[0032] In response to receiving the second response information, verifying whether the local system of the target application is secure based on the second response information, and sending the user biometric authentication requirement to the terminal device when verifying that the local system of the target application is secure.

[0033] In a third aspect, the present application further provides a login authentication device, which is integrated in a terminal device, including:

[0034] A first determination module is configured to determine whether a user biometric authentication result is stored locally in response to receiving a user biometric authentication requirement, wherein the user biometric authentication requirement is sent by a server of a target application;

[0035] A first sending module, configured to send a first response message to a server in response to the user biometric authentication result being stored locally;

[0036] A second determination module is configured to, in response to receiving the user account location field information and algorithm information sent by the server based on the first response information, determine user information matching the user account location field information from the information stored in association with the user biometric authentication result, and process the user information based on the algorithm information to obtain target information;

[0037] The second sending module is used to send the target information to the server, so that the server determines the login authentication result based on the target information.

[0038] In a fourth aspect, the present application further provides a login authentication device, which is integrated in a server, and includes:

[0039] A third determination module, configured to, in response to receiving an access request from a target application, determine whether login authentication is required based on the access request;

[0040] A third sending module is used to send a user biometric authentication request to the terminal device installed with the target application in response to the need for login authentication, wherein the terminal device determines whether the user biometric authentication result is stored locally when receiving the user biometric authentication request, and if the user biometric authentication result is stored locally, sends a first response information to the server;

[0041] a fourth sending module, configured to send user account location field information and algorithm information to the terminal device in response to receiving the first response information sent by the terminal device, wherein when the terminal device receives the user account location field information and the algorithm information, it determines the user information matching the user account location field information from the information stored in association with the user biometric authentication result, processes the user information based on the algorithm information, obtains the target information, and sends the target information to the server;

[0042] The fourth determination module is used to determine a unique user account based on the target information in response to receiving the target information sent by the terminal device, and determine a login authentication result according to the status of the unique user account.

[0043] In a fifth aspect, the present application further provides an electronic device, the electronic device comprising:

[0044] one or more processors;

[0045] A storage device for storing one or more programs;

[0046] When the one or more programs are executed by the one or more processors, the one or more processors implement the login authentication method as described above.

[0047] In a sixth aspect, the present application also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the login authentication method as described above is implemented.

[0048] The login authentication method disclosed in the present application determines whether the user biometric authentication result is stored locally when the terminal device receives the user biometric authentication request for the target application sent by the server. In response to the user biometric authentication result being stored locally, a first response message is sent to the server. When the user account location field information and algorithm information sent by the server based on the first response message are received, the user information matching the user account location field information is determined from the information stored in association with the user biometric authentication result, and the user information is processed based on the algorithm information to obtain the target information; the target information is sent to the server so that the server determines the login authentication result based on the target information. By storing the user biometric authentication result locally, the user can log in to multiple third-party applications without any sense after performing an identity authentication once, which simplifies the user operation and improves the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for describing the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0050] Figure 1 A flowchart of a login authentication method provided in an embodiment of the present application Figure 1 ;

[0051] Figure 2 A schematic diagram of the system architecture of a terminal device for executing the login authentication method in the present application provided in an embodiment of the present application;

[0052] Figure 3 A flowchart of a login authentication method provided in an embodiment of the present application Figure 2 ;

[0053] Figure 4 An interactive sequence diagram of a login authentication method provided in an embodiment of the present application;

[0054] Figure 5 A schematic diagram of a login authentication device provided in an embodiment of the present application Figure 1 ;

[0055] Figure 6 A schematic diagram of a login authentication device provided in an embodiment of the present application Figure 2 ;

[0056] Figure 7 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0058] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0059] Figure 1 The flowchart of a login authentication method proposed in this application is applicable to the login authentication of third-party applications. Specifically, the login authentication method can be executed by a login authentication device, which can be integrated into a terminal device, such as a smart phone, a tablet computer, a car-mounted smart terminal, etc. For example, refer to Figure 2 The system architecture diagram of a terminal device for executing the login authentication method in the present application is shown, which specifically includes a trusted platform module (Trusted Platform Module, TPM) 210 and a trusted execution environment module 220.

[0060] The trusted platform module 210 may be in the form of a microchip, which is usually installed on the system motherboard and provides hardware-based security-related functions. Its main purpose is to protect the system security and the security of stored data through encryption keys and digital certificates, and to prevent security threats such as data leakage and attacks.

[0061] The trusted execution environment module 220 may specifically include: a common execution environment (Rich Execution Environment, REE) 221 and a trusted execution environment (Trusted Execution Environment, TEE) 222. The trusted execution environment is isolated from the common execution environment. The trusted execution environment is an environment for performing high-security operations. Compared with the common execution environment, the trusted execution environment has relatively fewer functions and only retains some security-related mechanisms, such as key management.

[0062] The application running in REE is called client application CA, and the application running in TEE is called trusted application TA. In the implementation of this application solution, the service Service in REE and the application TA in TEE implement the required trusted capabilities. Service calls TEETA through CA to call TEE capabilities. At the same time, Service can also use the TPM interface to call the security capabilities provided by TPM.

[0063] The login authentication method of the present application involves a trusted user, which refers to a local user who has been authenticated by the trusted platform module 210 and the trusted execution environment module 220. The "local" in the local user means a user who enters identity information (such as fingerprints, facial prints, voice prints, etc.) through a terminal device that carries the trusted platform module 210 and the trusted execution environment module 220.

[0064] like Figure 1 As shown, the login authentication method includes the following steps:

[0065] S110. In response to receiving a user biometric authentication request, determine whether a user biometric authentication result is stored locally.

[0066] Among them, the user biometric authentication result is used to indicate that the user is a trusted user. For example, during a user identity authentication process, the user may be required to enter identity information (such as voiceprint, fingerprint, faceprint, etc.), and then the identity information entered by the user is compared with the pre-stored identity information. If the two are the same, it is determined that the user identity authentication is passed and the user is a trusted user, and the user biometric authentication result is stored locally for use when other local applications need to authenticate the user's identity. Specifically, the user biometric authentication result is associated with the user's other information (such as email, mobile phone number, etc.) and stored. When login authentication of other applications is required later, the user's other information can be obtained through the user biometric authentication result, and then the unique user account is located based on the user's other information, and whether login is allowed is determined based on the status of the user account. This avoids the user from having to perform identity authentication operations repeatedly, reduces user operations, and improves convenience. For users, performing an identity authentication once can achieve non-perceptual login authentication for multiple third-party applications.

[0067] It should be noted that the user identity authentication process can occur in the login authentication process of any third-party application. For example, when a user uses a local third-party application A, he is required to perform identity authentication. The user completes the face recognition authentication by interacting with the terminal device. When the user uses a local third-party application B, if he is required to perform face recognition authentication again, the user does not need to scan his face again. Instead, the background program obtains other information of the user based on the previous face recognition result (that is, the identity authentication result when using third-party application A) and feeds it back to the server of third-party application B, so that the server of third-party application B locates the unique user account based on other information of the user, and then determines whether to allow the user to log in. For the user, it realizes non-perceived login authentication, that is, the user performs a face recognition operation once, and can log in to multiple third-party applications without feeling, instead of having to perform face recognition authentication once for each third-party application. This simplifies user operations and improves user experience.

[0068] In some implementations, a validity period can be set for the identity authentication result, for example, a validity period of 24 hours. When an identity authentication result exceeds 24 hours, it will become invalid and the user will be required to perform identity authentication again, which can further improve security.

[0069] The user biometric authentication requirement is sent by the target application's server. Usually, when a user accesses a resource through a target application, the target application sends an access request to its server, which then processes the access request and, when it determines that the user's identity needs to be authenticated, feeds back the user biometric authentication requirement.

[0070] Furthermore, in order to achieve higher security, the server will verify the security of the local system of the target application before authenticating the user's identity. Specifically, when the target application accesses resources, if the user is required to log in and authenticate, the TPM-based remote attestation is triggered first. As required by the TPM remote attestation specification, the server generates a random number and enters the challenge-response process. The TPM reads the measurement registers PCRs and the event log Event Log, signs them with AIK, and attaches the AIK certificate as a response to the server. After receiving the response, the server verifies the authenticity of the AIK certificate with the private certificate authority, verifies the AIK signature, and checks the integrity of the signature content. Recalculate based on the Event Log Event Log, and compare the calculation result with the data of the read register to determine whether the local system of the target application is secure. When it is determined that the local system of the target application is secure, the user biometric authentication requirement is fed back.

[0071] In summary, before the response to receiving the user biometric authentication request, it also includes: in response to receiving a trigger operation based on the target application, sending an access request to the server of the target application; in response to receiving the system security verification requirement sent by the server, performing a system security verification operation. The response to receiving the system security verification requirement sent by the server, performing a system security verification operation includes: in response to receiving the system security verification requirement sent by the server, reading the platform configuration register and event log, signing the read data, obtaining the signed data, and sending the signed data and the certificate used for the signature as the second response information to the server, so that the server verifies whether the local system of the target application is secure, wherein the user biometric authentication request is sent when the server verifies that the local system of the target application is secure.

[0072] In some embodiments, in response to receiving a trigger operation based on the target application, sending an access request to the server of the target application includes: in response to receiving a trigger operation based on the target application, determining whether a token matching the target application is stored locally; in response to a token matching the target application being stored locally, sending a first access request including the token to the server of the target application; in response to a token matching the target application not being stored locally, sending a second access request to the server of the target application. Wherein, when the server of the target application confirms the credibility of the user's identity, it will issue a token to the target application. When the target application accesses resources again, it can send the token previously issued by the server to the server, so that the server can confirm whether the current user is a trusted user and whether the resources can be opened to the target application. Therefore, when the target application sends an access request to its server, it will first confirm whether there is a matching token. If so, it will send the token to the server.

[0073] S120: In response to the user biometric authentication result being stored locally, a first response message is sent to the server.

[0074] That is, when it is determined that the user biometric authentication result is stored locally, the message is notified to the server so that the server can continue with subsequent operations. Optionally, when sending the first response information to the server, the locally stored user biometric authentication result is signed and also sent to the server so that the server can be more certain that the current user is trustworthy.

[0075] In the present application scheme, in order to achieve the purpose of users performing an identity authentication operation once and logging into multiple third-party applications without noticing, after the user performs an identity authentication operation once, the identity authentication result is associated with the user's other identity information and stored locally. When other third-party applications need to perform login authentication on the user, it can search locally to see whether there is a valid identity authentication result. If so, the identity authentication is skipped and other information of the user is further obtained. The server determines whether to allow login based on the other information of the user, thereby saving user operations and achieving the purpose of users performing an identity authentication operation once and logging into multiple third-party applications without noticing.

[0076] If the user's biometric authentication result is not stored locally, or the user's biometric authentication result is invalid, the user is prompted to enter biometric information (fingerprint, voiceprint or faceprint); the biometric information entered by the user is compared with the pre-stored biometric identification features, and the user's biometric authentication result is determined based on the comparison result. When the user's biometric authentication result is passed, the user's biometric authentication result is associated with the user's information (such as the user's email address, mobile phone number, etc.) and stored. If the biometric information entered by the user matches the pre-stored biometric identification features, the user's identity recognition result is determined to be passed.

[0077] After sending the first response information to the server, the server negotiates with the terminal device to determine the algorithm information that the terminal device can support and the user information (such as mobile phone number, email address, etc.) that the terminal device can provide. After negotiation and determination, the terminal device determines the user information that matches the user account location field information from the information stored in association with the user's biometric authentication result, and processes the user information based on the algorithm information to obtain the target information.

[0078] Among them, the user information is processed based on the algorithm information to obtain the target information, which can be specifically: assuming that the algorithm information is a hash algorithm, the user information and some other necessary information (such as identification information of the target application) are calculated with the hash algorithm. The hash value is determined as the target information. The purpose of this processing is to ensure the security of user information during transmission. The processing of this step can be performed based on the secure computing environment provided by TEE, with the purpose of ensuring the security of the data.

[0079] S130. In response to receiving the user account location field information and algorithm information sent by the server based on the first response information, determine the user information that matches the user account location field information from the information stored in association with the user biometric authentication result, and process the user information based on the algorithm information to obtain target information.

[0080] S140. Send the target information to the server, so that the server determines a login authentication result based on the target information.

[0081] When the server receives the target information, it parses the target information, obtains the user information contained therein, and matches a unique trusted user account in its own account library based on the user information. If the status of the user account is normal, it determines that the login authentication result is passed, allows this login, and opens the corresponding resources to the target application. At the same time, the server generates a token Token for access based on a certain strategy, and sends it to the target application. The terminal device associates the token with the third-party application and user information and saves it in the TEE. When the target application requests access to resources from the server again, it carries this token as an identity credential and sends it to the server. When the server receives the access request, it checks this Token for access control, and updates and issues a new Token in a timely manner. Correspondingly, the login authentication method also includes: receiving the token of the target application, and storing the token in association with the target application and the user information.

[0082] In particular, for the same user of the same application, the new Token replaces the old Token. And the token usually has an expiration date in order to achieve a higher level of security.

[0083] In some implementations, when the user actively logs out, the application-related token is deleted. When the terminal device is shut down or restarted, the tokens of all applications are deleted.

[0084] The login authentication method disclosed in the embodiment of the present application associates and stores the biometric authentication result with other information of the user (such as mobile phone number, email address, etc.) after the user performs a biometric authentication (such as face recognition). When the user accesses resources through any third-party application, if biometric authentication is required, it first detects whether the biometric authentication result is stored locally. If it is already stored, repeated authentication is no longer performed, but the user information associated with the biometric authentication result is obtained and fed back to the server. The server locates the unique account based on the user information and checks the account status. If the account status is normal, the login is allowed, that is, the login authentication is passed. This allows users to log in to multiple third-party applications without feeling after performing a biometric identification once, simplifies the user's authentication operation, and improves the user experience.

[0085] In summary, this application scheme makes full use of the core advantages of TPM remote attestation and TEE privacy computing, localizes information processing while ensuring information security, and enables the server to recognize the biometric authentication results of the trusted system. By associating the authenticated biometrics with personal information, the biometric information of the same subject can be used for login authentication of different applications, avoiding manual re-authentication each time, ensuring security while improving user experience.

[0086] In some embodiments, reference is made to Figure 3 A flow chart of a login authentication method shown in FIG. 1 is shown in FIG. 1 , and the login authentication method is executed by the server. Figure 3 As shown, the following steps are included:

[0087] S310: In response to receiving an access request from a target application, determine whether login authentication is required based on the access request.

[0088] Among them, when the user accesses the resource through the target application, it triggers the sending of an access request to the server. Specifically, when the terminal device receives the trigger operation based on the target application, it determines whether a token matching the target application is stored locally; in response to the token matching the target application being stored locally, a first access request including the token is sent to the server of the target application; in response to the token matching the target application not being stored locally, a second access request is sent to the server of the target application.

[0089] When receiving an access request, the server determines whether login authentication is required based on a certain policy. For example, when the access request does not carry a token, or the carried token has expired, it is determined that login authentication is required.

[0090] S320: In response to the need for login authentication, a user biometric authentication request is sent to the terminal device where the target application is installed.

[0091] When receiving the user biometric authentication request, the terminal device determines whether the user biometric authentication result is stored locally. If the user biometric authentication result is stored locally, the terminal device sends a first response message to the server.

[0092] Optionally, before sending a user biometric authentication request to a terminal device on which the target application is installed in response to the need for login authentication, the method further includes:

[0093] In response to the need for login authentication, a system security verification requirement is sent to the terminal device, wherein, when the terminal device receives the system security verification requirement, it reads the platform configuration register and the event log, signs the read data, obtains the signed data, and sends the signed data and the certificate used for the signature as a second response message to the server; in response to receiving the second response message, it is verified based on the second response message whether the local system of the target application is secure, and when verifying the security of the local system of the target application, the user biometric authentication requirement is sent to the terminal device.

[0094] S330. In response to receiving the first response information sent by the terminal device, send user account location field information and algorithm information to the terminal device.

[0095] Among them, when the terminal device receives the user account location field information and algorithm information, it determines the user information that matches the user account location field information from the information stored in association with the user biometric authentication result, and processes the user information based on the algorithm information to obtain the target information, and sends the target information to the server.

[0096] After the server receives the first response information, the server negotiates with the terminal device to determine the algorithm information that the terminal device can support and the user information that the terminal device can provide (such as mobile phone number, email address, etc.). After the negotiation and determination, the server sends the user account location field information and algorithm information determined after negotiation to the terminal device. The terminal device determines the user information that matches the user account location field information from the information stored in association with the user biometric authentication result, and processes the user information based on the algorithm information to obtain the target information.

[0097] Among them, the user information is processed based on the algorithm information to obtain the target information, which can be specifically: assuming that the algorithm information is a hash algorithm, the user information and some other necessary information (such as identification information of the target application) are calculated with the hash algorithm. The hash value is determined as the target information. The purpose of this processing is to ensure the security of user information during transmission. The processing of this step can be performed based on the secure computing environment provided by TEE, with the purpose of ensuring the security of the data.

[0098] When the server receives the target information, it parses the target information, obtains the user information contained therein, and matches a unique trusted user account in its own account library based on the user information. If the status of the user account is normal, it determines that the login authentication result is passed, allows this login, and opens the corresponding resources to the target application. At the same time, the server generates a token Token for access based on a certain strategy, and sends it to the target application. The terminal device associates the token with the third-party application and user information and saves it in the TEE. When the target application requests access to resources from the server again, it carries this token as an identity credential and sends it to the server. When the server receives the access request, it checks this Token for access control, and updates and issues a new Token in a timely manner. Correspondingly, the login authentication method also includes: receiving the token of the target application, and storing the token in association with the target application and the user information.

[0099] In particular, for the same user of the same application, the new Token replaces the old Token. And the token usually has an expiration date in order to achieve a higher level of security.

[0100] In some implementations, when the user actively logs out, the application-related token is deleted. When the terminal device is shut down or restarted, the tokens of all applications are deleted.

[0101] S340: In response to receiving the target information sent by the terminal device, determine a unique user account based on the target information, and determine a login authentication result according to a status of the unique user account.

[0102] In other embodiments, reference is made to Figure 4 The interactive sequence diagram of a login authentication method shown includes the following interactive steps:

[0103] S1. The application sends a trusted proof of login authentication to the server.

[0104] Specifically, when an application accesses a resource, if user login authentication is required, TPM-based remote attestation is triggered first.

[0105] S2. The server sends a random number to the TPM.

[0106] Specifically, as required by the TPM remote attestation specification, the server generates a random number to enter the challenge-response process. The TPM reads the measurement registers PCRs and the event log Event Log, signs them with the AIK, and attaches the AIK certificate and sends it to the server as a response.

[0107] S3. TPM feeds back the AIK signature, event log, data of the read measurement register PCRs, and AIK certificate to the server.

[0108] The server verifies the AIK signature and checks the integrity of the signature content. It performs calculations based on the event log and compares the calculation results with the data of the read measurement register PCRs. It verifies the authenticity of the AIK certificate with the private certificate authority to determine whether the local system of the target application is secure. When it is determined that the local system of the target application is secure, it feeds back the user's biometric authentication requirements.

[0109] S4. Verify the authenticity of the AIK certificate with the private certificate authority.

[0110] S5. The private certificate authority feeds back the TPM identity verification result to the server.

[0111] S6. The server sends a user biometric authentication request to TEE.

[0112] S7. Collect facial information through the camera.

[0113] S8. Read pre-stored biometric information from the TPM or TEE.

[0114] Local authentication uses biometric authentication methods, such as face, fingerprint, voiceprint, etc., depending on the methods supported by the local system. When using face authentication, you can use the camera of the terminal device (such as the car computer), or call the mobile phone camera through the car computer interconnection to collect face data, and then compare the face model data that has been securely stored in the car computer to complete the authentication. If local authentication is successful, it means that the user's identity is authentic.

[0115] S9. Biometric verification passed.

[0116] S10. The application notifies the server that the user identity verification has been passed in the form of biometrics and that field information needs to be identified.

[0117] S11. The server returns field information identifying the user account to TEE.

[0118] Local authentication is sufficient to prove the authenticity of the user, but no connection is established with the account of the third-party application. At this time, it is necessary to negotiate with the server for field information (such as mobile phone number, ID number, etc.) and hash algorithm that can be used to locate the unique user. The server sends the above field information and hash algorithm to the terminal device.

[0119] S12. TPM obtains personal information corresponding to the user.

[0120] Based on the field information, obtain the information corresponding to the biometric user from the secure storage of the TPM. Note: If the TPM storage space is insufficient, you can use TPM to seal and securely store it in the TPM external space (here refers to TEE), and unseal it when needed. Select a hash algorithm, reorder the above information to calculate the hash value, and sign it. Specifically, the hash value signature calculated together with the selected fields, algorithms and other necessary information (such as application information) is sent to the server as a response. The calculation of this step is based on the secure computing capability provided by TEE.

[0121] S13. Send the signature to the server.

[0122] The server verifies the signature, matches the unique user account, generates a token for TEE, and TEE stores the token.

[0123] S14. Return a token.

[0124] S15. Obtain a token.

[0125] Specifically, when the application needs to access resources, it obtains the corresponding token.

[0126] S16. Access with token.

[0127] The server verifies the validity period of the token and updates the token in time within the validity period.

[0128] S17. Update token.

[0129] TEE update token.

[0130] S18. Delete the corresponding token.

[0131] Specifically, when actively logging out or restarting, the corresponding token is deleted.

[0132] Based on the above embodiments, Figure 5 Schematic diagram of a login authentication device provided in an embodiment of the present application, which can be integrated in terminal devices such as vehicle-mounted terminals and smart phones. Figure 5As shown, the device includes: a first determination module 510, used to determine whether a user biometric authentication result is stored locally in response to receiving a user biometric authentication requirement, wherein the user biometric authentication requirement is sent by the server of the target application; a first sending module 520, used to send a first response message to the server in response to the user biometric authentication result being stored locally; a second determination module 530, used to determine user information matching the user account location field information from the information stored in association with the user biometric authentication result in response to receiving user account location field information and algorithm information sent by the server based on the first response message, and process the user information based on the algorithm information to obtain target information; a second sending module 540, used to send the target information to the server, so that the server determines the login authentication result based on the target information.

[0133] Based on the above embodiments, Figure 6 is a schematic diagram of the structure of a login authentication device provided in an embodiment of the present application, which can be integrated in a server. Figure 6 As shown, the device includes: a third determination module 610, which is used to determine whether login authentication is required based on the access request in response to receiving an access request from a target application; a third sending module 620, which is used to send a user biometric authentication requirement to a terminal device on which the target application is installed in response to the need for login authentication, wherein the terminal device determines whether a user biometric authentication result is stored locally when receiving the user biometric authentication requirement, and if the user biometric authentication result is stored locally, sends a first response message to a server; a fourth sending module 630, which is used to send user account location field information and algorithm information to the terminal device in response to receiving the first response message sent by the terminal device, wherein the terminal device determines user information matching the user account location field information from information stored in association with the user biometric authentication result when receiving the user account location field information and algorithm information, processes the user information based on the algorithm information, obtains target information, and sends the target information to the server; a fourth determination module 640, which is used to determine a unique user account based on the target information in response to receiving the target information sent by the terminal device, and determines the login authentication result according to the state of the unique user account.

[0134] The login authentication device provided in the embodiment of the present disclosure can execute the steps in the login authentication method provided in the method embodiment of the present disclosure, and the execution steps and beneficial effects are no longer repeated here.

[0135] Figure 7 Schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 7 , which shows a structural schematic diagram of an electronic device 500 suitable for implementing the embodiments of the present disclosure. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0136] like Figure 7 As shown, the electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage device 508 into a random access memory (RAM) to implement the method of the embodiment described in the present disclosure. In RAM503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, ROM 502, and RAM503 are connected to each other via a bus 504. An I / O interface 505 is also connected to the bus 504. An input device 506, an output device 507, a storage device 508, and a communication device 509 are all connected to the I / O interface 505.

[0137] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart, thereby implementing the login authentication method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0138] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0139] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device executes the method steps in the present application.

[0140] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0141] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0142] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0143] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and its core ideas of this application. The above is only the preferred implementation method of this application. It should be pointed out that due to the limitations of textual expression and the objective existence of infinite specific structures, ordinary technicians in this technical field can make several improvements, modifications or changes without departing from the principles of this application, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes or combinations, or the direct application of the concept and technical solution of the invention to other occasions without improvement, should be regarded as the scope of protection of this application.

Claims

1. A login authentication method, applied to a terminal device, characterized in that: include: In response to receiving a user biometric authentication request, determining whether a user biometric authentication result is stored locally; In response to the user biometric authentication result being stored locally, sending a first response message to the server; In response to receiving the user account location field information and algorithm information sent by the server based on the first response information, determining user information matching the user account location field information from the information stored in association with the user biometric authentication result, and processing the user information based on the algorithm information to obtain target information; The target information is sent to the server, so that the server determines a login authentication result based on the target information.

2. The login authentication method according to claim 1, characterized in that: Also includes: In response to the user biometric authentication result not being stored locally, prompting the user to enter biometric information; The biometric information entered by the user is compared with the pre-stored biometric features, and the user biometric authentication result is determined based on the comparison result. When the user biometric authentication result is passed, the user biometric authentication result is associated with the user information and stored.

3. The login authentication method according to claim 1, characterized in that: Before the response receives the user biometric authentication request, the method further includes: In response to receiving a trigger operation based on the target application, sending an access request to a server of the target application; In response to receiving the system security verification request sent by the server, a system security verification operation is performed.

4. The login authentication method according to claim 3, characterized in that: The step of sending an access request to a server of the target application in response to receiving a trigger operation based on the target application includes: In response to receiving a trigger operation based on the target application, determining whether a token matching the target application is stored locally; In response to locally storing a token matching the target application, sending a first access request including the token to a server of the target application; In response to not storing a token matching the target application locally, sending a second access request to a server of the target application.

5. The login authentication method according to claim 3, characterized in that: The performing of a system security verification operation in response to receiving a system security verification request sent by the server includes: In response to receiving the system security verification requirement sent by the server, the platform configuration register and the event log are read, the read data is signed, the signed data is obtained, and the signed data and the certificate used for the signature are sent to the server as a second response message, so that the server verifies whether the local system of the target application is secure, wherein when the server verifies that the local system of the target application is secure, the user biometric authentication requirement is sent.

6. The login authentication method according to claim 1, characterized in that: Also includes: A token of the target application is received, and the token is associated with the target application and the user information and stored.

7. A login authentication method, applied to a server, characterized in that: include: In response to receiving an access request from a target application, determining whether login authentication is required based on the access request; In response to the need for login authentication, sending a user biometric authentication request to a terminal device on which the target application is installed, wherein upon receiving the user biometric authentication request, the terminal device determines whether a user biometric authentication result is stored locally, and if the user biometric authentication result is stored locally, sends a first response message to the server; In response to receiving the first response information sent by the terminal device, sending the user account location field information and the algorithm information to the terminal device, wherein when the terminal device receives the user account location field information and the algorithm information, it determines the user information matching the user account location field information from the information stored in association with the user biometric authentication result, processes the user information based on the algorithm information, obtains the target information, and sends the target information to the service end; In response to receiving the target information sent by the terminal device, a unique user account is determined based on the target information, and a login authentication result is determined according to a status of the unique user account.

8. The login authentication method according to claim 7, characterized in that: Before sending a user biometric authentication request to the terminal device where the target application is installed in response to the need for login authentication, the method further includes: In response to the need for login authentication, a system security verification requirement is sent to the terminal device, wherein upon receiving the system security verification requirement, the terminal device reads the platform configuration register and the event log, signs the read data, obtains the signed data, and sends the signed data and the certificate used for the signature as the second response information to the server; In response to receiving the second response information, verifying whether the local system of the target application is secure based on the second response information, and sending the user biometric authentication requirement to the terminal device when verifying that the local system of the target application is secure.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the login authentication method as described in any one of claims 1-6 or 7-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the login authentication method as described in any one of claims 1-6 or 7-8 is implemented.

Images