Software login method and device

Abstract

The embodiment of the invention provides a software login method and device. The method comprises the following steps: the terminal equipment periodically detects a short-distance wireless communication signal; after detecting a short-distance wireless communication signal carrying a pre-stored target equipment identifier, the terminal equipment establishes a short-distance wireless communication connection with the portable authentication equipment; the terminal equipment receives the authorized login information sent by the portable authentication equipment, and performs signature verification on the authorized login information by using a public key in a digital certificate of the portable authentication equipment; the terminal equipment judges whether the signal strength of the received connection maintaining signal is greater than or equal to a first preset strength threshold value; and when the signal strength of the connection signal is kept to be greater than or equal to a first preset strength threshold value and the authorization login information passes the signature verification, the terminal equipment inputs the user login information into a login port of preset software in the terminal equipment so as to log in the preset software. According to the technical scheme provided by the invention, the problems of security risk and responsibility risk caused by leakage of the user account and password are avoided.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication technology, and in particular to a software login method and device. Background Art

[0002] In recent years, computer devices such as laptops, desktop computers, tablet computers, servers, and mobile phones have become increasingly popular in people's daily lives and work. People use these computer devices for work, entertainment, shopping, surfing the Internet, etc. It can be said that computer devices have become one of the indispensable and important tools in modern society.

[0003] With the popularization of various computer devices, the security issues of computer devices have become more and more prominent, such as hardware security, software security and network security. Among them, one of the more prominent security issues is the leakage of user accounts and passwords. Usually, in order to improve the security of computer devices, operating systems, application software and other software need to use user accounts and passwords to log in and complete permission authentication. After successful login, various functions of the software can be used.

[0004] However, in real life, security risks and liability risks caused by the leakage of user accounts and passwords often occur, and the inventor has conducted research on this. Summary of the invention

[0005] The embodiments of the present invention aim to solve one of the technical problems in the related art at least to a certain extent.

[0006] To this end, an embodiment of the present invention discloses a software login method and device, which uses a digital certificate mechanism to authenticate the identity of a portable authentication device. The terminal device uses the user login information to log in to the preset software only when it determines that the signal strength of the connection-maintaining signal sent by the portable authentication device is greater than or equal to a first preset strength threshold, thereby avoiding security risks and liability risks caused by leakage of user accounts and passwords.

[0007] In a first aspect, an embodiment of the present invention provides a software login method, which is applied to a communication system, wherein the communication system includes a terminal device and a portable authentication device, wherein the terminal device and the portable authentication device can be connected via a short-range wireless communication mode, and the terminal device pre-stores a target device identifier of the portable authentication device; the method includes: The terminal device periodically detects short-range wireless communication signals; The terminal device establishes a short-range wireless communication connection with the portable authentication device after detecting a short-range wireless communication signal carrying a pre-stored target device identification; The terminal device receives the authorized login information sent by the portable authentication device, and uses the public key in the digital certificate of the portable authentication device pre-stored to verify the signature of the authorized login information; wherein the authorized login information is obtained after the portable authentication device signs the user login information; The terminal device determines whether the signal strength of the received connection-maintaining signal sent by the portable authentication device is greater than or equal to a first preset strength threshold; When the signal strength of the connection maintaining signal is greater than or equal to the first preset strength threshold and the authorized login information verification is passed, the terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software.

[0008] Optionally, in some implementations of the first aspect of the present invention, the user login information is pre-stored in the portable authentication device, and the method further includes: When the signal strength of the connection maintaining signal is greater than or equal to the first preset strength threshold, the terminal device sends a login information acquisition request to the portable authentication device; After receiving the login information acquisition request, the portable authentication device signs the user login information to obtain the authorized login information; The portable authentication device sends the authorized login information to the terminal device.

[0009] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: The terminal device sends the user login information input by the user to the portable authentication device; The portable authentication device signs the user login information to obtain the authorized login information; The portable authentication device sends the authorized login information to the terminal device.

[0010] Optionally, in some implementations of the first aspect of the present invention, after the terminal device detects a short-range wireless communication signal carrying a pre-stored target device identifier, establishing a short-range wireless communication connection with the portable authentication device includes: The terminal device establishes a short-range wireless communication connection with the portable authentication device when detecting a short-range wireless communication signal carrying a pre-stored target device identifier and the signal strength of the short-range wireless communication signal is greater than or equal to a second preset strength threshold.

[0011] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: The portable authentication device performs identity authentication on the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The portable authentication device sends the authorized login information to the terminal device when the user identity authentication is completed.

[0012] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: The portable authentication device performs identity authentication on the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The portable authentication device sends a short-range wireless communication signal carrying the target device identification when the user identity authentication is completed.

[0013] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: The portable authentication device enters a passive mode after receiving a first operation from a user; In the passive mode, the portable authentication device sends the authorized login information to the terminal device when receiving the second operation of the user.

[0014] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: When the signal strength is less than the first preset strength threshold, the terminal device exits the login of the preset software.

[0015] Optionally, in some implementations of the first aspect of the present invention, when the signal strength is less than the first preset strength threshold, the terminal device exits the login of the preset software, including: When the duration of the signal strength being less than the first preset strength threshold exceeds the first preset duration, and the signal strength is greater than or equal to a third preset strength threshold, the terminal device exits the login of the preset software; When the signal strength is less than the third preset strength threshold, the terminal device exits the login of the preset software.

[0016] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: The portable authentication device obtains its own positioning information; The portable authentication device determines whether the portable authentication device is within a preset geographical range according to the positioning information; When the portable authentication device is within a preset geographical range, the portable authentication device sends the authorization login information.

[0017] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: When the portable authentication device is not within the preset geographical range and receives a third operation from the user, the portable authentication device sends emergency instruction information to the terminal device; When the terminal device receives the emergency instruction information, it controls the preset software to enter the emergency mode; The terminal device sends a temporary login request to the background management server via the Internet in the emergency mode; The terminal device receives temporary login information fed back by the background management server based on the temporary login request, and uses the temporary login information to log in to the preset software within a second preset time period.

[0018] Optionally, in some embodiments of the first aspect of the present invention, the method further comprises: Determine whether the user login information is in the login information list; If the user login information is in the login information list, the terminal device inputs the user login information into a login port of a preset software in the terminal device to log in to the preset software.

[0019] In a second aspect, an embodiment of the present invention further provides a software login device, which is applied to a communication system, wherein the communication system includes a terminal device and a portable authentication device, wherein the terminal device and the portable authentication device can be connected via a short-range wireless communication mode, and the terminal device pre-stores a target device identifier of the portable authentication device; the device includes: a detection module, an establishment module, a receiving module, a first judgment module and a login module located in the terminal device; a second sending module and a third sending module located in the portable authentication device; The detection module is used to periodically detect short-range wireless communication signals; The first sending module is used to send a short-range wireless communication signal carrying a target device identifier; The establishing module is used to establish a short-range wireless communication connection with the portable authentication device after detecting a short-range wireless communication signal carrying a pre-stored target device identification; The second sending module is used to send the authorization login information to the terminal device; The receiving module is used to receive the authorized login information sent by the portable authentication device, and use the public key in the digital certificate of the portable authentication device pre-stored to verify the signature of the authorized login information; wherein the authorized login information is obtained after the portable authentication device signs the user login information; The third sending module is used to send a connection maintenance signal to the terminal device; The first determination module is used to determine whether the signal strength of the received connection-maintaining signal sent by the portable authentication device is greater than or equal to a first preset strength threshold; The login module is used to input the user login information into the login port of the preset software in the terminal device to log in to the preset software when the signal strength of the connection signal is greater than or equal to the first preset strength threshold and the authorized login information verification is passed.

[0020] Optionally, in some implementations of the second aspect of the present invention, the user login information is pre-stored in the portable authentication device, and the apparatus further comprises: a fourth sending module located in the terminal device; a first signature module located in the portable authentication device; The fourth sending module is used for sending a login information acquisition request to the portable authentication device when the signal strength of the connection maintaining signal is greater than or equal to the first preset strength threshold; The first signature module is used to sign the user login information after receiving the login information acquisition request to obtain the authorized login information.

[0021] Optionally, in some implementations of the second aspect of the present invention, the apparatus further comprises: a fifth sending module located in the terminal device; a second signature module located in the portable authentication device; The fifth sending module is used to send the user login information input by the user to the portable authentication device; The second signature module is used to sign the user login information to obtain the authorized login information.

[0022] Optionally, in some implementations of the second aspect of the present invention, the establishing module is specifically used to: When a short-range wireless communication signal carrying a pre-stored target device identifier is detected and the signal strength of the short-range wireless communication signal is greater than or equal to a second preset strength threshold, a short-range wireless communication connection with the portable authentication device is established.

[0023] Optionally, in some implementations of the second aspect of the present invention, the apparatus further comprises: a first identity authentication module located in the portable authentication device; The first identity authentication module is used to authenticate the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The second sending module is used to send the authorized login information to the terminal device when the user identity authentication is completed.

[0024] Optionally, in some implementations of the second aspect of the present invention, the apparatus further comprises: a second identity authentication module located in the portable authentication device; The second identity authentication module is used to authenticate the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The first sending module is used to send a short-range wireless communication signal carrying the target device identification when the user identity authentication is completed.

[0025] Optionally, in some implementations of the second aspect of the present invention, the device further comprises: a mode switching module; The mode switching module is used to enter the passive mode after receiving a first operation from the user; The second sending module is used to send the authorized login information to the terminal device when receiving the second operation of the user in the passive mode.

[0026] Optionally, in some implementations of the second aspect of the present invention, the apparatus further comprises: an exit module located in the terminal device; The exit module is used to exit the login of the preset software when the signal strength is less than the first preset strength threshold.

[0027] Optionally, in some implementations of the second aspect of the present invention, the exit module is specifically used to: When the duration of the signal strength being less than the first preset strength threshold exceeds the first preset duration, and the signal strength is greater than or equal to a third preset strength threshold, log out of the preset software; When the signal strength is less than the third preset strength threshold, log out of the preset software.

[0028] Optionally, in some implementations of the second aspect of the present invention, the apparatus further comprises: a positioning module and a second determination module located in the portable authentication device; The positioning module obtains the positioning information of the portable authentication device; The second determination module is used to determine whether the portable authentication device is within a preset geographical range according to the positioning information; The second sending module is used to send the authorized login information to the terminal device when the portable authentication device is within a preset geographical range.

[0029] Optionally, in some implementations of the second aspect of the present invention, the apparatus further comprises: a sixth sending module located in the portable authentication device; a control module and a seventh sending module located in the terminal device; The sixth sending module is used to send emergency indication information to the terminal device when the portable authentication device is not within the preset geographical range and receives a third operation from the user; The control module is used to control the preset software to enter the emergency mode upon receiving the emergency indication information; The seventh sending module is used to send a temporary login request to the background management server through the Internet in the emergency mode; The receiving module is used to receive temporary login information fed back by the background management server based on the temporary login request; The login module is used to log in to the preset software within a second preset time period using the temporary login information.

[0030] Optionally, in some implementations of the second aspect of the present invention, the apparatus further comprises: a third determination module located in the terminal device; The third judgment module is used to judge whether the user login information is in the login information list; The login module is used to input the user login information into a login port of a preset software in the terminal device to log in to the preset software when the user login information is in the login information list.

[0031] Beneficial effects of the embodiments of the present invention: A software login method and device provided by an embodiment of the present invention is applied to a communication system, wherein the communication system includes a terminal device and a portable authentication device, wherein the terminal device and the portable authentication device can be connected via a short-distance wireless communication mode, and the terminal device pre-stores a target device identifier of the portable authentication device; the method includes: the terminal device periodically detects a short-distance wireless communication signal; after the terminal device detects a short-distance wireless communication signal carrying a pre-stored target device identifier, the terminal device establishes a short-distance wireless communication connection with the portable authentication device; the terminal device receives the authorization login information sent by the portable authentication device, and uses the public key in the digital certificate of the pre-stored portable authentication device to verify the authorization login information; the terminal device determines whether the signal strength of the connection-maintaining signal received from the portable authentication device is greater than or equal to a first preset strength threshold; when the signal strength of the connection-maintaining signal is greater than or equal to the first preset strength threshold, and the authorization login information verification passes, the terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software. The technical solution of the embodiment of the present invention adopts a digital certificate mechanism to authenticate the portable authentication device, and the terminal device uses the user login information to log in to the preset software only when it determines that the signal strength of the connection-maintaining signal sent by the portable authentication device is greater than or equal to the first preset strength threshold. It can be seen that the technical solution of the embodiment of the present invention cannot directly log in to the preset software based on the user login information without the participation of a portable authentication device, thereby avoiding the security risks and liability risks caused by the leakage of user accounts and passwords. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of a software login method provided by an embodiment of the present invention.

[0033] Figure 2 A schematic diagram of the structure of a software login device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to more clearly understand the above-mentioned purposes, features and advantages of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the technical concept of the embodiments of the present invention belong to the scope of protection of the present invention.

[0035] As mentioned in the background art, when a user account and password are used to log in to an operating system, application software, or other software in the prior art, security risks and liability risks often arise due to the leakage of the user account and password. To this end, an embodiment of the present invention provides a software login method and apparatus, which uses a portable authentication device to assist in the login process to complete the authority authentication.

[0036] Furthermore, a more specific technical concept of the embodiment of the present invention is: a short-range wireless communication method is used between the terminal device and the portable authentication device to achieve communication connection, and then the terminal device obtains the user login information from the portable authentication device, and uses a digital certificate mechanism to implement identity authentication of the portable authentication device. On this basis, when the signal strength of the connection-maintaining signal sent by the portable authentication device is greater than or equal to the first preset strength threshold, that is, when the portable authentication device is within the first set distance range of the terminal device, the terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software. The technical solution of the embodiment of the present invention uses a digital certificate mechanism to authenticate the portable authentication device, and the terminal device uses the user login information to log in to the preset software only when it determines that the signal strength of the connection-maintaining signal sent by the portable authentication device is greater than or equal to the first preset strength threshold. It can be seen that the technical solution of the embodiment of the present invention cannot directly log in to the preset software based on the user login information without the participation of the portable authentication device, thereby avoiding the security risks and liability risks caused by the leakage of user accounts and passwords.

[0037] After describing the technical concept of the embodiment of the present invention, the technical solution of the embodiment of the present invention will be described in detail below with reference to the accompanying drawings. Figure 1 The figure is a flow chart of a software login method provided by an embodiment of the present invention.

[0038] See also Figure 1 As shown, Figure 1 A software login method is provided in an embodiment of the present invention. Figure 1 The software login method is applied to a communication system, which includes a terminal device and a portable authentication device, wherein the terminal device and the portable authentication device can be connected via short-range wireless communication, and the terminal device pre-stores a target device identifier of the portable authentication device.

[0039] In actual applications, terminal devices can be laptops, desktop computers, tablet computers, mobile phones and other computer devices with communication, storage and computing capabilities. Portable authentication devices are small and easy-to-carry hardware devices such as Bluetooth Key, U-Shield, smart card, dynamic password token, etc. that can provide identity authentication and user login services. In daily life, portable authentication devices can usually be carried by putting them in clothing pockets or special storage bags, or by hand.

[0040] The portable authentication device and the terminal device can use short-range wireless communication technologies such as Bluetooth and Star Flash to achieve short-range wireless communication connection. The terminal device pre-stores the target device identification of the portable authentication device, indicating that the portable authentication device is a paired device of the terminal device. It is understandable that the pairing process can be implemented when the terminal device and the portable authentication device leave the factory, or can be pre-implemented by the administrator of the terminal device and the portable authentication device.

[0041] Further. Figure 1 The software login method shown may include the following steps: In step S101, the terminal device periodically detects short-range wireless communication signals.

[0042] Specifically, the terminal device periodically detects short-range wireless communication signals sent by other hardware devices other than the terminal device that use the short-range wireless communication protocol in accordance with the provisions of the standard of the short-range wireless communication protocol used between the terminal device and the portable authentication device. Among them, the short-range wireless communication signals sent by other hardware devices include device identification. In practical applications, the device identification can be a device name, a device PIN (Personal identification number) code, or other characters that can identify the identity of the hardware device.

[0043] Generally, the short-range wireless communication signals sent by other hardware devices are also periodic. The detection period of the terminal device and the period of sending short-range wireless communication signals by other hardware devices are related to the specific short-range wireless communication protocol adopted. Obviously, other hardware devices include portable authentication devices.

[0044] In step S102, after detecting the short-range wireless communication signal carrying the pre-stored target device identification, the terminal device establishes a short-range wireless communication connection with the portable authentication device.

[0045] Specifically, when the terminal device detects a short-range wireless communication signal carrying a pre-stored target device identifier, it indicates that the portable authentication device has entered the effective connection range of the terminal device, and the portable authentication device has the conditions to connect to the terminal device, and the terminal device establishes a short-range wireless communication connection with the portable authentication device. Among them, the process of establishing a short-range wireless communication connection between the terminal device and the portable authentication device is determined according to the short-range wireless communication protocol adopted between the terminal device and the portable authentication device. For example, when the Bluetooth communication protocol is adopted between the terminal device and the portable authentication device, the short-range wireless communication connection between the terminal device and the portable authentication device is realized according to the pairing process specified by the Bluetooth communication protocol.

[0046] In step S103, the terminal device receives the authorized login information sent by the portable authentication device, and uses the public key in the digital certificate of the portable authentication device stored in advance to verify the authorized login information.

[0047] The authorized login information is obtained after the portable authentication device signs the user login information. Generally, the user login information includes the user account and password. On the portable authentication device side, the portable authentication device signs the user login information using a private key to obtain the authorized login information.

[0048] In actual applications, the terminal device can communicate with the certificate authority that issues the digital certificate for the portable authentication device to obtain the digital certificate of the portable authentication device, or import the digital certificate of the portable authentication device through the physical interface of the terminal device, or obtain the digital certificate of the portable authentication device from the portable authentication device when establishing a short-range wireless communication connection with the portable authentication device for the first time. After receiving the authorized login information sent by the portable authentication device, the terminal device uses the public key in the digital certificate to verify the authorized login information.

[0049] In step S104, the terminal device determines whether the signal strength of the received connection-maintaining signal sent by the portable authentication device is greater than or equal to a first preset strength threshold.

[0050] Specifically, after the terminal device and the portable authentication device establish a short-range wireless communication connection, the portable authentication device periodically sends a keep-connected signal to the terminal device to ensure a stable connection between the terminal device and the portable authentication device. The keep-connected signal is used to ensure a stable connection between the terminal device and the portable authentication device. In actual use, it can be a heartbeat signal, etc.

[0051] In this step, when the terminal device receives the keep-connected signal sent by the portable authentication device, it can calculate the signal strength of the keep-connected signal, and then determine whether the signal strength of the keep-connected signal is greater than or equal to the first preset strength threshold. In practical applications, the signal strength of the keep-connected signal sent by the portable authentication device is consistent, and the signal strength of the keep-connected signal received by the terminal device reflects the distance between the terminal device and the portable authentication device. Therefore, the terminal device determines whether the signal strength of the keep-connected signal sent by the portable authentication device is greater than or equal to the first preset strength threshold, which is actually to determine whether the distance between the portable authentication device and the terminal device is within the first set distance. It should be noted that the selection criteria of the first set distance should consider both the security of the preset software login and the convenience of the preset software login. Generally, the first set distance should enable the surroundings of the terminal device to be seen by the carrier of the portable authentication device to avoid illegal login of the preset software, while taking into account that the carrier of the portable authentication device can meet the conditions for logging into the preset software immediately when arriving at the terminal device. For example, the first set distance can be selected as 3m, 2m, etc., and the corresponding first preset strength threshold can be obtained by calibration or set by experience.

[0052] In step S105, when the signal strength of the connection signal is maintained to be greater than or equal to the first preset strength threshold and the authorized login information is verified, the terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software.

[0053] Specifically, maintaining the signal strength of the connection signal greater than or equal to the first preset strength threshold indicates that the distance between the carrier of the portable authentication device and the terminal device is within the first set distance, and the verification of the authorized login information indicates that the identity of the portable authentication device is legal, so the terminal device has the conditions for logging into the preset software. The terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software.

[0054] In actual applications, the preset software may be system software or application software that requires user login information to log in, such as an operating system, a database, or an application software. The login port of the preset software may be an explicit login window (i.e., a login window visible to the user) or an implicit login window (i.e., a login window invisible to the user).

[0055] The software login method provided by the embodiment of the present invention is applied to a communication system, wherein the communication system includes a terminal device and a portable authentication device, wherein the terminal device and the portable authentication device can be connected via a short-distance wireless communication mode, and the terminal device pre-stores a target device identifier of the portable authentication device; the method includes: the terminal device periodically detects a short-distance wireless communication signal; after the terminal device detects a short-distance wireless communication signal carrying a pre-stored target device identifier, the terminal device establishes a short-distance wireless communication connection with the portable authentication device; the terminal device receives the authorization login information sent by the portable authentication device, and uses the public key in the digital certificate of the pre-stored portable authentication device to verify the authorization login information; the terminal device determines whether the signal strength of the connection-maintaining signal received from the portable authentication device is greater than or equal to a first preset strength threshold; when the signal strength of the connection-maintaining signal is greater than or equal to the first preset strength threshold, and the authorization login information verification passes, the terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software. The technical solution of the embodiment of the present invention adopts a digital certificate mechanism to authenticate the portable authentication device, and the terminal device uses the user login information to log in to the preset software only when it determines that the signal strength of the connection-maintaining signal sent by the portable authentication device is greater than or equal to the first preset strength threshold. It can be seen that the technical solution of the embodiment of the present invention cannot directly log in to the preset software based on the user login information without the participation of a portable authentication device, thereby avoiding the security risks and liability risks caused by the leakage of user accounts and passwords.

[0056] Furthermore, in actual applications, user login information may have a variety of different sources depending on actual needs and solution designs, as illustrated below.

[0057] Optionally, in some implementations of the embodiments of the present invention, the user login information is pre-stored in the portable authentication device. In specific implementations, the user login information can be entered through the terminal device and then synchronized to the portable authentication device through short-range wireless communication, or can be directly entered before the portable authentication device leaves the factory, or can be directly entered through the input interface on the portable authentication device. The embodiments of the present invention do not limit this.

[0058] Furthermore, the software login method of the embodiment of the present invention may also include: When the signal strength of the connection signal is maintained to be greater than or equal to a first preset strength threshold, the terminal device sends a login information acquisition request to the portable authentication device; After receiving the login information acquisition request, the portable authentication device signs the user login information to obtain the authorized login information; The portable authentication device sends the authorization login information to the terminal device.

[0059] In this implementation, the user login information is directly stored in the portable authentication device in advance, so as to avoid leakage of the user login information through other channels, thereby ensuring the security of the user login information. In addition, the process of obtaining the authorized login information is triggered only when the signal strength of the connection signal is kept greater than or equal to the first preset strength threshold, so as to avoid the portable authentication device merely entering the effective communication range of the terminal device and the user having no intention to log in to the preset software, that is, when the terminal device has no need to obtain the user login information, the portable authentication device sends the user login information to the terminal device, further improving the security of the user login information and being able to reduce the power consumption of the portable authentication device to a certain extent. In addition, in this implementation, the user does not need to enter the user login information, thereby increasing the convenience of logging in to the preset software.

[0060] Of course, in some other implementations, after the terminal device establishes a short-range wireless communication connection with the portable authentication device, the portable authentication device may immediately send the authorization login information to the terminal device.

[0061] Optionally, in some implementations of the embodiments of the present invention, the software login method of the embodiments of the present invention may further include: The terminal device sends the user login information input by the user to the portable authentication device; The portable authentication device signs the user login information to obtain the authorized login information; The portable authentication device sends the authorization login information to the terminal device.

[0062] It is obvious that in this implementation, an explicit login window needs to be provided for the preset software.

[0063] In this implementation, the user is required to input correct user login information, and a portable authentication device is required to perform auxiliary authentication, thereby ensuring the security of the user login information.

[0064] Furthermore, considering that the effective communication distance of Bluetooth and Star Flash reaches more than 10m or even farther, it is unnecessary for the terminal device to connect to the portable authentication device too early, and it will increase the power consumption of the portable authentication device. To this end, in some implementations of the embodiments of the present invention, step S102 may include: When the terminal device detects a short-range wireless communication signal carrying a pre-stored target device identifier and the signal strength of the short-range wireless communication signal is greater than or equal to a second preset strength threshold, the terminal device establishes a short-range wireless communication connection with the portable authentication device.

[0065] Among them, the second preset strength threshold is less than the first preset strength threshold, and the second set distance corresponding to the second preset strength threshold is greater than the first set distance. Generally, the second set distance should take into account the walking speed of a person and the time taken for the terminal device to establish a short-range wireless communication connection with the portable authentication device. Specifically, when the carrier of the portable authentication device is at the first set distance from the terminal device, the terminal device and the portable authentication device have completed the establishment of a short-range wireless communication connection. For example, the second set distance can be selected as 6m, 5m, etc. The corresponding second preset strength threshold can be obtained through calibration or set by experience.

[0066] In this implementation, the terminal device establishes a short-distance wireless communication connection with the portable authentication device only when the signal strength of the short-distance wireless communication signal is greater than or equal to the second preset strength threshold. Compared with the implementation in which the terminal device immediately establishes a short-distance wireless communication connection with the portable authentication device when detecting a short-distance wireless communication signal carrying a pre-stored target device identifier, the power consumption of the portable authentication device can be reduced.

[0067] Furthermore, considering the scenario where the portable authentication device is lost, a third person other than the legitimate user of the portable authentication device uses the portable authentication device to illegally log into the preset software, in some implementations of the embodiments of the present invention, the software login method of the embodiments of the present invention may further include: The portable authentication device authenticates the user based on the user's biometric information; After completing the user identity authentication, the portable authentication device sends the authorized login information to the terminal device.

[0068] The user biometric information may be fingerprint information, face information, etc. The portable authentication device collects the user biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user biometric information sent by the terminal device. For the method in which the portable authentication device receives the user biometric information sent by the terminal device, the biometric sensor is located on the terminal device, and the terminal device collects the user biometric information and synchronizes it to the portable authentication device.

[0069] In this implementation, the portable authentication device will send the authorization login information to the terminal device only after the user has passed the identity authentication based on the user's biometric information, ensuring that the user of the portable authentication device is the legitimate user of the portable authentication device, and effectively preventing a third party from illegally logging into the preset software using the portable authentication device. In addition, in this implementation, the user can flexibly choose whether to trigger the portable authentication device to send the authorization login information according to their own needs, which can avoid unnecessary login when the user has no intention to log in.

[0070] Optionally, in some other implementations of the embodiments of the present invention, the software login method of the embodiments of the present invention may further include: The portable authentication device authenticates the user based on the user's biometric information; When the portable authentication device has completed the user identity authentication, it sends a short-range wireless communication signal carrying the target device identification.

[0071] In this implementation, the portable authentication device will send a short-range wireless communication signal carrying the target device identification to the terminal device only after the user has passed the identity authentication based on the user's biometric information, ensuring that the user of the portable authentication device is the legitimate user of the portable authentication device, and effectively preventing a third party from illegally logging into the preset software using the portable authentication device. In addition, in this implementation, the user can flexibly choose whether to trigger the portable authentication device to send a short-range wireless communication signal according to their own needs, which can avoid unnecessary connections and logins when the user has no intention of logging in, and reduce the power consumption of the portable authentication device.

[0072] Furthermore, in consideration of the convenience of automatic login when the portable authentication device is close to the terminal device and the actual need in some scenarios (such as when the user performs some work near the terminal device that does not require the terminal device) in which the user carries the portable authentication device close to the terminal device but has no intention to log in, in some implementations of the embodiments of the present invention, the portable authentication device may be configured with an active mode and a passive mode. In the active mode, when the portable authentication device is close to the terminal device so that the signal strength of the connection-maintaining signal received by the terminal device is greater than or equal to a first preset strength threshold, the portable authentication device has sent the authorization login information (for example, the authorization login information is sent when the terminal device and the portable authentication device establish a short-range wireless communication connection) or immediately sends the authorization login information to the terminal device. In the passive mode, the portable authentication device sends the authorization login information to the terminal device only when the user performs the second operation on the portable authentication device. Specifically, the software login method of the embodiments of the present invention may also include: The portable authentication device enters a passive mode after receiving a first operation from the user; When the portable authentication device receives the second operation from the user in the passive mode, it sends the authorized login information to the terminal device.

[0073] Among them, in actual use, the first operation can be the input interface configured on the portable authentication device for the user to switch the active mode or the passive mode when the user operates; when a gravity sensor or a gyroscope sensor is configured in the portable authentication device, the first operation can also be a specific spatial movement operation of the portable authentication device, for example, the user's arm moving downward (first operation) triggers the passive mode, and the user's hand-raising movement triggers the active mode. The second operation can be the input interface configured on the portable authentication device for the user to trigger the sending of the authorized login information; when a gravity sensor or a gyroscope sensor is configured in the portable authentication device, the second operation can also be a specific spatial movement operation of the portable authentication device, for example, the user's hand-raising movement is used as the second operation to trigger the sending of the authorized login information to the terminal device. Obviously, the portable authentication device can enter the active mode by the user performing the first operation again, or by the user performing a fourth operation different from the first operation.

[0074] Furthermore, considering the need for the user to exit the preset software login when carrying the portable authentication device away from the terminal device. In some implementations of the embodiments of the present invention, the software login method of the embodiments of the present invention may further include: When the signal strength is less than the first preset strength threshold, the terminal device exits the login of the preset software.

[0075] Furthermore, considering some scenarios, such as when a user temporarily leaves the terminal device, such as when the user collects water or briefly communicates with a colleague near the terminal device, and the terminal device is within the user's perception range, there is no need to log out of the preset software. To improve the user experience in these scenarios, in some implementations of the embodiments of the present invention, when the signal strength is less than the first preset strength threshold, the terminal device logs out of the preset software, which may include: When the duration of the signal strength being less than the first preset strength threshold exceeds the first preset duration, and the signal strength is greater than or equal to the third preset strength threshold, the terminal device exits the login of the preset software; When the signal strength is less than the third preset strength threshold, the terminal device exits the login of the preset software.

[0076] The first preset duration may be an empirical value, such as 30 seconds, 2 minutes, etc. The third preset strength threshold is used to distinguish whether the user's departure distance can ensure the security of the preset software. The third preset strength threshold may be obtained through calibration or set through experience. In addition, when a second preset strength threshold is set for determining whether the terminal device establishes a short-range wireless communication connection with the portable authentication device, the third preset strength threshold should be greater than or equal to the second preset strength threshold, and should generally be greater than the second preset strength threshold.

[0077] Furthermore, considering security and the management regulations of some organizations, it is limited to only allow login to the terminal device within a preset distance range (for example, in an office location allowed by the company). To this end, in some implementations of the embodiments of the present invention, the software login method of the embodiments of the present invention may also include: The portable authentication device obtains its own location information; The portable authentication device determines whether the portable authentication device is within a preset geographical range according to the positioning information; When the portable authentication device is within a preset geographical range, the authorized login information is sent to the terminal device.

[0078] Furthermore, considering the special situation that an emergency login to a terminal device is required, when the portable authentication device is not within a preset geographical range, an embodiment of the present invention further provides an emergency solution. Specifically, in some implementations of the embodiments of the present invention, the software login method of the embodiments of the present invention may further include: When the portable authentication device is not within the preset geographical range and receives a third operation from the user, the portable authentication device sends emergency instruction information to the terminal device; When receiving the emergency instruction information, the terminal device controls the preset software to enter the emergency mode; The terminal device sends a temporary login request to the background management server via the Internet in emergency mode; The terminal device receives temporary login information fed back by the background management server based on the temporary login request, and uses the temporary login information to log in to the preset software within a second preset time period.

[0079] In actual use, the third operation may be an input interface configured on the portable authentication device for triggering the portable authentication device to send emergency indication information. The second preset time length may be an empirical value. For example, the second preset time length may be 10 minutes, 30 minutes, 1 hour, etc.

[0080] Furthermore, considering the situation where the corresponding user login information is cancelled in a scenario such as when the portable authentication device is lost, in some implementations of the embodiments of the present invention, the software login method of the embodiments of the present invention may further include: Determine whether the user login information is in the login information list; If the user login information is in the login information list, the terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software.

[0081] The default login information list lists legal user login information. Obviously, when the user login information is not in the login information list, the default software is prohibited from logging in.

[0082] It should be noted that the aforementioned method embodiment is a partial embodiment of the software login method, and other embodiments may exist under the technical concept of the embodiment of the present invention. For example, the user's biometric information and positioning information may be combined to determine whether to send the authorization login information. When the portable authentication device uses the user's biometric information to complete the identity authentication, and the positioning information of the portable authentication device indicates that the portable authentication device is within a preset geographical range, the portable authentication device sends the authorization login information to the terminal device. It is understandable that the combination of other implementations also constitutes an implementation of the embodiment of the present invention.

[0083] Corresponding to the above method embodiment, the embodiment of the present invention also discloses a software login device, which is applied to a communication system. The communication system includes a terminal device and a portable authentication device. The terminal device and the portable authentication device can be connected via short-range wireless communication. The terminal device pre-stores a target device identifier of the portable authentication device. Figure 2 As shown, the software login device of an embodiment of the present invention may include: a detection module 201, an establishment module 202, a receiving module 203, a first judgment module 204 and a login module 205 located in a terminal device; a first sending module 206, a second sending module 207 and a third sending module 208 located in a portable authentication device.

[0084] The detection module 201 is used to periodically detect short-range wireless communication signals; The first sending module 206 is used to send a short-range wireless communication signal carrying a target device identifier; The establishing module 202 is used to establish a short-range wireless communication connection with the portable authentication device after detecting a short-range wireless communication signal carrying a pre-stored target device identification; The second sending module 207 is used to send the authorization login information to the terminal device; The receiving module 202 is used to receive the authorized login information sent by the portable authentication device, and use the public key in the digital certificate of the portable authentication device pre-stored to verify the authorized login information; wherein the authorized login information is obtained after the portable authentication device signs the user login information; The third sending module 208 is used to send a connection-maintaining signal to the terminal device; The first judgment module 204 is used to judge whether the signal strength of the received connection-maintaining signal sent by the portable authentication device is greater than or equal to a first preset strength threshold; The login module 205 is used to input the user login information into the login port of the preset software in the terminal device to log in to the preset software when the signal strength of the connection signal is kept greater than or equal to the first preset strength threshold and the authorized login information verification is passed.

[0085] The software login device provided by the embodiment of the present invention uses a digital certificate mechanism to authenticate the portable authentication device, and the terminal device uses the user login information to log in to the preset software only when it determines that the signal strength of the connection-maintaining signal sent by the portable authentication device is greater than or equal to the first preset strength threshold. It can be seen that the technical solution of the embodiment of the present invention cannot directly log in to the preset software based on the user login information without the participation of the portable authentication device, thereby avoiding the security risks and liability risks caused by the leakage of user accounts and passwords.

[0086] Optionally, in some implementations of the embodiments of the present invention, the user login information is pre-stored in the portable authentication device, and the software login apparatus of the embodiments of the present invention further comprises: a fourth sending module located in the terminal device; a first signature module located in the portable authentication device; The fourth sending module is used to send a login information acquisition request to the portable authentication device when the signal strength of the connection signal is greater than or equal to the first preset strength threshold; The first signature module is used to sign the user login information after receiving the login information acquisition request to obtain authorized login information.

[0087] Optionally, in some implementations of the embodiments of the present invention, the software login device of the embodiments of the present invention further includes: a fifth sending module located in the terminal device; a second signature module located in the portable authentication device; The fifth sending module is used to send the user login information input by the user to the portable authentication device; The second signature module is used to sign the user login information to obtain authorized login information.

[0088] Optionally, in some implementations of the embodiments of the present invention, the establishing module 202 is specifically used to: When a short-range wireless communication signal carrying a pre-stored target device identifier is detected and the signal strength of the short-range wireless communication signal is greater than or equal to a second preset strength threshold, a short-range wireless communication connection with the portable authentication device is established.

[0089] Optionally, in some implementations of the embodiments of the present invention, the software login apparatus of the embodiments of the present invention further comprises: a first identity authentication module located in the portable authentication device; The first identity authentication module is used to authenticate the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The second sending module 207 is used to send the authorized login information to the terminal device when the user identity authentication is completed.

[0090] Optionally, in some implementations of the embodiments of the present invention, the software login device of the embodiments of the present invention further includes: a second identity authentication module located in the portable authentication device; The second identity authentication module is used to authenticate the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The first sending module 206 is used to send a short-range wireless communication signal carrying a target device identifier when the user identity authentication is completed.

[0091] Optionally, in some implementations of the embodiments of the present invention, the software login device of the embodiments of the present invention further includes: a mode switching module; The mode switching module is used to enter the passive mode after receiving the first operation of the user; The second sending module 207 is used to send the authorization login information to the terminal device when receiving the second operation of the user in the passive mode.

[0092] Optionally, in some implementations of the embodiments of the present invention, the software login device of the embodiments of the present invention further includes: an exit module located in the terminal device; The exit module is used to exit the login of the preset software when the signal strength is less than the first preset strength threshold.

[0093] Optionally, in some implementations of the embodiments of the present invention, the exit module is specifically used to: When the duration of the signal strength being less than the first preset strength threshold exceeds the first preset duration and the signal strength is greater than or equal to the third preset strength threshold, log out of the preset software; When the signal strength is less than the third preset strength threshold, log out of the preset software.

[0094] Optionally, in some implementations of the embodiments of the present invention, the software login device of the embodiments of the present invention further includes: a positioning module and a second judgment module located in the portable authentication device; The positioning module obtains the positioning information of the portable authentication device; The second determination module is used to determine whether the portable authentication device is within a preset geographical range according to the positioning information; The second sending module 207 is used to send the authorization login information to the terminal device when the portable authentication device is within a preset geographical range.

[0095] Optionally, in some implementations of the embodiments of the present invention, the software login device of the embodiments of the present invention further includes: a sixth sending module located in the portable authentication device; a control module and a seventh sending module located in the terminal device; The sixth sending module is used to send emergency instruction information to the terminal device when the portable authentication device is not within the preset geographical range and receives a third operation from the user; The control module is used to control the preset software to enter the emergency mode when receiving the emergency instruction information; The seventh sending module is used to send a temporary login request to the background management server via the Internet in the emergency mode; The receiving module 203 is used to receive temporary login information fed back by the background management server based on the temporary login request; The login module 205 is used to log in to the preset software within a second preset time period using the temporary login information.

[0096] Optionally, in some implementations of the embodiments of the present invention, the software login device of the embodiments of the present invention further includes: a third judgment module located in the terminal device; The third judgment module is used to judge whether the user login information is in the login information list; The login module 205 is used to input the user login information into the login port of the preset software in the terminal device to log in to the preset software when the user login information is in the login information list.

[0097] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention or certain parts of the embodiments.

[0098] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. In the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system and device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0099] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0100] The above-described embodiments of the present invention do not constitute a limitation on the protection scope of the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A software login method, characterized in that: Applied to a communication system, the communication system includes a terminal device and a portable authentication device, the terminal device and the portable authentication device can be connected via short-range wireless communication, and the terminal device pre-stores a target device identifier of the portable authentication device; the method includes: The terminal device periodically detects short-range wireless communication signals; The terminal device establishes a short-range wireless communication connection with the portable authentication device after detecting a short-range wireless communication signal carrying a pre-stored target device identification; The terminal device receives the authorized login information sent by the portable authentication device, and uses the public key in the digital certificate of the portable authentication device pre-stored to verify the signature of the authorized login information; wherein the authorized login information is obtained after the portable authentication device signs the user login information; The terminal device determines whether the signal strength of the received connection-maintaining signal sent by the portable authentication device is greater than or equal to a first preset strength threshold; When the signal strength of the connection maintaining signal is greater than or equal to the first preset strength threshold and the authorized login information verification is passed, the terminal device inputs the user login information into the login port of the preset software in the terminal device to log in to the preset software.

2. The method according to claim 1, characterized in that The user login information is pre-stored in the portable authentication device, and the method further includes: When the signal strength of the connection maintaining signal is greater than or equal to the first preset strength threshold, the terminal device sends a login information acquisition request to the portable authentication device; After receiving the login information acquisition request, the portable authentication device signs the user login information to obtain the authorized login information; The portable authentication device sends the authorized login information to the terminal device; Alternatively, the method further comprises: The terminal device sends the user login information input by the user to the portable authentication device; The portable authentication device signs the user login information to obtain the authorized login information; The portable authentication device sends the authorized login information to the terminal device.

3. The method according to claim 1, characterized in that After the terminal device detects a short-range wireless communication signal carrying a pre-stored target device identifier, establishing a short-range wireless communication connection with the portable authentication device includes: The terminal device establishes a short-range wireless communication connection with the portable authentication device when detecting a short-range wireless communication signal carrying a pre-stored target device identifier and the signal strength of the short-range wireless communication signal is greater than or equal to a second preset strength threshold.

4. The method according to claim 1, characterized in that: The method further comprises: The portable authentication device performs identity authentication on the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The portable authentication device sends the authorized login information to the terminal device when the user identity authentication is completed.

5. The method according to claim 1, characterized in that The method further comprises: The portable authentication device performs identity authentication on the user based on the user's biometric information; wherein the portable authentication device collects the user's biometric information through a biometric sensor configured thereon, or the portable authentication device receives the user's biometric information sent by the terminal device; The portable authentication device sends a short-range wireless communication signal carrying the target device identification when the user identity authentication is completed.

6. The method according to claim 1, characterized in that The method further comprises: The portable authentication device enters a passive mode after receiving a first operation from a user; When the portable authentication device receives a second operation from the user in the passive mode, the portable authentication device sends the authorized login information to the terminal device.

7. The method according to claim 1, characterized in that The method further comprises: When the duration of the signal strength being less than the first preset strength threshold exceeds the first preset duration, and the signal strength is greater than or equal to a third preset strength threshold, the terminal device exits the login of the preset software; When the signal strength is less than the third preset strength threshold, the terminal device exits the login of the preset software.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: The portable authentication device obtains its own positioning information; The portable authentication device determines whether the portable authentication device is within a preset geographical range according to the positioning information; When the portable authentication device is within a preset geographical range, the portable authentication device sends the authorized login information to the terminal device.

9. The method according to claim 8, characterized in that The method further comprises: When the portable authentication device is not within the preset geographical range and receives a third operation from the user, the portable authentication device sends emergency instruction information to the terminal device; When the terminal device receives the emergency instruction information, it controls the preset software to enter the emergency mode; The terminal device sends a temporary login request to the background management server via the Internet in the emergency mode; The terminal device receives temporary login information fed back by the background management server based on the temporary login request, and uses the temporary login information to log in to the preset software within a second preset time period.

10. A software login device, characterized in that: Applied to a communication system, the communication system includes a terminal device and a portable authentication device, the terminal device and the portable authentication device can be connected via short-range wireless communication, and the terminal device pre-stores a target device identifier of the portable authentication device; the device includes: a detection module, an establishment module, a receiving module, a first judgment module and a login module located in the terminal device; a first sending module, a second sending module and a third sending module located in the portable authentication device; The detection module is used to periodically detect short-range wireless communication signals; The first sending module is used to send a short-range wireless communication signal carrying a target device identifier; The establishing module is used to establish a short-range wireless communication connection with the portable authentication device after detecting a short-range wireless communication signal carrying a pre-stored target device identification; The second sending module is used to send the authorization login information to the terminal device; The receiving module is used to receive the authorized login information sent by the portable authentication device, and use the public key in the digital certificate of the portable authentication device pre-stored to verify the signature of the authorized login information; wherein the authorized login information is obtained after the portable authentication device signs the user login information; The third sending module is used to send a connection maintenance signal to the terminal device; The first determination module is used to determine whether the signal strength of the received connection-maintaining signal sent by the portable authentication device is greater than or equal to a first preset strength threshold; The login module is used to input the user login information into the login port of the preset software in the terminal device to log in to the preset software when the signal strength of the connection signal is greater than or equal to the first preset strength threshold and the authorized login information verification is passed.

Images