Authentication method and device, equipment, storage medium and program product

Abstract

The invention provides an authentication method and device, equipment, a storage medium and a program product, and is applied to a first terminal, and the specific technical scheme comprises the steps: responding to the operation of a user, and displaying a login interface; signature information sent by a near field communication (NFC) reading device is received, the signature information comprises key information, and the signature information is acquired by the NFC reading device from a subscriber identity module (SIM) card of a second terminal; and acquiring encrypted account information corresponding to the login interface from a locally stored password warehouse, and decrypting the encrypted account information by using the key information to obtain login information. Thus, the encrypted account information is stored in the first terminal, the key information is stored in the second terminal, the encrypted account information and the key information are stored separately, and the security of the terminals is improved.

Description

Technical Field

[0001] The present application belongs to the field of security technology, and in particular, relates to an authentication method, device, equipment, storage medium and program product. Background Art

[0002] With the development of Internet technology, there are more and more clients, application tools and websites. When users log in to the client, application tools and websites, they need to enter the corresponding account password to obtain the user's personal data in the client, application tools and websites for user use.

[0003] However, there may be a phenomenon that multiple people use the same terminal. For example, a laptop or tablet computer in a family. It is possible that multiple users in the family need to log in to the instant messaging software on the terminal. To facilitate user login, users usually choose to store their personal account password in the terminal. In this way, there is a risk of user information being leaked, and information security cannot be effectively guaranteed. Summary of the invention

[0004] The embodiments of the present application provide an authentication method, apparatus, device, storage medium and program product, which can improve the security of user information in a terminal.

[0005] In a first aspect, an embodiment of the present application provides an authentication method, applied to a first terminal, the method comprising:

[0006] In response to the user's operation, a login interface is displayed;

[0007] Receiving signature information sent by a near field communication (NFC) reading device, the signature information including key information, the signature information being obtained by the NFC reading device from a subscriber identity module (SIM) card of the second terminal;

[0008] The encrypted account information corresponding to the login interface is obtained from the locally stored password repository, and the encrypted account information is decrypted using the key information to obtain the login information.

[0009] In a possible implementation manner, the signature information includes a SIM card identifier and encryption key information; and the method further includes:

[0010] Searching for a target public key corresponding to the SIM card identifier in a preset correspondence relationship between the SIM card identifier and the public key stored locally;

[0011] The encrypted key information is decrypted using the target public key to obtain the key information.

[0012] In a possible implementation manner, before searching for the target public key corresponding to the SIM card identifier in the preset correspondence relationship between the SIM card identifier and the public key stored locally, the method further includes:

[0013] In response to an operation of a user using the NFC reader to read the key information provided by the SIM card, receiving the key information and the SIM card identifier sent by the NFC reader, wherein the key information includes the target public key;

[0014] A preset correspondence between the target public key and the SIM card identifier is established.

[0015] In a possible implementation, before displaying the login interface in response to the user's operation, the method further includes:

[0016] Detecting that a user logs in to the login interface, displaying a prompt message on the display interface of the first terminal, the prompt message is used to remind the user to use the NFC reading device to read the signature information in the SIM card of the second terminal, the signature information including the key information;

[0017] Receiving the signature information sent by the NFC reading device;

[0018] Using the key information to encrypt the account information input by the user on the login interface to obtain the encrypted account information;

[0019] The correspondence between the encrypted account information and the login interface is stored in the password repository.

[0020] In a second aspect, an embodiment of the present application provides an authentication method, which is applied to a subscriber identification module SIM card in a second terminal, and the method includes:

[0021] Receiving a request instruction sent by a near field communication (NFC) reading device, wherein the request instruction includes a login interface identifier corresponding to the login interface in the first terminal;

[0022] When the NFC reader is authenticated, the target key information is searched according to the preset correspondence between the locally stored login interface identifier and the key information;

[0023] The signature information is sent to the NFC reading device, where the signature information includes the target key information, so that the first terminal uses the target key information to decrypt the encrypted account information corresponding to the login interface identifier to obtain the login information.

[0024] In a possible implementation manner, before sending the signature information to the NFC reading device, the method further includes:

[0025] Obtaining a private key from the target key information;

[0026] The target key information is encrypted using the private key to obtain the signature information.

[0027] In a possible implementation, before searching for target key information according to a preset correspondence between a locally stored login interface identifier and key information, the method further includes:

[0028] Sending a card-side random number to the NFC reading device;

[0029] Receive a first hash value fed back by the NFC reading device, where the first hash value is obtained by the NFC reading device performing a hash calculation on the card-side random number;

[0030] When the locally calculated second hash value is the same as the first hash value, it is determined that the NFC reading device is authenticated.

[0031] In a possible implementation, before searching for target key information according to a preset correspondence between a locally stored login interface identifier and key information, the method further includes:

[0032] Generate the key information according to a preset key generation algorithm;

[0033] A preset correspondence between the login interface identifier and the key information is constructed.

[0034] In a third aspect, an embodiment of the present application provides an authentication device, applied to a first terminal, the device comprising:

[0035] A display module, used to display a login interface in response to a user's operation;

[0036] A receiving module, used to receive signature information sent by a near field communication NFC reading device, wherein the signature information includes key information, and the signature information is obtained by the NFC reading device from a subscriber identity module SIM card of the second terminal;

[0037] The decryption module is used to obtain the encrypted account information corresponding to the login interface from the locally stored password repository, and decrypt the encrypted account information using the key information to obtain the login information.

[0038] In a fourth aspect, an embodiment of the present application provides an authentication device, which is applied to a subscriber identification module SIM card in a second terminal, and the device includes:

[0039] A receiving module, configured to receive a request instruction sent by a near field communication (NFC) reading device, wherein the request instruction includes a login interface identifier corresponding to the login interface in the first terminal;

[0040] A search module, used to search for target key information according to a preset correspondence between a locally stored login interface identifier and key information when the NFC reading device is authenticated;

[0041] The sending module is used to send signature information to the NFC reading device, wherein the signature information includes the target key information, so that the first terminal uses the target key information to decrypt the encrypted account information corresponding to the login interface identifier to obtain login information.

[0042] In a fifth aspect, an embodiment of the present application provides an electronic device, the device comprising: a processor and a memory storing computer program instructions;

[0043] When the processor executes the computer program instructions, the method of the first aspect or the second aspect is implemented.

[0044] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the authentication method as described in any one of the first aspect or the second aspect is implemented.

[0045] In a seventh aspect, an embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device performs the authentication method as described in any one of the first aspect or the second aspect.

[0046] An authentication method, device, equipment, storage medium and program product of an embodiment of the present application obtains the key information stored in the SIM card of the second terminal from the NFC reading device after the user opens the login interface. Then, after the terminal searches for the encrypted account information corresponding to the login interface in the locally stored password warehouse, it can use the above key information to decrypt the encrypted account information to obtain the login information corresponding to the login interface. In this way, the terminal locally stores the encrypted encrypted account information, and the key information corresponding to the encrypted account information is stored in the SIM card of the second terminal. The encrypted account information and the key information are stored separately, which can improve the security of the user information stored locally in the terminal, thereby effectively ensuring the terminal information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0048] Figure 1 This is a schematic diagram of a system architecture using an authentication method provided by an embodiment of the present application;

[0049] Figure 2 is a flowchart of a method for authentication applied to a first terminal provided in an embodiment of the present application;

[0050] Figure 3 It is a flowchart of a method for storing encrypted account information provided by an embodiment of the present application;

[0051] Figure 4 is a flow chart of an authentication method applied to a second terminal provided in an embodiment of the present application;

[0052] Figure 5 This is a method flow chart of a NFC reading device verification method provided by an embodiment of the present application;

[0053] Figure 6 is an exemplary schematic diagram of an encrypted account information storage method provided in an embodiment of the present application;

[0054] Figure 7 is an exemplary schematic diagram of an authentication method provided in an embodiment of the present application;

[0055] Figure 8 is a structural diagram of a device for authentication applied to a first terminal provided in an embodiment of the present application;

[0056] Fig. 9 This is a schematic diagram of a structure of a device for authentication of a second terminal provided in an embodiment of the present application.

[0057] Fig.10 It is a structural diagram of an electronic device provided by yet another embodiment of the present application. DETAILED DESCRIPTION

[0058] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0059] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0060] In order to solve the problems existing in the prior art, the embodiments of the present application provide a method, apparatus, device, storage medium and program product for authentication. Figure 1 The following describes the system architecture of an authentication method provided by an embodiment of the present application. Figure 1 As shown, the system architecture includes a first terminal, a second terminal and a near field communication (NFC) reading device.

[0061] For example, the first terminal may be a computer in a home application scenario, and the second terminal may be a mobile phone of a family member. The NFC reading device may be an NFC reading device external to the computer.

[0062] The user can log in to the client, application or web page on the first terminal. The second terminal is placed close to the NFC reader, so that the NFC reader can read the key information corresponding to the client, application or web page stored in the Subscriber Identity Module (SIM) card of the second terminal, and send the read key information to the first terminal. The first terminal searches the local password warehouse for the encrypted account information corresponding to the client, application or web page, and uses the received key information to decrypt the encrypted account information, and can obtain the login information for logging in to the client, application or web page, thereby completing the automatic login.

[0063] The following combination Figure 2 An authentication method provided in an embodiment of the present application is introduced, such as Figure 2 As shown, the method is applied to a first terminal, and the method includes:

[0064] S201. In response to a user operation, a login interface is displayed.

[0065] S202: Receive signature information sent by a near field communication (NFC) reader.

[0066] The signature information includes key information, and the signature information is obtained by the NFC reading device from the subscriber identity module SIM card of the second terminal.

[0067] Specifically, when the first terminal does not have the NFC reading function, an external NFC reading device can be connected to the first terminal; when the first terminal has the NFC reading function, the signature information of the second terminal can be directly read through its own NFC reading function.

[0068] In addition, after the user operates the client, the first terminal displays a login interface in response to the user's operation, and then the user needs to attach the second terminal to the NFC reader so that the NFC reader can read the data in the SIM card of the second terminal.

[0069] S203: Obtain the encrypted account information corresponding to the login interface from the locally stored password repository, and decrypt the encrypted account information using the key information to obtain the login information.

[0070] The local password warehouse stores the correspondence between the login interface identifier and the encrypted account information. The first terminal can search for the corresponding encrypted account information in the password warehouse by acquiring the login interface identifier corresponding to the login interface.

[0071] By adopting the above method, after the user opens the login interface, the key information stored in the SIM card of the second terminal is obtained from the NFC reading device. Then, after the terminal searches for the encrypted account information corresponding to the login interface in the locally stored password warehouse, the encrypted account information can be decrypted using the above key information to obtain the login information corresponding to the login interface. In this way, the terminal locally stores the encrypted encrypted account information, and the key information corresponding to the encrypted account information is stored in the SIM card of the second terminal. The method of storing the encrypted account information and the key information separately can improve the security of the user information stored locally in the terminal, thereby effectively ensuring the terminal information security.

[0072] Before the above authentication process, the first terminal stores the encrypted account information in the local password repository in advance, as shown in the following example: Figure 3 As shown, the method for the first terminal to store encrypted account information is as follows:

[0073] S301: Detecting that a user logs into the above login interface, displaying prompt information on the display interface of the first terminal.

[0074] The prompt information is used to remind the user to use the NFC reading device to read the signature information in the SIM card of the second terminal, and the signature information includes the key information.

[0075] Specifically, when a user logs into the above login interface for the first time, the first terminal detects in real time whether the user has successfully logged in. After the user enters correct account information, the first terminal may display a prompt message on the display interface.

[0076] S302: Receive signature information sent by an NFC reading device.

[0077] Specifically, the NFC reading device sends the login interface identifier corresponding to the login interface to the SIM card of the second terminal, and requests the SIM card of the second terminal to return key information. The SIM card of the second terminal can return signature information to the NFC reading device, and the NFC reading device returns signature information to the first terminal.

[0078] The signature information may be unencrypted key information or key information encrypted using a preset encryption algorithm.

[0079] S303: Use the key information to encrypt the account information input by the user on the login interface to obtain encrypted account information.

[0080] Among them, an encryption algorithm for encrypting account information is pre-set in the first terminal, and the embodiment of the present application does not specifically limit the encryption algorithm.

[0081] S304: Storing the correspondence between the encrypted account information and the login interface in the password repository.

[0082] Specifically, the password warehouse can store the correspondence between the encrypted account information and the login interface identifier. In addition, since different users correspond to different account information, and the first terminal can support different users to enter account information to log in to the application, the password warehouse stores the preset correspondence between the SIM card identifier and the encrypted account information. In this way, after the user swipes the SIM card of the second terminal on the NFC reading device, the corresponding encrypted account information can be found in the password warehouse according to the SIM card identifier.

[0083] The SIM card identifier may be a mobile phone number.

[0084] By adopting the method provided in the embodiment of the present application, when the first terminal detects that the user has logged into the login interface, a prompt message can be displayed on the display interface of the first terminal after the user has successfully logged in. After the user swipes the SIM card of the second terminal with the NFC reader, the signature information can be obtained from the SIM card, so that the first terminal can encrypt the account information input by the user according to the acquired signature information, thereby obtaining the encrypted account information. In this way, the account information is encrypted and stored in the local password warehouse in the form of encrypted account information, which can improve the security of information storage, and because the first terminal does not store key information locally, even if the local password warehouse is attacked, the encrypted key information cannot be decrypted, thereby avoiding the leakage of account information.

[0085] In some embodiments of the present application, in order to further improve information security, the signature information sent by the second terminal to the NFC reading device may include the SIM card identifier and the encryption key information. Accordingly, in the case where the signature information includes the SIM card identifier and the encryption key information, Figure 1 The authentication method shown also includes:

[0086] The target public key corresponding to the SIM card identifier is searched in the preset correspondence between the SIM card identifier and the public key stored locally, and the encrypted key information is decrypted using the target public key to obtain the key information.

[0087] It can be understood that in order to improve the security of information, each SIM card corresponds to a unique public key.

[0088] Using the method provided in the embodiment of the present application, when the signature information includes the SIM card identifier and the encryption key information, the first terminal can search for the corresponding target public key in the preset correspondence between the SIM card identifier and the public key. The target public key can be used to decrypt the encrypted key information to obtain the key information. In this way, the key information is encrypted using the public key, which can improve the security of data transmission.

[0089] Before searching for the target public key corresponding to the SIM card identifier in the preset correspondence relationship between the SIM card identifier and the public key stored locally, the preset correspondence relationship is constructed. The method for constructing the preset correspondence relationship between the SIM card identifier and the public key can be specifically implemented as follows:

[0090] In response to the user's operation of using an NFC reader to read the key information provided by the SIM card, the key information and the SIM card identifier sent by the NFC reader are received, wherein the key information includes a target public key, and a preset correspondence relationship between the target public key and the SIM card identifier is established.

[0091] By adopting the method provided in the embodiment of the present application, after receiving the key information and SIM card identification fed back by the NFC reading device, the first terminal can locally store the preset correspondence between the public key and the SIM card identification in the key information. In this way, when the first terminal subsequently authenticates the second terminal, it is convenient to search the corresponding target public key locally according to the SIM card identification of the second terminal, thereby improving the authentication efficiency.

[0092] Based on the same concept, the embodiment of the present application also provides an authentication method, which is applied to the second terminal, specifically, Figure 4 As shown, the method includes:

[0093] S401: Receive a request instruction sent by a near field communication (NFC) reading device.

[0094] The request instruction includes a login interface identifier corresponding to the login interface in the first terminal.

[0095] S402: When the NFC reading device is authenticated, the target key information is searched according to the preset correspondence between the locally stored login interface identifier and the key information.

[0096] The key information is used to decrypt the encrypted account information in the first terminal.

[0097] S403: Send signature information to the NFC reading device, where the signature information includes target key information, so that the first terminal can use the target key information to decrypt the encrypted account information corresponding to the login interface identifier to obtain login information.

[0098] Using the method provided in the embodiment of the present application, after the user opens the login interface, the user swipes the second terminal on the NFC reading device, so that the NFC reading device sends a request instruction to the second terminal. The request instruction includes a login interface identifier corresponding to the login interface. On this basis, the second terminal searches for the target key information corresponding to the login interface identifier according to the preset correspondence, so that the second terminal sends the target key identifier to the first terminal, so that the first terminal can use the target key identifier to decrypt the encrypted account information corresponding to the locally stored login interface identifier. In this way, the terminal locally stores the encrypted encrypted account information, and the key information corresponding to the encrypted account information is stored in the SIM card of the second terminal. The method of storing the encrypted account information and the key information separately can improve the security of the user information stored locally in the terminal, thereby effectively ensuring the terminal information security.

[0099] It should be noted that in order to further improve information security and ensure the security of information transmission, the second terminal can also obtain the private key in the target key information before sending the signature information to the NFC reader; use the private key to encrypt the target key information to obtain the signature information.

[0100] Among them, the private key and the SIM card identifier are one-to-one corresponding, and the first terminal stores the corresponding relationship between the SIM card identifier and the public key. The private key and the public key corresponding to the same SIM card identifier are a pair of key pairs. The private key is used to encrypt the data in the second terminal. When the NFC reading device sends the encrypted data to the first terminal, the first terminal can use the public key to decrypt the encrypted data to obtain the data in plain text.

[0101] In this way, the target key information is encrypted using the locally stored private key, which can improve the data transmission security of the target key information.

[0102] In some embodiments of the application, in the above S302, when the NFC reading device is authenticated, before searching for the target key information according to the preset correspondence between the locally stored login interface identifier and the key information, the second terminal can perform a legitimacy check on the NFC reading device, thereby ensuring the security of the device and preventing access by illegal devices. Specifically, Figure 5 As shown, in the above S302, when the NFC reading device is authenticated, before searching for the target key information according to the preset correspondence between the locally stored login interface identifier and the key information, the method further includes:

[0103] S501: Send a card-side random number to an NFC reading device.

[0104] S502: Receive a first hash value fed back by an NFC reading device, where the first hash value is obtained by performing a hash calculation on a random number on the card side by the NFC reading device.

[0105] S503: When the locally calculated second hash value is the same as the first hash value, determine that the NFC reading device is authenticated.

[0106] It can be understood that the same hash algorithm is stored in the legitimate NFC reading device and the second terminal. Therefore, when the second hash value calculated locally is the same as the first hash value, it indicates that the NFC reading device is a legitimate device.

[0107] Using the method provided in the embodiment of the present application, after receiving the request instruction of the NFC reading device, the second device sends a card-side random number to the NFC reading device, receives a first hash value fed back by the NFC reading device, and the second device compares the first hash value with a second hash value calculated locally. Since the hash algorithm built into the legitimate NFC reading device is the same as the hash algorithm in the second terminal, the hash value can be used to determine whether the NFC reading device is a legitimate device.

[0108] In addition, in order to ensure the security of data transmission, after calculating the first hash, the NFC reading device can send the first hash value and the device random number generated by the NFC device to the second terminal. In this way, the second terminal can send signature information to the NFC reading device after the NFC reading device is verified. The signature information includes the encrypted key information and the device random number. Then the NFC reading device forwards the signature information and the device random number to the first terminal. The first terminal decrypts the signature information and verifies whether the device random number in the signature information is the same as the device random number synchronized by the NFC reading device. If they are the same, it means that the data interaction is normal. If they are different, it means that the NFC reading device may fail or be replaced during the data interaction process.

[0109] It should be noted that, when the above-mentioned second terminal passes the verification of the NFC reading device, it is also possible to establish a preset correspondence between the login interface identifier and the key information. Specifically, in the above-mentioned S302, when the NFC reading device is authenticated, before searching for the target key information based on the preset correspondence between the locally stored login interface identifier and the key information, the second terminal can generate the key information according to the preset key generation algorithm; and establish a preset correspondence between the login interface identifier and the key information.

[0110] Among them, the preset key generation algorithm is pre-set based on experience, and the embodiment of the present application does not impose any specific restrictions on the preset key generation algorithm.

[0111] In this way, the second terminal can generate corresponding key information for each login interface identifier through the built-in preset key generation algorithm, thereby establishing a preset correspondence between the login interface identifier and the key information. This ensures that the login interface and the key information are in a one-to-one correspondence, establishes a strong binding relationship between the login interface and the key information, and improves information security.

[0112] The following combination Figure 6 The method for storing encrypted account information provided by the embodiment of the present application is introduced, such as Figure 6 As shown, the method includes:

[0113] S601: The information processing device detects an account and password that needs to be saved, and displays a prompt message on a display interface.

[0114] The information processing device is installed in the first terminal, and the information processing device can be an application, a plug-in or a script.

[0115] S602: The NFC reading device queries the SIM card terminal whether there is a card application in the SIM card.

[0116] The card application refers to the authentication function provided by the SIM card. The SIM card side terminal is the second terminal in the above embodiment.

[0117] S603: The SIM card terminal returns a response instruction to the NFC reading device.

[0118] S604: The NFC reading device requests the SIM card terminal to obtain the secret management ID, public key and secret management key ID.

[0119] The key management ID is a unique identifier of the key management system, which is used to distinguish different key management instances or services. The key management key ID is used to create a unique identifier of the customer master key (CMK) in the key management system. The customer master key refers to the key used to encrypt the key.

[0120] S605: The SIM card terminal creates a key.

[0121] The SIM card side terminal determines the corresponding key management system according to the key management ID, and then manages and uses the key created by the key management key ID.

[0122] S606: The SIM card terminal returns the key ID, public key, secret management key ID and security element identifier SEID to the NFC reading device.

[0123] Among them, SEID (Secure Element ID) is a secure element identifier, which is a unique number associated with the device. SEID is associated with the NFC chip of the SIM card. The key ID, public key, secret key ID and secure element identifier SEID are the key information in the above embodiment.

[0124] S607: The NFC reading device returns the key ID, public key, secret management key ID and SEID to the information processing device.

[0125] S607: The information processing device uses SEID to encrypt the account password and stores it in the password repository.

[0126] The information processing device encrypts the account password using the SEID according to a preset encryption algorithm. The encryption algorithm and the SEID may correspond one to one. That is, the encryption algorithms corresponding to different SEIDs may be different. The embodiment of the present application does not limit the encryption algorithm.

[0127] According to the method provided in the embodiment of the present application, the information processing device detects that the user has entered the correct account information, and prompts the user to swipe the SIM card to save the account information. Then the NFC reading device obtains the key information from the SIM card side terminal, and forwards the obtained key information to the information processing device. Thus, the information processing device can use the key information to encrypt the account entered by the user, and locally store the corresponding relationship between the encrypted account information and the login interface. In this way, the information processing device encrypts the user's account information to ensure the security of the user data. And because the key information is not stored in the information processing device, the key information leakage is avoided, thereby further improving the security of the user data. In addition, since the encryption algorithms stored in the SIM card are different, the key information generated by different SIM cards is different, and the key information received by the first terminal is also different, and then the first terminal encrypts the account information in different ways, that is, the encrypted account information in the password warehouse and the SIM card are strongly bound. In the case of the second terminal or the SIM card being lost, the encrypted account information in the first terminal will not be leaked, thereby improving information security.

[0128] exist Figure 6 Based on the embodiment shown, when the user logs in to the client again, the information processing device can search for the corresponding account password in the local password warehouse for automatic login. Specifically, Figure 7 As shown, the method includes:

[0129] S701. The NFC reading device sends an application selection instruction to the SIM card terminal.

[0130] The application selection instruction includes a login interface identifier.

[0131] S702: The SIM card terminal feeds back a response instruction to the NFC reading device.

[0132] The response instruction includes a card-side random number sent by the SIM card-side terminal.

[0133] S703: The NFC reading device sends an authentication instruction to the SIM card terminal.

[0134] The authentication instruction includes a hash value of a random number on the card side and a device random number generated by an NFC reading device. The hash value of the random number on the card side is the first hash value in the above embodiment.

[0135] S704: The SIM card terminal verifies the random number hash value on the card side. If it is correct, the private key is used to sign the SEID and the device random number.

[0136] The same hash algorithm is pre-set in the SIM card terminal and the NFC reader. Therefore, if the second hash value calculated by the SIM card terminal for the card random number is the same as the first hash value calculated by the NFC reader for the card random number, it indicates that the NFC reader is a legitimate device.

[0137] S705: The SIM card terminal sends a response authentication instruction to the NFC reading device.

[0138] The response authentication instruction includes the signature information in the above embodiment. Specifically, the signature information includes the signature value obtained after the SIM card side terminal signs the SEID and the device side random number using a preset encryption algorithm and a private key, and the SIM card identifier.

[0139] S706. The NFC reading device sends the SEID and the signature value of the device random number to the information processing device.

[0140] The NFC reading device sends a device random number to the information processing device.

[0141] S707: The information processing device uses the public key to verify the signature value.

[0142] The public key and the private key are corresponding key pairs, the private key is used to encrypt data, and the public key is used to decrypt data. Therefore, after the information processing device uses the SIM card identifier to find the corresponding target public key, it can decrypt the signature value using the target public key and a preset decryption algorithm.

[0143] The information processing device is pre-set with a preset decryption algorithm corresponding to the above preset encryption algorithm.

[0144] S708: When the signature verification is successful, obtain the service identifier that the current terminal needs to log in and verify.

[0145] The service identifier is the login interface identifier in the above embodiment.

[0146] S709. Obtain the account password from the password repository according to the SEID and the business identifier.

[0147] Among them, SEID is the SIM card identifier of the SIM card. The information processing device searches the password warehouse for the account and password corresponding to different users of the service identifier according to the service identifier, and then uses SEID to search for the account and password corresponding to the current SIM card among the account and password corresponding to different users.

[0148] S710, synchronize the account and password to log in.

[0149] By using the method provided in the embodiment of the present application, after the user opens the login interface, the key information stored in the SIM card of the SIM card side terminal is obtained from the NFC reading device. Furthermore, after the information processing device searches for the encrypted account information corresponding to the login interface in the locally stored password warehouse, the encrypted account information can be decrypted using the above key information to obtain the login information corresponding to the login interface. In this way, the information processing device stores the encrypted encrypted account information locally, and the key information corresponding to the encrypted account information is stored in the SIM card of the SIM card side terminal. The method of storing the encrypted account information and the key information separately can improve the security of the user information stored locally in the terminal, thereby effectively ensuring the terminal information security.

[0150] In addition, since the first terminal locally stores a password repository, the first terminal can use the same SIM card to bind multiple accounts and passwords of the same client. When the user logs in, the first terminal can obtain multiple accounts and passwords of the client through the NFC reading device, and the user can choose the account and password required to log in.

[0151] Based on the same concept, the embodiment of the present application provides an authentication device, which is applied to a first terminal, such as Figure 8 As shown, the device comprises:

[0152] Display module 801, used to display a login interface in response to a user operation;

[0153] The receiving module 802 is used to receive signature information sent by a near field communication NFC reading device, where the signature information includes key information and the signature information is obtained by the NFC reading device from a subscriber identity module SIM card of the second terminal;

[0154] The decryption module 803 is used to obtain the encrypted account information corresponding to the login interface from the locally stored password repository, and decrypt the encrypted account information using the key information to obtain the login information.

[0155] In a possible implementation manner, the signature information includes a SIM card identifier and encryption key information; the device further includes:

[0156] A search module, used to search for a target public key corresponding to the SIM card identifier in a preset correspondence relationship between the SIM card identifier and the public key stored locally;

[0157] The decryption module 803 is used to decrypt the encrypted key information using the target public key to obtain the key information.

[0158] In a possible implementation, the device further includes:

[0159] The receiving module 802 is further configured to receive the key information and the SIM card identifier sent by the NFC reading device in response to an operation of the user using the NFC reading device to read the key information provided by the SIM card, wherein the key information includes the target public key;

[0160] A construction module is used to construct a preset corresponding relationship between the target public key and the SIM card identifier.

[0161] In a possible implementation, the device further includes:

[0162] a prompt module, configured to detect that a user logs into the login interface, and display a prompt message on the display interface of the first terminal, wherein the prompt message is used to remind the user to use the NFC reading device to read the signature information in the SIM card of the second terminal, wherein the signature information includes the key information;

[0163] The receiving module 802 is further configured to receive the signature information sent by the NFC reading device;

[0164] An encryption module, used to encrypt the account information input by the user on the login interface using the key information to obtain the encrypted account information;

[0165] A storage module is used to store the corresponding relationship between the encrypted account information and the login interface in the password warehouse.

[0166] It should be noted that the authentication device is a device corresponding to the above-mentioned method for authentication, and all implementation methods in the above-mentioned method embodiment are applicable to the embodiment of the device and can achieve the same technical effect.

[0167] Based on the same concept, the embodiment of the present application provides an authentication device, which is applied to a subscriber identification module SIM card in a second terminal, such as Fig. 9 As shown, the device comprises:

[0168] The receiving module 901 is used to receive a request instruction sent by a near field communication NFC reading device, wherein the request instruction includes a login interface identifier corresponding to the login interface in the first terminal;

[0169] A search module 902 is used to search for target key information according to a preset correspondence between a locally stored login interface identifier and key information when the NFC reading device is authenticated;

[0170] The sending module 903 is used to send signature information to the NFC reading device, where the signature information includes the target key information, so that the first terminal can use the target key information to decrypt the encrypted account information corresponding to the login interface identifier to obtain login information.

[0171] In a possible implementation, the device further includes:

[0172] An acquisition module, used for acquiring a private key in the target key information;

[0173] The encryption module is used to encrypt the target key information using the private key to obtain the signature information.

[0174] In a possible implementation, the device further includes:

[0175] The sending module 903 is further used to send the card-side random number to the NFC reading device;

[0176] The receiving module 901 is further configured to receive a first hash value fed back by the NFC reading device, where the first hash value is obtained by the NFC reading device performing a hash calculation on the card-side random number;

[0177] The authentication module is used to determine that the authentication of the NFC reading device is successful when the second hash value calculated locally is the same as the first hash value.

[0178] In a possible implementation, the device further includes:

[0179] A generation module, used to generate the key information according to a preset key generation algorithm;

[0180] A construction module is used to construct a preset corresponding relationship between the login interface identifier and the key information.

[0181] It should be noted that the authentication device is a device corresponding to the above-mentioned authentication method, and all implementation methods in the above-mentioned method embodiment are applicable to the embodiment of the device and can achieve the same technical effect.

[0182] Fig.10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0183] The electronic device may include a processor 1001 and a memory 1002 storing computer program instructions.

[0184] Specifically, the processor 1001 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0185] The memory 1002 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 1002 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 1002 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 1002 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 1002 is a non-volatile solid-state memory.

[0186] The memory may include read-only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical or other physical / tangible memory storage devices. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0187] The processor 1001 implements any one of the file access methods in the above embodiments by reading and executing computer program instructions stored in the memory 1002 .

[0188] In one example, the electronic device may further include a communication interface 1003 and a bus 1004. Fig.10As shown, the processor 1001, the memory 1002, and the communication interface 1003 are connected via a bus 1004 and communicate with each other.

[0189] The communication interface 1003 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0190] Bus 1004 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 1004 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0191] In addition, in combination with the authentication method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the authentication methods in the above embodiment is implemented.

[0192] In combination with the authentication method in the above embodiments, an embodiment of the present application may provide a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes any authentication method in the above embodiments.

[0193] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0194] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0195] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0196] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0197] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application.

Claims

1. A method of authentication, characterized in that: Applied to a first terminal, the method includes: In response to the user's operation, a login interface is displayed; Receiving signature information sent by a near field communication (NFC) reading device, the signature information including key information, the signature information being obtained by the NFC reading device from a subscriber identity module (SIM) card of the second terminal; The encrypted account information corresponding to the login interface is obtained from the locally stored password repository, and the encrypted account information is decrypted using the key information to obtain the login information.

2. The method according to claim 1, characterized in that The signature information includes the SIM card identification and encryption key information; the method further includes: Searching for a target public key corresponding to the SIM card identifier in a preset correspondence relationship between the SIM card identifier and the public key stored locally; The encrypted key information is decrypted using the target public key to obtain the key information.

3. The method according to claim 2, characterized in that Before searching for the target public key corresponding to the SIM card identifier in the preset correspondence relationship between the SIM card identifier and the public key stored locally, the method further includes: In response to an operation of a user using the NFC reader to read the key information provided by the SIM card, receiving the key information and the SIM card identifier sent by the NFC reader, wherein the key information includes the target public key; A preset correspondence between the target public key and the SIM card identifier is established.

4. The method according to claim 1, characterized in that: Before displaying the login interface in response to the user's operation, the method further includes: Detecting that a user logs in to the login interface, displaying a prompt message on the display interface of the first terminal, the prompt message is used to remind the user to use the NFC reading device to read the signature information in the SIM card of the second terminal, the signature information including the key information; Receiving the signature information sent by the NFC reading device; Using the key information to encrypt the account information input by the user on the login interface to obtain encrypted account information; The correspondence between the encrypted account information and the login interface is stored in the password repository.

5. A method of authentication, characterized in that: A subscriber identification module SIM card is applied to the second terminal, and the method comprises: Receiving a request instruction sent by a near field communication (NFC) reading device, wherein the request instruction includes a login interface identifier corresponding to the login interface in the first terminal; When the NFC reader is authenticated, the target key information is searched according to the preset correspondence between the locally stored login interface identifier and the key information; The signature information is sent to the NFC reading device, where the signature information includes the target key information, so that the first terminal uses the target key information to decrypt the encrypted account information corresponding to the login interface identifier to obtain the login information.

6. The method according to claim 5, characterized in that Before sending the signature information to the NFC reading device, the method further includes: Obtaining a private key from the target key information; The target key information is encrypted using the private key to obtain the signature information.

7. The method according to claim 6, characterized in that Before searching for target key information according to the preset correspondence between the locally stored login interface identifier and the key information, the method further includes: Sending a card-side random number to the NFC reading device; Receive a first hash value fed back by the NFC reading device, where the first hash value is obtained by the NFC reading device performing a hash calculation on the card-side random number; When the locally calculated second hash value is the same as the first hash value, it is determined that the NFC reading device is authenticated.

8. The method according to claim 5, characterized in that Before searching for target key information according to the preset correspondence between the locally stored login interface identifier and the key information, the method further includes: Generate the key information according to a preset key generation algorithm; A preset correspondence between the login interface identifier and the key information is constructed.

9. An authentication device, characterized in that: Applied to a first terminal, the device includes: A display module, used to display a login interface in response to a user's operation; A receiving module, used to receive signature information sent by a near field communication NFC reading device, wherein the signature information includes key information, and the signature information is obtained by the NFC reading device from a subscriber identity module SIM card of the second terminal; The decryption module is used to obtain the encrypted account information corresponding to the login interface from the locally stored password repository, and decrypt the encrypted account information using the key information to obtain the login information.

10. An authentication device, characterized in that: A subscriber identification module SIM card applied to a second terminal, the device comprising: A receiving module, configured to receive a request instruction sent by a near field communication (NFC) reading device, wherein the request instruction includes a login interface identifier corresponding to the login interface in the first terminal; A search module, used to search for target key information according to a preset correspondence between a locally stored login interface identifier and key information when the NFC reading device is authenticated; The sending module is used to send signature information to the NFC reading device, wherein the signature information includes the target key information, so that the first terminal uses the target key information to decrypt the encrypted account information corresponding to the login interface identifier to obtain login information.

11. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the authentication method as described in any one of claims 1-4 or claims 5-8 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the authentication method according to any one of claims 1 to 4 or claims 5 to 8 is implemented.

13. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the authentication method as described in any one of claims 1-4 or claims 5-8.

Images