An authentication method and apparatus

Abstract

The application relates to the field of information security, in particular to an authentication method and device. In the identity authentication stage, a first authentication data packet is sent to a server, and a second authentication data packet is sent to the server, a coupling field in the second authentication data packet is the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet, thereby providing a scheme for improving the security of an SPA authentication method.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and in particular to an authentication method and device. BACKGROUND

[0002] With the development of Internet technology, network security problems are increasingly prominent. Users verify the identity of devices and users before allowing access to the network by using SPA (Single Packet Authorization) protocol, so as to achieve "network stealth", so that the attacker cannot find the service address and port.

[0003] However, in the process of using the SPA protocol for verification, if the attacker intercepts the data packet and replays the data packet to the gateway server, the gateway port can be opened to the attacker.

[0004] Therefore, how to improve the security of the SPA authentication method is a problem to be solved at present. SUMMARY

[0005] Embodiments of the present application provide an authentication method and device to provide a solution to improve the security of the SPA authentication method.

[0006] In a first aspect, the embodiments of the present application provide an authentication method applied to an electronic device, and the method comprises:

[0007] In the identity authentication stage, a first authentication data packet is sent to a server; and

[0008] A second authentication data packet is sent to the server, and a coupling field in the second authentication data packet is the same as part of the data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

[0009] The above solution sends two authentication data packets, and the second authentication data packet includes a coupling field for verification, so that the attacker cannot attack successfully after intercepting any one authentication data packet. And the coupling field ensures the dependent relationship between the two authentication data packets, greatly improving the security of identity authentication.

[0010] In some optional embodiments, the method further comprises:

[0011] Based on a target selection rule in a plurality of preset selection rules, a target position corresponding to the target selection rule in the first authentication data packet is determined;

[0012] Based on the data in the target position in the first authentication data packet, the coupling field is generated, and a second authentication data packet containing the coupling field is generated.

[0013] In some optional embodiments, the second authentication data packet further comprises a rule identifier; the rule identifier is used to indicate the target selection rule.

[0014] In some optional embodiments, the first authentication data packet comprises a random number, and the second authentication data packet comprises the random number; the random number is used to verify the first authentication data packet and the second authentication data packet.

[0015] In a second aspect, the embodiments of the present application provide an authentication method, applied to a server, the method comprising:

[0016] receiving a first authentication data packet and a second authentication data packet sent by an electronic device;

[0017] determining a coupling field in the second authentication data packet, and verifying the first authentication data packet and the second authentication data packet based on the coupling field;

[0018] based on a verification result of the coupling field, determining an identity authentication result corresponding to the first authentication data packet and the second authentication data packet.

[0019] In some optional embodiments, the verifying the first authentication data packet and the second authentication data packet based on the coupling field comprises:

[0020] based on a rule identifier carried in the second authentication data packet and a mapping relationship between a pre-stored rule identifier and a selection rule, determining a target selection rule used by the electronic device when generating the coupling field;

[0021] determining a target position corresponding to the target selection rule in the first authentication data packet;

[0022] verifying the coupling field using data of the target position; if the data of the target position is the same as data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data of the target position is not the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet do not pass the coupling field verification.

[0023] In some optional embodiments, after the receiving the first authentication data packet and the second authentication data packet sent by the electronic device, and before the determining the identity authentication result of the first authentication data packet and the second authentication data packet, the method further comprises:

[0024] The first authentication data packet and the second authentication data are subjected to random number verification, if the first authentication data packet and the second authentication data packet contain the same random number, it is determined that the first authentication data packet and the second authentication data packet pass the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, it is determined that the first authentication data packet and the second authentication data packet do not pass the random number verification.

[0025] In some optional embodiments, based on the verification result of the coupling field, an identity authentication result corresponding to the first authentication data packet and the second authentication data packet is determined.

[0026] Based on the verification result of the coupling field and the random number verification result, an identity authentication result corresponding to the first authentication data packet and the second authentication data packet is determined.

[0027] In a third aspect, an embodiment of the present application provides an authentication device, which comprises:

[0028] A first sending module is configured to send a first authentication data packet to a server in an identity authentication stage; and

[0029] A second sending module is configured to send a second authentication data packet to the server, wherein a coupling field in the second authentication data packet is the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

[0030] In some optional embodiments, the device is further configured to:

[0031] Based on a target selection rule in a plurality of preset selection rules, a target position corresponding to the target selection rule in the first authentication data packet is determined.

[0032] Based on data in the first authentication data packet at the target position, the coupling field is generated, and a second authentication data packet containing the coupling field is generated.

[0033] In some optional embodiments, the second authentication data packet further comprises a rule identifier; the rule identifier is used to indicate the target selection rule.

[0034] In some optional embodiments, the first authentication data packet comprises a random number, the second authentication data packet comprises the random number, and the random number is used to verify the first authentication data packet and the second authentication data packet.

[0035] In a fourth aspect, an embodiment of the present application provides an authentication device, which comprises:

[0036] receive a first authentication data packet and a second authentication data packet sent by an electronic device;

[0037] verify a coupling field in the second authentication data packet, and verify the first authentication data packet and the second authentication data packet based on the coupling field;

[0038] determine an identity authentication result corresponding to the first authentication data packet and the second authentication data packet based on a verification result of the coupling field.

[0039] In some optional embodiments, the verification module is specifically configured to:

[0040] determine a target selection rule used by the electronic device when generating the coupling field based on a rule identifier carried in the second authentication data packet and a mapping relationship between a pre-stored rule identifier and a selection rule;

[0041] determine a target position corresponding to the target selection rule in the first authentication data packet;

[0042] verify the coupling field using data at the target position, and if the data at the target position is the same as data in the coupling field, determine that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data at the target position is not the same as the data in the coupling field, determine that the first authentication data packet and the second authentication data packet do not pass the coupling field verification.

[0043] In some optional embodiments, the determination module is further configured to:

[0044] perform random number verification on the first authentication data packet and the second authentication data packet, and if the first authentication data packet and the second authentication data packet both contain the same random number, determine that the first authentication data packet and the second authentication data packet pass the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, determine that the first authentication data packet and the second authentication data packet do not pass the random number verification.

[0045] In some optional embodiments, the determination module is specifically configured to:

[0046] determine an identity authentication result corresponding to the first authentication data packet and the second authentication data packet based on a verification result of the coupling field and a random number verification result.

[0047] In a fifth aspect, an electronic device is provided, including at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the steps of any of the methods in the first aspect or any of the methods in the second aspect.

[0048] In a sixth aspect, a computer readable storage medium is provided, which stores a computer program executable by a processor, and when the program is run on the processor, the processor executes the steps of any of the methods in the first aspect or any of the methods in the second aspect.

[0049] In a seventh aspect, a computer program product is provided, which includes a computer program stored in a computer readable storage medium, and when a processor of an electronic device reads the computer program from the computer readable storage medium, the processor executes the computer program, so that the electronic device executes the steps of any of the methods in the first aspect or any of the methods in the second aspect. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0051] Figure 1 An application scenario diagram is provided for the embodiments of the present application.

[0052] Figure 2 An implementation flowchart of an authentication method is provided for the embodiments of the present application.

[0053] Figure 3 A flowchart of generating a second authentication data packet is provided for the embodiments of the present application.

[0054] Figure 4 A flowchart of identity authentication is provided for the embodiments of the present application.

[0055] Figure 5 A flowchart of coupling field verification is provided for the embodiments of the present application.

[0056] Figure 6 A flowchart of random number verification is provided for the embodiments of the present application.

[0057] Figure 7 A flowchart of timestamp verification is provided for the embodiments of the present application.

[0058] Figure 8 An overall implementation procedure provided for the embodiment of the present application Figure 1 ;

[0059] Figure 9 An overall implementation procedure provided for the embodiment of the present application Figure 2 ;

[0060] Figure 10 An overall implementation procedure provided for the embodiment of the present application Figure 3 ;

[0061] Figure 11 A schematic diagram of an authentication device provided for the embodiment of the present application Figure 1 ;

[0062] Figure 12 A schematic diagram of an authentication device provided for the embodiment of the present application Figure 2 ;

[0063] Figure 13 A schematic diagram of an electronic device provided for the embodiment of the present application

[0064] Figure 14 A schematic diagram of an electronic device provided for the embodiment of the present application DETAILED DESCRIPTION

[0065] In order to make the objectives, technical solutions and advantages of the present application clearer, the following will further describe the present application with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0066] The terms "first", "second" are only used for descriptive purpose, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specified and limited.

[0067] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be direct connection or indirect connection through an intermediate medium, and can be the communication inside two devices. For those of ordinary skill in the art, the specific meaning of the above term in the present application can be understood according to the specific circumstances.

[0068] For the convenience of understanding the method, device and electronic equipment for a microservice to obtain user information provided by the embodiments of the present application, some terms in the embodiments of the present application are explained below, so as to facilitate understanding by those skilled in the art.

[0069] SPA (Single Packet Authorization) is a network security technology that verifies the identity of a client by exchanging a small number of data packets between the client and the server, thereby allowing or denying access.

[0070] NTP (Network Time Protocol) is a protocol for synchronizing computer clocks in a network.

[0071] In order to make the purposes, technical solutions and beneficial effects of the present application clearer, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0072] As shown in Figure 1 , a schematic diagram of an application scenario of an embodiment of the present application is shown. In the identity authentication stage, the electronic device 10 sends a first authentication data packet and a second authentication data packet to the server 11, and the server 11 performs identity authentication based on the first authentication data packet and the second authentication data packet.

[0073] Among them, the electronic device 10 and the server 11 can perform wired transmission and / or wireless transmission.

[0074] In the embodiments of the present application, the electronic device 10 can be a terminal device used by a user, which can be a personal computer, a mobile phone, a tablet computer, a notebook computer, a smart voice interaction device, a medical image device, etc. computer device with certain computing power. The electronic device 10 can support running a client.

[0075] The server 11 in the embodiments of the present application can be a standalone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud storage, cloud functions, network services, cloud communication, middleware services, domain name services, security services, content distribution networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0076] Of course, the method provided by the embodiments of the present application is not limited to Figure 1 the application scenario shown, but can also be used in other possible application scenarios, which are not limited by the embodiments of the present application.

[0077] AsFigure 2 As shown in the embodiment of the application, the implementation flowchart of the authentication method is shown in the following steps:

[0078] In step S201, the electronic device sends a first authentication data packet to the server and a second authentication data packet to the server in the identity authentication stage.

[0079] In the implementation, the client running on the electronic device performs identity authentication with the server through the electronic device.

[0080] In the embodiment of the application, before the electronic device sends the first authentication data packet and the second authentication data packet to the server, the electronic device further includes signing the first authentication data packet and the second authentication data packet based on the private key respectively, to ensure the integrity of the data and the credibility of the source.

[0081] In step S202, the server performs identity authentication based on the coupling field in the second authentication data packet.

[0082] In the embodiment of the application, after receiving the first authentication data packet and / or the second authentication data packet, the server decrypts the received authentication data packet and determines that the signature verification is passed, and then performs identity authentication based on the authentication data carried in the first authentication data packet and the second authentication data packet.

[0083] The authentication data carried in the second authentication data packet includes the coupling field.

[0084] In step S201, the client generates the second authentication data packet through the implementation flowchart as shown in the following steps: Figure 3

[0085] In step S301, the electronic device determines a target position corresponding to a target selection rule in the first authentication data packet based on the target selection rule in the plurality of preset selection rules.

[0086] Optionally, the first authentication data packet in the embodiment of the application can include a first data packet version number (Version) and a first data packet type (Type).

[0087] It should be noted that the data packet version number represents the version of the SPA data packet, to ensure the compatibility between the client and the server. The data packet type represents the type of the data packet.

[0088] In the embodiment of the application, the first data packet version number included in the first authentication data packet represents the version number of the first authentication data packet, and the first data packet type can be an initialization request type.

[0089] ​Optionally, each of the plurality of preset selection rules in the embodiment of the present application represents a position of the selected data, and different selection rules represent different positions of the selected data.

[0090] For example, the selection rule 1 represents positions 1, 3 and 5, and the selection rule 2 represents positions 2, 6 and 7.

[0091] It should be noted that the positions of the selected data represented by the selection rules in the above example are only examples, and the embodiment of the present application does not limit the number of positions represented by the selection rules, and does not limit how to set the positions in the selection rules.

[0092] In the embodiment of the present application, one selection rule is randomly determined as a target selection rule from the plurality of preset selection rules, and the position represented by the target selection rule is taken as a target position corresponding to the target selection rule in the first authentication data packet.

[0093] For example, if the target selection rule is the selection rule 1 described above, the positions 1, 3 and 5 represented by the selection rule 1 are taken as the target positions corresponding to the target selection rule in the first authentication data.

[0094] In step S302, the electronic device generates a coupling field based on the data in the target positions in the first authentication data packet, and generates a second authentication data packet containing the coupling field.

[0095] That is, the coupling field in the second authentication data packet is the same as part of the data in the first authentication data packet.

[0096] For example, if the target selection rule is the selection rule 1 described above, the data in the position 1, the data in the position 3 and the data in the position 5 in the first authentication data packet are combined to generate the coupling field.

[0097] Optionally, the second authentication data packet in the embodiment of the present application can include a second data packet version number (Version), a second data packet type (Type) and the coupling field.

[0098] In the embodiment of the present application, the second data packet version number contained in the second authentication data packet represents the version number of the second authentication data packet, and the second data packet type can be a determination response type.

[0099] Optionally, in the embodiment of the present application, the second authentication data packet can further include a rule identifier, and the rule identifier is used to indicate the target selection rule.

[0100] It should be noted that each of the preset selection rules has an associated rule identifier, and each rule identifier is used to represent the selection rule associated with the rule identifier.

[0101] Exemplarily, the rule identifier associated with the above-mentioned selection rule 1 can be 1, and the rule identifier associated with the above-mentioned selection rule 2 can be 2. Then, the rule identifier 1 represents the selection rule 1, and the rule identifier 2 represents the selection rule 2.

[0102] In step S202, after receiving the first authentication data packet and the second authentication data packet sent by the electronic device, the server performs identity authentication through an implementation flowchart as shown in the following table: Figure 4

[0103] In step S401, the server determines the coupling field in the second authentication data packet, and verifies the first authentication data packet and the second authentication data packet based on the coupling field.

[0104] It should be noted that the coupling field is located in the position for placing the coupling field in the second authentication data packet, and then the server can read the coupling field from the preset position for placing the coupling field.

[0105] As shown in the following table, an implementation flowchart of the coupling field verification in an embodiment of the present application is shown, and the specific steps are as follows: Figure 5

[0106] In step S501, the server determines the target selection rule used by the electronic device when generating the coupling field based on the rule identifier carried in the second authentication data packet and the mapping relationship between the pre-stored rule identifier and the selection rule.

[0107] Exemplarily, the pre-stored mapping relationship can be the mapping relationship between the rule identifier 1 and the selection rule 1, the mapping relationship between the rule identifier 2 and the selection rule 2, and the like.

[0108] It should be noted that the mapping relationship between each selection rule and the rule identifier in the server and the electronic device is the same, and the present application does not limit the representation form of each rule identifier, but the server and the electronic device set the rule identifier and the selection rule in the same way.

[0109] In step S502, the server determines the target position corresponding to the target selection rule in the first authentication data packet.

[0110] In which, the position represented by the target selection rule is taken as the target position corresponding to the target selection rule in the first authentication data packet.

[0111] In step S503, the server verifies the coupling field using the data of the target position, and obtains a coupling field verification result.

[0112] ​​In this embodiment of the application, if the data at the target location is the same as the data in the coupling field, then the first authentication data packet and the second authentication data packet are determined to have passed the coupling field verification; if the data at the target location is different from the data in the coupling field, then the first authentication data packet and the second authentication data packet are determined to have failed the coupling field verification.

[0113] In step S402, the server determines the identity authentication results corresponding to the first authentication data packet and the second authentication data packet based on the verification results of the coupling field.

[0114] Optionally, the coupling field validation result includes: validation passed and validation failed. The identity authentication result includes: authentication passed and authentication failed.

[0115] In this embodiment of the application, if the coupling field verification is not passed, the identity authentication is determined to be unsuccessful.

[0116] In one optional implementation, in addition to determining the authentication result based on the coupling field verification result, the embodiments of this application can also combine the random number verification result to determine the authentication result.

[0117] In this embodiment, the first authentication data packet includes a random number, and the second authentication data packet includes the random number.

[0118] For ease of explanation, the random number contained in the first authentication data packet will be referred to as the first random number. When generating the second authentication data packet, the client uses the second random number and the first random number from the first authentication data packet to generate the second authentication data packet. The authentication data in the second authentication data packet includes both the first and second random numbers.

[0119] It should be noted that the first random number is generated randomly by the client. The second random number is a new random number generated by the client. These random numbers are used to verify both the first and second authentication data packets.

[0120] like Figure 6 As shown, after the server receives the first authentication data packet and the second authentication data packet sent by the electronic device, this application embodiment provides an implementation flowchart for random number verification of the first authentication data packet and the second authentication data packet. The specific steps are as follows:

[0121] Step S601: The server reads the random number from the first authentication data packet and the random number from the second authentication data packet.

[0122] In step S602, the server determines the random number verification result by comparing the random number in the first authentication data packet with the random number in the second authentication data packet.

[0123] Optionally, the random number verification result includes: passing random number verification and failing random number verification.

[0124] In this embodiment of the application, if both the first authentication data packet and the second authentication data packet contain the same random number, then the first authentication data packet and the second authentication data packet are determined to have passed the random number verification; if the first authentication data packet and the second authentication data packet do not contain the same random number, then the first authentication data packet and the second authentication data packet are determined to have failed the random number verification.

[0125] The server then determines the authentication results of the first authentication data packet and the second authentication data packet based on the verification results of the coupling field and the random number verification results.

[0126] Optionally, embodiments of this application may also use another random number verification method, in which case the validity of the random number is verified by the random number verification method in the SPA authentication method. For example, the random number verification method in the authentication method verifies the validity of the random number in the second authentication data packet.

[0127] It should be noted that verifying the validity of random numbers through the random number verification method in the SPA authentication method is existing technology, and will not be elaborated here.

[0128] In another optional implementation, the embodiments of this application may further perform timestamp verification on the first authentication data packet and the second authentication data packet, and then determine the identity authentication result based on the verification result of the coupling field, the verification result of the random number and the timestamp verification result.

[0129] In this embodiment, the authentication data in the first authentication data packet further includes a first timestamp, which is used to record the generation time of the first authentication data packet. The authentication data in the second authentication data packet further includes a second timestamp, which is used to record the generation time of the second authentication data packet.

[0130] like Figure 7 As shown, after the server receives the first authentication data packet and the second authentication data packet sent by the electronic device, this application embodiment provides a flowchart of the implementation of timestamp verification, and the specific steps are as follows:

[0131] Step S701: The server obtains the first timestamp from the first authentication data packet and the second timestamp from the second authentication data.

[0132] In step S702, the server obtains the timestamp verification result by comparing the difference between the first timestamp and the second timestamp with a time threshold.

[0133] Optionally, the timestamp verification result includes: passed timestamp verification and failed timestamp verification.

[0134] In the embodiment of the present application, if the difference between the first timestamp and the second timestamp is not greater than the time threshold, it is determined that the first authentication data packet and the second authentication data packet pass the timestamp verification; if the difference between the first timestamp and the second timestamp is greater than the time threshold, it is determined that the first authentication data packet and the second authentication data packet do not pass the timestamp verification.

[0135] For example, the time threshold can be set to 2 seconds.

[0136] It should be noted that in the embodiment of the present application, the server can first receive the first authentication data packet, or first receive the second authentication data packet, or simultaneously receive the first authentication data packet and the second authentication data packet. As long as the difference between the timestamps of the first authentication data packet and the second authentication data packet is not greater than 2 seconds, it is determined to pass the timestamp verification.

[0137] In the embodiment of the present application, when the server determines that the coupling field verification, the random number verification and the timestamp verification are passed, it is determined that the identity authentication is passed. Then the server allows the client on the electronic device to access.

[0138] Optionally, the authentication data carried in the second authentication data packet in the embodiment of the present application can be the coupling field, the first random number, the second random number and the second timestamp. The authentication data is used for identity authentication of the first authentication data packet and the second authentication data packet.

[0139] The first random number is used to verify the identity of the client, the second random number is a new random number generated by the client, and the second timestamp is used to prevent replay attacks.

[0140] As shown in FIG. 8, the embodiment of the present application provides an overall implementation process Figure 8 , and the specific steps are as follows: Figure 1

[0141] Step S801, the client sends a first authentication data packet to the server.

[0142] The client runs on an electronic device and interacts with the server through the electronic device, so the action performed by the client can also be understood as the action performed by the electronic device.

[0143] Step S802, the server preliminarily verifies the first authentication data packet.

[0144] For example, in the preliminary verification process, the embodiment of the present application decrypts the first authentication data packet and performs signature verification.

[0145] Optionally, in the preliminary verification process, the embodiment of the present application can also verify the validity of the first random number in the first authentication data packet based on the random number verification method in the SPA authentication method. ​

[0146] Step S803: After the first authentication data packet passes the initial verification, the server records the data in the first authentication data packet.

[0147] In step S804, the client sends a second authentication data packet to the server.

[0148] Step S805: The server performs a preliminary verification of the second authentication data packet.

[0149] For example, in this embodiment of the application, signature verification is performed after the second authentication data packet is decrypted.

[0150] For example, in the preliminary verification process, the second authentication data packet is decrypted and a signature verification is performed.

[0151] Optionally, in the preliminary verification process, embodiments of this application may also verify the validity of the random number in the second authentication data packet based on the random number verification method in the SPA authentication method.

[0152] Step S806: The server verifies the data in the first authentication data packet and the second authentication data packet.

[0153] For example, coupled field verification, random number verification, and timestamp verification are performed based on data in the first authentication data packet and the second authentication data packet.

[0154] Optionally, the server performs coupled field verification, random number verification, and timestamp verification on the first and second authentication packets based on the authentication data in the second authentication packet.

[0155] The authentication data in the second authentication data packet may include a first random number, a second random number, a coupling field, and a second timestamp.

[0156] In step S807, the server sends an authentication response to the client.

[0157] Once the server confirms successful authentication, it notifies the client of the authentication success via an authentication response, allowing the client to access the server.

[0158] For the client side, such as Figure 9 As shown, an overall implementation process of this application embodiment is illustrated. Figure 2 The specific steps are as follows:

[0159] Step S901: The client generates the first random number.

[0160] In step S902, the client generates a first timestamp and generates a first authentication data packet based on a first random number and the first timestamp.

[0161] In step S903, the client uses its private key to sign the first authentication data packet.

[0162] In step S904, the client sends the first authentication data packet to the server.

[0163] Step S905: The client generates a second random number.

[0164] In step S906, the client generates a second timestamp and generates a second authentication data packet based on the second random number, the second timestamp, and the coupling field.

[0165] The coupling field is generated based on the first authentication data packet, and some data in the coupling field is the same as that in the first authentication data packet.

[0166] In step S907, the client uses its private key to sign the second authentication data packet.

[0167] In step S908, the client sends a second authentication data packet to the server.

[0168] It should be noted that the embodiments of this application do not limit the order of generating random numbers and generating timestamps.

[0169] For the server side, such as Figure 10 As shown, an overall implementation process of this application embodiment is illustrated. Figure 3 The specific steps are as follows:

[0170] Step S1001: The server performs preliminary verification on the received first authentication data packet, and records the data in the first authentication data packet after the first authentication data packet passes the preliminary verification.

[0171] In step S1002, the server performs preliminary verification on the received second authentication data packet.

[0172] In step S1003, after the second authentication data packet passes the initial verification, the server compares the random number in the second authentication data packet with the random number in the first authentication data packet. If the first authentication data packet and the second authentication data packet contain the same random number, then the random number verification is deemed successful.

[0173] In step S1004, the server compares the second timestamp in the second authentication data packet with the first timestamp in the first authentication data packet. If the difference between the first timestamp and the second timestamp is not greater than a time threshold, then the first authentication data packet and the second authentication data packet are determined to have passed timestamp verification.

[0174] Step S1005, the server compares the coupling field in the second authentication data with the data in the target position in the first authentication data packet. If the data in the coupling field is the same as the data in the target position in the first authentication data packet, it is determined that the coupling field verification is passed.

[0175] Step S1006, if the coupling field verification is passed, the random number verification is passed, and the timestamp verification is passed, the server determines that the identity authentication is passed, and allows the client to access.

[0176] If any of the above verifications fails, the server notifies the client to resend the data packet.

[0177] The beneficial effects of the present application are:

[0178] 1. Improved security:

[0179] By increasing the coupling degree between the authentication data packets, the man-in-the-middle attack and the replay attack are prevented. The single-packet authentication method in the prior art is vulnerable to attacks, while the double-packet authentication method has improved, but lacks a strict coupling mechanism. The present application increases the coupling field in the second authentication data packet, ensuring the dependency between the first authentication data packet and the second authentication data packet, greatly improving the security of the authentication.

[0180] By using strict control of the timestamp and the random number, the freshness and uniqueness of the data packet are ensured, further preventing the replay attack. This multi-factor authentication mechanism makes it difficult for attackers to forge valid data packets.

[0181] 2. Simplified process:

[0182] The client only needs to send two data packets, and the server does not return any data packet, simplifying the authentication process. This simplification not only reduces communication overhead, but also improves the efficiency and response speed of the system.

[0183] By reducing the number of server responses, the load of the server is reduced, and the overall performance of the system is improved.

[0184] 3. Enhanced reliability:

[0185] By strict control of the timestamp and the random number, the freshness and uniqueness of the data packet are ensured, enhancing the reliability of the system. The use of time synchronization protocols (such as NTP) ensures the consistency of time between the client and the server, preventing authentication failures due to time differences. A strict time window is set, for example, ±2 seconds. The freshness and legality of the data packet are further ensured by time difference verification.

[0186] By verifying the matching of multiple fields, the integrity and accuracy of the authentication process are ensured, improving the robustness of the system.

[0187] The embodiments of the present application ensure the uniqueness of each request by using the first random number and the second random number, ensure the freshness of the data packet by using the first timestamp and the second timestamp, and ensure the integrity and trusted source of the data by using the first signature (Signature1) and the second signature (Signature2).

[0188] It should be noted that the first signature is a signature corresponding to the first authentication data packet, and the second signature is a signature corresponding to the second authentication data packet.

[0189] As shown in Figure 11 , the present application provides an authentication device schematic Figure 1 , comprising:

[0190] The first sending module 1101 is configured to send a first authentication data packet to a server in an identity authentication stage; and

[0191] The second sending module 1102 is configured to send a second authentication data packet to the server, wherein a coupling field in the second authentication data packet is the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet.

[0192] In some optional embodiments, the device is further configured to:

[0193] Determine a target position in the first authentication data packet corresponding to a target selection rule in a plurality of preset selection rules;

[0194] Generate the coupling field based on the data in the first authentication data packet located at the target position, and generate the second authentication data packet containing the coupling field.

[0195] In some optional embodiments, the second authentication data packet further comprises a rule identifier; and the rule identifier is used to indicate the target selection rule.

[0196] In some optional embodiments, the first authentication data packet comprises a random number, and the second authentication data packet comprises the random number; and the random number is used to verify the first authentication data packet and the second authentication data packet.

[0197] As shown in Figure 12 , the present application provides an authentication device schematic Figure 2 , comprising:

[0198] The receiving module 1201 is configured to receive a first authentication data packet and a second authentication data packet sent by an electronic device;

[0199] The verification module 1202 is configured to determine a coupling field in the second authentication data packet, and verify the first authentication data packet and the second authentication data packet based on the coupling field.

[0200] The determination module 1203 is configured to determine an identity authentication result corresponding to the first authentication data packet and the second authentication data packet based on a verification result of the coupling field.

[0201] In some optional embodiments, the verification module 1202 is specifically configured to:

[0202] determine a target selection rule used by the electronic device when generating the coupling field based on a rule identifier carried in the second authentication data packet and a pre-stored mapping relationship between rule identifiers and selection rules.

[0203] determine a target position corresponding to the target selection rule in the first authentication data packet.

[0204] verify the coupling field using data of the target position, and determine that the first authentication data packet and the second authentication data packet pass the coupling field verification if the data of the target position is the same as data in the coupling field, or determine that the first authentication data packet and the second authentication data packet do not pass the coupling field verification if the data of the target position is not the same as the data in the coupling field.

[0205] In some optional embodiments, the determination module 1203 is further configured to:

[0206] perform random number verification on the first authentication data packet and the second authentication data packet, determine that the first authentication data packet and the second authentication data packet pass the random number verification if the first authentication data packet and the second authentication data packet both contain the same random number, or determine that the first authentication data packet and the second authentication data packet do not pass the random number verification if the first authentication data packet and the second authentication data packet do not contain the same random number.

[0207] In some optional embodiments, the determination module 1203 is specifically configured to:

[0208] determine an identity authentication result corresponding to the first authentication data packet and the second authentication data packet based on a verification result of the coupling field and a random number verification result.

[0209] Based on the same inventive concept as the method embodiments described above, the embodiments of the present application also provide an electronic device. The principle of solving the problem of the electronic device is similar to the method of the above-mentioned embodiments, and therefore the implementation of the electronic device can be referred to the implementation of the above-mentioned method, and the repeated parts will not be described here.

[0210] For reference Figure 13As shown, the electronic device 130 can at least include a processor 131, and a memory 132. The memory 132 stores program codes which, when executed by the processor 131, cause the processor 131 to perform the steps of the micro-service obtaining user information method in the embodiments of the present application.

[0211] The electronic device 140 according to this embodiment of the present application will be described below with reference to Figure 14 Figure 14 The electronic device 140 is merely an example and should not limit the function and scope of use of the embodiments of the present application.

[0212] As Figure 14 , the electronic device 140 is in the form of a general electronic device. The components of the electronic device 140 can include, but are not limited to, at least one processing unit 141, at least one storage unit 142 as described above, and a bus 143 connecting different system components, including the storage unit 142 and the processing unit 141.

[0213] The bus 143 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor or local bus using any of a variety of bus structures.

[0214] The storage unit 142 can include a readable medium in the form of volatile memory, such as a random access memory (RAM) 1421 and / or a cache memory 1422, and can further include a read-only memory (ROM) 1423.

[0215] The storage unit 142 can also include a program / utility 1414 having a set of program modules 1424, such as an operating system, one or more application programs, other program modules, and program data, each of which or a combination of which can include an implementation of a network environment.

[0216] ​The electronic device 140 can also communicate with one or more external devices 144 such as a keyboard or a pointing device, through an input / output (I / O) interface 145. And, the electronic device 140 can communicate with one or more networks, such as a local area network (LAN), a wide area network (WAN), and / or the public network, such as the Internet, through a network adapter 146. As depicted, the network adapter 146 is in communication with the other components of the electronic device 140 through the bus 143. It should be appreciated that other hardware and / or software modules can be used in conjunction with the electronic device 140, including but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0217] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, apparatus, or computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, magnetic disks, CD-ROMs, optical storage media, etc.) embodying computer readable program code.

[0218] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0219] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0220] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable data processing devices provide a process for implementing the functions specified in the flowchart Figure 1 one flow or multiple flows and / or blocks Figure 1 Figure 1 one block or multiple blocks.

[0221] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. An authentication method characterized by, The application is applied to an electronic device, comprising: In the identity authentication stage, a first authentication data packet is sent to a server; and A second authentication data packet is sent to the server, a coupling field in the second authentication data packet is the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet; The method further comprises: Based on a target selection rule in a plurality of preset selection rules, a target position corresponding to the target selection rule in the first authentication data packet is determined; Based on data at the target position in the first authentication data packet, the coupling field is generated, and the second authentication data packet containing the coupling field is generated, the second authentication data packet further comprising a rule identifier, the rule identifier being used to indicate the target selection rule.

2. The method of claim 1, wherein, The first authentication data packet comprises a random number, and the second authentication data packet comprises the random number, the random number being used to verify the first authentication data packet and the second authentication data packet.

3. An authentication method characterized by, The application is applied to a server, comprising: A first authentication data packet and a second authentication data packet sent by an electronic device are received; A coupling field in the second authentication data packet is determined, and based on a rule identifier carried in the second authentication data packet and a mapping relationship between a pre-stored rule identifier and a selection rule, a target selection rule used by the electronic device when generating the coupling field is determined; A target position corresponding to the target selection rule in the first authentication data packet is determined; Data at the target position is used to verify the coupling field, if the data at the target position is the same as data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet pass the coupling field verification, if the data at the target position is not the same as the data in the coupling field, it is determined that the first authentication data packet and the second authentication data packet do not pass the coupling field verification; Based on the verification result of the coupling field, an identity authentication result corresponding to the first authentication data packet and the second authentication data packet is determined.

4. The method of claim 3, wherein, After the first authentication data packet and the second authentication data packet sent by the electronic device are received, before the identity authentication result corresponding to the first authentication data packet and the second authentication data packet is determined, it further comprises: Random number verification is performed on the first authentication data packet and the second authentication data, if the first authentication data packet and the second authentication data packet both contain the same random number, it is determined that the first authentication data packet and the second authentication data packet pass the random number verification, if the first authentication data packet and the second authentication data packet do not contain the same random number, it is determined that the first authentication data packet and the second authentication data packet do not pass the random number verification.

5. The method of claim 4, wherein, Based on the verification result of the coupling field, an identity authentication result corresponding to the first authentication data packet and the second authentication data packet is determined, comprising: Based on the verification result of the coupling field and the random number verification result, an identity authentication result corresponding to the first authentication data packet and the second authentication data packet is determined.

6. An authentication apparatus characterized by comprising: The application is applied to an electronic device, the device comprising: The first sending module is configured to send a first authentication data packet to a server in an identity authentication stage; and The second sending module is configured to send a second authentication data packet to the server, a coupling field in the second authentication data packet being the same as part of data in the first authentication data packet, so that the server performs identity authentication based on the coupling field in the second authentication data packet. The apparatus is further configured to: determine a target position corresponding to a target selection rule in the first authentication data packet based on the target selection rule in a plurality of preset selection rules; generate the coupling field based on data at the target position in the first authentication data packet, and generate the second authentication data packet containing the coupling field, the second authentication data packet further containing a rule identifier, the rule identifier being used to indicate the target selection rule.

7. An authentication apparatus characterized by comprising: The apparatus applied to a server comprises: A receiving module is configured to receive a first authentication data packet and a second authentication data packet sent by an electronic device. A verification module is configured to determine a coupling field in the second authentication data packet, and determine a target selection rule used by the electronic device when generating the coupling field based on a rule identifier carried in the second authentication data packet and a mapping relationship between a pre-stored rule identifier and a selection rule; determine a target position corresponding to the target selection rule in the first authentication data packet; use data at the target position to verify the coupling field, and if the data at the target position is the same as data in the coupling field, determine that the first authentication data packet and the second authentication data packet pass the coupling field verification; if the data at the target position is not the same as the data in the coupling field, determine that the first authentication data packet and the second authentication data packet do not pass the coupling field verification. A determination module is configured to determine an identity authentication result corresponding to the first authentication data packet and the second authentication data packet based on a verification result of the coupling field.

Images