Login authentication method based on enterprise-level mobile application

Abstract

The invention discloses a login authentication method based on an enterprise-level mobile application, and relates to the technical field of software, and the method comprises the steps: receiving an application identifier and a user identifier corresponding to a to-be-authenticated user sent by an application client, carrying out the legal verification, and generating a random number; the random number is sent to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, then the user submits the random number to the application client, the application client performs password operation on the random number and feeds back an operation result, verification is performed according to the user identifier and the operation result, and authentication is completed after verification is passed. The random number is forwarded to the user through the enterprise-level mobile application without depending on modes such as short messages and mails, and the practicability for the enterprise user is high. And the password operation is completed at the client and the result is submitted, so that verification can be carried out at the authentication center, and a master key updating mechanism is provided, thereby not only improving the system security, but also simplifying the secondary authentication process.

Description

Technical Field

[0001] The present application relates to the field of software technology, and in particular to a login authentication method based on enterprise-level mobile applications. Background Art

[0002] When logging into a client web application or mobile terminal, existing solutions usually use verification code login or password login. However, the verification code login solution usually relies on SMS, email, etc., which has poor security and cannot send SMS and email in some scenarios. For the password login solution, if the account / password is used, the user is at risk of forgetting the password. For dynamic passwords, existing solutions are usually implemented in combination with the Public Key Infrastructure (PKI) system, in which the certificate management process is complex. Summary of the Invention

[0003] The main purpose of this application is to provide a login authentication method based on enterprise-level mobile applications, aiming to solve the technical problems of complex authentication and low security in existing authentication schemes such as verification code or password login.

[0004] To achieve the above objectives, the present application proposes a login authentication method based on enterprise-level mobile applications, which is applied to an authentication center and includes:

[0005] Receive the application ID and user ID corresponding to the user to be authenticated sent by the application client;

[0006] Performing a legality check on the application identifier and the user identifier, and generating a random number of preset digits if the check passes;

[0007] Sending the random number to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, submitting the random number to the application client through the enterprise-level mobile application, and the application client performing a cryptographic operation on the random number and feeding back a first cryptographic operation result and the user identifier;

[0008] performing a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result;

[0009] Login authentication is performed based on the second password operation result.

[0010] In one embodiment, the step of performing a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result includes:

[0011] Reading the master key and elliptic curve parameters stored locally, wherein the master key and the elliptic curve parameters are consistent with the master key and the elliptic curve parameters stored in the unified authentication program;

[0012] Concatenate the user identifier and the master key to obtain a first secret key seed;

[0013] Generate the public key using the SM9 algorithm based on the elliptic curve parameters and the first secret key seed to obtain the public key corresponding to the user to be authenticated;

[0014] A cryptographic operation is performed on the first cryptographic operation result according to the public key to obtain a second cryptographic operation result, where the second cryptographic operation result includes the first encrypted data and the random number.

[0015] In one embodiment, before the step of reading the locally stored master key and elliptic curve parameters, the method further includes:

[0016] When it is determined that the master key corresponding to the user identifier does not exist locally, receiving the login authentication information of the user to be authenticated sent by the application client, and authenticating the login authentication information;

[0017] When the login authentication information is authenticated, a master key corresponding to the user identifier is generated according to a random number generation algorithm, and the master key is stored;

[0018] The master key is sent to the application client through a preset secure channel, so that the application client stores the master key in a unified authentication program.

[0019] In one embodiment, the step of performing login authentication based on the second password operation result includes:

[0020] Processing the random number in the second cryptographic operation result according to a keyed hash message authentication code algorithm to obtain second encrypted data;

[0021] determining whether the first encrypted data and the second encrypted data in the second cryptographic operation result are consistent;

[0022] If the first encrypted data is consistent with the second encrypted data, the login authentication is successful.

[0023] To achieve the above objectives, the present application also proposes a login authentication method based on an enterprise-level mobile application, which is applied to an application client and includes:

[0024] When a login request from a user to be authenticated is detected, the application identifier and user identifier corresponding to the user to be authenticated are sent to an authentication center, so that the authentication center performs a legality check on the application identifier and the user identifier, and sends a random number of preset digits to the enterprise-level mobile application logged in by the user to be authenticated;

[0025] receiving the random number forwarded by the enterprise-level mobile application;

[0026] Calling a unified authentication program to perform a cryptographic operation on the random number according to the user identifier to obtain a first cryptographic operation result, wherein the unified authentication program is integrated in the application client;

[0027] The first cryptographic operation result and the user identification are sent to the authentication center so that the authentication center performs login authentication based on the first cryptographic operation result and the user identification.

[0028] In one embodiment, the step of calling the unified authentication program to perform a cryptographic operation on the random number according to the user identifier to obtain a first cryptographic operation result includes:

[0029] Reading the master key and elliptic curve parameters stored in the unified authentication program, wherein the master key and the elliptic curve parameters are consistent with the master key and the elliptic curve parameters stored in the authentication center;

[0030] Concatenate the user identifier and the master key to obtain a second secret key seed;

[0031] Generate the private key using the SM9 algorithm based on the elliptic curve parameters and the second secret key seed to obtain the private key corresponding to the user to be authenticated;

[0032] Processing the random number according to a keyed hash message authentication code algorithm and the master key to obtain first encrypted data;

[0033] The first encrypted data and the random number are spliced together, and the splicing result is encrypted according to the national secret SM9 algorithm and the private key to obtain a first cryptographic operation result.

[0034] In one embodiment, before the step of reading the master key and elliptic curve parameters stored in the unified authentication program, the method further includes:

[0035] Determine whether there is a master key corresponding to the user identifier in the login request locally by using a unified authentication program in the application client;

[0036] If it does not exist, the login authentication information input by the user to be authenticated is submitted to the authentication center, so that when the authentication center authenticates the login authentication information, it generates and feeds back a master key corresponding to the user identifier according to a random number generation algorithm;

[0037] Receive the master key fed back by the authentication center and store the master key in the unified authentication program.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a login authentication device based on an enterprise-level mobile application, which is applied to an authentication center and includes:

[0039] An information receiving module is used to receive the application identifier and user identifier corresponding to the user to be authenticated sent by the application client;

[0040] A legality verification module, configured to perform legality verification on the application identifier and the user identifier, and generate a random number of preset digits when the verification is passed;

[0041] a random number display module, configured to send the random number to the enterprise-level mobile application logged in by the user to be authenticated based on the user identifier, submit the random number to the application client through the enterprise-level mobile application, and the application client perform a cryptographic operation on the random number and feedback a first cryptographic operation result and the user identifier;

[0042] a cryptographic operation module, configured to perform a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result;

[0043] A login authentication module is used to perform login authentication according to the second password operation result.

[0044] In addition, to achieve the above-mentioned purpose, the present application also proposes a login authentication device based on an enterprise-level mobile application, which is applied to an application client and includes:

[0045] An information sending module is used to, upon detecting a login request from a user to be authenticated, send the application identifier and user identifier corresponding to the user to be authenticated to an authentication center, so that the authentication center can perform a legal verification on the application identifier and the user identifier, and send a random number of preset digits to the enterprise-level mobile application logged in by the user to be authenticated;

[0046] A random number receiving module, configured to receive the random number forwarded by the enterprise-level mobile application;

[0047] a random number operation module, configured to call a unified authentication program to perform a cryptographic operation on the random number according to the user identifier to obtain a first cryptographic operation result, wherein the unified authentication program is integrated in the application client;

[0048] The cryptographic operation result sending module is used to send the first cryptographic operation result and the user identification to the authentication center, so that the authentication center performs login authentication based on the first cryptographic operation result and the user identification.

[0049] In addition, to achieve the above-mentioned purpose, the present application also proposes a login authentication device based on enterprise-level mobile applications, the device comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the login authentication method based on enterprise-level mobile applications as described above.

[0050] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the login authentication method based on enterprise-level mobile applications as described above are implemented.

[0051] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the login authentication method based on enterprise-level mobile applications as described above.

[0052] The present application provides a login authentication method based on an enterprise-level mobile application, which performs a legal verification by receiving the application identifier and user identifier corresponding to the user to be authenticated sent by the application client, and generates a random number; the random number is sent to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, and then the user submits the random number to the application client, and the application client uses a cryptographic operation program to perform a cryptographic operation on the random number and then obtains a first cryptographic operation result and feeds it back to the authentication center; the authentication center verifies the user identifier and the first cryptographic operation result according to certain rules, and completes the login after the login authentication is passed. After the present application performs a legal verification on the user and the application, a random number is generated, and the user identifier and random number are uniformly forwarded to the application client through the enterprise-level mobile application, without relying on SMS, email, etc. to send verification codes or passwords, so that it can be applied to users in various regions. The user identifier and random number are forwarded to the application client for cryptographic operation and the first cryptographic operation result is fed back, so that login authentication can be performed after the cryptographic operation, which improves security and does not need to rely on the certificate authentication system, simplifying the authentication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0055] Figure 1 A flowchart of the first embodiment of the login authentication method for enterprise-level mobile applications provided in this application;

[0056] Figure 2 A flowchart of the second embodiment of the login authentication method for enterprise-level mobile applications provided in this application;

[0057] Figure 3 This is a schematic diagram of the overall interactive process of the login authentication method based on enterprise-level mobile applications in this application;

[0058] Figure 4 This is a schematic diagram of the module structure of the first embodiment of the login authentication device based on enterprise-level mobile applications according to the embodiment of the present application;

[0059] Figure 5 This is a schematic diagram of the module structure of the second embodiment of the login authentication device based on enterprise-level mobile applications according to the embodiment of the present application;

[0060] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the login authentication method based on enterprise-level mobile applications in an embodiment of the present application.

[0061] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0062] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0063] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0064] The main solution of the embodiment of the present application is: the authentication center receives the application identifier and user identifier corresponding to the user to be authenticated sent by the application client; performs a legal verification on the application identifier and the user identifier, and generates a random number of preset bits when the verification is passed; sends the random number to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, so that the enterprise-level mobile application forwards the random number to the application client, and the application client performs a cryptographic operation on the random number, and feeds back the first cryptographic operation result and the user identifier; performs a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result; and performs login authentication according to the second cryptographic operation result.

[0065] When logging into a client web application or mobile terminal, existing solutions usually use verification code login or password login. However, the verification code login solution usually relies on SMS, email, etc., which has poor security and cannot send SMS and email in some scenarios. For the password login solution, if the account / password is used, the user is at risk of forgetting the password. For dynamic passwords, existing solutions are usually implemented in combination with the PKI system, in which the certificate management process is complex.

[0066] The present application provides a solution, which performs legal verification by receiving the application identifier and user identifier corresponding to the user to be authenticated sent by the application client, and generates a random number; sends the random number to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, so that the enterprise-level mobile application forwards the random number to the application client, and the application client performs cryptographic operation on the random number and feedback; performs login authentication according to the user identifier and the first cryptographic operation result. After performing legal verification on the user and the application, the present application generates a random number, and uniformly forwards the user identifier and the random number to the application client through the enterprise-level mobile application, without relying on SMS, email, etc. to send verification codes or passwords, so that it can be applied to users in various regions. The user identifier and random number are forwarded to the application client for cryptographic operation and the first cryptographic operation result obtained is fed back, so that login authentication can be performed after the cryptographic operation, which improves security and does not need to rely on the certificate authentication system, simplifying the authentication process.

[0067] It should be noted that the execution entities of the method of this embodiment can be an authentication center and an application client. The authentication center can be a computing service device that specifically performs login authentication functions, such as a tablet computer, personal computer, or mobile phone. The application client can be the client corresponding to the business application system.

[0068] Based on this, the embodiment of the present application provides a login authentication method based on enterprise-level mobile applications, referring to Figure 1 , Figure 1This is a flow chart of the first embodiment of the login authentication method based on enterprise-level mobile applications of this application.

[0069] In this embodiment, the method is applied to an authentication center. The login authentication method based on an enterprise-level mobile application includes steps S10 to S50:

[0070] Step S10: receiving the application identifier and user identifier corresponding to the user to be authenticated sent by the application client.

[0071] It is understood that after the user to be authenticated logs in through the application client, the authentication center receives the application identifier and user identifier corresponding to the user to be authenticated sent by the application client. The application identifier can be used to uniquely identify the application system that the user logs in to, for example, it can be the application system name or ID, and the user identifier can be used to uniquely identify the user, for example, it can be a user name or user unique identification code.

[0072] Step S20: Perform a legality check on the application identifier and the user identifier, and generate a random number of preset digits if they pass the check.

[0073] It should be understood that the authentication center verifies the legality of the application identifier and user identifier to determine whether the application system exists and whether the user is a legitimate user. It can perform legal verification based on the pre-registered and saved legal user table and legal application system table. If both are verified to be legal, a random number random (for example, a 6- or 8-digit random number) is generated and the validity period is set (which can be set to 5 minutes or 10 minutes). If one or more of the application or user fails the verification, a login failure message is sent to the application client, and the login process ends.

[0074] Step S30: Send the random number to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, submit the random number to the application client through the enterprise-level mobile application, and the application client performs a cryptographic operation on the random number and feeds back the first cryptographic operation result and the user identifier.

[0075] It is understandable that the user to be authenticated can be determined based on the user ID, and then the enterprise-level mobile application logged in by the user can be tracked based on the user ID. Since the existing solution relies on SMS and email for verification in the method of logging in through a verification code, some scenarios cannot be sent (for example, users in some countries or regions cannot receive SMS or emails). Therefore, in this solution, an enterprise-level mobile application is set up to forward random numbers. The enterprise-level mobile application is a terminal that can be used and communicated by all users. For example, it can be an enterprise WeChat. In addition, other applications such as WeChat applets can also be used as enterprise-level mobile applications for message forwarding. The enterprise-level mobile application forwards the random number to the application client, and the application client performs cryptographic operations on the random number, and feeds back the first cryptographic operation result response and the above-mentioned user ID.

[0076] Step S40: performing a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result.

[0077] In a feasible implementation, step S40 may include steps S401 to S404:

[0078] Step S401 , reading the master key and elliptic curve parameters stored locally, wherein the master key and the elliptic curve parameters are consistent with the master key and the elliptic curve parameters stored in the unified authentication program.

[0079] It should be understood that the authentication center can encrypt and save the master key masterKey and elliptic curve (ECC) parameters locally in advance, and provide this information to the SDK through a secure channel. The master key and ECC parameters are securely stored to prevent unauthorized access. In particular, for scenarios with higher security requirements, the SDK requires users to regularly use other methods (such as SMS, password login) for auxiliary authentication to ensure that the client program in the current authentication system is always trustworthy. Upon receiving the user identification and the first cryptographic operation result sent by the application client, the locally stored key information is read and decrypted to obtain the master key masterKey and ECC parameters.

[0080] Step S402: Concatenate the user identifier and the master key to obtain a first secret key seed.

[0081] It is understandable that the authentication center concatenates the user identifier userId with the master key masterKey to obtain the first secret key seed seed1.

[0082] Step S403: Generate a public key using the SM9 algorithm based on the elliptic curve parameters and the first secret key seed to obtain the public key corresponding to the user to be authenticated.

[0083] It is understood that the first secret key seed seed1 and ECC parameters are encrypted according to a preset encryption library (for example, BouncyCastle or other encryption libraries) to generate the user's corresponding public key publicKey = SM9KG(userId||masterKey). Among them, BouncyCastle is an open source encryption library that provides a wide range of cryptographic algorithms and protocol implementations, covering various encryption technologies such as symmetric encryption, asymmetric encryption, hash functions, message digests, digital signatures, and certificate generation.

[0084] Step S404: Perform a cryptographic operation on the first cryptographic operation result according to the public key to obtain a second cryptographic operation result, where the second cryptographic operation result includes the first encrypted data and the random number.

[0085] It should be understood that the first cryptographic operation result response can be cryptographically operated according to the public key publicKey through the SM9 algorithm to obtain the second cryptographic operation result d_response, where d_response includes the first encrypted data h_random and the random number random; wherein the first encrypted data h_random is the encrypted data provided by the application client.

[0086] In a feasible implementation manner, before step S401, steps S401 to S404 may also be included:

[0087] Step S31: When it is determined that the master key corresponding to the user identifier does not exist locally, the login authentication information of the user to be authenticated is received from the application client, and the login authentication information is authenticated.

[0088] Step S32: When the login authentication information is authenticated, a master key corresponding to the user identifier is generated according to a random number generation algorithm, and the master key is saved.

[0089] Step S33: Send the master key to the application client through a preset secure channel, so that the application client stores the master key in a unified authentication program.

[0090] It should be noted that this section only describes the master key update scenario. After a user changes the app login client, the system does not support multiple simultaneous logins from the same app client (similar to the situation where a WeChat account changes devices and logs in simultaneously), improving security. Therefore, when obtaining the local master key, it is necessary to first determine whether the master key corresponding to the user ID exists locally. If not, re-authentication is required to generate it.

[0091] Specifically, when it is determined that the master key corresponding to the user identifier does not exist locally, the program guides the user to submit login authentication information to the unified authentication center on the application client (which can be done through SMS, password, challenge code, etc.). After the unified authentication center authenticates the login authentication information, it uses a secure random number generation algorithm to generate a master key corresponding to the user to be authenticated, and saves the generated master key locally in the authentication center. At the same time, it sends the master key to the unified authentication client through a secure channel for secure storage.

[0092] In this implementation, the user identifier and random number are encrypted by combining a pre-encrypted master key and ECC parameters. The master key and ECC parameters are securely stored to prevent unauthorized access. The user identifier and master key are concatenated to obtain a first secret key seed. The first secret key seed and elliptic curve parameters are encrypted using a preset encryption library to obtain a public key. A cryptographic operation is then performed on the first cryptographic operation result using the public key to obtain the first encrypted data and random number. This improves the security and accuracy of password acquisition and simplifies the process.

[0093] Step S50: Perform login authentication based on the second password operation result.

[0094] In a feasible implementation, step S50 may include steps S501 to S503:

[0095] Step S501: Process the random number in the second cryptographic operation result according to a keyed hash message authentication code algorithm to obtain second encrypted data.

[0096] It is understood that when the authentication center performs login authentication based on the result of the second cryptographic operation, it calculates the random number random at the end of the message according to the Keyed-Hash Message Authentication Code (HMAC) algorithm to obtain the second encrypted data h_random2. Among them, HMAC is a message authentication code algorithm based on a hash function and a key, which is used to verify the integrity and source of the message.

[0097] Step S502: Determine whether the first encrypted data and the second encrypted data in the second cryptographic operation result are consistent.

[0098] It should be understood that it is determined whether the first encrypted data h_random in the second cryptographic operation result is consistent with the second encrypted data h_random2 obtained by calculation.

[0099] Step S503: If the first encrypted data is consistent with the second encrypted data, the login authentication is successful.

[0100] It is understood that if h_random and h_random2 are consistent, the authentication is successful, and the authentication center generates a successful authentication token and sends it to the application, completing the login authentication process. If the two are inconsistent, it means that the encrypted data received from the application client is incorrect, possibly an illegal attack message, and the login authentication fails.

[0101] This embodiment provides a login authentication method based on an enterprise-level mobile application. The authentication center receives the application identifier and user identifier corresponding to the user to be authenticated sent by the application client, performs legal verification, and generates a random number; the random number is sent to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, and the random number is submitted to the application client. The application client uses a cryptographic operation program to perform a cryptographic operation on the random number and then obtains a first cryptographic operation result and feeds it back to the authentication center; the authentication center verifies the user identifier and the first cryptographic operation result according to certain rules, and completes the login after the login authentication is passed. After the user and the application are legally verified, the present application generates a random number, and uniformly forwards the user identifier and random number to the application client through the enterprise-level mobile application, without relying on SMS, email, etc. to send verification codes or passwords, so that it can be applied to users in various regions. The user identifier and random number are forwarded to the application client for cryptographic operation and the first cryptographic operation result is fed back, so that login authentication can be performed after the cryptographic operation, which improves security and does not need to rely on the certificate authentication system, simplifying the authentication process.

[0102] In addition, refer to Figure 2 , Figure 2 This is a flow chart of a second embodiment of a login authentication method based on an enterprise-level mobile application of the present application, and proposes a second embodiment of a login authentication method based on an enterprise-level mobile application of the present application.

[0103] In a second embodiment, the login authentication method based on enterprise-level mobile applications is applied to an application client, and the login authentication method based on enterprise-level mobile applications further includes steps A10 to A40:

[0104] Step A10, when a login request from the user to be authenticated is detected, the application identifier and user identifier corresponding to the user to be authenticated are sent to the authentication center, so that the authentication center verifies the legitimacy of the application identifier and the user identifier, and sends a random number of preset digits to the enterprise-level mobile application logged in by the user to be authenticated.

[0105] It should be noted that when the user to be authenticated logs in through an application client (which can be a web or app) that has integrated a unified authentication program (Software Development Kit, SDK), the current application identifier and user identifier (which can be a user name. If the user name cannot be used as the user's unique identifier, the user's corresponding identification ID can be queried through the user name) are submitted to the authentication center.

[0106] It can be understood that when the authentication center receives the application identifier and user identifier sent by the application client, it performs a legal verification on both to verify whether the application system and user exist and are legal. After the verification is passed, it generates a random number of preset bits and sends the random number to the enterprise-level mobile application.

[0107] Step A20: Receive the random number forwarded by the enterprise-level mobile application.

[0108] It should be understood that the user submits the random number to the application client using the enterprise-level mobile application, and the application client receives the random number from the enterprise-level mobile application without receiving it via SMS or email, which improves applicability and security.

[0109] Step A30: Calling a unified authentication program to perform a cryptographic operation on the random number according to the user identifier to obtain a first cryptographic operation result, wherein the unified authentication program is integrated in the application client.

[0110] It is understandable that the application client calls the unified authentication SDK to perform cryptographic calculations on the random number according to the user identifier to obtain a first cryptographic operation result response.

[0111] In a feasible implementation, step A30 may include steps A301 to A305:

[0112] Step A301, read the master key and elliptic curve parameters stored in the unified authentication program, and the master key and the elliptic curve parameters are consistent with the master key and elliptic curve parameters stored in the authentication center.

[0113] It's understood that the unified authentication process stores a master key and elliptic curve parameters. These two parameters are generated by the authentication center and pre-sent to the application client. They are then encrypted and stored in the SDK integrated into the application client for security protection. When a user logs in, the key information in the SDK is read and decrypted to obtain the master key and elliptic curve parameters.

[0114] Step A302: Concatenate the user identifier and the master key to obtain a second secret key seed.

[0115] It should be understood that the user identifier userId and the master key masterKey are concatenated to obtain the second secret key seed seed2.

[0116] Step A303: Generate a private key using the SM9 algorithm based on the elliptic curve parameters and the second secret key seed to obtain the private key corresponding to the user to be authenticated.

[0117] It should be understood that the second secret key seed seed2 and the ECC parameter are encrypted according to a preset encryption library (which may be BouncyCastle) to generate the user's corresponding private key privateKey.

[0118] Step A304: Process the random number according to the keyed hash message authentication code algorithm and the master key to obtain first encrypted data.

[0119] It can be understood that the HMAC algorithm is used to calculate the random number random with the master key masterKey as the secret key, and the first encrypted data h_random.

[0120] Step A305: concatenate the first encrypted data and the random number, and encrypt the concatenation result according to the national secret SM9 algorithm and the private key to obtain a first cryptographic operation result.

[0121] It should be understood that the first encrypted data h_random and the random number random are concatenated, and then the concatenation result is encrypted using the SM9 encryption algorithm with privateKey as the encryption key to obtain the first cryptographic operation result response. The SM9 encryption algorithm is the State Commercial Encryption Algorithm (SM9). SM9 is a domestically designed commercial identification cipher based on bilinear pairing theory. It supports user identity as the public key and does not require certificate management.

[0122] In this implementation, a unified authentication process is used to store the master key and elliptic curve parameters, improving data security and preventing unauthorized access. By combining encryption algorithms such as BouncyCastle, HMAC, and SM9, encryption complexity is further increased, reducing the risk of malicious attacks.

[0123] In a feasible implementation manner, before step A301, steps A21 to A23 may also be included:

[0124] Step A21 : determining whether a master key corresponding to the user identifier in the login request exists locally by applying a unified authentication program in the client.

[0125] Step A22: If it does not exist, the login authentication information input by the user to be authenticated is submitted to the authentication center, so that when the authentication center authenticates the login authentication information, it generates and feeds back the master key corresponding to the user identifier according to the random number generation algorithm.

[0126] Step A23: Receive the master key fed back by the authentication center and store the master key in the unified authentication program.

[0127] It's worth noting that after a user submits their username through the application client, the unified authentication client program determines whether the user's corresponding master key is stored locally. If not, the program guides the user through the application client to submit their login information to the unified authentication center (via SMS, password, challenge code, etc.). After the user passes authentication at the unified authentication center, a secure random number generation algorithm is used to generate the user's corresponding master key. The authentication center then sends the master key to the unified authentication client via a secure channel for secure storage.

[0128] In this embodiment, the master key update process can deal with the following risks: after the user changes the application login client, he needs to log in to the unified authentication center once to bind the master key with the commonly used client to improve security; even if the random code is leaked in the subsequent authentication process, the hacker still needs to obtain the master key and ECC parameters; it does not support multiple identical clients logging in at the same time (similar to changing devices on WeChat).

[0129] Step A40: Send the first cryptographic operation result and the user identification to the authentication center, so that the authentication center performs login authentication based on the first cryptographic operation result and the user identification.

[0130] In this embodiment, the application identifier and user identifier corresponding to the user to be authenticated are sent to the authentication center, so that the authentication center generates a random number after performing a legal verification on the application identifier and the user identifier, and receives the random number forwarded by the enterprise-level mobile application. The unified authentication program is called to perform cryptographic operations on the random number in combination with the user identifier, and the unified authentication SDK is used to implement cryptographic calculations in the system to increase the complexity of cryptographic operations and improve authentication security.

[0131] For example, here is an overall description of the overall interactive implementation process of the login authentication method based on enterprise-level mobile applications. Figure 3 , Figure 3 A schematic diagram of the overall interactive process of a login authentication method based on an enterprise-level mobile application is provided. The following example illustrates the overall process, specifically including steps 1 to 13:

[0132] Step 1: After the user submits their username through the application client, the unified authentication client SDK determines whether the user's corresponding master key is stored locally;

[0133] Step 2: The program guides the user to the application client to submit their login information to the unified authentication center (via SMS, password, challenge code, etc.);

[0134] Step 3: After the user passes the authentication at the unified authentication center, a secure random number generation algorithm is used to generate the user's corresponding master key and save it locally at the authentication center;

[0135] Step 4: The authentication center sends the master key to the unified authentication client through a secure channel for secure storage.

[0136] Step 5: When the user logs in using the application client integrated with the SDK, the current application ID and user ID will be submitted to the unified authentication center service;

[0137] Step 6: The authentication center determines whether the user name and application system identifier are legal. If they are legal, proceed to step 3; otherwise, terminate the process.

[0138] Step 7: The unified authentication center generates a 6-digit random number and sets the validity period (which can be set to 5 minutes);

[0139] Step 8: The unified authentication center sends the random number random to the user through WeChat for Business;

[0140] Step 9: After receiving the random number, the user submits it to the application client;

[0141] Step 10: The application client calls the unified authentication SDK to execute the password to calculate the random value and obtain the response, which includes ① to ⑤:

[0142] ① Read the ECC parameters and other information encrypted and saved in the SDK and decrypt them;

[0143] ②Concatenate the user ID userId and the master key masterKey to obtain seed1;

[0144] ③ Use BouncyCastle to generate the user's corresponding private key privateKey based on seed1 and ECC parameters;

[0145] ④ Use the HMAC algorithm (the secret key is masterKey) to calculate random to obtain h_random;

[0146] ⑤Use privateKey as the encryption key and use the SM9 encryption algorithm to perform cryptographic operations on the result of h_random and random splicing to obtain response;

[0147] Step 11: The application client submits the response, application ID, and user name to the application system backend;

[0148] Step 12: The application system backend submits the response, application ID, user name and other information to the unified authentication center;

[0149] Step 13: The unified authentication center calculates the response and compares the results. The master key and ECC parameters used in this process remain the same as those in step 6. Specifically, it includes ① to ⑥:

[0150] ① Read the ECC parameters and other information encrypted and saved by the authentication center and decrypt them;

[0151] ②Concatenate the user ID userId and the master key masterKey to obtain seed2;

[0152] ③ Use BouncyCastle to generate the user's corresponding public key publicKey based on seed2 and ECC parameters;

[0153] ④Use publicKey to perform cryptographic operations on response to obtain d_response, which includes h_random and random;

[0154] ⑤ Use the HMAC algorithm to calculate random to obtain h_random2; HMAC is a message authentication code algorithm based on a hash function and a key, used to verify the integrity and source of information.

[0155] ⑥Compare h_random2 and h_random to see if they are consistent.

[0156] It should be noted that the above examples are only used to understand this application and do not constitute a limitation on the login authentication method of this application based on enterprise-level mobile applications. More simple transformations based on this technical concept are all within the scope of protection of this application.

[0157] This application also provides a login authentication device based on enterprise-level mobile applications, please refer to Figure 4 The login authentication device based on enterprise-level mobile applications is applied to an authentication center, and the login authentication device based on enterprise-level mobile applications includes:

[0158] The information receiving module 10 is used to receive the application identifier and user identifier corresponding to the user to be authenticated sent by the application client;

[0159] A legality verification module 20 is used to verify the legality of the application identifier and the user identifier, and generate a random number of preset digits when the verification is passed;

[0160] A random number display module 30 is configured to send the random number to the enterprise-level mobile application logged in by the user to be authenticated based on the user identifier, submit the random number to the application client through the enterprise-level mobile application, and the application client performs a cryptographic operation on the random number and feeds back a first cryptographic operation result and the user identifier;

[0161] a cryptographic operation module 40 configured to perform a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result;

[0162] The login authentication module 50 is configured to perform login authentication according to the second password operation result.

[0163] This application also provides a login authentication device based on enterprise-level mobile applications, please refer to Figure 5 The login authentication device based on enterprise-level mobile applications is applied to an application client, and the login authentication device based on enterprise-level mobile applications includes:

[0164] An information sending module 60 is configured to, upon detecting a login request from a user to be authenticated, send the application identifier and user identifier corresponding to the user to be authenticated to an authentication center, so that the authentication center can verify the legitimacy of the application identifier and the user identifier, and send a random number of preset digits to the enterprise-level mobile application logged in by the user to be authenticated;

[0165] A random number receiving module 70, configured to receive the random number forwarded by the enterprise-level mobile application;

[0166] A random number operation module 80 is configured to call a unified authentication program to perform a cryptographic operation on the random number according to the user identifier to obtain a first cryptographic operation result, wherein the unified authentication program is integrated in the application client;

[0167] The cryptographic operation result sending module 90 is used to send the first cryptographic operation result and the user identification to the authentication center, so that the authentication center performs login authentication based on the first cryptographic operation result and the user identification.

[0168] The enterprise-level mobile application-based login authentication device provided in this application utilizes the enterprise-level mobile application-based login authentication method of the aforementioned embodiment to resolve the technical problem. Compared to the prior art, the beneficial effects of the enterprise-level mobile application-based login authentication device provided in this application are the same as those of the enterprise-level mobile application-based login authentication method provided in the aforementioned embodiment. The other technical features of the enterprise-level mobile application-based login authentication device are the same as those disclosed in the aforementioned embodiment and are not further elaborated here.

[0169] The present application provides a login authentication device based on an enterprise-level mobile application. The login authentication device based on an enterprise-level mobile application includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the login authentication method based on the enterprise-level mobile application in the above-mentioned embodiment one.

[0170] Reference below Figure 6 , which shows a schematic diagram of the structure of a login and authentication device based on enterprise-level mobile applications suitable for implementing embodiments of the present application. The login and authentication device based on enterprise-level mobile applications in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The login authentication device based on enterprise-level mobile applications shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0171] like Figure 6As shown, a login authentication device based on enterprise-level mobile applications may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory 1002 or programs loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the login authentication device based on enterprise-level mobile applications. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: an input device 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the enterprise-level mobile application-based login authentication device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows an enterprise-level mobile application-based login authentication device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems may be implemented or have alternatively.

[0172] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0173] The enterprise-level mobile application-based login authentication device provided in this application utilizes the enterprise-level mobile application-based login authentication method described in the aforementioned embodiment, thereby resolving the technical issues associated with enterprise-level mobile application-based login authentication. Compared to the prior art, the beneficial effects of the enterprise-level mobile application-based login authentication device provided in this application are the same as those of the enterprise-level mobile application-based login authentication method described in the aforementioned embodiment. The other technical features of the enterprise-level mobile application-based login authentication device are the same as those disclosed in the aforementioned embodiment and are not further elaborated upon here.

[0174] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0175] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0176] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, and the computer-readable program instructions are used to execute the login authentication method based on enterprise-level mobile applications in the above-mentioned embodiment.

[0177] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0178] The computer-readable storage medium may be included in the login authentication device based on the enterprise-level mobile application; or may exist independently without being assembled into the login authentication device based on the enterprise-level mobile application.

[0179] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by a login authentication device based on an enterprise-level mobile application, the login authentication device based on the enterprise-level mobile application: receives the application identifier and user identifier corresponding to the user to be authenticated sent by the application client; performs a legality check on the application identifier and the user identifier, and generates a random number with a preset number of bits when the check passes; sends the random number to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, submits the random number to the application client through the enterprise-level mobile application, and the application client performs a cryptographic operation on the random number, and feeds back the first cryptographic operation result and the user identifier; performs a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result; and performs login authentication according to the second cryptographic operation result.

[0180] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0181] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0182] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0183] The computer-readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned login authentication method based on enterprise-level mobile applications, thereby resolving the technical problem. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the login authentication method based on enterprise-level mobile applications provided in the aforementioned embodiments, and are not further elaborated here.

[0184] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned login authentication method based on enterprise-level mobile applications.

[0185] The computer program product provided in this application can solve the technical problem. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the login authentication method based on enterprise-level mobile applications provided in the above embodiment, and will not be repeated here.

[0186] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A login authentication method based on enterprise-level mobile applications, characterized in that: The method is applied to an authentication center, and the method comprises: Receive the application ID and user ID corresponding to the user to be authenticated sent by the application client; Performing a legality check on the application identifier and the user identifier, and generating a random number of preset digits if the check passes; Sending the random number to the enterprise-level mobile application logged in by the user to be authenticated according to the user identifier, submitting the random number to the application client through the enterprise-level mobile application, and the application client performing a cryptographic operation on the random number and feeding back a first cryptographic operation result and the user identifier; performing a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result; Login authentication is performed based on the second password operation result.

2. The method according to claim 1, wherein The step of performing a cryptographic operation on the first cryptographic operation result according to the user identifier to obtain a second cryptographic operation result includes: Read the master key and elliptic curve parameters stored locally, where the master key and the elliptic curve parameters are consistent with the master key and the elliptic curve parameters stored in the unified authentication program; Concatenate the user identifier and the master key to obtain a first secret key seed; Generate the public key using the SM9 algorithm based on the elliptic curve parameters and the first secret key seed to obtain the public key corresponding to the user to be authenticated; A cryptographic operation is performed on the first cryptographic operation result according to the public key to obtain a second cryptographic operation result, where the second cryptographic operation result includes the first encrypted data and the random number.

3. The method according to claim 2, wherein Before the step of reading the master key and elliptic curve parameters stored locally, the method further includes: When it is determined that the master key corresponding to the user identifier does not exist locally, receiving the login authentication information of the user to be authenticated sent by the application client, and authenticating the login authentication information; When the login authentication information is authenticated, a master key corresponding to the user identifier is generated according to a random number generation algorithm, and the master key is stored; The master key is sent to the application client through a preset secure channel, so that the application client stores the master key in a unified authentication program.

4. The method according to claim 2, wherein The step of performing login authentication according to the second password operation result includes: Processing the random number in the second cryptographic operation result according to a keyed hash message authentication code algorithm to obtain second encrypted data; determining whether the first encrypted data and the second encrypted data in the second cryptographic operation result are consistent; If the first encrypted data is consistent with the second encrypted data, the login authentication is successful.

5. A login authentication method based on enterprise-level mobile applications, characterized in that: The method is applied to an application client, and the method includes: When a login request from a user to be authenticated is detected, Send the application identifier and user identifier corresponding to the user to be authenticated to the authentication center, so that the authentication center can verify the legality of the application identifier and the user identifier, and send a random number with a preset number of digits to the enterprise-level mobile application logged in by the user to be authenticated; receiving the random number forwarded by the enterprise-level mobile application; Calling a unified authentication program to perform a cryptographic operation on the random number according to the user identifier to obtain a first cryptographic operation result, wherein the unified authentication program is integrated in the application client; The first cryptographic operation result and the user identification are sent to the authentication center so that the authentication center performs login authentication based on the first cryptographic operation result and the user identification.

6. The method according to claim 5, wherein The step of calling the unified authentication program to perform a cryptographic operation on the random number according to the user identifier to obtain a first cryptographic operation result includes: Reading the master key and elliptic curve parameters stored in the unified authentication program, wherein the master key and the elliptic curve parameters are consistent with the master key and the elliptic curve parameters stored in the authentication center; Concatenate the user identifier and the master key to obtain a second secret key seed; Generate the private key using the SM9 algorithm based on the elliptic curve parameters and the second secret key seed to obtain the private key corresponding to the user to be authenticated; Processing the random number according to a keyed hash message authentication code algorithm and the master key to obtain first encrypted data; The first encrypted data and the random number are spliced together, and the splicing result is encrypted according to the national secret SM9 algorithm and the private key to obtain a first cryptographic operation result.

7. The method according to claim 6, wherein Before the step of reading the master key and elliptic curve parameters stored in the unified authentication program, the method further includes: Determine whether there is a master key corresponding to the user identifier in the login request locally by using a unified authentication program in the application client; If it does not exist, the login authentication information input by the user to be authenticated is submitted to the authentication center, so that when the authentication center authenticates the login authentication information, it generates and feeds back a master key corresponding to the user identifier according to a random number generation algorithm; Receive the master key fed back by the authentication center and store the master key in the unified authentication program.

8. A login authentication device based on enterprise-level mobile applications, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the login authentication method based on enterprise-level mobile applications as claimed in any one of claims 1 to 4 or any one of claims 5 to 7.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the login authentication method based on enterprise-level mobile applications as described in any one of claims 1 to 4 or any one of claims 5 to 7 are implemented.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the login authentication method based on enterprise-level mobile applications according to any one of claims 1 to 4 or any one of claims 5 to 7 are implemented.

Images