Authentication method and device, equipment, storage medium and program product

Abstract

The invention provides an authentication method and device, equipment, a storage medium and a program product, relates to the technical field of communication, and is used for encrypting a unique identifier at terminal equipment to obtain first encrypted data and sending the first encrypted data to an application server instead of directly transmitting the unique identifier, so that the unique identifier is prevented from being intercepted during transmission, and the user experience is improved. And the leakage risk of the unique identifier is reduced. The method comprises the steps that a first request is sent in response to login application operation, the first request is used for requesting to obtain a mobile phone mask of terminal equipment, and the mobile phone mask is used for authenticating login application; a second request from the application server is received, the second request is used for requesting to obtain a unique identifier, and the unique identifier is used for indicating the terminal equipment; the unique identifier is encrypted to obtain first encrypted data, and the unique identifier comprises an IMSI and / or an IMEI; sending a first message, wherein the first message comprises the first encrypted data; and receiving a second response from the application server, wherein the second response comprises the mobile phone mask of the terminal equipment.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to authentication methods, devices, equipment, storage media, and program products. Background Art

[0002] Currently, when users log in to applications using their devices, the application server must authenticate the user's identity before they can log in. For example, the application server might authenticate the user's mobile phone number. However, the authentication process carries a high risk of information leakage due to weak security measures. Summary of the Invention

[0003] The present application provides an authentication method, apparatus, device, storage medium, and program product for reducing the risk of information leakage.

[0004] In a first aspect, the present application provides an authentication method, which is applied to a terminal device, and the method includes: in response to a login application operation, sending a first request, the first request is used to request to obtain a mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate the login application; receiving a second request from an application server, the second request is used to request to obtain a unique identifier, and the unique identifier is used to indicate the terminal device; encrypting the unique identifier to obtain first encrypted data, the unique identifier includes IMSI and / or IMEI; sending a first message, the first message includes the first encrypted data; receiving a second response from the application server, the second response includes the mobile phone mask of the terminal device.

[0005] The authentication method provided in this application encrypts the unique identifier separately at the terminal device to obtain first encrypted data. This first encrypted data is sent to the application server instead of directly transmitting the unique identifier, thereby avoiding information leakage caused by the unique identifier being intercepted during transmission and reducing the risk of unique identifier leakage.

[0006] In a possible implementation, encrypting the unique identifier to obtain first encrypted data includes: encrypting the unique identifier based on an encryption key and a symmetric encryption algorithm to obtain the first encrypted data.

[0007] Encrypting the unique identifier according to the symmetric encryption algorithm and encryption key can increase the amount of computing required to crack the encrypted unique identifier, making it less susceptible to cracking by quantum computing with stronger computing power, thereby reducing the risk of unique identifier leakage.

[0008] In another possible implementation, the first message further includes a first key identifier and a name of the symmetric encryption algorithm, where the first key identifier is used to indicate the encryption key.

[0009] The terminal device sends the first encrypted data along with the first key identifier and the name of the symmetric encryption algorithm. This facilitates the authentication server to use the first key identifier to obtain a decryption key, and to use the name of the symmetric encryption algorithm to select the corresponding symmetric encryption algorithm. The first encrypted data is decrypted using the decryption key and the encryption symmetric algorithm to obtain a unique identifier, thereby ensuring the accuracy of the unique identifier.

[0010] Another possible implementation is that the terminal device includes a SIM card, and the encryption key is stored in the SIM card based on quantum key distribution technology.

[0011] Quantum key distribution technology, based on the properties of quantum mechanics, can generate a random, secure key for the SIM card to encrypt the unique identifier. This makes the encrypted unique identifier more difficult to crack, thereby reducing the risk of unique identifier leakage.

[0012] In a second aspect, the present application provides an authentication method, which is applied to an application server, and the method includes: receiving a first request from a terminal device, the first request is used to request a mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate the login application; sending a second request, the second request is used to request to obtain a unique identifier, and the unique identifier is used to indicate the terminal device; receiving a first message from the terminal device, the first message includes first encrypted data, and the first encrypted data is obtained by encrypting the unique identifier; encrypting the first message, sending second encrypted data, and the second encrypted data includes data encrypted from the first encrypted data; receiving a first response from the authentication server, the first response includes a mobile phone mask; sending a second response, and the second response includes a mobile phone mask.

[0013] Based on the first encrypted data obtained by encrypting the unique identifier, the first encrypted data is encrypted to obtain the second encrypted data, thereby further increasing the difficulty of cracking the unique identifier and reducing the risk of leakage of the unique identifier.

[0014] In one possible implementation, the first message also includes a first key identifier and the name of a symmetric encryption algorithm, where the first key identifier is used to indicate the encryption key; encrypting the first message includes: encrypting the first encrypted data, the first key identifier and the name of the symmetric encryption algorithm to obtain second encrypted data.

[0015] While encrypting the first encrypted data, the first key identifier and the name of the symmetric encryption algorithm are also encrypted, thereby reducing the risk of leakage of the first key identifier and the name of the symmetric encryption algorithm.

[0016] In a third aspect, the present application provides an authentication method, which is applied to an authentication server, and the method includes: receiving second encrypted data from an application server, the second encrypted data including data encrypted from the first encrypted data; decrypting the second encrypted data to obtain first encrypted data; decrypting the first encrypted data to obtain a unique identifier, the unique identifier is used to indicate a terminal device; obtaining a mobile phone mask corresponding to the unique identifier, and sending a first response, the first response including a mobile phone mask, and the mobile phone mask is used to authenticate the login application.

[0017] The mobile phone mask is obtained according to the unique identifier obtained by decrypting the second encrypted data, and the mobile phone mask is sent to the terminal device so that the user can log in to the application after confirming the accuracy of the mobile phone mask, thereby ensuring that the authentication and login process of the application can be executed normally.

[0018] A possible implementation method is to decrypt the second encrypted data, including: decrypting the second encrypted data to obtain the first key identifier and the name of the symmetric encryption algorithm; decrypting the first encrypted data to obtain a unique identifier, including: decrypting the first encrypted data based on the decryption key indicated by the first key identifier and the symmetric encryption algorithm to obtain a unique identifier.

[0019] The first key identifier is used to obtain a decryption key, and the name of the symmetric encryption algorithm is used to select the corresponding symmetric encryption algorithm. The first encrypted data is decrypted according to the decryption key and the encryption symmetric algorithm to obtain a unique identifier, thereby ensuring the accuracy of the decrypted unique identifier.

[0020] Another possible implementation is that the authentication server stores the decryption key based on quantum key distribution technology.

[0021] Quantum key distribution technology generates a decryption key corresponding to the encryption key for the authentication server based on the characteristics of quantum mechanics, and uses the decryption key to decrypt the first encrypted data to obtain a unique identifier, thereby ensuring the accuracy of the obtained unique identifier.

[0022] In a fourth aspect, the present application provides a terminal device, the terminal device including modules for executing the method in the first aspect or any possible design of the first aspect. For example, the authentication device includes a transceiver module and an encryption module.

[0023] The transceiver module is used to send a first request, the first request is used to request to obtain the mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate and log in to the application; the transceiver module is also used to receive a second request from the application server, the second request is used to request to obtain a unique identifier, and the unique identifier is used to indicate the terminal device; the encryption module is used to encrypt the unique identifier to obtain first encrypted data, and the unique identifier includes IMSI and / or IMEI; the transceiver module is also used to send a first message, and the first message includes the first encrypted data; the transceiver module is also used to receive a second response from the application server, and the second response includes the mobile phone mask of the terminal device.

[0024] In a possible implementation, when the encryption module encrypts the unique identifier to obtain the first encrypted data, it is specifically configured to: encrypt the unique identifier based on an encryption key and a symmetric encryption algorithm to obtain the first encrypted data.

[0025] In another possible implementation, the first message further includes a first key identifier and a name of the symmetric encryption algorithm, where the first key identifier is used to indicate the encryption key.

[0026] Another possible implementation is that the terminal device includes a SIM card, and the encryption key is stored in the SIM card based on quantum key distribution technology.

[0027] In a fifth aspect, the present application provides an application server, the application server including modules for executing the method in the second aspect or any possible design of the second aspect. For example, the authentication device includes a transceiver module and a processing module.

[0028] The transceiver module is used to receive a first request from a terminal device, the first request is used to request a mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate and log in to the application; the transceiver module is also used to send a second request, and the second request is used to request to obtain a unique identifier, and the unique identifier is used to indicate the terminal device; the transceiver module is also used to receive a first message from the terminal device, the first message includes first encrypted data, and the first encrypted data is obtained by encrypting the unique identifier; the processing module is used to encrypt the first message to obtain second encrypted data, and the second encrypted data includes data encrypted from the first encrypted data; the transceiver module is also used to send the second encrypted data; the transceiver module is also used to receive a first response from the authentication server, and the first response includes a mobile phone mask; the transceiver module is also used to send a second response, and the second response includes a mobile phone mask.

[0029] In one possible implementation method, the first message also includes a first key identifier and the name of the symmetric encryption algorithm, and the first key identifier is used to indicate the encryption key; when the processing module encrypts the first message, it is specifically used to: encrypt the first encrypted data, the first key identifier and the name of the symmetric encryption algorithm to obtain the second encrypted data.

[0030] In a sixth aspect, the present application provides an authentication server, which includes modules for executing the method in the third aspect or any possible design of the third aspect. For example, the authentication device includes a transceiver module and a decryption module.

[0031] The transceiver module is used to receive second encrypted data from the application server, and the second encrypted data includes data encrypted from the first encrypted data; the decryption module is used to decrypt the second encrypted data to obtain the first encrypted data; the decryption module is also used to decrypt the first encrypted data to obtain a unique identifier, and the unique identifier is used to indicate the terminal device; the decryption module is also used to generate a mobile phone mask based on the mobile phone number corresponding to the unique identifier; the transceiver module is also used to send a first response, and the first response includes a mobile phone mask, and the mobile phone mask is used to authenticate the login application.

[0032] In one possible implementation method, when the decryption module decrypts the second encrypted data, it is specifically used to: decrypt the second encrypted data to obtain the first key identifier and the name of the symmetric encryption algorithm; when the decryption module decrypts the first encrypted data to obtain the unique identifier, it is specifically used to: decrypt the first encrypted data based on the decryption key indicated by the first key identifier and the symmetric encryption algorithm to obtain the unique identifier.

[0033] Another possible implementation is that the authentication server stores the decryption key based on quantum key distribution technology.

[0034] In a seventh aspect, the present application provides a computer device comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the computer device implements the method of the first aspect above.

[0035] In an eighth aspect, the present application provides a computer-readable storage medium, which includes: computer software instructions; when the computer software instructions are executed in an authentication device, the authentication device implements the method of the first aspect above.

[0036] In a ninth aspect, the present application provides a computer program product, which includes a computer program; when the computer program runs in a computer device, the computer device implements the method of the first aspect above.

[0037] The beneficial effects of the second to ninth aspects mentioned above refer to the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of the network architecture of an authentication system provided for this application;

[0039] Figure 2A flowchart of an authentication method provided for this application;

[0040] Figure 3 A flowchart of another authentication method provided for this application;

[0041] Figure 4 A schematic diagram of the authorization interface provided for this application;

[0042] Figure 5 A schematic diagram of the structure of a terminal device provided in this application;

[0043] Figure 6 A schematic diagram of the structure of an application server provided for this application;

[0044] Figure 7 A schematic diagram of the structure of an authentication server provided for this application;

[0045] Figure 8 A schematic diagram of the structure of a computer device provided in this application. DETAILED DESCRIPTION

[0046] The authentication method provided in this application will be described in detail below with reference to the accompanying drawings.

[0047] The term "and / or" in this article is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0048] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0049] Furthermore, the terms "including," "having," and any variations thereof, as used in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not limited to the listed steps or units but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to the process, method, product, or apparatus.

[0050] It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being more preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0051] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0052] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0053] Authentication login applications utilize the carrier's gateway authentication capabilities to authenticate users. Users can register or log into applications using their phone number with a single click, eliminating the need to enter a password or SMS verification code. This authentication method effectively eliminates the latency associated with traditional password and SMS verification code logins and is widely used in key sectors such as communications, finance, and government. For example, in the financial sector, payment applications use one-click login to quickly log in and ensure transaction security. In the public service sector, government platforms utilize one-click login to streamline the citizen authentication process and improve service efficiency.

[0054] Quantum computing is a new computing model based on the principles of quantum mechanics. Its core principle is to exploit the quantum properties of qubits (qubits) to process information. Unlike the fixed state of binary bits (0 or 1) in classical computing, qubits can simultaneously exist in a combination of 0 and 1 through superposition. Furthermore, multiple qubits can form interconnected states through quantum entanglement, giving quantum computing an exponential computing power advantage when solving specific problems.

[0055] In some embodiments, when a user uses a terminal device to authenticate and log in to an application, the authentication server obtains the mobile phone number based on the unique identifier provided by the terminal device, and the application server switches the application software to the login state based on the mobile phone number obtained by the authentication server. Unique identifiers include, for example, the International Mobile Subscriber Identification Number (IMSI) and the International Mobile Equipment Identity (IMEI). However, due to low security measures, the risk of leakage of unique identifiers is high.

[0056] To address the high risk of unique identifier leakage, this application provides an authentication method. The method includes: in response to an application login operation, sending a first request for obtaining a terminal device's phone mask, which is used to authenticate the application login; receiving a second request from an application server for obtaining a unique identifier, which is used to identify the terminal device; encrypting the unique identifier to obtain first encrypted data, which includes the IMSI and / or IMEI; sending a first message, which includes the first encrypted data; and receiving a second response from the application server, which includes the terminal device's phone mask.

[0057] The authentication method provided in this application encrypts the unique identifier separately at the terminal device to obtain first encrypted data. This first encrypted data is sent to the application server instead of directly transmitting the unique identifier, thereby avoiding information leakage caused by the unique identifier being intercepted during transmission and reducing the risk of unique identifier leakage.

[0058] The authentication method provided by this application can be applied to Figure 1 In the application environment shown.

[0059] Figure 1 A schematic diagram of a network architecture of an authentication system provided in an embodiment of the present application is shown. The network architecture of the authentication system includes a base station 110, a terminal device 120, an application server 130 and an authentication server 140.

[0060] In some embodiments, base station 110 is used to provide wireless access services to terminal device 120. Specifically, a base station provides a service coverage area (also called a cell). Terminals entering this area can communicate with the base station via wireless signals to receive the wireless access services provided by the base station.

[0061] In some embodiments, the base station 110 can be a base station or an evolved base station (eNB or eNodeB) in long term evolution (LTE), long term evolution advanced (LTEA), a base station device in a 5G network, or a base station in a future communication system, etc. The base station can include various macro base stations, micro base stations, home base stations, wireless remote stations, reconfigurable intelligent surfaces (RIS), routers, wireless fidelity (WIFI) devices and other network side devices.

[0062] In some embodiments, the terminal device 120 can be a device with wireless transceiver capabilities, which can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as a ship, etc.); it can also be deployed in the air (for example, on an airplane, a balloon, and a satellite, etc.). The terminal can be a mobile phone, a tablet computer, a computer with wireless transceiver capabilities, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical care, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The embodiments of the present application do not limit the application scenarios. Terminal devices may also be referred to as users, UEs, access terminals, UE units, UE stations, mobile stations, mobile stations, remote stations, remote terminals, mobile devices, UE terminals, wireless communication devices, UE agents, or UE devices, etc., although this is not limited in the present embodiment. Terminal device 120 includes a subscriber identity module (SIM), which is also known as a SIM card or subscriber identity card. Terminal device 120 also has applications installed. Applications may also be referred to as application software, application programs, or application front ends, etc., although this is not limited in the present embodiment.

[0063] In some embodiments, the terminal device 120 is used to communicate with the application server 130 through the base station 110. For example, the terminal device 120 is used to send data. For example, the terminal device 120 sends a first request and a first message to the application server 130 through the base station 110. The first request is used to request to obtain the mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate the login application. The first message includes first encrypted data. For another example, the terminal device 120 is used to receive data. For example, the terminal device 120 receives a second request or a second response sent by the application server 130 through the base station 110. The second request is used to request to obtain a unique identifier, the unique identifier is used to indicate the terminal device, and the second response includes the mobile phone mask.

[0064] In other embodiments, the terminal device 120 is further configured to encrypt the unique identifier to obtain first encrypted data.

[0065] In some embodiments, application server 130 is configured to provide background services for applications installed on terminal device 120. For example, application server 130 encrypts a first message to obtain second encrypted data. This application does not limit the number of application servers 130, and application server 130 can be, for example, a single server, a server cluster, or a cloud computing platform.

[0066] In some embodiments, application server 130 is further configured to communicate with terminal device 120 or authentication server 140. For example, application server 130 may send data. For example, application server 130 may send a second request to terminal device 120, a second response to terminal device 120, or second encrypted data to authentication server 140. For another example, application server 130 may receive data. For example, application server 130 may receive a first request or a first message sent by terminal device 120.

[0067] In some embodiments, authentication server 140 may be an operator authentication server (e.g., an operator core network) or a third-party identity authentication center. In the embodiment of the present application, i.e., in the scenario of authentication login application, authentication server 140 is used to decrypt the second encrypted data to obtain the first encrypted data, decrypt the first encrypted data to obtain the unique identifier, and obtain the phone mask corresponding to the unique identifier. Optionally, authentication server 140 is also used to generate an authentication token.

[0068] In some embodiments, the authentication server 140 is further configured to communicate with the application server 130. For example, the authentication server 140 receives the second encrypted data sent by the application server 130, and the authentication server 140 sends a first response to the application server 130.

[0069] It should be noted that the authentication system network architecture described in the embodiment of the present application is for the purpose of more clearly illustrating the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided in the embodiment of the present application. A person skilled in the art will know that with the evolution of the system architecture, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

[0070] Next, the authentication method provided by this application is described in detail with reference to the accompanying drawings.

[0071] Figure 2 A flow chart of an authentication method provided for this application, mainly based on Figure 1 The network architecture diagram of the authentication system shown in the figure is used to illustrate the authentication method provided by this application. Figure 2 As shown, the method includes the following steps.

[0072] Step 201: The terminal device sends a first request. Correspondingly, step 202: The application server receives the first request.

[0073] In some embodiments, the first request is used to request a mobile phone mask, which is used to authenticate and log in to an application. For example, an application is installed on a terminal device, and when a user clicks an application icon on the terminal device to launch the application, the terminal device sends a first request to the application server.

[0074] Applications include but are not limited to applications (APP), applets, browser applications (WebApplication), etc. An application server is, for example, a single server, a server cluster, or a cloud computing platform that provides background services for an application.

[0075] A phone mask is created by partially masking a user's real phone number. Typically, this method retains the first and last digits of the number and replaces the middle digits with a specific character (such as an asterisk "*"). A phone mask is primarily used to prevent phone number information leakage while still allowing users to identify the number. For example, a phone mask might be "123****4567."

[0076] Step 203: The application server sends a second request. Correspondingly, step 204: The terminal device receives the second request.

[0077] In some embodiments, the application server sends a second request to the terminal device, the second request being used to request a unique identifier of the terminal device, including but not limited to an International Mobile Subscriber Identification Number (IMSI) and an International Mobile Equipment Identity (IMEI).

[0078] Optionally, the application server deploys an operator software development kit (SDK). The second request is also used to instruct the terminal device to verify the legitimacy of the operator SDK identity. If the terminal device verifies the operator SDK identity correctly, subsequent steps 205 to 217 are executed.

[0079] For example, the terminal device's SIM card contains an operator root certificate (e.g., Root_Cert), and the operator SDK contains a sub-certificate (e.g., Sub_Cert). The second request sent by the application server contains the sub-certificate, and the SIM card verifies the sub-certificate using the built-in root certificate. After confirming that the sub-certificate is correct, steps 205 to 217 are executed.

[0080] For example, the SIM card uses the root certificate to verify the signature of the sub-certificate, parses the sub-certificate's signature algorithm, decrypts the signature with the root certificate's public key, and compares it with the sub-certificate's hash value. Verification includes: whether the certificate was issued by the operator's root certificate and whether the certificate is within its validity period.

[0081] This application does not limit the deployment location of the operator SDK. In addition to being deployed on the application server, the operator SDK can also be deployed on the application front end, that is, the terminal device where the application is located. In the case where the operator SDK is deployed on the application front end, the application front end contains a sub-certificate, and the SIM card contains the operator root certificate. After the terminal device receives the second request, the SIM card uses the operator root certificate to verify the sub-certificate. If the sub-certificate is correct, the subsequent steps are executed.

[0082] Step 205: The terminal device encrypts the unique identifier to obtain first encrypted data.

[0083] In some embodiments, the encryption key is stored in the SIM card of the terminal device.

[0084] Optionally, the encryption key is stored in the SIM card when the SIM card leaves the factory. The encryption key can be stored in the SIM card by, for example, using quantum key distribution (QKD) technology.

[0085] In some embodiments, the terminal device encrypts the unique identifier using an encryption key and a symmetric encryption algorithm to obtain first encrypted data. The symmetric encryption algorithm includes, but is not limited to, a post-quantum symmetric encryption algorithm. An example of a post-quantum symmetric encryption algorithm is AES256.

[0086] Step 206: The terminal device sends a first message. Correspondingly, step 207: The application server receives the first message.

[0087] In some embodiments, the terminal device sends a first message to the application server, where the first message includes the first encrypted data obtained in step 205 .

[0088] Optionally, the first message also includes a first key identifier and a name of the symmetric encryption algorithm, wherein the first key identifier is used to indicate the encryption key.

[0089] Optionally, the application server receiving the first encrypted data is, for example, an operator SDK in the application server receiving the first encrypted data.

[0090] Step 208: The application server encrypts the first message to obtain second encrypted data.

[0091] In some embodiments, the application server encrypts the first encrypted data contained in the first message using a security protocol to obtain second encrypted data, wherein the security protocol includes but is not limited to Transport Layer Security (TLS) and Internet Protocol Security (IPSec).

[0092] Optionally, when the first message includes the first key identifier, the name of the symmetric encryption algorithm and the first encrypted data, the application server uses a security protocol to encrypt the first key identifier, the name of the symmetric encryption algorithm and the first encrypted data to obtain second encrypted data.

[0093] For example, the second encrypted data includes the following content:

[0094] jsonCopy Code

[0095] {

[0096] "enc_data":"ENC_PSK_A(IMSI||IMEI)",

[0097] "psk_id":"PSK_ID_001",

[0098] "cell_info":{"lac":1234,"cid":5678},

[0099] "algo":"AES-256"}

[0100] The "enc_data" field represents the first encrypted data, and ENC_PSK_A(IMSI||IMEI) represents the content of the first encrypted data. The "psk_id" field represents the first key identifier, and PSK_ID_001 represents the content of the first key identifier. The "algo" field represents the name of the symmetric encryption algorithm. AES-256 indicates that the symmetric encryption algorithm is AES-256. The "cell_info" field represents base station information. "lac":1234 indicates that the area code of the base station location is 1234, and "cid":5678 indicates that the ID of the base station cell is 5678.

[0101] Step 209: The application server sends the second encrypted data. Correspondingly, step 210: The authentication server receives the second encrypted data.

[0102] In some embodiments, the application server sends the second encrypted data to the authentication server based on a communication transmission protocol.

[0103] The communication transmission protocol includes but is not limited to Hypertext Transfer Protocol Secure (HTTPS) and the like.

[0104] The authentication server includes but is not limited to an operator authentication server (eg, an operator core network, etc.) or a third-party identity authentication center, etc.

[0105] Step 211: The authentication server decrypts the second encrypted data to obtain the first encrypted data.

[0106] In some embodiments, the authentication server decrypts the second encrypted data according to the security protocol selected in step 209 to obtain the first encrypted data.

[0107] Optionally, when the application server uses a security protocol to encrypt the first encrypted data, the first key identifier and the name of the symmetric encryption algorithm to obtain the second encrypted data, the authentication server decrypts the second encrypted data according to the security protocol to obtain the first encrypted data, the first key identifier and the name of the symmetric encryption algorithm.

[0108] Step 212: The authentication server decrypts the first encrypted data to obtain a unique identifier.

[0109] In some embodiments, the authentication server stores a key library, which contains multiple decryption keys, multiple key identifiers, and corresponding relationships between the multiple decryption keys and the multiple key identifiers.

[0110] In some embodiments, the authentication server retrieves and obtains a decryption key corresponding to the first key identifier from a key library, selects a symmetric encryption algorithm based on the name of the symmetric encryption algorithm, and decrypts the first encrypted data using the decryption key and the symmetric encryption algorithm to obtain a unique identifier.

[0111] Optionally, the decryption key is stored in the authentication server using, for example, QKD technology.

[0112] Step 213: The authentication server generates a mobile phone mask according to the mobile phone number corresponding to the unique identifier.

[0113] In some embodiments, the authentication server includes a mobile phone number database that stores a correspondence between a unique identifier and a mobile phone number.

[0114] In some embodiments, the authentication server searches a mobile phone number database to obtain the mobile phone number corresponding to the unique identifier and generates a mobile phone mask based on the mobile phone number. The mobile phone mask can be generated by, for example, retaining the first three and last four digits of the mobile phone number and replacing the middle digits with an asterisk (*). For example, the mobile phone mask is "123****4567."

[0115] Optionally, the authentication server generates an authentication token and records the correspondence between the authentication token and the mobile phone number. This application does not limit the method of generating the token, which includes but is not limited to a hash-based message authentication code (HMAC), a JSON Web Token (JWT), or a random token based on a universally unique identifier (UUID).

[0116] Optional, authentication token is also called authentication Token.

[0117] For example, the authentication token contains the following content:

[0118] jsonCopy Code

[0119] {

[0120] "code":200,

[0121] "token":"Temp_Token_XYZ",

[0122] "expire":300}

[0123] The "expire" field indicates the validity period of the authentication token. 300 indicates a validity period of 300 seconds. "token":"Temp_Token_XYZ" indicates that the content of the authentication token is Temp_Token_XYZ. "code":200 indicates that the status code of the authentication token is 200.

[0124] Step 214: The authentication server sends a first response. Correspondingly, step 215: The application server receives the first response.

[0125] In some embodiments, the authentication server sends a first response to the application server, wherein the first response includes a mobile phone mask, wherein the mobile phone mask is the mobile phone mask corresponding to the unique identifier obtained in step 213 .

[0126] Optionally, the first response also includes an authentication token.

[0127] Step 216: The application server sends a second response. Correspondingly, step 217: The terminal device receives the second response.

[0128] In some embodiments, after receiving the first response, the application server sends a second response to the terminal device, where the second response includes the mobile phone mask.

[0129] Optionally, the second response also includes an authentication token.

[0130] The authentication method provided in this application encrypts the unique identifier separately at the terminal device to obtain first encrypted data, and sends the first encrypted data to the application server instead of directly transmitting the unique identifier, thereby avoiding information leakage caused by the unique identifier being intercepted during transmission and reducing the risk of unique identifier leakage.

[0131] It should be understood that the authentication method provided in this application also provides a function for allowing the user to choose to use the mobile phone mask to log in to the application after the terminal device obtains the mobile phone mask.

[0132] Therefore, if Figure 3 As shown, after step 217, the authentication method provided in the embodiment of the present application further includes the following steps.

[0133] Step 301: The terminal device displays the authorization interface.

[0134] In some embodiments, the terminal device includes an application front end. The application front end refers to the page provided by the application on the terminal device that interacts with the user, and is used to display information (such as a phone mask) and process user operations (such as clicking a login button).

[0135] In some embodiments, the application front end in the terminal device displays an authorization interface. The content displayed in the authorization interface includes but is not limited to a mobile phone mask, a login button, etc.

[0136] like Figure 4 The figure shows a schematic diagram of an authorization interface provided by this application.

[0137] Figure 4 The mobile phone mask in is the mobile phone mask obtained in step 213. When the user checks the correctness of the mobile phone mask and confirms that the mobile phone mask is correct, he clicks the login button to achieve the purpose of authenticating and logging into the application.

[0138] Step 302: The terminal device sends a third request. Correspondingly, step 303: The application server receives the third request.

[0139] In some embodiments, when the user clicks the login button in the authorization interface, the terminal device sends a third request to the application server, where the third request is used to request the application server to switch the application to a logged-in state.

[0140] Optionally, the third request includes the authentication Token obtained in step 213 .

[0141] Step 304: The application server sends a fourth request. Correspondingly, step 308: The authentication server receives the fourth request.

[0142] In some embodiments, after receiving the third request, the application server sends a fourth request to the authentication server, where the fourth request is used to obtain the complete user mobile phone number.

[0143] Optionally, the fourth request includes an authentication token.

[0144] Optionally, the fourth request further includes an application name, where the application name refers to the name of the application deployed on the application server, that is, the name of the application that requires authentication and login.

[0145] In some embodiments, the authentication server receives the fourth request, obtains the authentication token included in the fourth request, and obtains the mobile phone number based on the correspondence between the authentication token and the mobile phone number in step 213 .

[0146] Step 306: The authentication server sends the mobile phone number. Correspondingly, step 307: The application server receives the mobile phone number.

[0147] In some embodiments, the authentication server sends the mobile phone number to the application server. After receiving the mobile phone number, the application server compares it with the registered mobile phone number used by the user when registering the application. If the mobile phone number is the same as the registered mobile phone number, the application server switches the application to a logged-in state.

[0148] Step 308: The application server sends an application authorization token. Correspondingly, step 309: The terminal device receives the application authorization token.

[0149] In some embodiments, the application server generates an application authorization token and sends the application authorization token to the terminal device.

[0150] The implementation method for generating an application authorization token can be referenced in step 213 for generating an authentication token, and is not further described here. The purpose of the application authorization token is to carry the application authorization token in the request sent by the terminal device to the application server, so that the application server can verify the legitimacy of the terminal device's request, identify the user, and authorize access to specific resources or functions of the application server.

[0151] Step 310: The terminal device stores the application authorization Token.

[0152] In some embodiments, the application authorization token is stored in the terminal device. For example, the application authorization token is stored in the terminal device's storage medium. The storage medium includes, but is not limited to, memory, disk, etc. When a user accesses an application server by operating an application installed on the terminal device, the terminal device sends a request to the application server containing the application authorization token.

[0153] It can be seen that the above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the embodiment of the present application provides hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0154] In the embodiments of the present application, the functional modules of the authentication device can be divided according to the above-mentioned method examples. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. Optionally, the division of modules in the embodiments of the present application is schematic and is only a logical functional division. In actual implementation, other division methods may be used.

[0155] In some embodiments, the present application further provides a terminal device 500. The terminal device 500 may include one or more functional modules for implementing the authentication method of the above method embodiment.

[0156] Figure 5 This is a schematic diagram of the structure of a terminal device provided in an embodiment of the present application. Figure 5 As shown, the terminal device 500 includes: a transceiver module 501 and an encryption module 502.

[0157] The transceiver module 501 is used to send a first request, the first request is used to request to obtain the mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate the login application. For example, the transceiver module 501 is used to execute Figure 2 Step 201 in .

[0158] The transceiver module 501 is further configured to receive a second request from the application server, the second request being configured to request a unique identifier, the unique identifier being configured to indicate the terminal device. Figure 2Step 204 in .

[0159] The encryption module 502 is used to encrypt the unique identifier to obtain the first encrypted data, where the unique identifier includes IMSI and / or IMEI. Figure 2 Step 205 in .

[0160] The transceiver module 501 is further configured to send a first message, the first message including the first encrypted data. Figure 2 Step 206 in .

[0161] The transceiver module 501 is further configured to receive a second response from the application server, the second response including the mobile phone mask of the terminal device. Figure 2 Step 217 in .

[0162] In some embodiments, the present application further provides an application server 600. The application server 600 may include one or more functional modules for implementing the authentication method of the above method embodiment.

[0163] Figure 6 This is a schematic diagram of the structure of an application server provided in an embodiment of the present application. Figure 6 As shown, the application server 600 includes a transceiver module 601 and a processing module 602 .

[0164] The transceiver module 601 is used to receive a first request from a terminal device. For example, the transceiver module 601 is used to execute Figure 2 Step 202 in .

[0165] The transceiver module 601 is further configured to send a second request. For example, the transceiver module 601 is configured to execute Figure 2 Step 203 in .

[0166] The transceiver module 601 is further configured to receive a first message from a terminal device, the first message including first encrypted data, the first encrypted data being obtained by encrypting the unique identifier. Figure 2 Step 207 in .

[0167] The processing module 602 is used to encrypt the first message to obtain second encrypted data, where the second encrypted data includes data encrypted from the first encrypted data. Figure 2 Step 208 in .

[0168] The transceiver module 601 is further configured to send the second encrypted data. For example, the transceiver module 601 is configured to execute Figure 2 Step 209 in .

[0169] The transceiver module 601 is further configured to receive a first response from the authentication server, the first response including the mobile phone mask. Figure 2 Step 215 in .

[0170] The transceiver module 601 is further configured to send a second response, the second response including the mobile phone mask. Figure 2 Step 216 in .

[0171] In some embodiments, the present application further provides an authentication server 700. The authentication server 700 may include one or more functional modules for implementing the authentication method of the above method embodiment.

[0172] Figure 7 This is a schematic diagram of the structure of an authentication server provided in an embodiment of the present application. Figure 7 As shown, the authentication server 700 includes a transceiver module 701 and a decryption module 702 .

[0173] The transceiver module 701 is used to receive the second encrypted data from the application server, and the second encrypted data includes the data encrypted from the first encrypted data. Figure 2 Step 210 in .

[0174] The decryption module 702 is used to decrypt the second encrypted data to obtain the first encrypted data. For example, the decryption module 702 is used to execute Figure 2 Step 211 in .

[0175] The decryption module 702 is further configured to decrypt the first encrypted data to obtain a unique identifier, which is used to indicate the terminal device. Figure 2 Step 212 in .

[0176] The decryption module 702 is further used to generate a mobile phone mask according to the mobile phone number corresponding to the unique identifier. For example, the decryption module 702 is used to execute Figure 2 Step 213 in .

[0177] The transceiver module 701 is also used to send a first response, which includes a mobile phone mask, which is used to authenticate the login application. Figure 2 Step 214 in .

[0178] It should be understood that the terminal device 500, application server 600 and authentication server 700 of the embodiment of the present application are implemented by application-specific integrated circuit (ASIC) or programmable logic device (PLD), and the above PLD is a complex programmable logical device (CPLD), field programmable gate array (FPGA), generic array logic (GAL) or any combination thereof. Figure 2 In the method shown, the application server 600 and its various modules are also software modules.

[0179] The terminal device 500, the application server 600 and the authentication server 700 according to the embodiment of the present application may correspond to executing the method described in the embodiment of the present application, and the above and other operations and / or functions of each unit in the terminal device 500, the application server 600 and the authentication server 700 are respectively to implement Figure 2 For the sake of brevity, the corresponding processes of each method in are not repeated here.

[0180] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present invention provides a possible structural diagram of the computer device involved in the above-mentioned embodiment. Figure 8 As shown, the computer device 800 includes: a processor 802 , a communication interface 803 , and a bus 804 . Optionally, the computer device 800 may further include a memory 801 .

[0181] Processor 802 may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 802 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 802 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, or a combination of a DSP and a microprocessor.

[0182] In the present application, the processor 802 is configured to encrypt the unique identifier to obtain first encrypted data.

[0183] The communication interface 803 is used to connect to other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0184] In the present application, the communication interface 803 is further configured to receive a first message so that the processor 802 can encrypt the first message to obtain second encrypted data. The communication interface 803 is further configured to receive the second encrypted data so that the processor 802 can decrypt the second encrypted data to obtain the first encrypted data, decrypt the first encrypted data to obtain a unique identifier, and obtain a mobile phone mask corresponding to the unique identifier.

[0185] The memory 801 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0186] As a possible implementation, memory 801 may exist independently of processor 802. Memory 801 may be connected to processor 802 via bus 804 to store instructions or program codes. When processor 802 calls and executes the instructions or program codes stored in memory 801, the authentication method provided in this embodiment of the present invention can be implemented.

[0187] In another possible implementation, the memory 801 may also be integrated with the processor 802 .

[0188] The bus 804 may be an extended industry standard architecture (EISA) bus, etc. The bus 804 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0189] It should be understood that the computer device 800 according to this embodiment may correspond to the terminal device 500, the application server 600 or the authentication server 700 in this embodiment and corresponds to the computer device 800 that executes the authentication process according to the present embodiment. Figure 2The corresponding subject in any method, and the above and other operations and / or functions of each module in the terminal device 500, the application server 600 and the authentication server 700 are respectively to achieve Figure 2 For the sake of brevity, we will not go into details here.

[0190] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the authentication device can be divided into different functional modules to complete all or part of the functions described above.

[0191] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above-mentioned method embodiment can be completed by computer instructions to instruct the relevant hardware, and the program can be stored in the above-mentioned computer-readable storage medium. When the program is executed, it may include the processes of the above-mentioned method embodiments. The computer-readable storage medium can be the memory of any of the above-mentioned embodiments. The above-mentioned computer-readable storage medium can also be an external storage device of the above-mentioned service calling device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the above-mentioned service calling device. Furthermore, the above-mentioned computer-readable storage medium can also include both the internal storage unit of the above-mentioned service calling device and an external storage device. The above-mentioned computer-readable storage medium is used to store the above-mentioned computer program and other programs and data required by the above-mentioned service calling device. The above-mentioned computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0192] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program product runs on a computer, it enables the computer to execute any one of the authentication methods provided in the above embodiments.

[0193] The above are only specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. An authentication method, characterized in that: The method is applied to a terminal device, and the method includes: In response to the application login operation, a first request is sent, wherein the first request is used to request to obtain the mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate the login to the application; receiving a second request from the application server, where the second request is used to request a unique identifier, where the unique identifier is used to indicate the terminal device; Encrypting the unique identifier to obtain first encrypted data, wherein the unique identifier includes an International Mobile Subscriber Identity (IMSI) and / or an International Mobile Equipment Identity (IMEI); Sending a first message, where the first message includes the first encrypted data; A second response is received from the application server, where the second response includes the phone mask of the terminal device.

2. The method according to claim 1, characterized in that The step of encrypting the unique identifier to obtain first encrypted data includes: The unique identifier is encrypted based on an encryption key and a symmetric encryption algorithm to obtain the first encrypted data.

3. The method according to claim 2, characterized in that The first message also includes a first key identifier and the name of the symmetric encryption algorithm, where the first key identifier is used to indicate the encryption key.

4. The method according to claim 2 or 3, characterized in that The terminal device includes a SIM card, in which the encryption key is stored based on quantum key distribution technology.

5. An authentication method, characterized in that: The method is applied to an application server and includes: Receiving a first request from a terminal device, wherein the first request is used to request a mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate a login application; Sending a second request, where the second request is used to request to obtain a unique identifier, where the unique identifier is used to indicate the terminal device; receiving a first message from a terminal device, where the first message includes first encrypted data, where the first encrypted data is obtained by encrypting the unique identifier; encrypting the first message and sending second encrypted data, where the second encrypted data includes data encrypted from the first encrypted data; receiving a first response from an authentication server, wherein the first response includes the mobile phone mask; A second response is sent, wherein the second response includes the handset mask.

6. The method according to claim 5, characterized in that The first message further includes a first key identifier and a name of the symmetric encryption algorithm, where the first key identifier is used to indicate the encryption key; The encrypting the first message includes: The first encrypted data, the first key identifier, and the name of the symmetric encryption algorithm are encrypted to obtain the second encrypted data.

7. An authentication method, characterized in that: The method is applied to an authentication server and includes: receiving second encrypted data from the application server, wherein the second encrypted data includes data encrypted from the first encrypted data; decrypting the second encrypted data to obtain the first encrypted data; decrypting the first encrypted data to obtain a unique identifier, where the unique identifier is used to indicate the terminal device; A mobile phone mask is generated according to the mobile phone number corresponding to the unique identifier, and a first response is sent, where the first response includes the mobile phone mask, and the mobile phone mask is used to authenticate the login application.

8. The method according to claim 7, characterized in that Decrypting the second encrypted data includes: decrypting the second encrypted data to obtain the first key identifier and the name of the symmetric encryption algorithm; Decrypting the first encrypted data to obtain a unique identifier includes: The first encrypted data is decrypted based on the decryption key indicated by the first key identifier and the symmetric encryption algorithm to obtain the unique identifier.

9. The method according to claim 8, characterized in that The authentication server stores the decryption key based on quantum key distribution technology.

10. A terminal device, characterized in that: The terminal device includes: A transceiver module, configured to send a first request, wherein the first request is used to request to obtain a mobile phone mask of the terminal device, wherein the mobile phone mask is used to authenticate and log in to the application; The transceiver module is further configured to receive a second request from the application server, where the second request is used to request a unique identifier, where the unique identifier is used to indicate the terminal device; an encryption module, configured to encrypt the unique identifier to obtain first encrypted data, wherein the unique identifier includes an IMSI and / or an IMEI; The transceiver module is further configured to send a first message, where the first message includes the first encrypted data; The transceiver module is further configured to receive a second response from the application server, where the second response includes the mobile phone mask of the terminal device.

11. An application server, characterized in that: The application server includes: a transceiver module, configured to receive a first request from a terminal device, wherein the first request is used to request a mobile phone mask of the terminal device, and the mobile phone mask is used to authenticate a login application; The transceiver module is further configured to send a second request, where the second request is configured to request a unique identifier, where the unique identifier is configured to indicate the terminal device; The transceiver module is further configured to receive a first message from a terminal device, where the first message includes first encrypted data, where the first encrypted data is obtained by encrypting the unique identifier; a processing module, configured to encrypt the first message to obtain second encrypted data, where the second encrypted data includes data encrypted from the first encrypted data; The transceiver module is further configured to send second encrypted data; The transceiver module is further configured to receive a first response from the authentication server, wherein the first response includes the mobile phone mask; The transceiver module is further configured to send a second response, where the second response includes the mobile phone mask.

12. An authentication server, characterized in that: The authentication server includes: a transceiver module, configured to receive second encrypted data from the application server, wherein the second encrypted data includes data encrypted from the first encrypted data; a decryption module, configured to decrypt the second encrypted data to obtain the first encrypted data; The decryption module is further configured to decrypt the first encrypted data to obtain a unique identifier, wherein the unique identifier is used to indicate the terminal device; The decryption module is further configured to generate a mobile phone mask based on the mobile phone number corresponding to the unique identifier; The transceiver module is further configured to send a first response, where the first response includes the mobile phone mask, and the mobile phone mask is used to authenticate a login application.

13. A computer device, characterized in that: The method comprises a processor and a memory, wherein the processor is coupled to the memory; the memory is used to store computer instructions, and the computer instructions are loaded and executed by the processor to enable the computer device to implement the authentication method according to any one of claims 1 to 9.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium includes computer-executable instructions, and when the computer-executable instructions are executed on a computer, the computer is caused to execute the authentication method according to any one of claims 1 to 9.

15. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is run on a computer device, the computer device is caused to perform the authentication method according to any one of claims 1 to 9.

Images