Authentication method and device

Abstract

The invention relates to the field of information security, in particular to an authentication method and device. In an identity authentication stage, a first authentication data packet is sent to a server; and a second authentication data packet is sent to the server, the coupling field in the second authentication data packet is the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet, and a scheme for improving the security of the SPA authentication method is provided.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to an authentication method and device. Background Art

[0002] With the development of Internet technology, network security issues are becoming increasingly prominent. Users use the SPA (Single Packet Authorization) protocol to verify the device and user identity before allowing access to the network, thereby achieving "network invisibility" and preventing attackers from finding service addresses and ports.

[0003] However, during the authentication process using the SPA protocol, if an attacker intercepts a data packet and replays the data packet to the gateway server, the gateway port can be opened to the attacker.

[0004] Therefore, how to improve the security of the SPA authentication method is an urgent problem to be solved. Summary of the invention

[0005] The embodiments of the present application provide an authentication method and device to provide a solution for improving the security of the SPA authentication method.

[0006] In a first aspect, an embodiment of the present application provides an authentication method, which is applied to an electronic device, and the method includes:

[0007] During the identity authentication phase, a first authentication data packet is sent to the server; and

[0008] A second authentication data packet is sent to the server, wherein a coupling field in the second authentication data packet is identical to part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

[0009] The above scheme sends two authentication data packets, and the second authentication data packet includes a coupling field for verification, so that the attacker cannot successfully attack after intercepting any authentication data packet. And the dependency between the two authentication data packets is ensured by the coupling field, which greatly improves the security of identity authentication.

[0010] In some optional implementations, the method further comprises:

[0011] Based on a target selection rule among a plurality of preset selection rules, determining a target position corresponding to the target selection rule in the first authentication data packet;

[0012] The coupling field is generated based on the data located at the target position in the first authentication data packet, and a second authentication data packet including the coupling field is generated.

[0013] In some optional implementations, the second authentication data packet also includes a rule identifier; the rule identifier is used to indicate the target selection rule.

[0014] In some optional implementations, the first authentication data packet includes a random number, the second authentication data packet includes the random number, and the random number is used to verify the first authentication data packet and the second authentication data packet.

[0015] In a second aspect, an embodiment of the present application provides an authentication method, which is applied to a server, and the method includes:

[0016] Receive a first authentication data packet and a second authentication data packet sent by the electronic device;

[0017] determining a coupling field in the second authentication data packet, and verifying the first authentication data packet and the second authentication data packet based on the coupling field;

[0018] Based on the verification result of the coupling field, the identity authentication results corresponding to the first authentication data packet and the second authentication data packet are determined.

[0019] In some optional implementations, the verifying the first authentication data packet and the second authentication data packet based on the coupling field includes:

[0020] Determining a target selection rule used by the electronic device when generating the coupling field based on the rule identifier carried in the second authentication data packet and a mapping relationship between the pre-stored rule identifier and the selection rule;

[0021] Determine a target position corresponding to the target selection rule in the first authentication data packet;

[0022] The coupling field is verified using the data at the target position. If the data at the target position is the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data at the target position is not the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet do not pass the coupling field verification.

[0023] In some optional implementations, after receiving the first authentication data packet and the second authentication data packet sent by the electronic device and before determining the identity authentication results of the first authentication data packet and the second authentication data packet, the method further includes:

[0024] Perform random number verification on the first authentication data packet and the second authentication data. If the first authentication data packet and the second authentication data packet both contain the same random number, it is determined that the first authentication data packet and the second authentication data packet pass the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, it is determined that the first authentication data packet and the second authentication data packet do not pass the random number verification.

[0025] In some optional implementations, determining the identity authentication results corresponding to the first authentication data packet and the second authentication data packet based on the verification result of the coupling field includes:

[0026] Based on the verification result of the coupling field and the random number verification result, the identity authentication results corresponding to the first authentication data packet and the second authentication data packet are determined.

[0027] In a third aspect, an embodiment of the present application provides an authentication device, the device comprising:

[0028] A first sending module, configured to send a first authentication data packet to a server during an identity authentication phase; and

[0029] The second sending module is used to send a second authentication data packet to the server, wherein a coupling field in the second authentication data packet is the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

[0030] In some optional implementations, the device is also used for:

[0031] Based on a target selection rule among a plurality of preset selection rules, determining a target position corresponding to the target selection rule in the first authentication data packet;

[0032] The coupling field is generated based on the data located at the target position in the first authentication data packet, and a second authentication data packet including the coupling field is generated.

[0033] In some optional implementations, the second authentication data packet also includes a rule identifier; the rule identifier is used to indicate the target selection rule.

[0034] In some optional implementations, the first authentication data packet includes a random number, the second authentication data packet includes the random number, and the random number is used to verify the first authentication data packet and the second authentication data packet.

[0035] In a fourth aspect, an embodiment of the present application provides an authentication device, the device comprising:

[0036] A receiving module, used to receive a first authentication data packet and a second authentication data packet sent by an electronic device;

[0037] a verification module, configured to determine a coupling field in the second authentication data packet, and verify the first authentication data packet and the second authentication data packet based on the coupling field;

[0038] A determination module is used to determine the identity authentication results corresponding to the first authentication data packet and the second authentication data packet based on the verification result of the coupling field.

[0039] In some optional implementations, the verification module is specifically used to:

[0040] Determining a target selection rule used by the electronic device when generating the coupling field based on the rule identifier carried in the second authentication data packet and a mapping relationship between the pre-stored rule identifier and the selection rule;

[0041] Determine a target position corresponding to the target selection rule in the first authentication data packet;

[0042] The coupling field is verified using the data at the target position. If the data at the target position is the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data at the target position is not the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet do not pass the coupling field verification.

[0043] In some optional implementation manners, the determination module is further configured to:

[0044] Performing random number verification on the first authentication data packet and the second authentication data packet, if the first authentication data packet and the second authentication data packet both contain the same random number, determining that the first authentication data packet and the second authentication data packet pass the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, determining that the first authentication data packet and the second authentication data packet do not pass the random number verification;

[0045] In some optional implementation manners, the determination module is specifically used to:

[0046] Based on the verification result of the coupling field and the random number verification result, the identity authentication results corresponding to the first authentication data packet and the second authentication data packet are determined.

[0047] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the steps of any method described in the first aspect or any method described in the second aspect.

[0048] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of any method described in the first aspect or any method described in the second aspect.

[0049] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of any method described in the first aspect or any method described in the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0052] Figure 2 A flowchart of an implementation of an authentication method provided in an embodiment of the present application;

[0053] Figure 3 A flowchart of generating a second authentication data packet provided in an embodiment of the present application;

[0054] Figure 4 A flowchart of an identity authentication provided in an embodiment of the present application;

[0055] Figure 5 A flowchart of coupling field verification provided in an embodiment of the present application;

[0056] Figure 6 A flowchart of random number verification provided in an embodiment of the present application;

[0057] Figure 7 A flowchart of a timestamp verification provided in an embodiment of the present application;

[0058] Figure 8 An overall implementation process provided for the embodiment of this application Figure 1 ;

[0059] Fig. 9 An overall implementation process provided for the embodiment of this application Figure 2 ;

[0060] Fig.10 An overall implementation process provided for the embodiment of this application Figure 3 ;

[0061] Fig.11 A schematic diagram of an authentication device provided in an embodiment of the present application Figure 1 ;

[0062] Fig.12 A schematic diagram of an authentication device provided in an embodiment of the present application Figure 2 ;

[0063] Fig.13 A schematic diagram of an electronic device provided in an embodiment of the present application;

[0064] Fig.14 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0066] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0067] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two devices. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0068] In order to facilitate understanding of the method, device, and electronic device for obtaining user information by a microservice provided in an embodiment of the present application, some terms in the embodiment of the present application are explained below to facilitate understanding by those skilled in the art.

[0069] SPA (Single Packet Authorization) is a network security technology that verifies the identity of the client by exchanging a small number of data packets between the client and the server, thereby allowing or denying access.

[0070] NTP (Network Time Protocol) is a protocol used to synchronize computer clocks in a network.

[0071] In order to make the purpose, technical solution and beneficial effects of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0072] like Figure 1 As shown, a schematic diagram of an application scenario of an embodiment of the present application, in the identity authentication stage, the electronic device 10 sends a first authentication data packet and a second authentication data packet to the server 11, and the server 11 performs identity authentication based on the first authentication data packet and the second authentication data packet.

[0073] Among them, wired transmission and / or wireless transmission can be performed between the electronic device 10 and the server 11.

[0074] In the embodiment of the present application, the electronic device 10 may be a terminal device used by a user, and the electronic device may be a computer device with certain computing capabilities, such as a personal computer, a mobile phone, a tablet computer, a notebook, an intelligent voice interaction device, a medical imaging device, etc. The electronic device 10 can support running a client.

[0075] In the embodiment of the present application, the server 11 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, cloud functions, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), as well as big data and artificial intelligence platforms.

[0076] Of course, the method provided in the embodiment of the present application is not limited to Figure 1 The application scenario shown can also be used in other possible application scenarios, which are not limited in the embodiments of the present application.

[0077] like Figure 2 As shown, an implementation flow chart of an authentication method in an embodiment of the present application, the specific steps are as follows:

[0078] Step S201, during the identity authentication phase, the electronic device sends a first authentication data packet to the server, and sends a second authentication data packet to the server.

[0079] During implementation, the client running on the electronic device performs identity authentication with the server through the electronic device.

[0080] In the embodiment of the present application, before the electronic device sends the first authentication data packet and the second authentication data packet to the server, it also includes signing the first authentication data packet and the second authentication data packet based on a private key to ensure the integrity and source of the data.

[0081] Step S202: The server performs identity authentication based on the coupling field in the second authentication data packet.

[0082] In an embodiment of the present application, after receiving the first authentication data packet and / or the second authentication data packet, the server decrypts the received authentication data packet and determines that the signature verification passes, and then performs identity authentication based on the authentication data carried in the first authentication data packet and the second authentication data packet.

[0083] The authentication data carried in the second authentication data packet includes a coupling field.

[0084] In step S201, the client Figure 3 The implementation flow chart shown generates a second authentication data packet, and the specific steps are as follows:

[0085] Step S301: The electronic device determines a target position corresponding to a target selection rule in a first authentication data packet based on a target selection rule among a plurality of preset selection rules.

[0086] Optionally, the first authentication data packet in the embodiment of the present application may include: a first data packet version number (Version) and a first data packet type (Type).

[0087] It should be noted that the data packet version number represents the version of the SPA data packet to ensure compatibility between the client and the server. The data packet type represents the type of the data packet.

[0088] In the embodiment of the present application, the first data packet version number included in the first authentication data packet represents the version number of the first authentication data packet, and the first data packet type may be an initialization request type.

[0089] Optionally, each of the multiple preset selection rules in the embodiment of the present application represents the location of the selected data, and different selection rules represent different locations of the selected data.

[0090] Exemplarily, rule 1 is selected to represent position 1, position 3, and position 5, and rule 2 is selected to represent position 2, position 6, and position 7.

[0091] It should be noted that the positions of the selected data represented by the selection rules in the above examples are only examples, and the embodiments of the present application do not limit the number of positions represented by the selection rules, and do not limit how to set the positions in the selection rules.

[0092] In the embodiment of the present application, a selection rule is randomly determined as a target selection rule from a plurality of preset selection rules, and the position represented by the target selection rule is used as the target position corresponding to the target selection rule in the first authentication data packet.

[0093] Exemplarily, if the target selection rule is the above-mentioned selection rule 1, the position 1, position 3 and position 5 represented by the selection rule 1 are used as the target positions corresponding to the target selection rule in the first authentication data.

[0094] Step S302: The electronic device generates a coupling field based on the data located at the target position in the first authentication data packet, and generates a second authentication data packet including the coupling field.

[0095] That is, the coupling field in the second authentication data packet is identical to part of the data in the first authentication data packet.

[0096] Exemplarily, if the target selection rule is the above selection rule 1, the data at position 1, the data at position 3 and the data at position 5 in the first authentication data packet are combined to generate a coupling field.

[0097] Optionally, the second authentication data packet in the embodiment of the present application may include: a second data packet version number (Version), a second data packet type (Type) and a coupling field.

[0098] In the embodiment of the present application, the second data packet version number contained in the second authentication data packet represents the version number of the second authentication data packet, and the second data packet type may be a confirmed response type.

[0099] Optionally, in an embodiment of the present application, the second authentication data packet may further include a rule identifier, where the rule identifier is used to indicate a target selection rule.

[0100] It should be noted that each preset selection rule has an associated rule identifier, and each rule identifier is used to represent the selection rule associated with the rule identifier.

[0101] Exemplarily, the rule identifier associated with the selection rule 1 may be 1, and the rule identifier associated with the selection rule 2 may be 2. Then the rule identifier 1 represents the selection rule 1, and the rule identifier 2 represents the selection rule 2.

[0102] In step S202, after receiving the first authentication data packet and the second authentication data packet sent by the electronic device, the server Figure 4 The implementation flowchart shown in the figure is used for identity authentication. The specific steps are as follows:

[0103] Step S401: The server determines a coupling field in the second authentication data packet, and verifies the first authentication data packet and the second authentication data packet based on the coupling field.

[0104] It should be noted that the coupling field is located at a position in the second authentication data packet for placing the coupling field, and the server can read the coupling field from the preset position for placing the coupling field.

[0105] like Figure 5 As shown, a flowchart of an implementation of coupling field verification in an embodiment of the present application, the specific steps are as follows:

[0106] Step S501: The server determines the target selection rule used by the electronic device when generating the coupling field based on the rule identifier carried in the second authentication data packet and the mapping relationship between the pre-stored rule identifier and the selection rule.

[0107] Exemplarily, the pre-stored mapping relationship may be a mapping relationship between rule identifier 1 and selection rule 1, a mapping relationship between rule identifier 2 and selection rule 2, and so on.

[0108] It should be noted that the mapping relationship between each selection rule and the rule identifier in the server and the electronic device is the same. This application does not limit the representation form of each rule identifier, but the server and the electronic device have the same settings for the rule identifier and the selection rule.

[0109] Step S502: The server determines a target position corresponding to a target selection rule in a first authentication data packet.

[0110] The position represented by the target selection rule is used as the target position corresponding to the target selection rule in the first authentication data packet.

[0111] Step S503: the server verifies the coupling field using the data of the target location to obtain a coupling field verification result.

[0112] In an embodiment of the present application, if the data at the target location is the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data at the target location is not the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet do not pass the coupling field verification.

[0113] Step S402: The server determines the identity authentication results corresponding to the first authentication data packet and the second authentication data packet based on the verification result of the coupling field.

[0114] Optionally, the coupling field verification result includes: passing the coupling field verification and failing the coupling field verification. The identity authentication result includes: passing the identity authentication and failing the identity authentication.

[0115] In the embodiment of the present application, if the coupling field verification fails, it is determined that the identity authentication fails.

[0116] In an optional implementation, in addition to determining the identity authentication result based on the coupling field verification result, the embodiment of the present application can also determine the identity authentication result in combination with the random number verification result.

[0117] In this implementation, the first authentication data packet includes a random number, and the second authentication data packet includes the random number.

[0118] For ease of introduction, the random number included in the first authentication data packet is referred to as the first random number. When the client generates the second authentication data packet, it generates the second authentication data packet based on the second random number and the first random number in the first authentication data packet. The authentication data in the second authentication data packet includes the first random number and the second random number.

[0119] It should be noted that the random number is randomly generated by the client. The second random number is a new random number generated by the client. The random number is used to verify the first authentication data packet and the second authentication data packet.

[0120] like Figure 6 As shown, after the server receives the first authentication data packet and the second authentication data packet sent by the electronic device, the embodiment of the present application provides an implementation flow chart of random number verification of the first authentication data packet and the second authentication data, and the specific steps are as follows:

[0121] Step S601: The server reads the random number in the first authentication data packet and the random number in the second authentication data packet.

[0122] Step S602: The server determines a random number verification result by comparing the random number in the first authentication data packet with the random number in the second authentication data packet.

[0123] Optionally, the random number verification result includes: passing the random number verification and failing the random number verification.

[0124] In an embodiment of the present application, if the first authentication data packet and the second authentication data packet both contain the same random number, it is determined that the first authentication data packet and the second authentication data packet pass the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, it is determined that the first authentication data packet and the second authentication data packet do not pass the random number verification.

[0125] The server then determines the identity authentication results of the first authentication data packet and the second authentication data packet based on the verification result of the coupling field and the random number verification result.

[0126] Optionally, the embodiment of the present application may also use another random number verification method, and the validity of the random number is verified by the random number verification method in the SPA authentication method. For example, the random number verification method in the authentication method verifies the validity of the random number in the second authentication data packet.

[0127] It should be noted that verifying the validity of random numbers through the random number verification method in the SPA authentication method is a prior art and will not be described in detail in this application.

[0128] In another optional implementation, the embodiment of the present application may also perform timestamp verification on the first authentication data packet and the second authentication data packet, and determine the identity authentication result based on the coupling field verification result, the random number verification result and the timestamp verification result.

[0129] In this embodiment, the authentication data in the first authentication data packet also includes a first timestamp, which is used to record the generation time of the first authentication data packet. The authentication data in the second authentication data packet also includes a second timestamp, which is used to record the generation time of the second authentication data packet.

[0130] like Figure 7 As shown, after the server receives the first authentication data packet and the second authentication data packet sent by the electronic device, the embodiment of the present application provides an implementation flow chart of timestamp verification, and the specific steps are as follows:

[0131] Step S701: The server obtains a first timestamp in a first authentication data packet and a second timestamp in a second authentication data packet.

[0132] Step S702: The server obtains a timestamp verification result by comparing the difference between the first timestamp and the second timestamp with a time threshold.

[0133] Optionally, the timestamp verification result includes: passing the timestamp verification and failing the timestamp verification.

[0134] In an embodiment of the present application, if the difference between the first timestamp and the second timestamp is not greater than the time threshold, it is determined that the first authentication data packet and the second authentication data packet pass the timestamp verification; if the difference between the first timestamp and the second timestamp is greater than the time threshold, it is determined that the first authentication data packet and the second authentication data packet do not pass the timestamp verification.

[0135] Exemplarily, the time threshold may be set to 2 seconds.

[0136] It should be noted that in the embodiment of the present application, the server may receive the first authentication data packet first, or the second authentication data packet first, or the first authentication data packet and the second authentication data packet at the same time. As long as the timestamp difference between the first authentication data packet and the second authentication data packet is not greater than 2 seconds, it can be determined that the timestamp verification has been passed.

[0137] In the embodiment of the present application, when the server determines that the identity authentication is passed after passing the coupling field verification, the random number verification, and the timestamp verification, the server allows the client on the electronic device to access.

[0138] Optionally, the authentication data carried in the second authentication data packet in the embodiment of the present application may be a coupling field, a first random number, a second random number, and a second timestamp. The authentication data is used to perform identity authentication on the first authentication data packet and the second authentication data packet.

[0139] The first random number is used to verify the identity of the client, the second random number is a new random number generated by the client, and the second timestamp is used to prevent replay attacks.

[0140] like Figure 8 As shown, an overall implementation process of the embodiment of the present application Figure 1 , the specific steps are as follows:

[0141] Step S801: The client sends a first authentication data packet to the server.

[0142] The client runs on an electronic device and interacts with the server through the electronic device, so the actions performed by the client can also be understood as actions performed by the electronic device.

[0143] Step S802: The server preliminarily verifies the first authentication data packet.

[0144] Illustratively, during the preliminary verification process, the embodiment of the present application decrypts the first authentication data packet and performs signature verification.

[0145] Optionally, the embodiment of the present application may also verify the validity of the first random number in the first authentication data packet based on the random number verification method in the SPA authentication method during the preliminary verification process.

[0146] Step S803: After the first authentication data packet passes the preliminary verification, the server records the data in the first authentication data packet.

[0147] Step S804: the client sends a second authentication data packet to the server.

[0148] Step S805: the server preliminarily verifies the second authentication data packet.

[0149] Illustratively, the embodiment of the present application performs signature verification after decrypting the second authentication data packet.

[0150] Illustratively, during the preliminary verification process, the embodiment of the present application decrypts the second authentication data packet and performs signature verification.

[0151] Optionally, during the preliminary verification process, the embodiment of the present application may also verify the validity of the random number in the second authentication data packet based on the random number verification method in the SPA authentication method.

[0152] Step S806: The server verifies the data in the first authentication data packet and the second authentication data packet.

[0153] Exemplarily, coupling field verification, random number verification and timestamp verification are performed based on data in the first authentication data packet and the second authentication data packet.

[0154] Optionally, the server performs coupling field verification, random number verification and timestamp verification on the first authentication data packet and the second authentication data packet based on the authentication data in the second authentication data packet.

[0155] The authentication data in the second authentication data packet may include a first random number, a second random number, a coupling field and a second timestamp.

[0156] Step S807: The server sends an identity authentication response to the client.

[0157] When the server determines that the authentication is successful, it notifies the client of the success of the authentication through an authentication response and allows the client to access.

[0158] For the client side, such as Fig. 9 As shown, an overall implementation process of the embodiment of the present application Figure 2 , the specific steps are as follows:

[0159] Step S901: The client generates a first random number.

[0160] Step S902: The client generates a first timestamp, and generates a first authentication data packet based on the first random number and the first timestamp.

[0161] Step S903: The client uses a private key to sign the first authentication data packet.

[0162] Step S904: the client sends a first authentication data packet to the server.

[0163] Step S905: The client generates a second random number.

[0164] Step S906: The client generates a second timestamp, and generates a second authentication data packet based on the second random number, the second timestamp and the coupling field.

[0165] The coupling field is generated based on the first authentication data packet, and the coupling field is identical to part of the data in the first authentication data packet.

[0166] Step S907: The client uses the private key to sign the second authentication data packet.

[0167] Step S908: The client sends a second authentication data packet to the server.

[0168] It should be noted that the embodiments of the present application do not limit the order of generating random numbers and generating timestamps.

[0169] For the server side, such as Fig.10 As shown, an overall implementation process of the embodiment of the present application Figure 3 , the specific steps are as follows:

[0170] Step S1001: The server performs preliminary verification on a received first authentication data packet, and after the first authentication data packet passes the preliminary verification, records the data in the first authentication data packet.

[0171] Step S1002: The server performs preliminary verification on the received second authentication data packet.

[0172] Step S1003: After the second authentication data packet passes the preliminary verification, the server compares the random number in the second authentication data packet with the random number in the first authentication data packet. If the first authentication data packet and the second authentication data packet contain the same random number, it is determined that the random number verification has passed.

[0173] Step S1004: the server compares the second timestamp in the second authentication data packet with the first timestamp in the first authentication data packet. If the difference between the first timestamp and the second timestamp is not greater than the time threshold, it is determined that the first authentication data packet and the second authentication data packet pass the timestamp verification.

[0174] Step S1005, the server compares the coupling field in the second authentication data with the data at the target position in the first authentication data packet. If the data in the coupling field is the same as the data at the target position in the first authentication data packet, it is determined that the coupling field verification has been passed.

[0175] Step S1006: If the coupling field verification, the random number verification and the timestamp verification are passed, the server determines that the identity authentication is passed and allows the client to access.

[0176] If any of the above verifications fails, the server notifies the client to resend the data packet.

[0177] Beneficial effects of this application:

[0178] 1. Improve safety:

[0179] By increasing the coupling degree between authentication data packets, man-in-the-middle attacks and replay attacks are prevented. The single-packet authentication method in the prior art is vulnerable to attacks, and although the double-packet authentication method has been improved, it lacks a strict coupling mechanism. The present application adds a coupling field in the second authentication data packet to ensure the dependency between the first authentication data packet and the second authentication data packet, thereby greatly improving the security of authentication.

[0180] By strictly controlling the timestamp and random number, the freshness and uniqueness of the data packet are ensured, further preventing replay attacks. This multi-factor authentication mechanism makes it difficult for attackers to forge valid data packets.

[0181] 2. Simplify the process:

[0182] The client only needs to send two data packets, and the server does not return any data packets, which simplifies the authentication process. This simplification not only reduces communication overhead, but also improves the efficiency and response speed of the system.

[0183] By reducing the number of server responses, the server load is reduced and the overall system performance is improved.

[0184] 3. Enhanced reliability:

[0185] Through strict control of timestamps and random numbers, the freshness and uniqueness of data packets are ensured, and the reliability of the system is enhanced. The use of time synchronization protocols (such as NTP) ensures the time consistency between the client and the server, preventing authentication failures due to time differences. Set a strict time window, such as ±2 seconds. The freshness and legitimacy of the data packet are further ensured through time difference verification.

[0186] By verifying the matching of multiple fields, the integrity and accuracy of the authentication process are ensured, and the robustness of the system is improved.

[0187] The embodiment of the present application ensures the uniqueness of each request by using the first random number and the second random number, ensures the freshness of the data packet by using the first timestamp and the second timestamp, and ensures the integrity and source credibility of the data by using the first signature (Signature1) and the second signature (Signature2).

[0188] It should be noted that the first signature is the signature corresponding to the first authentication data packet, and the second signature is the signature corresponding to the second authentication data packet.

[0189] like Fig.11 As shown, the present application provides an authentication device schematic Figure 1 ,include:

[0190] A first sending module 1101 is used to send a first authentication data packet to a server during an identity authentication phase; and

[0191] The second sending module 1102 is used to send a second authentication data packet to the server, wherein a coupling field in the second authentication data packet is identical to part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

[0192] In some optional implementations, the device is also used for:

[0193] Based on a target selection rule among a plurality of preset selection rules, determining a target position corresponding to the target selection rule in the first authentication data packet;

[0194] The coupling field is generated based on the data located at the target position in the first authentication data packet, and a second authentication data packet including the coupling field is generated.

[0195] In some optional implementations, the second authentication data packet also includes a rule identifier; the rule identifier is used to indicate the target selection rule.

[0196] In some optional implementations, the first authentication data packet includes a random number, the second authentication data packet includes the random number, and the random number is used to verify the first authentication data packet and the second authentication data packet.

[0197] like Fig.12 As shown, the present application provides an authentication device schematic Figure 2 ,include:

[0198] The receiving module 1201 is used to receive a first authentication data packet and a second authentication data packet sent by an electronic device;

[0199] A verification module 1202, configured to determine a coupling field in the second authentication data packet, and verify the first authentication data packet and the second authentication data packet based on the coupling field;

[0200] The determination module 1203 is used to determine the identity authentication results corresponding to the first authentication data packet and the second authentication data packet based on the verification result of the coupling field.

[0201] In some optional implementations, the verification module 1202 is specifically used to:

[0202] Determining a target selection rule used by the electronic device when generating the coupling field based on the rule identifier carried in the second authentication data packet and a mapping relationship between the pre-stored rule identifier and the selection rule;

[0203] Determine a target position corresponding to the target selection rule in the first authentication data packet;

[0204] The coupling field is verified using the data at the target position. If the data at the target position is the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data at the target position is not the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet do not pass the coupling field verification.

[0205] In some optional implementation manners, the determining module 1203 is further configured to:

[0206] Performing random number verification on the first authentication data packet and the second authentication data packet, if the first authentication data packet and the second authentication data packet both contain the same random number, determining that the first authentication data packet and the second authentication data packet pass the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, determining that the first authentication data packet and the second authentication data packet do not pass the random number verification;

[0207] The determination module 1203 is specifically used for:

[0208] Based on the verification result of the coupling field and the random number verification result, the identity authentication results corresponding to the first authentication data packet and the second authentication data packet are determined.

[0209] Based on the same inventive concept as the above-mentioned method embodiment, an electronic device is also provided in the embodiment of the present application. The principle of solving the problem by the electronic device is similar to the method of the above-mentioned embodiment. Therefore, the implementation of the electronic device can refer to the implementation of the above-mentioned method, and the repeated parts will not be repeated.

[0210] See also Fig.13As shown, the electronic device 130 may include at least a processor 131 and a memory 132. The memory 132 stores a program code, and when the program code is executed by the processor 131, the processor 131 executes the steps of the microservice method for obtaining user information in the above embodiment of the present application.

[0211] Refer to the following Fig.14 The electronic device 140 according to this embodiment of the present application is described. Fig.14 The electronic device 140 is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0212] like Fig.14 The electronic device 140 is in the form of a general electronic device. The components of the electronic device 140 may include but are not limited to: at least one processing unit 141, at least one storage unit 142, and a bus 143 connecting different system components (including the storage unit 142 and the processing unit 141).

[0213] Bus 143 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0214] The storage unit 142 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1421 and / or a cache memory 1422 , and may further include a read-only memory (ROM) 1423 .

[0215] The storage unit 142 may also include a program / utility 1414 having a set (at least one) of program modules 1424, such program modules 1424 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0216] The electronic device 140 may also communicate with one or more external devices 144 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable objects to interact with the electronic device 140, and / or communicate with any device that enables the electronic device 140 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 145. Furthermore, the electronic device 140 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 146. As shown, the network adapter 146 communicates with other modules for the electronic device 140 via a bus 143. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 140, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0217] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0218] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0219] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0220] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0221] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An authentication method, characterized in that: Used in electronic equipment, including: During the identity authentication phase, a first authentication data packet is sent to the server; and A second authentication data packet is sent to the server, wherein a coupling field in the second authentication data packet is identical to part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

2. The method according to claim 1, characterized in that The method further comprises: Based on a target selection rule among a plurality of preset selection rules, determining a target position corresponding to the target selection rule in the first authentication data packet; The coupling field is generated based on the data located at the target position in the first authentication data packet, and a second authentication data packet including the coupling field is generated.

3. The method according to claim 2, characterized in that The second authentication data packet also includes a rule identifier; the rule identifier is used to indicate the target selection rule.

4. The method according to claim 2, characterized in that: The first authentication data packet includes a random number, and the second authentication data packet includes the random number, and the random number is used to verify the first authentication data packet and the second authentication data packet.

5. An authentication method, characterized in that: Applicable to servers, including: Receive a first authentication data packet and a second authentication data packet sent by the electronic device; determining a coupling field in the second authentication data packet, and verifying the first authentication data packet and the second authentication data packet based on the coupling field; Based on the verification result of the coupling field, the identity authentication results corresponding to the first authentication data packet and the second authentication data packet are determined.

6. The method according to claim 5, characterized in that The verifying the first authentication data packet and the second authentication data packet based on the coupling field comprises: Determining a target selection rule used by the electronic device when generating the coupling field based on the rule identifier carried in the second authentication data packet and a mapping relationship between the pre-stored rule identifier and the selection rule; Determine a target position corresponding to the target selection rule in the first authentication data packet; The coupling field is verified using the data at the target position. If the data at the target position is the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data at the target position is not the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet do not pass the coupling field verification.

7. The method according to claim 5 or 6, characterized in that: After receiving the first authentication data packet and the second authentication data packet sent by the electronic device, and before determining the identity authentication results corresponding to the first authentication data packet and the second authentication data packet, the method further includes: Perform random number verification on the first authentication data packet and the second authentication data. If the first authentication data packet and the second authentication data packet both contain the same random number, it is determined that the first authentication data packet and the second authentication data packet pass the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, it is determined that the first authentication data packet and the second authentication data packet do not pass the random number verification.

8. The method according to claim 7, characterized in that The determining, based on the verification result of the coupling field, identity authentication results corresponding to the first authentication data packet and the second authentication data packet includes: Based on the verification result of the coupling field and the random number verification result, the identity authentication results corresponding to the first authentication data packet and the second authentication data packet are determined.

9. An authentication device, characterized in that: The device comprises: A first sending module, configured to send a first authentication data packet to a server during an identity authentication phase; and The second sending module is used to send a second authentication data packet to the server, wherein a coupling field in the second authentication data packet is the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

10. An authentication device, characterized in that: The device comprises: A receiving module, used to receive a first authentication data packet and a second authentication data packet sent by an electronic device; a verification module, configured to determine a coupling field in the second authentication data packet, and verify the first authentication data packet and the second authentication data packet based on the coupling field; A determination module is used to determine the identity authentication results corresponding to the first authentication data packet and the second authentication data packet based on the verification result of the coupling field.

Images