Authentication method, device, computer equipment, readable storage medium and program product

Abstract

The present application relates to an identity authentication method, apparatus, computer device, computer-readable storage medium, and computer program product. The method comprises: receiving a verification instruction sent by a client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result; when the account-password verification result is a failure and the key relationship table is usable, querying the intermediate snapshot key from the key relationship table according to the user identifier, decrypting the reference login password using the intermediate snapshot key to obtain a decryption result, and performing a second account-password verification on the decryption result to obtain an identity authentication result; the intermediate snapshot key is the decryption snapshot key obtained when the server last performed identity authentication. The use of this method can improve the security of user login.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an identity authentication method, apparatus, computer device, computer-readable storage medium, and computer program product. Background Art

[0002] With the rapid development of Internet identity authentication technology, the authentication method based on account and password (account secret) has always occupied a mainstream position due to its advantages such as low deployment cost and low user awareness threshold.

[0003] Currently, the most common user authentication method is account-password authentication. When the server needs to verify password strength, many solutions use a pre-encrypted key to encrypt the transmitted password. If a malicious user steals the transmitted ciphertext, they can use this method to log in to the user account, making the user account insecure. Summary of the Invention

[0004] Based on this, it is necessary to provide an identity authentication method, apparatus, computer device, computer-readable storage medium and computer program product that can improve security in response to the above technical problems.

[0005] In a first aspect, the present application provides an identity authentication method, which is applied to a server; the method comprises:

[0006] Receive a verification instruction sent by the client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and a reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using the public key; the reference snapshot key is the snapshot key used by the client when last encrypting the initial login password corresponding to the user identifier;

[0007] decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result;

[0008] When the account-password verification result is failure and the key relationship table is usable, an intermediate snapshot key is queried from the key relationship table according to the user identifier, the reference login password is decrypted using the intermediate snapshot key to obtain a decrypted result, and a second account-password verification is performed on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decryption snapshot key obtained when the server last performed identity verification.

[0009] In one embodiment, decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result includes:

[0010] Decrypting the encrypted snapshot key according to the private key to obtain the decrypted snapshot key;

[0011] Decrypting the ciphertext based on the decryption snapshot key to obtain the reference login password;

[0012] A first hash value corresponding to the user identifier and the reference login password is calculated, and the hash value is matched with a pre-stored first credential to obtain the account-password verification result.

[0013] In one embodiment, decrypting the reference login password using the intermediate snapshot key to obtain a decryption result, and performing a second account and password verification on the decryption result to obtain an identity verification result includes:

[0014] Decrypting the reference login password using the intermediate snapshot key to obtain the decryption result;

[0015] The user identification and a second hash value corresponding to the decryption result are calculated, and the second hash value is matched with a pre-stored second credential to obtain the identity authentication result.

[0016] In a second aspect, the present application provides an identity authentication method, applied to a client, the method comprising:

[0017] Get the initial login password and user ID;

[0018] Encrypting the initial login password using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key is the snapshot key used by the client to encrypt the initial login password corresponding to the user identifier last time;

[0019] Encrypting the snapshot key according to the pre-acquired public key to obtain an encrypted snapshot key;

[0020] A verification instruction is generated according to the user identifier, the ciphertext and the encrypted snapshot key, and the verification instruction is sent to the server; the server performs identity authentication according to the user identifier, the ciphertext and the encrypted snapshot key.

[0021] In one embodiment, encrypting the initial login password using the randomly generated snapshot key and the reference snapshot key to obtain a ciphertext includes:

[0022] Encrypting the initial login password using the randomly generated snapshot key to obtain a reference ciphertext;

[0023] Encrypting the reference ciphertext using the reference snapshot key to obtain the ciphertext;

[0024] After obtaining the ciphertext, the method further includes:

[0025] The ciphertext is saved and the stored initial login password is replaced by the ciphertext.

[0026] In a third aspect, the present application provides an identity authentication device, which is applied to a server, and the device includes:

[0027] a receiving module, configured to receive a verification instruction sent by a client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and a reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using a public key; the reference snapshot key is the snapshot key used by the client when last encrypting the initial login password corresponding to the user identifier;

[0028] a decryption module, configured to decrypt the encrypted snapshot key and the ciphertext to obtain a reference login password, and perform a first account-password verification on the reference login password to obtain an account-password verification result;

[0029] a verification module configured to, when the account-password verification result is failed and the key relationship table is usable, query an intermediate snapshot key from the key relationship table according to the user identifier, decrypt the reference login password using the intermediate snapshot key to obtain a decrypted result, and perform a second account-password verification on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decryption snapshot key obtained when the server last performed identity verification.

[0030] In a fourth aspect, the present application provides an identity authentication device, applied to a client, the device comprising:

[0031] The acquisition module is used to obtain the initial login password and user ID;

[0032] a first encryption module, configured to encrypt the initial login password using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key being the snapshot key used by the client when encrypting the initial login password corresponding to the user identifier last time;

[0033] a second encryption module, configured to encrypt the snapshot key according to a pre-acquired public key to obtain an encrypted snapshot key;

[0034] The sending module is used to generate a verification instruction according to the user identifier, the ciphertext and the encrypted snapshot key, and send the verification instruction to the server; the server performs identity authentication according to the user identifier, the ciphertext and the encrypted snapshot key.

[0035] In a fifth aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method in any one of the above embodiments when executing the computer program.

[0036] In a sixth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method in any one of the above embodiments when the computer program is executed by a processor.

[0037] In a seventh aspect, the present application provides a computer program product, comprising a computer program, which implements the steps of the method in any one of the above embodiments when executed by a processor.

[0038] The aforementioned identity authentication method, apparatus, computer device, computer-readable storage medium, and computer program product receive a verification instruction sent by a client and decrypt the ciphertext using the encrypted snapshot key carried in the verification instruction to obtain a reference login password. The client then performs a first account-password verification on the reference login password to obtain an account-password verification result. A failure in the account-password verification indicates that the client has double-encrypted the initial login password using both the snapshot key and the reference snapshot key. At this point, the server queries the key relationship table using the user identifier to obtain the decryption snapshot key from the server's previous authentication. The reference login password is then decrypted to obtain a decryption result. After obtaining the decryption result, the server performs a second account-password verification on the decrypted result to obtain the final authentication result. This allows the server to provide highly secure account authentication without introducing multi-factor authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 A diagram showing an application environment of an identity authentication method in an embodiment;

[0041] Figure 21 is a flow chart of an identity verification method according to an embodiment;

[0042] Figure 3 A schematic diagram of a process for performing identity authentication on a client in one embodiment;

[0043] Figure 4 is a flowchart of an identity authentication method in another embodiment;

[0044] Figure 5 Schematic diagram of the process of server-side identity authentication in one embodiment;

[0045] Figure 6 is a structural block diagram of an identity verification device in one embodiment;

[0046] Figure 7 is a structural block diagram of an identity verification device in another embodiment;

[0047] Figure 8 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0049] The identity authentication method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the client 102 communicates with the server 104 through the network. The data storage system can store the data that the service client 104 needs to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. The client 102 obtains the initial login password and user identification; encrypts the initial login password by a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key is the snapshot key used by the client when it last encrypted the initial login password corresponding to the user identification; encrypts the snapshot key according to the pre-acquired public key to obtain an encrypted snapshot key; generates a verification instruction according to the user identification, ciphertext and encrypted snapshot key, and sends the verification instruction to the server; the server performs identity authentication according to the user identification, ciphertext and encrypted snapshot key; the server performs identity authentication according to the user identification, ciphertext and encrypted snapshot key. The server 104 receives a verification command sent by the client; the verification command carries a ciphertext, an encrypted snapshot key, and a user identifier. The ciphertext is obtained by encrypting the obtained initial login password using the snapshot key and the reference snapshot key. The encrypted snapshot key is obtained by encrypting the snapshot key using the public key. The reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier. The encrypted snapshot key and ciphertext are decrypted to obtain a reference login password, and a first account-password verification is performed on the reference login password to obtain an account-password verification result. If the account-password verification result fails and the key relationship table indicates that it is usable, the server 104 retrieves an intermediate snapshot key from the key relationship table based on the user identifier, decrypts the reference login password using the intermediate snapshot key, obtains a decrypted result, and performs a second account-password verification on the decrypted result to obtain an identity verification result. The intermediate snapshot key is the decrypted snapshot key obtained by the server the last time it performed identity verification. The client 102 may be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, smart car devices, projectors, and the like. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0050] In an exemplary embodiment, Figure 2 As shown, an authentication method is provided, which is applied to Figure 1Taking the client 102 in the example as an example, the following steps are included from step 202 to step 208. Among them:

[0051] Step 202: Obtain the initial login password and user ID.

[0052] The initial login password refers to the user's password obtained by the client, which is used for login verification. The user identification refers to information that uniquely identifies the user, that is, the user's ID.

[0053] Optionally, there are two ways to obtain the initial login password: exemplarily, one is the password entered by the user using the virtual keyboard; and the other is exemplarily, the "memory" of the client.

[0054] For example, when a user logs into a website, he or she may enter a password and a user ID through a virtual keyboard, and the client will then obtain the corresponding initial login password and user ID.

[0055] For example, if the user has previously logged into the website on the same device and selected "Remember Password" or used the auto-fill function, the client can automatically fill in the user's initial login password and user ID based on locally stored encrypted credentials or a secure storage mechanism to quickly complete the login.

[0056] Step 204: Encrypt the initial login password using the randomly generated snapshot key and the reference snapshot key to obtain a ciphertext; the reference snapshot key is the snapshot key used by the client last time to encrypt the initial login password corresponding to the user identifier.

[0057] The snapshot key is a one-time key generated by the client and regenerated for each login session. It is stored in the client's memory and transmitted to the server via public key encryption. The server then authenticates the login according to different security policies. The reference snapshot key is the snapshot key generated when a user logs in with the same client account. It is important to note that the snapshot key is stored in memory and is not written to any persistent device on the client. Each time you enter the login interface, the snapshot key is refreshed and is used to encrypt the initial login password.

[0058] Optionally, the initial login password can be encrypted using the randomly generated snapshot key and the reference snapshot key in a certain order. For example, the initial login password can be encrypted using the randomly generated snapshot key, and then encrypted again using the reference snapshot key to obtain the encrypted initial login key, which is the ciphertext in this embodiment. In this case, the initial login password may be encrypted twice.

[0059] Optionally, the randomly generated snapshot key and the reference snapshot key may be used to encrypt the initial login password simultaneously. The hybrid encryption of the initial login password using the two keys enhances the data's anti-cracking capability.

[0060] Whether using a randomly generated snapshot key to encrypt the initial login password, the encryption method can be a symmetric encryption algorithm (such as AES), an asymmetric encryption algorithm (such as RSA), or a hash algorithm combined with salt encryption (such as PBKDF2, bcrypt) and other secure encryption methods.

[0061] Optionally, a secure random algorithm such as a pseudo-random number generator (PRNG) or a time-based random number (such as HMAC-DRBG) is used to generate the key to ensure the unpredictability and security of the key.

[0062] Step 206: Encrypt the snapshot key according to the pre-acquired public key to obtain an encrypted snapshot key.

[0063] Before encryption, the client and server first negotiate a public and private key. The public key is placed on the client and the private key is stored on the authentication server. The public key can be obtained through the https interface or hard-coded into the client in a pre-agreed manner, that is, the public key is statically stored in the client's code or configuration file, making it unmodifiable to ensure stability and availability.

[0064] Among them, one or more of various encryption methods such as SA (Security Association), ECC (Elliptic Curve Cryptography), and DSA (Digital Signature Algorithm) are not limited in this embodiment.

[0065] In this embodiment, the client encrypts the randomly generated snapshot key using the pre-acquired public key to obtain the encrypted snapshot key, which can prevent the snapshot key from being leaked.

[0066] Optionally, the client and server will replace the public key and private key at a preset time, which can reduce the security risks brought by long-term use of the secret key.

[0067] Step 208: Generate a verification instruction based on the user identifier, ciphertext, and encrypted snapshot key, and send the verification instruction to the server; the server performs identity authentication based on the user identifier, ciphertext, and encrypted snapshot key.

[0068] Finally, the client generates a verification instruction based on the user ID, ciphertext, and encrypted snapshot key, and calls the login interface to send the verification instruction to the server. The server performs identity authentication based on the user ID, ciphertext, and encrypted snapshot key carried in the verification instruction.

[0069] In the above authentication method, the client uses a randomly generated snapshot key to encrypt the initial login key. In this way, the ciphertext submitted to the server is different for each login session. In addition, the initial login password is encrypted using the randomly generated snapshot key and the reference snapshot key, which greatly improves the security of the key.

[0070] In one embodiment, the above-mentioned encrypting the initial login password with a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext includes: encrypting the initial login password with a randomly generated snapshot key to obtain a reference ciphertext; and encrypting the reference ciphertext with the reference snapshot key to obtain a ciphertext.

[0071] In this embodiment, the initial login password is first encrypted using a randomly generated snapshot key to obtain a reference ciphertext. The reference snapshot key is then queried in the client based on the user identifier, and the reference ciphertext is encrypted again using the reference snapshot key to obtain the final ciphertext.

[0072] Generally, only the randomly generated snapshot key is used to encrypt the initial login password to obtain a reference ciphertext. However, the reference ciphertext may become plaintext due to different sources, human tampering, etc. In order to improve security, the reference ciphertext is re-encrypted using the reference snapshot key in this embodiment.

[0073] In one embodiment, after obtaining the ciphertext, the method further includes: saving the ciphertext and replacing the stored initial login password with the ciphertext.

[0074] In the prior art, many clients automatically remember login passwords. The purpose of storing account passwords in the local system is to improve the efficiency of the next login, especially on the user's frequently used login device. However, this also brings some security risks. If the device is lost, criminals can use the user's remembered account password to log in to the user's system. Or, criminals can temporarily use the user's device to take a photo or copy the user's account and password information, and then log in to the user's system using their own device. Therefore, in this embodiment, the ciphertext is saved and replaced with the initial login password stored on the client. This prevents the temporary password ciphertext from being misused and greatly improves the security of the password compared to traditional plaintext storage or storage encrypted using a fingerprint algorithm.

[0075] For example, combined Figure 3 As shown, Figure 3 The figure is a schematic diagram of the steps for client authentication in one embodiment.

[0076] The client first obtains the public key C from the server. When the user logs in to the session, the client randomly generates a snapshot key S1 based on the current session and obtains the user's corresponding user ID and initial login password. The user login key is the plaintext password P1 entered by the user.

[0077] The client then encrypts P1 using S1, generating a reference ciphertext, P2. P2 is a snapshot of the ciphertext. For each login with the same password, P2 is different: P2 = S1(P1). S1 changes with each login, so if P1 remains unchanged, P2 will naturally change accordingly.

[0078] Normally, the temporary ciphertext P2 generated by the last encryption with the snapshot key S1 is used. However, this P2 may become plaintext due to different sources, human tampering, etc. To improve security and uniformly handle it, this embodiment uses a secondary encryption method to encrypt P2 in this case again. Therefore, the temporary ciphertext P2 transmitted to the backend during this login may have two encryption situations:

[0079] ① P2=S1(P1)

[0080] ② P2=S1(S1_last(P1))

[0081] Where P1 is the plaintext password, P2 is the temporary ciphertext generated in this login session, S1 is the snapshot key generated in this login session, and S1_last is the snapshot key generated during the last login with the same device and account, which is the reference snapshot key used in the above embodiment. Therefore, we can see that P2 may have been encrypted at most twice, using different snapshot keys each time.

[0082] In the above embodiment, the client uses a randomly generated snapshot key to encrypt the initial login key, so that the ciphertext submitted to the server is different for each login session, and the initial login password is encrypted using the randomly generated snapshot key and the reference snapshot key, which greatly improves the security of the key.

[0083] In an exemplary embodiment, Figure 4 As shown, an authentication method is provided, which is applied to Figure 1 The server 104 in FIG. 1 is taken as an example to illustrate the process, including the following steps 402 to 406. Among them:

[0084] Step 402, receive the verification instruction sent by the client; the verification instruction carries the ciphertext, the encrypted snapshot key and the user ID; the ciphertext is obtained by the client using the snapshot key and the reference snapshot key to encrypt the obtained initial login password; the encrypted snapshot key is obtained by the client using the public key to encrypt the snapshot key; the reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user ID.

[0085] The specific process of the client authenticating the initial login password can be referred to the description in the above embodiment, and will not be repeated again.

[0086] Step 404 : decrypt the encrypted snapshot key and the ciphertext to obtain a reference login password, and perform a first account-password verification on the reference login password to obtain an account-password verification result.

[0087] Because the client encrypts both the randomly generated snapshot key and the initial login password, in this embodiment, the encrypted snapshot key and ciphertext are decrypted to obtain the decrypted initial login password, which is the reference login password described in this embodiment. After obtaining the reference login password, a first account-password verification is performed on the reference login password to obtain the corresponding account-password verification result.

[0088] If the account-password verification result is successful, then the server-side identity verification is successful. If the account-password verification result fails, it is necessary to further query the key relationship table and use the intermediate snapshot key in the key relationship table for decryption.

[0089] Optionally, the encrypted snapshot key may be decrypted first, and the decrypted encrypted snapshot key is used to decrypt the ciphertext to obtain the reference login password.

[0090] It should be noted that this step is for the case where the client only uses the randomly generated snapshot key to encrypt the initial login password. For security reasons, the client encrypts the initial login password twice before sending it. However, the server does not know the client's encryption method, that is, whether it uses only the randomly generated snapshot key for encryption or encrypts it twice. Therefore, when decrypting, the server first decrypts the encrypted snapshot key and ciphertext to obtain the reference login password. It then performs the first account and password verification on the reference login password. If it fails, it queries the intermediate snapshot key in the key relationship table for identity verification.

[0091] In step 406, if the account-password verification result fails and the key relationship table indicates that it is usable, the intermediate snapshot key is retrieved from the key relationship table based on the user ID. The reference login password is decrypted using the intermediate snapshot key to obtain a decrypted result. A second account-password verification is then performed on the decrypted result to obtain an identity verification result. The intermediate snapshot key is the decryption snapshot key obtained during the server's previous identity verification.

[0092] The key relationship table is a table on the server that records the relationship between a user and the key used in their most recent successful login. This relationship table can be enabled or disabled based on different security policies, and the data in the table is continuously updated with different login session activities.

[0093] Exemplarily, in conjunction with Table 1, Table 1 is a key relationship table in an embodiment.

[0094] Table 1

[0095]

[0096] The relationship table is primarily used in scenarios where devices remember passwords for login. To improve login efficiency and provide a positive user experience, many devices offer a password-remembering feature. However, this remembered password may have been modified due to various factors. To ensure security, this embodiment encrypts the remembered password again, potentially resulting in the password being encrypted twice. In this scenario, the snapshot key from the last successful login must be saved for the user to log in correctly. Since the session key is different for each login, the next login without entering a password requires logging in from the device used last time. This significantly enhances authentication security. If the device is lost, the user does not need to change the password; they simply need to manually enter the password on another device to log in again. The server then updates the relationship table with the snapshot key, preventing malicious users from logging in to their account using the lost device. This process is repeated each time the password is manually entered, significantly improving account security. Malicious users can also be prevented from logging in by disabling a specific user's entry in the relationship table.

[0097] If you need to invalidate the passwords recorded on the devices of all or some users, you can do so by disabling the relationship table or invalidating some records in the relationship table. If you need higher login efficiency and a good login experience, you can enable the relationship table. If you need higher security, you can choose to disable the relationship table so that users must enter their account and password each time to log in.

[0098] In this embodiment, if the account-password verification result fails and the key relationship table is enabled, the intermediate snapshot key is retrieved from the key relationship table based on the user ID. The intermediate snapshot key is the decryption snapshot key obtained during the server's previous authentication. The key relationship table being enabled means that the key relationship table is enabled.

[0099] The reference login password is decrypted using the intermediate snapshot key to obtain a decryption result. This decryption result is then verified using the second account and password to obtain an identity verification result. If the identity verification result is "passed," the authentication is successful; otherwise, it fails.

[0100] The aforementioned identity authentication method, apparatus, computer device, computer-readable storage medium, and computer program product receive a verification instruction sent by a client and decrypt the ciphertext using the encrypted snapshot key carried in the verification instruction to obtain a reference login password. The client then performs a first account-password verification on the reference login password to obtain an account-password verification result. A failure in the account-password verification indicates that the client has double-encrypted the initial login password using both the snapshot key and the reference snapshot key. At this point, the server queries the key relationship table using the user identifier to obtain the decryption snapshot key from the server's previous authentication. The reference login password is then decrypted to obtain a decryption result. After obtaining the decryption result, the server performs a second account-password verification on the decrypted result to obtain the final authentication result. This allows the server to provide highly secure account authentication without introducing multi-factor authentication.

[0101] Furthermore, the encrypted snapshot key and the ciphertext are decrypted to obtain a reference login password, and a first account-password verification is performed on the reference login password to obtain an account-password verification result, including: decrypting the encrypted snapshot key according to the private key to obtain a decrypted snapshot key; decrypting the ciphertext based on the decrypted snapshot key to obtain the reference login password; calculating a first hash value corresponding to the user identifier and the reference login password, and matching the hash value with a pre-stored first credential to obtain an account-password verification result.

[0102] Since the client uses the public key to encrypt the randomly generated snapshot key, the server uses the private key to decrypt the encrypted snapshot key to obtain the decrypted snapshot key. The decrypted snapshot key obtained by the server is the snapshot key randomly generated by the client.

[0103] The ciphertext is then decrypted using the decryption snapshot key to obtain the reference login password. This decrypted reference login password is also the client's initial login password. A first hash value is then calculated based on the user ID and the reference login password. This first hash value is then matched against the first credential to obtain the account and password verification result.

[0104] Optionally, a fingerprint algorithm may be used to calculate the first hash value, such as one or more of MD5 (Message Digest Algorithm 5), SHA256 (Secure Hash Algorithm 256-bit), and SHA-3 (Secure Hash Algorithm 3). For example, SHA256 may be used to calculate the first hash value. This algorithm can generate a fixed-length value that does not collide with different input content. In this embodiment, the user's password is stored in the database using this algorithm, which is the first credential. During identity authentication, the password is determined to be correct by comparing the SHA256 value in the database, that is, the first credential and the first hash value.

[0105] Furthermore, if the first credential is consistent with the first hash value, the account-password verification result is passed, otherwise it is failed.

[0106] Furthermore, when the account-password verification result fails and the key relationship table is usable, the intermediate snapshot key is queried from the key relationship table according to the user identifier, the reference login password is decrypted using the intermediate snapshot key to obtain the decrypted result, and the decrypted result is subjected to a second account-password verification to obtain the identity authentication result.

[0107] Among them, the reference login password is decrypted using the intermediate snapshot key to obtain a decryption result, and the decryption result is subjected to a second account and password verification to obtain an identity authentication result, including: decrypting the reference login password using the intermediate snapshot key to obtain a decryption result; calculating the user identifier and a second hash value corresponding to the decryption result, and matching the second hash value with a pre-stored second credential to obtain an identity authentication result.

[0108] If the account and password verification fails, it means that the client has performed a secondary encryption, so the server needs to decrypt the reference login password again. At this time, the server uses the decryption snapshot key obtained during the previous user authentication, which is also the intermediate snapshot key, to decrypt the reference login password.

[0109] After the server uses the intermediate snapshot key to decrypt the reference login password, it obtains the corresponding decryption result and performs a second account and password verification on the decryption result.

[0110] Similar to the first account-password verification, during the second verification, a second hash value is calculated that corresponds to the user ID and the decrypted result, and this second hash value is matched with the second credential. The second credential is generated in a similar manner to the first credential and will not be repeated here.

[0111] Furthermore, if the second credential is consistent with the second hash value, the identity authentication result is passed, otherwise it is failed.

[0112] For example, combined Figure 5 As shown, Figure 5 The figure is a flow chart of authentication performed by a server in one embodiment.

[0113] The private key corresponding to the public key is used to decrypt S2 to obtain the decrypted snapshot key, which is S1. S2 is the encrypted snapshot key, which is obtained by encrypting the snapshot key using the public key obtained in advance by the client.

[0114] Afterwards, S1 is used to decrypt P2, yielding the decrypted P1, which serves as the reference login password in this embodiment. A first account-password check is performed based on the user ID and SHA256 (P1). If successful, authentication is successful. If the key relationship table is enabled, the relationship between S1 and the user ID is recorded; otherwise, it is not recorded.

[0115] If the initial account-password verification fails, the system checks whether the key relationship table is enabled. If not, authentication fails. If enabled, the system queries the key relationship table for the previous snapshot key, S1_Last, based on the user ID. This is also the intermediate snapshot key. If the previous snapshot key, S1_Last, is not found in the key relationship table, authentication fails.

[0116] Once the intermediate snapshot key is retrieved, P1 is decrypted using the intermediate snapshot key, yielding the decrypted password P1_RAW, the decrypted result. A second account-password check is then performed on the decrypted result based on the user ID and SHA256 (P1), yielding the authentication result.

[0117] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0118] Based on the same inventive concept, the present application also provides an authentication device for implementing the aforementioned authentication method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more authentication device embodiments provided below can be found in the above-mentioned limitations of the authentication method and will not be repeated here.

[0119] In an exemplary embodiment, Figure 6 As shown, an identity authentication device applied to a server is provided, which includes: a receiving module 100, a decryption module 200 and a verification module 300, wherein:

[0120] Receiving module 100 is used to receive a verification instruction sent by the client; the verification instruction carries a ciphertext, an encrypted snapshot key and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and the reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using the public key; the reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier.

[0121] The decryption module 200 is configured to decrypt the encrypted snapshot key and the ciphertext to obtain a reference login password, and perform a first account-password verification on the reference login password to obtain an account-password verification result.

[0122] Verification module 300 is configured to, when the account-password verification result fails and the key relationship table indicates that the key relationship table is usable, query the key relationship table based on the user identifier for an intermediate snapshot key, decrypt the reference login password using the intermediate snapshot key to obtain a decrypted result, and perform a second account-password verification on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decryption snapshot key obtained during the server's previous identity verification.

[0123] In one embodiment, the decryption module includes:

[0124] The private key decryption unit is used to decrypt the encrypted snapshot key according to the private key to obtain the decrypted snapshot key.

[0125] The first password decryption unit is used to decrypt the ciphertext based on the decryption snapshot key to obtain a reference login password.

[0126] The first hash verification module is used to calculate a first hash value corresponding to the user identification and the reference login password, and match the hash value with a pre-stored first credential to obtain an account and password verification result.

[0127] In one embodiment, the verification module includes:

[0128] The second password decryption unit is used to decrypt the reference login password using the intermediate snapshot key to obtain a decryption result.

[0129] The second hash verification module is used to calculate the user identification and the second hash value corresponding to the decryption result, and match the second hash value with the pre-stored second credential to obtain the identity authentication result.

[0130] In an exemplary embodiment, Figure 7 As shown, an identity authentication device applied to a client is provided, which includes: an acquisition module 400, a first encryption module 500, a second encryption module 600 and a sending module 700, wherein:

[0131] The acquisition module 400 is used to acquire the initial login password and user identification.

[0132] The first encryption module 500 is used to encrypt the initial login password using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key is the snapshot key used by the client last time to encrypt the initial login password corresponding to the user identifier.

[0133] The second encryption module 600 is configured to encrypt the snapshot key according to the pre-acquired public key to obtain an encrypted snapshot key.

[0134] The sending module 700 is used to generate a verification instruction according to the user identifier, ciphertext and encrypted snapshot key, and send the verification instruction to the server; the server performs identity authentication according to the user identifier, ciphertext and encrypted snapshot key.

[0135] In one embodiment, the first encryption module 500 includes:

[0136] The password encryption unit is used to encrypt the initial login password using a randomly generated snapshot key to obtain a reference ciphertext.

[0137] The key encryption unit is used to encrypt the reference ciphertext using the reference snapshot key to obtain the ciphertext.

[0138] In one embodiment, the above device further includes a storage unit,

[0139] The storage unit is used to store the ciphertext, and the ciphertext is used to replace the stored initial login password.

[0140] Each module in the aforementioned identity verification device may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0141] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store a key relationship table. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an authentication method is implemented.

[0142] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0143] In an exemplary embodiment, a computer device is provided, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented: receiving a verification instruction sent by a client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and the reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using the public key; the reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier; decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result; when the account-password verification result is failure and the key relationship table is usable, querying the intermediate snapshot key from the key relationship table according to the user identifier, decrypting the reference login password using the intermediate snapshot key to obtain a decrypted result, and performing a second account-password verification on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decrypted snapshot key obtained when the server last performed identity authentication.

[0144] In one embodiment, when the processor executes the computer program, it further implements the following steps: decrypting the encrypted snapshot key according to the private key to obtain the decrypted snapshot key; decrypting the ciphertext based on the decrypted snapshot key to obtain the reference login password; calculating the first hash value corresponding to the user identifier and the reference login password, and matching the hash value with the pre-stored first credential to obtain the account and password verification result.

[0145] In one embodiment, when the processor executes the computer program, it further implements the following steps: decrypting the reference login password using the intermediate snapshot key to obtain a decryption result; calculating the user identifier and a second hash value corresponding to the decryption result, and matching the second hash value with a pre-stored second credential to obtain an identity authentication result.

[0146] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented: obtaining an initial login password and a user identifier; encrypting the initial login password by using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier; encrypting the snapshot key according to a pre-acquired public key to obtain an encrypted snapshot key; generating a verification instruction according to the user identifier, the ciphertext and the encrypted snapshot key, and sending the verification instruction to the server; the server performs identity authentication according to the user identifier, the ciphertext and the encrypted snapshot key.

[0147] In one embodiment, when executing the computer program, the processor further implements the following steps: encrypting the initial login password with a randomly generated snapshot key to obtain a reference ciphertext; and encrypting the reference ciphertext with a reference snapshot key to obtain a ciphertext.

[0148] In one embodiment, when the processor executes the computer program, the processor further implements the following steps: saving the ciphertext, and replacing the stored initial login password with the ciphertext.

[0149] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the following steps: receiving a verification instruction sent by a client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and the reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using the public key; the reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier; decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result; when the account-password verification result is failure and the key relationship table is usable, querying the intermediate snapshot key from the key relationship table according to the user identifier, decrypting the reference login password using the intermediate snapshot key to obtain a decrypted result, and performing a second account-password verification on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decrypted snapshot key obtained when the server last performed identity authentication.

[0150] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: decrypting the encrypted snapshot key according to the private key to obtain the decrypted snapshot key; decrypting the ciphertext based on the decrypted snapshot key to obtain the reference login password; calculating the first hash value corresponding to the user identifier and the reference login password, and matching the hash value with the pre-stored first credential to obtain the account and password verification result.

[0151] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: decrypting the reference login password using the intermediate snapshot key to obtain a decryption result; calculating the user identifier and a second hash value corresponding to the decryption result, and matching the second hash value with a pre-stored second credential to obtain an identity authentication result.

[0152] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the following steps: obtaining an initial login password and a user identifier; encrypting the initial login password using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier; encrypting the snapshot key according to a pre-acquired public key to obtain an encrypted snapshot key; generating a verification instruction according to the user identifier, the ciphertext, and the encrypted snapshot key, and sending the verification instruction to the server; the server performs identity authentication according to the user identifier, the ciphertext, and the encrypted snapshot key.

[0153] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: encrypting the initial login password with a randomly generated snapshot key to obtain a reference ciphertext; and encrypting the reference ciphertext with the reference snapshot key to obtain a ciphertext.

[0154] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: saving the ciphertext, and replacing the stored initial login password with the ciphertext.

[0155] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps: receiving a verification instruction sent by a client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and the reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using the public key; the reference snapshot key is the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier; decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result; when the account-password verification result is failure and the key relationship table is usable, querying the intermediate snapshot key from the key relationship table according to the user identifier, decrypting the reference login password using the intermediate snapshot key to obtain a decrypted result, and performing a second account-password verification on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decrypted snapshot key obtained when the server last performed identity authentication.

[0156] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: decrypting the encrypted snapshot key according to the private key to obtain the decrypted snapshot key; decrypting the ciphertext based on the decrypted snapshot key to obtain the reference login password; calculating the first hash value corresponding to the user identifier and the reference login password, and matching the hash value with the pre-stored first credential to obtain the account and password verification result.

[0157] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: decrypting the reference login password using the intermediate snapshot key to obtain a decryption result; calculating the user identifier and a second hash value corresponding to the decryption result, and matching the second hash value with a pre-stored second credential to obtain an identity authentication result.

[0158] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps: obtaining an initial login password and a user identifier; encrypting the initial login password using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key being the snapshot key used by the client the last time it encrypted the initial login password corresponding to the user identifier; encrypting the snapshot key using a pre-acquired public key to obtain an encrypted snapshot key; generating a verification instruction based on the user identifier, the ciphertext, and the encrypted snapshot key, and sending the verification instruction to a server; and the server performing identity authentication based on the user identifier, the ciphertext, and the encrypted snapshot key.

[0159] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: encrypting the initial login password with a randomly generated snapshot key to obtain a reference ciphertext; and encrypting the reference ciphertext with the reference snapshot key to obtain a ciphertext.

[0160] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: saving the ciphertext, and replacing the stored initial login password with the ciphertext.

[0161] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), data processing logic of programmable logic devices (PLDs), artificial intelligence (AI) processors, and the like.

[0162] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0163] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. An identity authentication method, characterized in that: Applied to the server; the method includes: Receive a verification instruction sent by the client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and the reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using the public key; the reference snapshot key is the snapshot key used by the client when last encrypting the initial login password corresponding to the user identifier; decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result; When the account-password verification result is failure and the key relationship table is usable, an intermediate snapshot key is queried from the key relationship table according to the user identifier, the reference login password is decrypted using the intermediate snapshot key to obtain a decrypted result, and a second account-password verification is performed on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decryption snapshot key obtained when the server last performed identity verification.

2. The method according to claim 1, characterized in that The decrypting the encrypted snapshot key and the ciphertext to obtain a reference login password, and performing a first account-password verification on the reference login password to obtain an account-password verification result includes: Decrypting the encrypted snapshot key according to the private key to obtain the decrypted snapshot key; Decrypting the ciphertext based on the decryption snapshot key to obtain the reference login password; A first hash value corresponding to the user identifier and the reference login password is calculated, and the hash value is matched with a pre-stored first credential to obtain the account-password verification result.

3. The method according to claim 1, characterized in that The decrypting the reference login password using the intermediate snapshot key to obtain a decryption result, and performing a second account and password verification on the decryption result to obtain an identity verification result, includes: Decrypting the reference login password using the intermediate snapshot key to obtain the decryption result; The user identification and a second hash value corresponding to the decryption result are calculated, and the second hash value is matched with a pre-stored second credential to obtain the identity authentication result.

4. An identity authentication method, characterized in that: Applied to a client, the method includes: Get the initial login password and user ID; Encrypting the initial login password using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key is the snapshot key used by the client to encrypt the initial login password corresponding to the user identifier last time; Encrypting the snapshot key according to the pre-acquired public key to obtain an encrypted snapshot key; A verification instruction is generated according to the user identifier, the ciphertext and the encrypted snapshot key, and the verification instruction is sent to the server; the server performs identity authentication according to the user identifier, the ciphertext and the encrypted snapshot key.

5. The method according to claim 4, characterized in that The encrypting the initial login password using the randomly generated snapshot key and the reference snapshot key to obtain a ciphertext includes: Encrypting the initial login password using the randomly generated snapshot key to obtain a reference ciphertext; Encrypting the reference ciphertext using the reference snapshot key to obtain the ciphertext; After obtaining the ciphertext, the method further includes: The ciphertext is saved and the stored initial login password is replaced by the ciphertext.

6. An identity verification device, characterized in that: Applied to the server, the device includes: a receiving module, configured to receive a verification instruction sent by a client; the verification instruction carries a ciphertext, an encrypted snapshot key, and a user identifier; the ciphertext is obtained by the client encrypting the obtained initial login password using the snapshot key and a reference snapshot key; the encrypted snapshot key is obtained by the client encrypting the snapshot key using a public key; the reference snapshot key is the snapshot key used by the client when last encrypting the initial login password corresponding to the user identifier; a decryption module, configured to decrypt the encrypted snapshot key and the ciphertext to obtain a reference login password, and perform a first account-password verification on the reference login password to obtain an account-password verification result; a verification module configured to, when the account-password verification result is failed and the key relationship table is usable, query an intermediate snapshot key from the key relationship table according to the user identifier, decrypt the reference login password using the intermediate snapshot key to obtain a decrypted result, and perform a second account-password verification on the decrypted result to obtain an identity verification result; the intermediate snapshot key is the decryption snapshot key obtained when the server last performed identity verification.

7. An identity verification device, characterized in that: Applied to a client, the device includes: The acquisition module is used to obtain the initial login password and user ID; a first encryption module, configured to encrypt the initial login password using a randomly generated snapshot key and a reference snapshot key to obtain a ciphertext; the reference snapshot key being the snapshot key used by the client when encrypting the initial login password corresponding to the user identifier last time; a second encryption module, configured to encrypt the snapshot key according to a pre-acquired public key to obtain an encrypted snapshot key; The sending module is used to generate a verification instruction according to the user identifier, the ciphertext and the encrypted snapshot key, and send the verification instruction to the server; the server performs identity authentication according to the user identifier, the ciphertext and the encrypted snapshot key.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 3 or 4 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 or 4 to 5 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 or 4 to 5 are implemented.

Images