Login authentication method, device, equipment, storage medium and computer program product

Abstract

The invention discloses a login authentication method and device, equipment, a storage medium and a computer program product, and belongs to the technical field of information management. The method comprises the following steps: acquiring input identity authentication information, and determining a grouping index according to the identity authentication information and the total number of authentication servers; performing grouping processing on the identity authentication information according to the grouping indexes to generate a target grouping sequence; determining a digital sequence corresponding to the target grouping sequence according to a corresponding relation between a preset grouping sequence and digits, and determining a coding sequence of the identity authentication information based on the digital sequence; and the coding sequence and the grouping index are sent to a jump point authentication module, and the jump point authentication module is used for performing login authentication based on the coding sequence and the grouping index. Through the mode, the security problems of account password leakage, replay attack and brute force cracking can be prevented, and the security of the login process is improved.

Description

Technical Field

[0001] The present application relates to the field of information management technology, and in particular to a login authentication method, apparatus, device, storage medium and computer program product. Background Art

[0002] The information management platform has significant advantages in centrally managing, storing, processing and sharing various information, especially in maintaining software product information. Software product information usually includes software function description, version information, user guide, price, update history, etc. With the help of the information management platform, the complexity of operation and maintenance can be effectively reduced, ensuring that software product information is updated in a timely manner and easy to share with other departments.

[0003] When an authorized user logs in to the information management platform, the account name and password entered by the user are obtained and encrypted with a key to ensure the security of the account and password during transmission. However, if the key is leaked, the encrypted information of the account and password will no longer be secure. A third party may use the leaked key and password to log in to the system, resulting in serious security risks for the information stored in the system. Summary of the invention

[0004] The embodiments of the present application provide a login authentication method, apparatus, device, storage medium and computer program product to at least solve the problem that the account password is easily leaked during the process of authorizing users to log in to the information management platform.

[0005] In order to solve the above technical problems, this application is implemented as follows: In a first aspect, an embodiment of the present application provides a login authentication method, which is applied to a client, and includes: obtaining input identity authentication information, and determining a grouping index based on the identity authentication information and the total number of authentication servers; performing group processing on the identity authentication information according to the grouping index to generate a target grouping sequence; determining a digital sequence corresponding to the target grouping sequence according to a correspondence between a preset grouping sequence and a number, and determining a coding sequence of the identity authentication information based on the digital sequence; sending the coding sequence and the grouping index to a jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping index.

[0006] In a second aspect, an embodiment of the present application provides a login authentication method, which is applied to a jump point authentication module, wherein the jump point authentication module includes multiple jump point authentication units, and the jump point authentication unit corresponds to an authentication server, including: obtaining a coding sequence and a grouping index; wherein the grouping index is determined by the client according to the input identity authentication information and the total number of authentication servers; the coding sequence determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and is determined based on the digital sequence; the target grouping sequence is generated by grouping the identity authentication information according to the grouping index; the coding sequence is grouped according to the grouping index to obtain a grouping sequence; the target jump point authentication unit corresponding to the grouping sequence is determined, and the grouping sequence is encrypted according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence; by transmitting the ciphertext conversion sequence to the target jump point authentication unit, when the target jump point authentication unit determines that the verification is completed based on the ciphertext conversion sequence, an authorization access instruction of the client is generated.

[0007] In a third aspect, an embodiment of the present application provides a client, comprising: an indicator determination module, used to obtain input identity authentication information, and determine a grouping indicator based on the identity authentication information and the total number of authentication servers; a sequence generation module, used to group the identity authentication information according to the grouping indicator to generate a target grouping sequence; a sequence determination module, used to determine a digital sequence corresponding to the target grouping sequence according to a correspondence between a preset grouping sequence and a number, and determine a coding sequence of the identity authentication information based on the digital sequence; an information sending module, used to send the coding sequence and the grouping indicator to a jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping indicator.

[0008] In a fourth aspect, an embodiment of the present application provides a jump point authentication module, the jump point authentication module includes multiple jump point authentication units, the jump point authentication unit corresponds to the authentication server, and includes: an information acquisition module, used to obtain a coding sequence and a grouping index; wherein the grouping index is determined by the client according to the input identity authentication information and the total number of authentication servers; the coding sequence determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and is determined based on the digital sequence; the target grouping sequence is generated by grouping the identity authentication information according to the grouping index; a sequence grouping module, used to group the coding sequence according to the grouping index to obtain a grouping sequence; a sequence encryption module, used to determine the target jump point authentication unit corresponding to the grouping sequence, and encrypt the grouping sequence according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence; an instruction generation module, used to transmit the ciphertext conversion sequence to the target jump point authentication unit, and when the target jump point authentication unit determines that the verification is completed based on the ciphertext conversion sequence, generate an authorization access instruction for the client.

[0009] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0010] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0011] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the method described in the first or second aspect above.

[0012] In the embodiment of the present application, the input identity authentication information is obtained, and the grouping index is determined according to the total number of identity authentication information and authentication servers; the identity authentication information is grouped and processed according to the grouping index to generate a target grouping sequence; the digital sequence corresponding to the target grouping sequence is determined according to the correspondence between the preset grouping sequence and the number, and the coding sequence of the identity authentication information is determined based on the digital sequence; the coding sequence and the grouping index are sent to the jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping index. In this way, by dynamically grouping and encoding the identity authentication information, security issues such as account password leakage, replay attacks, and brute force cracking can be prevented, and the security of the login process can be improved.

[0013] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0015] Figure 1 A schematic diagram of a process flow of a login authentication method provided in an embodiment of the present application is shown; Figure 2 Another schematic diagram of the process of the login authentication method provided in the embodiment of the present application is shown; Figure 3 A schematic diagram showing the structure of a client provided in an embodiment of the present application is shown; Figure 4 A schematic diagram of the structure of a jump point authentication module provided in an embodiment of the present application is shown; Figure 5 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0016] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0017] Software product information refers to all information related to computer software, software embedded in information systems or devices, and computer software provided when providing technical services such as computer information system integration and application services. It includes but is not limited to software function descriptions, version information, user guides, prices, and update history, etc.

[0018] Using an information management platform to maintain software product information has many advantages. First, the characteristics of the information management platform, such as "out-of-the-box" and "flexible expansion", can simplify some of the operation and maintenance work and reduce the pressure on the operation and maintenance team. Secondly, since the hardware and maintenance of the information management platform are handled by the supplier, this includes handling server hardware and software issues, managing user access and security, storing and managing data, and implementing upgrades and patches. Enterprises using information management platforms can focus more on their core business. At present, software managers usually use information management platforms to maintain and manage their software product information.

[0019] When an authorized user logs in to the information management platform, the platform obtains the account name and password typed by the user, and uses a key to encrypt the account password to ensure the security of the account password during transmission. However, if the key is leaked, the account password will not be private to any third party, and the third party will easily log in to the system with the obtained account password, making the software product information stored in the system no longer secure.

[0020] In response to the problems existing in the login authentication process of the above-mentioned information management platform, an embodiment of the present application provides a login authentication method, which groups and encodes identity authentication information to prevent security issues such as account and password leakage, replay attacks, and brute force cracking, thereby improving the security of the login process.

[0021] Figure 1 A schematic diagram of a login authentication method provided in an embodiment of the present application is shown, and the execution subject of the method may be a client. As shown in the figure, the method 100 may include the following steps: Step 101: Obtain input identity authentication information, and determine a grouping index according to the identity authentication information and the total number of authentication servers.

[0022] In a specific implementation, the account name and password entered by the current pre-access user to log in to the information management platform are obtained, and the identity authentication information of the current pre-access user is generated based on the account name and password, wherein the account name and password can be a 14 to 16-bit string consisting of numbers, letters and special characters. Then, according to the identity authentication information and the total number of authentication servers, a grouping index is determined. For example, the identity authentication information can be hashed by a hash algorithm (such as MD5 or SHA256) to obtain a hash value, and the grouping index is determined according to a part of the hash value and the total number of authentication servers.

[0023] Step 102: performing group processing on the identity authentication information according to the grouping index to generate a target grouping sequence.

[0024] In a specific implementation, the grouping method of the identity authentication information can be determined according to the grouping index obtained in the above step 101, and the identity authentication information can be grouped and processed according to the grouping method to generate a group sequence. For example, the identity authentication information is the account and password entered by the user, and the account and password are AAbb12345678-=. The identity authentication information is grouped and processed to generate a target group sequence AAbb1234, Abb12345, bb123456, etc.

[0025] Step 103: determining a digital sequence corresponding to the target group sequence according to a preset correspondence relationship between the group sequence and the digital sequence, and determining a coding sequence of the identity authentication information based on the digital sequence; In a specific implementation, the correspondence between the grouping sequence and the number can be obtained from a pre-stored grouping record table, which may include a sequence field and a frequency field; the sequence field in the grouping record table stores all grouping sequences, which are obtained by grouping the login password of the current pre-access user, and for different grouping indicators, all grouping sequences are obtained based on different grouping methods. Here, different grouping indicators are values ​​that can be calculated based on all integers randomly generated by a random function according to the login password of the current pre-access user. Numbers are stored in the frequency field in the grouping record table, and the grouping sequence stored in the sequence field corresponds to the number stored in the frequency field one by one; it should be noted that the number of characters constituting the grouping sequence stored in the sequence field is at least 1, and at most the total number of the login password minus 1.

[0026] The numbers D1, D2, ..., Dc corresponding to the target group sequence C1, C2, ..., Cc are found in the group record table of the current pre-visiting user in turn, and they are concatenated in the order of D1, D2, ..., Dc to obtain the coding sequence of the current pre-visiting user's visit.

[0027] Step 104: Send the coding sequence and the grouping indicator to a jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping indicator.

[0028] In a specific implementation, the client sends a coding sequence and a grouping index to a jump point authentication module, and the jump point authentication module performs corresponding login authentication according to the received coding sequence and grouping index.

[0029] In this way, by dynamically grouping and encoding the authentication information, we can prevent security issues such as account and password leakage, replay attacks, and brute force cracking, and improve the security of the login process.

[0030] In a possible implementation, in the above step 101, determining the grouping index according to the identity authentication information and the total number of authentication servers includes: The identity authentication information is hashed to obtain a hash value of the identity authentication information; English characters in the hash value of the identity authentication information are converted into corresponding ASCII code values ​​and summed to obtain a sum of the character ASCII code values; a grouping index is determined based on the sum of the character ASCII code values, the total number of authentication servers and a preset jump point coefficient.

[0031] In the embodiment of the present application, the MD5 algorithm can be used to perform hash processing on the identity authentication information of the current pre-access user to obtain a corresponding hash value A1; the English characters in the hash value A1 of the identity authentication information are converted into corresponding ASCII code values ​​and summed to obtain the sum of the character ASCII code values ​​A2; according to the sum of the character ASCII code values ​​A2, the total number of authentication servers and the preset jump point coefficient, the grouping index is determined, wherein the calculation formula of the grouping index of the current pre-access user's visit is as follows: ; in, B 1 is the grouping index; [·] is the rounding function; A 2 is the hash value A The sum of the decimal code values ​​of all English characters contained in 1 in the ASCII code table; P 1 is the total number of authentication servers set up by the information management platform for identity authentication; It is the preset jump point coefficient, which can ensure that the calculation result is between 1 and 16; A 3 is a positive integer randomly generated in the interval [Z1, Z2] using a random function, where Z1 and Z2 are the preset minimum and maximum values ​​of the interval respectively.

[0032] here, P 1- A 3 is a positive number. A The value of 3 is selected based on the interval [Z1,Z2], and Z 1 and Z 2 is based on P 1 preset maximum and minimum values; and B The comparison result of 1 is used to determine the grouping method. Based on the comparison result, it is determined whether to perform iterative grouping or cut grouping.

[0033] In a possible implementation, in the above step 102, grouping the identity authentication information according to the grouping index to generate a target grouping sequence includes: Determine the grouping rule according to the comparison result between the grouping index and the preset grouping determination value; group the identity authentication information according to the grouping rule to generate a target grouping sequence.

[0034] Among them, the grouping rule may include iterative grouping, cutting grouping, grouping based on hash values, grouping based on digital ranges, and so on.

[0035] In the embodiment of the present application, the grouping index B1 can be compared with the preset grouping determination value P2, and the corresponding grouping rule is determined according to the comparison result. Then, the identity authentication information is grouped according to the grouping rule to obtain the target grouping sequence. In a possible implementation manner, the grouping rule includes iterative grouping and cutting grouping. The above step of determining the grouping rule according to the comparison result between the grouping index and the preset grouping determination value includes: When the grouping index is greater than or equal to the preset grouping determination value, determine iterative grouping as the grouping rule; when the grouping index is less than the grouping determination value, determine cutting grouping as the grouping rule.

[0036] In specific implementation, compare the grouping index B1 with the grouping determination value P2 to determine the grouping method, and obtain all the grouping sequences C1, C2,..., Cc for the current pre-access user's current access. If B1≥P2, determine that the grouping method for the current pre-access user's current access is iterative grouping, and group the identity authentication information of the current pre-access user according to the iterative grouping rule to obtain all the grouping sequences C1, C2,..., Cc for the current pre-access user's current access; If B1<P2, determine that the grouping method for the current pre-access user's current access is cutting grouping, and group the identity authentication information of the current pre-access user according to the cutting grouping rule to obtain all the grouping sequences C1, C2,..., Cc for the current pre-access user's current access.

[0037] In a possible implementation manner, when the grouping rule is iterative grouping, in the above step 102, the step of grouping the identity authentication information according to the grouping index to generate a target grouping sequence includes: Determine multiple target characters in the identity authentication information according to the preset extraction rule; starting from each of the target characters, extract characters with the number of target characters from the identity authentication information in turn to obtain the target grouping sequence.

[0038] In an exemplary embodiment, from left to right, B1 characters are extracted from the first character constituting the identity authentication information of the current pre-access user to the right to obtain the first grouping sequence C1. It should be noted that the extracted characters include the first character; B1 characters are extracted from the second character constituting the identity authentication information of the current pre-access user to the right to obtain the second grouping sequence C2; ​​and so on, B1 characters are extracted from the 1st, 2nd, ..., cth characters constituting the identity authentication information typed by the current pre-access user to the right to obtain c grouping sequences, and the c grouping sequences are marked as C1, C2, ..., Cc in the order of extraction. It should be noted that the number of characters extracted from the c+1th character constituting the identity authentication information of the current pre-access user to the right is B1-1, which cannot be regarded as a grouping sequence.

[0039] For example, if the account password entered by the user is AAbb12345678-=, B1=8, then the corresponding grouping sequences are AAbb1234, Abb12345, bb123456, b1234567, 12345678, 2345678- and 345678-=.

[0040] In another possible implementation, when the grouping rule is segmented grouping, in the above step 102, grouping the identity authentication information according to the grouping index to generate a target grouping sequence includes: The identity authentication information is divided into a plurality of sequences according to the target number of characters; and a target grouping sequence is generated according to the plurality of sequences.

[0041] In an exemplary embodiment, the identity authentication information of the current pre-access user is cut into c parts, and each of the cut parts is used as a group sequence. The target number of characters in each group sequence is B1, and the c group sequences are marked as C1, C2, ..., Cc from left to right according to the position of each group sequence in the identity authentication information of the current pre-access user before cutting.

[0042] Here, it should be noted that if the number of characters constituting the current pre-access user account password is not divisible by B1, the number of characters in the first c-1 grouping sequences is B1, and the number of characters in the last grouping sequence is less than B1.

[0043] For example, if the account password entered by the user is AAbb12345678-=, B1=3, then the corresponding grouping sequence is AAb, b12, 345, 678 and -=; In a possible implementation, after sending the coding sequence and the grouping indicator to the jump point authentication module in the above step 104, the method further includes: The authorized access instruction returned by the jump point authentication module based on the coding sequence and the grouping index is obtained, and a preset value is added to each number in the digital sequence corresponding to the target grouping sequence.

[0044] The authorized access instruction is used to indicate that the login authentication based on the identity authentication information is passed.

[0045] In a specific implementation, when the authentication server performs login authentication based on the coding sequence and grouping indicators and determines that the login authentication is successful, it returns an authorized access instruction to the client. The client adds a preset value to each number in the digital sequence corresponding to the target grouping sequence, where the preset value is selected according to actual needs, for example, the preset value is set to 1.

[0046] Figure 2 Another flow chart of the login authentication method provided by the embodiment of the present application is shown. The execution subject of the method can be a jump point authentication module, which includes multiple jump point authentication units, and the jump point authentication units correspond to the authentication server. As shown in the figure, the method 200 may include the following steps: Step 201: Obtain a coding sequence and a grouping index.

[0047] Among them, the grouping index is determined by the client according to the input identity authentication information and the total number of authentication servers; the coding sequence determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and is determined based on the digital sequence; the target grouping sequence is generated by grouping the identity authentication information according to the grouping index.

[0048] In a specific implementation, the jump point authentication module is used to authenticate the pre-access user, and includes multiple jump point authentication units. One jump point authentication unit may correspond to one authentication server, where the authentication server is a cloud server set up by the information management platform for identity authentication.

[0049] The jump point authentication module obtains the coding sequence and grouping index sent by the client, and the grouping index is determined by the client according to the input identity authentication information and the total number of authentication servers; the coding sequence determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and is determined based on the digital sequence; the target grouping sequence is generated by grouping the identity authentication information according to the grouping index.

[0050] Step 202: performing grouping processing on the coding sequence according to the grouping index to obtain a grouped sequence.

[0051] In a specific implementation, the jump point authentication module may determine the grouping method of the identity authentication information according to the grouping index obtained in the above step 201, perform grouping processing on the identity authentication information according to the grouping method, and generate a grouping sequence.

[0052] Step 203: Determine the target jump point authentication unit corresponding to the packet sequence, and encrypt the packet sequence according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence.

[0053] In a specific implementation, the jump point authentication module determines the target jump point authentication unit corresponding to each grouping sequence, wherein each jump point authentication unit included in the jump point authentication module stores a grouping record subtable of all pre-access users based on the jump point authentication unit and an independent authentication sequence, and the independent authentication sequence is a string consisting of a number of numbers 1 and 0. At the same time, the grouping record subtable of all pre-access users based on the jump point authentication unit and the independent authentication sequence stored in each jump point authentication unit are also stored in the jump point authentication module.

[0054] Here, it should be noted that for the current pre-access user, the content of the total table obtained by merging the grouping record sub-tables of the pre-access users stored in all jump point authentication units is the same as the content of the grouping record table thereof stored in the information grouping unit.

[0055] Then, according to the independent authentication sequence corresponding to the target jump point authentication unit, the group sequence is encrypted to obtain a ciphertext conversion sequence.

[0056] Step 204: by transmitting the ciphertext conversion sequence to the target jump point authentication unit, when the target jump point authentication unit determines that the verification is completed based on the ciphertext conversion sequence, generating an authorized access instruction of the client.

[0057] In a specific implementation, the ciphertext conversion sequence corresponding to each group sequence is sent to the corresponding target jump point authentication unit. After the target jump point authentication unit receives all the ciphertext conversion sequences of the current pre-access user's current access based on the jump point authentication unit transmitted by the jump point authentication module, it performs AND operations on them according to the independent authentication sequence of the current pre-access user stored therein, and performs decimal conversion on the operation result to restore all the group sequences of the current pre-access user's current access based on the jump point authentication unit. All the restored group sequences are matched with the contents of the current pre-access user group record word table stored therein for consistency. If they are all matched, the jump point authentication unit generates an independent authentication success instruction and transmits it to the jump point authentication module. The jump point authentication module generates an authorized access instruction after receiving the independent authentication success instructions transmitted by all corresponding target jump point authentication units. In a possible implementation, in the above step 202, the coding sequence is grouped according to the grouping index to obtain a grouped sequence, including: According to the comparison result between the grouping index and the preset grouping judgment value, a grouping rule is determined; according to the grouping rule, the coding sequence is grouped to generate a grouping sequence.

[0058] In an embodiment of the present application, after receiving the coding sequence of the current pre-access user's current visit, the jump point authentication module restores all the grouping sequences of the current pre-access user's current visit and the corresponding jump point authentication units according to the preset restoration steps, and the restoration steps are as follows: first, the received grouping index B1 of the current pre-access user's current visit is compared with the preset grouping judgment value P2, and based on the comparison result, the grouping rule of the current pre-access user's current visit is restored, and based on the grouping rule, the coding sequence of the current pre-access user's current visit is grouped to restore all the grouping sequences of the current pre-access user's current visit.

[0059] In a possible implementation, in the above step 203, determining the target jump point authentication unit corresponding to the packet sequence includes: Acquire the account identifier corresponding to the identity authentication information; determine the group record subtable corresponding to the account identifier stored in the jump authentication unit corresponding to the authentication server; and determine the target jump authentication unit corresponding to the group sequence according to the group record subtable to which the group sequence belongs.

[0060] In a specific implementation, the jump point authentication module can obtain the group record subtable stored in all jump point authentication units according to the account identifier corresponding to the identity authentication information keyed in the current pre-access user, such as the account name. Based on each group record subtable, find the group sequence corresponding to the number consistent with each group sequence of the current pre-access user's current access, and obtain the jump point authentication units corresponding to these group sequences.

[0061] It should be noted here that the target jump point authentication unit corresponding to the packet sequence is the jump point authentication unit storing the packet record sub-table to which the packet sequence belongs.

[0062] In a possible implementation, in the above step 203, the group sequence is encrypted according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence, including: The independent authentication sequence corresponding to the target jump point authentication unit is converted into a binary sequence to obtain an authentication sequence; after the grouping sequence is converted into a binary sequence, an AND operation is performed with the authentication sequence to obtain a ciphertext conversion sequence.

[0063] In a specific implementation, the jump point authentication module transmits all packet sequences of the current pre-access user's current access according to a preset distributed transmission rule, which specifically includes the following steps: S2031: Obtaining an independent authentication sequence of the pre-access user stored in a jump point authentication unit for the current pre-access user's current visit, performing binary conversion on the independent authentication sequence, and marking the converted data as a binary authentication sequence F1 of the current pre-access user's current visit based on the jump point authentication unit; S2032: Filter and obtain all the group sequences corresponding to the jump point authentication unit from all the group sequence of the current pre-access user's visit obtained by the restoration, perform binary conversion on them, and mark the converted data as E1, E2, ..., Ee in sequence, 1≤e≤c; S2033: Perform an AND operation on the base authentication sequence F1 and E1, E2, ..., Ee respectively to obtain all ciphertext conversion sequences based on the jump point authentication unit, and transmit them to the jump point authentication unit; S2034: According to S2031 to S2033, all ciphertext conversion sequences of all jump authentication units accessed by the current pre-access user are calculated and transmitted to the corresponding jump authentication units. In this way, the randomness of the type and number of jump authentication units used for password authentication in each authentication process is guaranteed.

[0064] In a possible implementation, in the above step 204, after the authorization access instruction of the client is generated, the following is further included: A first identifier is added at a preset position of the independent authentication sequence corresponding to the target jump point authentication unit; and a second identifier is added at a preset position of the independent authentication sequence of other jump point authentication units except the target jump point authentication unit in the jump point authentication unit corresponding to the authentication server.

[0065] In an exemplary embodiment, the jump point authentication unit stores a group record subtable and an independent authentication sequence of all pre-access users based on the jump point authentication unit. The independent authentication sequence is a string of numbers 1 and 0, expressed in binary form, and the number of bits will increase with the number of logins; and the increased characters will only be 1 or 0. After a single jump point authentication unit successfully authenticates its group sequence, a first identifier is added to its left, for example, the first identifier is 1. If it does not participate in the authentication in the sequential access, a second identifier is added to its left, for example, the second identifier is 0, so that the change frequency of the independent authentication sequence is associated with the number and time of logins of the pre-logged-in user, so as to further ensure the dynamic variability of the independent authentication sequence.

[0066] In a possible implementation, in the above step 204, after generating the authorization access instruction of the client, the following is further included: The access authorization instruction is sent to the client, so that the client adds a preset value to each number in the digital sequence corresponding to the grouping sequence in the grouping record table.

[0067] In an exemplary embodiment, after receiving the independent authentication success instruction transmitted by all corresponding jump-point authentication units, the jump-point authentication module generates an authorized access instruction, transmits it to the information management platform and the client module respectively, and synchronously updates the independent authentication sequence of the current pre-access user based on all corresponding jump-point authentication units stored therein.

[0068] After generating the authorized access instruction, the jump point authentication module generates a passive update instruction and transmits it and the account name typed by the current pre-access user for this access to all other jump point authentication units that have not transmitted any data during this authentication process. After all jump point authentication units receive the passive update instruction transmitted by the jump point authentication module and the account name typed by the current pre-access user for this access, they add the number 0 to the leftmost side of the independent authentication sequence of the current pre-access user stored therein.

[0069] Furthermore, the information management platform performs security management on the software product information of the pre-access user, and the information management platform stores the software product information that all pre-access users entrust the platform to manage. After receiving the authorization instruction transmitted by the jump point authentication module, the information management platform authorizes the current pre-access user for this access, allowing him to update his software product information during this access.

[0070] After receiving the authorized access instruction transmitted by the jump point authentication module, the client adds a preset value, for example, 1, to the number corresponding to the corresponding grouping sequence in the information grouping unit according to all the grouping sequences of the current pre-access user's current access.

[0071] Figure 3 The schematic diagram of the structure of the client provided in the embodiment of the present application is shown. The client can be used to execute the above Figure 1 In some or all of the embodiments, the client 300 includes: An indicator determination module 310 is used to obtain input identity authentication information and determine a grouping indicator according to the identity authentication information and the total number of authentication servers; A sequence generation module 320, configured to perform grouping processing on the identity authentication information according to the grouping index to generate a target grouping sequence; A sequence determination module 330, configured to determine a digital sequence corresponding to the target group sequence according to a preset correspondence between the group sequence and the digital sequence, and determine a coding sequence of the identity authentication information based on the digital sequence; The information sending module 340 is used to send the coding sequence and the grouping index to the jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping index.

[0072] In a possible implementation, the indicator determination module 310, when used to determine the grouping indicator according to the identity authentication information and the total number of authentication servers, is specifically used to: Performing hash processing on the identity authentication information to obtain a hash value of the identity authentication information; Convert the English characters in the hash value of the identity authentication information into corresponding ASCII code values ​​and sum them to obtain the sum of the character ASCII code values; The grouping index is determined according to the sum of the ASCII code values ​​of the characters, the total number of authentication servers and a preset jump point coefficient.

[0073] In a possible implementation, the sequence generation module 320, when used to perform group processing on the identity authentication information according to the grouping index to generate a target grouping sequence, is specifically used to: Determining a grouping rule according to a comparison result between the grouping index and a preset grouping determination value; The identity authentication information is grouped according to the grouping rule to generate a target grouping sequence.

[0074] The grouping rules include iterative grouping and cut grouping. The sequence generation module 320, when used to determine the grouping rules according to the comparison result between the grouping index and the preset grouping determination value, is specifically used to: In the case where the grouping index is greater than or equal to a preset grouping determination value, determining iterative grouping as a grouping rule; When the grouping index is smaller than the grouping determination value, the split grouping is determined as the grouping rule.

[0075] In a possible implementation, when the grouping rule is iterative grouping, the sequence generation module 320, when used to perform grouping processing on the identity authentication information according to the grouping index to generate a target grouping sequence, is specifically used to: Determine multiple target characters in the identity authentication information according to a preset extraction rule; Starting from each of the target characters, characters of a target number are extracted from the identity authentication information in sequence to obtain a target grouping sequence.

[0076] In a possible implementation, when the grouping rule is segmented grouping, the sequence generation module 320, when used to perform grouping processing on the identity authentication information according to the grouping index to generate a target grouping sequence, is specifically used to: According to the target number of characters, the identity authentication information is divided into a plurality of sequences; A target packet sequence is generated according to the multiple sequences.

[0077] In a possible implementation, the client 300 further includes: The instruction acquisition module is used to obtain the authorization access instruction returned by the jump point authentication module based on the coding sequence and the grouping index, and add a preset value to each number in the digital sequence corresponding to the target grouping sequence.

[0078] The embodiment of the present application provides a client, including an indicator determination module, a sequence generation module, a sequence determination module and an information sending module; the indicator determination module obtains the input identity authentication information, and determines the grouping indicator according to the identity authentication information and the total number of authentication servers; the sequence generation module performs grouping processing on the identity authentication information according to the grouping indicator to generate a target grouping sequence; the sequence determination module determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and determines the coding sequence of the identity authentication information based on the digital sequence; the information sending module sends the coding sequence and the grouping indicator to the jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping indicator. In this way, by dynamically grouping and encoding the identity authentication information, security issues such as account password leakage, replay attacks, and brute force cracking can be prevented, and the security of the login process can be improved.

[0079] Figure 4 The schematic diagram of the structure of the jump point authentication module provided in the embodiment of the present application is shown. The authentication server can be used to perform the above Figure 2 In some or all of the embodiments, the jump point authentication module 400 includes a plurality of jump point authentication units, and the jump point authentication units correspond to the authentication server, including: The information acquisition module 410 is used to acquire a coding sequence and a grouping index; wherein the grouping index is determined by the client according to the input identity authentication information and the total number of authentication servers; the coding sequence determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and is determined based on the digital sequence; the target grouping sequence is generated by grouping the identity authentication information according to the grouping index; A sequence grouping module 420, configured to group the coding sequence according to the grouping index to obtain a grouped sequence; A sequence encryption module 430 is used to determine a target jump point authentication unit corresponding to the packet sequence, and encrypt the packet sequence according to an independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence; The instruction generation module 440 is configured to transmit the ciphertext conversion sequence to the target jump point authentication unit, and generate an authorized access instruction of the client when the target jump point authentication unit determines that the verification is completed based on the ciphertext conversion sequence.

[0080] In a possible implementation, the sequence grouping module 420, when used to group the coding sequence according to the grouping index to obtain the grouped sequence, is specifically used to: Determining a grouping rule according to a comparison result between the grouping index and a preset grouping determination value; According to the grouping rule, the coding sequence is grouped to generate a grouping sequence.

[0081] In a possible implementation, the sequence encryption module 430, when used to determine the target jump point authentication unit corresponding to the packet sequence, is specifically used to: Obtaining the account ID corresponding to the identity authentication information; Determine a group record subtable corresponding to the account identifier stored in a jump point authentication unit corresponding to the authentication server; According to the group record subtable to which the group sequence belongs, a target jump point authentication unit corresponding to the group sequence is determined.

[0082] In a possible implementation, the sequence encryption module 430, when used to encrypt the group sequence according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain the ciphertext conversion sequence, is specifically used to: Performing binary conversion on the independent authentication sequence corresponding to the target jump point authentication unit to obtain an authentication sequence; After the grouping sequence is converted into a binary sequence, an AND operation is performed with the authentication sequence to obtain a ciphertext conversion sequence.

[0083] In a possible implementation, the authentication server 400 further includes: An identification adding module, used for adding a first identification at a preset position of the independent authentication sequence corresponding to the target jump point authentication unit; A second identifier is added at a preset position of the independent authentication sequence of other jump point authentication units except the target jump point authentication unit in the jump point authentication unit corresponding to the authentication server.

[0084] In a possible implementation, the authentication server 400 further includes: The instruction sending module is used to send the authorization access instruction to the client, so that the client adds a preset value to each number in the digital sequence corresponding to the grouping sequence in the grouping record table.

[0085] The embodiment of the present application provides a jump point authentication module, which includes multiple jump point authentication units, the jump point authentication units correspond to the authentication server, and include an information acquisition module, a sequence grouping module, a sequence encryption module and an instruction generation module; the information acquisition module acquires the coding sequence and the grouping index; the sequence grouping module performs grouping processing on the coding sequence according to the grouping index to obtain a grouping sequence; the sequence encryption module determines the target jump point authentication unit corresponding to the grouping sequence, and encrypts the grouping sequence according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence; the instruction generation module transmits the ciphertext conversion sequence to the target jump point authentication unit, and generates the authorization access instruction of the client when the target jump point authentication unit determines that the verification is completed based on the ciphertext conversion sequence. In this way, by dynamically grouping and encrypting the coding sequence sent by the client, the identity authentication information can be made less likely to be tampered with or leaked, thereby improving the security of the login process.

[0086] Figure 5 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device 500 includes a processor 510, and optionally, includes an internal bus 520, a network interface 530, and a memory 540. Among them, the memory 540 may include a memory 541, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory 542 (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device 500 may also include hardware required for other services.

[0087] The processor 510, the network interface 530 and the memory may be interconnected via an internal bus 520, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0088] The memory 540 stores programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory 540 may include a memory 541 and a non-volatile memory 542 , and provide instructions and data to the processor 510 .

[0089] The processor 510 reads the corresponding computer program from the non-volatile memory 542 into the memory and then runs it, forming a device for locating the target user at the logical level. The processor 510 executes the program stored in the memory and specifically performs: Figure 1 or Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0090] The above application Figure 1 or Figure 2The method disclosed in the illustrated embodiment can be applied to the processor 510 or implemented by the processor 510. The processor 510 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 510. The above processor 510 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0091] The computer device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0092] Of course, in addition to software implementation, the electronic device 500 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0093] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 1 or Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0094] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0095] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 1 or Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0096] The embodiments of the present application can be applied to various electronic device collaboration or interconnection scenarios, including: collaboration and interconnection between mobile phones and laptops / tablet computers; collaboration and interconnection between mobile terminals and smart TVs / displays; collaboration and interconnection between mobile phones or tablet computers and in-car entertainment systems; collaboration and interconnection between mobile terminals and smart conference systems, etc., so as to meet the needs of users in various scenarios such as smart homes, smart offices, and smart travel.

[0097] In short, the above is only a preferred embodiment of the present application and does not limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0098] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0099] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0100] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0101] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A login authentication method, characterized in that: Applied to the client, including: Obtaining input identity authentication information, and determining a grouping index according to the identity authentication information and the total number of authentication servers; According to the grouping index, the identity authentication information is grouped to generate a target grouping sequence; Determine the digital sequence corresponding to the target group sequence according to the correspondence between the preset group sequence and the digital sequence, and determine the coding sequence of the identity authentication information based on the digital sequence; The coding sequence and the grouping indicator are sent to a jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping indicator.

2. The method according to claim 1, characterized in that The determining of the grouping index according to the identity authentication information and the total number of authentication servers includes: Performing hash processing on the identity authentication information to obtain a hash value of the identity authentication information; Convert the English characters in the hash value of the identity authentication information into corresponding ASCII code values ​​and sum them to obtain the sum of the character ASCII code values; The grouping index is determined according to the sum of the ASCII code values ​​of the characters, the total number of authentication servers and a preset jump point coefficient.

3. The method according to claim 1, characterized in that The step of grouping the identity authentication information according to the grouping index to generate a target grouping sequence includes: Determining a grouping rule according to a comparison result between the grouping index and a preset grouping determination value; The identity authentication information is grouped according to the grouping rule to generate a target grouping sequence.

4. The method according to claim 3, characterized in that The grouping rules include iterative grouping and cut grouping, and the grouping rules are determined according to the comparison result between the grouping index and the preset grouping determination value, including: In the case where the grouping index is greater than or equal to a preset grouping determination value, determining iterative grouping as a grouping rule; When the grouping index is smaller than the grouping determination value, the splitting group is determined as the grouping rule.

5. The method according to claim 3, characterized in that: In the case where the grouping rule is iterative grouping, the grouping process of the identity authentication information according to the grouping index to generate a target grouping sequence includes: Determine multiple target characters in the identity authentication information according to a preset extraction rule; Starting from each of the target characters, characters of a target number are extracted from the identity authentication information in sequence to obtain a target grouping sequence.

6. The method according to claim 3, characterized in that In the case where the grouping rule is segmented grouping, the grouping process is performed on the identity authentication information according to the grouping index to generate a target grouping sequence, including: According to the target number of characters, the identity authentication information is divided into multiple sequences; A target packet sequence is generated according to the multiple sequences.

7. The method according to any one of claims 1 to 6, characterized in that: After sending the coding sequence and the grouping indicator to the jump point authentication module, the method further includes: The authorized access instruction returned by the jump point authentication module based on the coding sequence and the grouping index is obtained, and a preset value is added to each number in the digital sequence corresponding to the target grouping sequence.

8. A login authentication method, characterized in that: Applied to a jump point authentication module, the jump point authentication module includes a plurality of jump point authentication units, the jump point authentication units correspond to the authentication server, and include: Obtaining a coding sequence and a grouping index; wherein the grouping index is determined by the client according to the input identity authentication information and the total number of authentication servers; the coding sequence determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and is determined based on the digital sequence; the target grouping sequence is generated by grouping the identity authentication information according to the grouping index; According to the grouping index, the coding sequence is grouped to obtain a grouped sequence; Determine a target jump point authentication unit corresponding to the packet sequence, and encrypt the packet sequence according to an independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence; By transmitting the ciphertext conversion sequence to the target jump point authentication unit, when the target jump point authentication unit determines that the verification is completed based on the ciphertext conversion sequence, an authorized access instruction of the client is generated.

9. The method according to claim 8, characterized in that The step of grouping the coding sequence according to the grouping index to obtain a grouping sequence includes: Determining a grouping rule according to a comparison result between the grouping index and a preset grouping determination value; According to the grouping rule, the coding sequence is grouped to generate a grouping sequence.

10. The method according to claim 8, characterized in that The target jump point authentication unit for determining the packet sequence corresponding to the target jump point authentication unit includes: Obtaining the account ID corresponding to the identity authentication information; Determine a group record subtable corresponding to the account identifier stored in a jump point authentication unit corresponding to the authentication server; According to the group record subtable to which the group sequence belongs, a target jump point authentication unit corresponding to the group sequence is determined.

11. The method according to claim 8, characterized in that The step of encrypting the grouping sequence according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence includes: Performing binary conversion on the independent authentication sequence corresponding to the target jump point authentication unit to obtain an authentication sequence; After the grouping sequence is converted into a binary sequence, an AND operation is performed with the authentication sequence to obtain a ciphertext conversion sequence.

12. The method according to claim 8, characterized in that After generating the authorization access instruction of the client, the method further includes: Adding a first identifier at a preset position of the independent authentication sequence corresponding to the target jump point authentication unit; A second identifier is added at a preset position of the independent authentication sequence of other jump point authentication units except the target jump point authentication unit in the jump point authentication unit corresponding to the authentication server.

13. The method according to any one of claims 8 to 12, characterized in that: After generating the authorization access instruction of the client, the method further includes: The access authorization instruction is sent to the client, so that the client adds a preset value to each number in the digital sequence corresponding to the grouping sequence in the grouping record table.

14. A client, characterized in that: include: An indicator determination module, used to obtain input identity authentication information, and determine a grouping indicator according to the identity authentication information and the total number of authentication servers; A sequence generation module, used to group the identity authentication information according to the grouping index to generate a target grouping sequence; A sequence determination module, used to determine the digital sequence corresponding to the target group sequence according to the correspondence between the preset group sequence and the number, and determine the coding sequence of the identity authentication information based on the digital sequence; The information sending module is used to send the coding sequence and the grouping index to the jump point authentication module, and the jump point authentication module is used to perform login authentication based on the coding sequence and the grouping index.

15. A jump point authentication module, characterized in that: The jump point authentication module includes a plurality of jump point authentication units, each of which corresponds to an authentication server and includes: An information acquisition module is used to acquire a coding sequence and a grouping index; wherein the grouping index is determined by the client according to the input identity authentication information and the total number of authentication servers; the coding sequence determines the digital sequence corresponding to the target grouping sequence according to the correspondence between the preset grouping sequence and the number, and is determined based on the digital sequence; the target grouping sequence is generated by grouping the identity authentication information according to the grouping index; A sequence grouping module, used for grouping the coding sequence according to the grouping index to obtain a grouped sequence; A sequence encryption module, used to determine the target jump point authentication unit corresponding to the packet sequence, and encrypt the packet sequence according to the independent authentication sequence corresponding to the target jump point authentication unit to obtain a ciphertext conversion sequence; The instruction generation module is used to generate an authorized access instruction of the client by transmitting the ciphertext conversion sequence to the target jump point authentication unit, when the target jump point authentication unit determines that the verification is completed based on the ciphertext conversion sequence.

16. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 13 are implemented.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 13 are implemented.

18. A computer program product, characterized in that The computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer is caused to perform the steps of the method according to any one of claims 1 to 13.

Images