Identity authentication method, device, equipment, storage medium and program product

Abstract

The application relates to the technical field of information security, and provides an identity authentication method, device, equipment, storage medium and program product, an identity authentication method applied to a server comprises the following steps: if it is determined that a user login state is a first state based on an authentication request sent by a client, determining an authentication key corresponding to the authentication request; wherein the authentication key is obtained based on a user password; performing decryption processing on the authentication request based on the authentication key to obtain authentication information; if it is determined that the authentication information passes initial authentication based on an authentication function, performing authentication processing on an authentication token in the authentication information to obtain an authentication result, and returning the authentication result to the client. The authentication key encrypts the authentication information, avoids secret information transmission in a channel, improves the security of authentication, and uses the authentication function for initial authentication in the authentication process; after the initial authentication passes, the authentication token is subjected to authentication processing, and the security of authentication is further improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, specifically to an identity authentication method, device, equipment, storage medium, and program product. Background Technology

[0002] JWT (JSON Web Token) is an open standard that defines a compact and secure way to securely transmit information between parties in the form of JSON (JavaScript Object Notation) objects, particularly suitable for single sign-on scenarios in distributed sites. Due to its lightweight, scalable, and secure nature, JWT is widely used in web applications and RESTful APIs and is one of the most popular cross-domain authentication solutions.

[0003] The JWT authentication protocol employs a stateless authentication method. Through token signature verification, the server does not need to store the user's session state or frequently query the database in subsequent requests to verify the user's identity. This reduces the server's need for session storage, lowers memory usage and storage pressure, and ensures that the token cannot be tampered with during transmission, thus improving system security. Furthermore, JWT is cross-domain and cross-platform, suitable for various clients. However, traditional authentication schemes transmit password information over the channel, posing a higher risk of interception by attackers, resulting in lower authentication security. Summary of the Invention

[0004] This application provides an identity authentication method, apparatus, device, storage medium, and program product to solve the technical problem of low security in authentication in the prior art.

[0005] In a first aspect, embodiments of this application provide an identity authentication method applied to a server, the method comprising:

[0006] If the user's login status is determined to be in the first state based on the authentication request sent by the client, the authentication key corresponding to the authentication request is determined; wherein, the authentication key is obtained based on the user's password;

[0007] The authentication request is decrypted based on the authentication key to obtain authentication information;

[0008] If the authentication information passes the initial authentication based on the authentication function, the authentication token in the authentication information is processed to obtain the authentication result, and the authentication result is returned to the client.

[0009] In one embodiment, the authentication process of the authentication token in the authentication information to obtain the authentication result includes:

[0010] Detect whether each piece of authentication data in the authentication token meets the authentication requirements corresponding to each piece of authentication data;

[0011] If it meets the requirements, calculate the authentication signature of the authentication token and verify whether the authentication signature meets the authentication requirements corresponding to the authentication signature.

[0012] If the authentication requirements corresponding to the authentication signature are met, the authentication result is determined to be successful.

[0013] In one embodiment, the authentication information further includes first random data and first time data; before the authentication token in the authentication information is authenticated based on the authentication function to obtain the authentication result, the method further includes:

[0014] Based on the first time data, it is determined whether the authentication information is within the authentication period in the authentication function;

[0015] If the authentication information is detected to be within the authentication period, check whether the first random data exists in the random number sequence of the authentication function;

[0016] If it is detected that the first random data does not exist in the random number sequence, it is determined that the authentication information has passed the initial authentication, and the first random data is added to the random number sequence.

[0017] In one embodiment, the method further includes:

[0018] Periodically clean up the first random data in the random number sequence that has been stored for longer than the authentication period.

[0019] In one embodiment, before determining the authentication key corresponding to the authentication request if the user's login state is determined to be in the first state based on the authentication request sent by the client, the method further includes:

[0020] If the user's login status is determined to be in the first state based on the received login request, the login request is decrypted based on the authentication key to obtain the login application information;

[0021] If the login application information is determined to pass the initial authentication based on the authentication function, authenticated login information is generated; wherein, the authenticated login information includes an authentication token;

[0022] The authentication login information is encrypted using the authentication key, and the encrypted authentication login information is sent to the client.

[0023] Secondly, embodiments of this application provide an identity authentication method applied to a client, the method comprising:

[0024] Authentication information is generated and encrypted using an authentication key; wherein the authentication key is obtained based on the user's password.

[0025] The username and the encrypted authentication information are sent to the server as an authentication request for authentication.

[0026] In one embodiment, before generating authentication information and encrypting the authentication information using an authentication key, the method further includes:

[0027] Obtain login application information and encrypt the login application information based on the authentication key;

[0028] The username and the encrypted login application information are sent to the server as a login request.

[0029] In one embodiment, the method further includes:

[0030] If authentication login information is received, the authentication login information is decrypted using the authentication key to obtain the authentication token, confirmation data, and second time data;

[0031] Time verification is performed based on the second time data;

[0032] If the time verification passes, generate confirmation verification data and verify whether the confirmation verification data and the confirmation data match.

[0033] If a match is found, the authentication token is saved.

[0034] Thirdly, embodiments of this application provide an identity authentication device applied to a server, the device comprising:

[0035] The first determining module is configured to determine the authentication key corresponding to the authentication request if the user's login state is determined to be a first state based on the authentication request sent by the client; wherein the authentication key is obtained based on the user's password;

[0036] The first decryption processing module is used to decrypt the authentication request based on the authentication key to obtain authentication information;

[0037] The authentication processing module is used to perform authentication processing on the authentication token in the authentication information if the authentication information is determined to pass the initial authentication based on the authentication function, obtain the authentication result, and return the authentication result to the client.

[0038] Fourthly, embodiments of this application provide an identity authentication device applied to a client, the device comprising:

[0039] The first encryption processing module is used to generate authentication information and encrypt the authentication information using an authentication key; wherein the authentication key is obtained based on the user's password.

[0040] The first sending module is configured to send the username and the encrypted authentication information as an authentication request to the server for authentication.

[0041] Fifthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the authentication methods described above.

[0042] Sixthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the authentication method as described above.

[0043] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements any of the authentication methods described above.

[0044] The authentication method, apparatus, device, storage medium, and program products provided in this application generate an authentication key based on the user's password and use it as a shared key to encrypt authentication information. Only when the user's entered password is correct can the system decrypt the information to obtain correct authentication information such as time data and random data, and simultaneously obtain an authentication token. Furthermore, because the authentication information is encrypted using the authentication key, even if an attacker intercepts the encrypted authentication information, they cannot directly obtain valid authentication information. The authentication scheme provided in this application not only achieves identity authentication but also ensures that confidential information such as the user's password (or the hash value of the user's password) is not transmitted over the channel, greatly improving authentication security. Moreover, the authentication process uses an authentication function for initial authentication; after successful initial authentication, the authentication token is then further authenticated, further enhancing authentication security. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1This is a flowchart illustrating the authentication method for servers provided in this application.

[0047] Figure 2 This is a flowchart illustrating the client-side authentication method provided in this application.

[0048] Figure 3 This is a schematic diagram of the identity authentication device applied to a server provided in this application.

[0049] Figure 4 This is a schematic diagram of the identity authentication device applied to the client provided in this application.

[0050] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] Traditional authentication methods, including those using the JWT standard protocol, involve the user entering their username and password on the client side. The client then transmits these two information (or their hash) to the server. The server receives the information and compares it to its database. If they match, authentication is successful. However, this authentication process transmits password information over a transmission channel, which, regardless of encryption, carries a high risk of interception by attackers. Analysis of this data can lead to password cracking, making this method of authentication—transmitting the user's password (or its hash)—insecure. Therefore, this application provides an authentication method, apparatus, device, storage medium, and program product to address these issues.

[0053] Figure 1 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 1 As shown in an exemplary embodiment, this authentication method is applied to a server and includes steps 110 to 130, which are described in detail below.

[0054] Step 110: If the user's login status is determined to be the first state based on the authentication request sent by the client, determine the authentication key corresponding to the authentication request; wherein the authentication key is obtained based on the user's password.

[0055] In this embodiment of the application, the server stores user information. A unique identifier and authentication key; the unique identifier is the username used when logging in. The authentication key is based on the login password. Received. User configuration is also available. Access permissions (Includes role and permission information), and generates user accounts. The signature verification key of the authentication token. .

[0056] When the server receives an authentication request sent by the client { , After that, the system first checks if the user's login status is in the first state, i.e., the active state. If the user's login status is not in the first state, the system returns the current user login status to the client. If the user's login status is in the first state, the system determines the corresponding authentication key based on the username. The user login status also includes a second state, i.e., the inactive state.

[0057] Step 120: Decrypt the authentication request based on the authentication key to obtain authentication information.

[0058] In this embodiment of the application, the authentication request is decrypted using the authentication key, that is, the authentication information is decrypted. The authentication information includes an authentication token, first random data, and first time data. The first random data is a random number generated by the client when generating the authentication request, and the first time data is the time when the client sends the authentication request.

[0059] Step 130: If the authentication information passes the initial authentication based on the authentication function, the authentication token in the authentication information is authenticated to obtain the authentication result, and the authentication result is returned to the client.

[0060] In this embodiment of the application, an authentication function is introduced to prevent the server from being subjected to replay attacks. ,in For message sending time, For message arrival time, The authentication period represents the effective transmission delay time interval, which can be set as the system's minimum delay. The random number received by the server from the client. This is a random number sequence generated by the server. The authentication function performs initial authentication on the authentication information. After successful initial authentication, the authentication token is processed to obtain the corresponding authentication result, which is then returned to the client.

[0061] The authentication scheme provided in this application avoids directly transmitting user passwords (or their hash values) over the channel. Instead, it generates an authentication key based on the user password and uses this key as a shared key to encrypt time data, random data, authentication tokens, and other information. If the user enters a correct password, the system can decrypt the password to obtain the correct time data, random data, and authentication token. Otherwise, if an incorrect password is entered, the authentication information cannot be decrypted, resulting in the inability to obtain an authentication token and access, thus leading to authentication failure. Furthermore, because the authentication information is encrypted using the authentication key, even if an attacker intercepts the encrypted authentication information, they cannot directly obtain valid authentication data. The authentication scheme provided in this application achieves both identity authentication and ensures that confidential information such as user passwords (or their hash values) is not transmitted over the channel, significantly improving authentication security.

[0062] The authentication scheme provided in this solution uses an authentication function during the authentication process. By comparing the authentication period and the status of the sent random data, it can be determined whether the message has been replayed, even if an attacker intercepts authentication-related information (such as...). , , (etc.), and will not be able to initiate a retransmission, nor will it pass the authentication scheme based on authentication period and random data, thus preventing retransmission attacks and improving authentication security.

[0063] In an exemplary embodiment of this application, before determining the authentication key corresponding to the authentication request if the user's login status is determined to be a first state based on the authentication request sent by the client, the method further includes:

[0064] If the user's login status is determined to be the first state based on the received login request, the login request is decrypted based on the authentication key to obtain the login application information;

[0065] If the login application information is determined to pass the initial authentication based on the authentication function, authenticated login information is generated; wherein, the authenticated login information includes an authentication token;

[0066] The authentication login information is encrypted using the authentication key, and the encrypted authentication login information is sent to the client.

[0067] In this embodiment of the application, when the user does not have an authentication token, the user on the client... Enter username and user password Upon submitting the login request, the client generates a login request and sends it to the server. The server receives the login request. , After that, first check if the user's login status is in the first state. If it is not in the first state, return the current user login status to the client. If it is in the first state, then use the username to... Determine the corresponding authentication key, and then use the authentication key to decrypt the login application information. Obtain third-time data Second random data Third time data The time when the client sends the login request, the second random data This is a random number generated by the client when creating the login request. Then, the authentication function is called. The authentication function first calculates Is it less than or equal to? This involves calculating whether the time interval between the arrival time of the login request and the third-party time data is less than or equal to the authentication period. If the time interval is greater than the authentication period, it returns false; otherwise, the server returns a random number sequence. Search Does it exist within a time period? (i.e., the second random data) If it exists, return false, indicating verification failure; if it does not exist, return true, indicating initial authentication passed.

[0068] During the initial authentication process, if the response is false, the session ends. Otherwise, the server will send a second set of random data. Write a random number sequence Then the server generates authentication login information, which includes authentication token, confirmation data, and second time data.

[0069] Specifically, use signature verification keys. The symmetric encryption key, such as HS256, is the hash value of the user's password. Taking the authentication key as an example, fill in the Header and Payload information of the authentication token, as shown below:

[0070] ;

[0071]

[0072] / / Encrypted using HS256, the encrypted result is a fixed-length character string with signature functionality;

[0073] ;

[0074] ;

[0075] ;

[0076] ;

[0077] in, K represents the symmetric encryption function (SM4 algorithm), and K represents the key. Indicates plaintext, that is Represents the signature verification key for user i; || represents a cascade operation; This represents a secure one-way hash function.

[0078] Based on the principles of JWT, a token is a token / ticket for a user's location resources, and must include three parts: Header, Payload, and Signature (as shown above). The Signature is a hashed encryption of the Header and Payload, providing signature verification functionality. The server then encrypts it using an authentication key. , , Receive encrypted authentication login information , This indicates confirmation data, used by the client. Confirmation of information on the server side This is the second time data, indicating the time when the authentication login information was sent. The server will send the authentication login information... Returned to the client.

[0079] In an exemplary embodiment of this application, the step of authenticating the authentication token in the authentication information to obtain an authentication result includes:

[0080] Detect whether each piece of authentication data in the authentication token meets the authentication requirements corresponding to each piece of authentication data;

[0081] If it meets the requirements, calculate the authentication signature of the authentication token and verify whether the authentication signature meets the authentication requirements corresponding to the authentication signature.

[0082] If the authentication requirements corresponding to the authentication signature are met, the authentication result is determined to be successful.

[0083] In this embodiment of the application, after the initial authentication is passed, each item is judged sequentially. Whether the various certification data meet the certification requirements, especially judging the... and Are they equal? ​​Is the current time within the range of...? and Between, roles and permissions Is the value the same as If the authentication fails, the system will ensure consistency with the user's credentials. If a mismatch occurs, the user will be informed of the specific reason for the authentication failure and asked to log in again to obtain a new authentication token. If all the above information is verified, the server will calculate the authentication signature of the authentication token.

[0084] ;

[0085] Compare The system checks if the request matches the authentication result. If not, the conversation ends. If the request matches, authentication is successful, and the client can access the relevant resources and obtain the required information.

[0086] In the authentication scheme provided in this application, the server receives a client's... Authentication token sent After that, proceed The verification will be performed if the ID information is incorrect or the current time is not within the validity period. and Between), account status, role and permissions If the authentication token is inconsistent with the system, the user will be directly informed of the error message and prompted to log in again to obtain a new authentication token (based on the new system). (Issuance is performed). Instead of mechanically verifying authentication tokens, as long as the authentication token is correctly verified, the user can access the relevant resources. Although the server does not store authentication token information, it still objectively invalidates the authentication token by verifying key information.

[0087] In an exemplary embodiment of this application, the authentication information further includes first random data and first time data; before the step of performing authentication processing on the authentication token in the authentication information to obtain the authentication result if it is determined based on the authentication function that the authentication information has passed the initial authentication, the method further includes:

[0088] Based on the first time data, it is determined whether the authentication information is within the authentication period in the authentication function;

[0089] If the authentication information is detected to be within the authentication period, check whether the first random data exists in the random number sequence of the authentication function;

[0090] If the first random data is detected not to exist in the random number sequence, the authentication information is determined to have passed the initial authentication, and the first random data is added to the random number sequence.

[0091] In this embodiment of the application, the first random data is obtained. and first-time data Then, call the authentication function. The authentication function first calculates Is it less than or equal to? This involves calculating whether the time interval between the arrival time of the authentication request and the first piece of data is less than or equal to the authentication period. If the time interval is greater than the authentication period, it returns false; otherwise, the server returns false using a random number sequence. Search Does it exist within a time period? (i.e., the first random data) If the condition exists, return false, indicating verification failure; if it does not exist, return true, indicating successful initial authentication. During the initial authentication process, if false is returned, the session ends. Otherwise, the server will send the first random data. Write a random number sequence middle.

[0092] In one exemplary embodiment of this application, the identity authentication method further includes:

[0093] Periodically clean up the first random data in the random number sequence that has been stored for longer than the authentication period.

[0094] In this embodiment of the application, random data that has been stored in the random number sequence for longer than the authentication period is periodically cleared to save resources and reduce the amount of computation required to match the random number sequence with the received random data.

[0095] Figure 2 This is a flowchart illustrating an identity authentication method according to an exemplary embodiment. Figure 2 As shown in an exemplary embodiment, this authentication method is applied to a client and includes steps 210 to 220, which are described in detail below.

[0096] Step 210: Generate authentication information and encrypt the authentication information using an authentication key; wherein the authentication key is obtained based on the user's password.

[0097] In this embodiment of the application, if the user If you have previously logged in using a username and password, you will not need to log in again using the username and password to access server resources. Instead, you can log in through the client. Send an authentication request to the server to authenticate and obtain access to the relevant resources.

[0098] Specifically, obtain the authentication key generated based on the user's password. Determine the time when the authentication request is sent, i.e., the first-time data. And generate random numbers, i.e., the first random data. Simultaneously, it retrieves the authentication token stored on the client. The authentication token, the first-time data, and the first random data are used as authentication information, which is then encrypted using the authentication key.

[0099] Taking the hash value of the user's password as the authentication key as an example, the client... The authentication information is encrypted and represented as follows: .

[0100] Step 220: Send the username and the encrypted authentication information as an authentication request to the server for authentication.

[0101] In this embodiment of the application, the username and encrypted authentication information are used as the authentication request. , Send it to the server.

[0102] In this embodiment, to avoid transmitting user passwords and keys over the channel, the authentication key is used as a session key to encrypt authentication information, thus preventing user passwords and keys from being transmitted over the network and reducing the risk of them being stolen. The server performs identity authentication based on the received authentication request. The specific authentication scheme of the server has been described previously and will not be repeated here.

[0103] Compared to standard JWT or other related protocols, the authentication scheme provided in this application offers advantages on the client side. When sending an authentication request to the server, the authentication information is encrypted using the shared key of both parties before being sent to the server. Since the authentication information is encrypted with the authentication key, even if an attacker intercepts the authentication request, they cannot directly obtain the real authentication information. This improves the security of authentication information transmission and indirectly reduces the possibility of retransmission and spoofing attacks using the authentication token.

[0104] In an exemplary embodiment of this application, before generating authentication information and encrypting the authentication information using an authentication key, the method further includes:

[0105] Obtain login application information and encrypt the login application information based on the authentication key;

[0106] The username and the encrypted login application information are sent to the server as a login request.

[0107] In this embodiment of the application, when the user does not have an authentication token, on the client... Enter username and user password Submit login, client Based on user password Calculate authentication keys, such as calculating user passwords. hash value The hash value is used as the authentication key.

[0108] Determine the time when the login request was sent, i.e., third-time data. And generate random numbers, i.e., the second random data. , will third time data Second random data As login application information, the login application information is encrypted using an authentication key, and can be represented as follows:

[0109] .

[0110] Then, the username and the encrypted login request information are used as the login request. , The client then sends a login request to the server. The server generates authentication login information based on the request and returns it to the client. The specific method for generating this authentication login information has been explained previously and will not be repeated here.

[0111] In one exemplary embodiment of this application, the identity authentication method further includes:

[0112] If authentication login information is received, the authentication login information is decrypted using the authentication key to obtain the authentication token, confirmation data, and second time data;

[0113] Time verification is performed based on the second time data;

[0114] If the time verification passes, generate confirmation verification data and verify whether the confirmation verification data and the confirmation data match.

[0115] If a match is found, the authentication token is saved.

[0116] In this embodiment of the application, the client Received authentication login information Then, use the authentication key to decrypt the authentication login information. Receive confirmation data Authentication token Second time data Utilizing the arrival time of authentication login information ,calculate Is it less than or equal to? This involves calculating whether the time interval between the arrival time of the authentication login information and the second time data is less than or equal to the authentication period. If not, the conversation ends, and the user is prompted that the password may be incorrect and asked to re-enter their password to log in. If the time verification passes, the calculation... ,judge and Check if they are equal; if they are equal, prompt the user. Login successful. The client saves the authentication token. .

[0117] In the authentication scheme provided in this application, all messages transmitted, except for the username, are encrypted using an authentication key. Even if an attacker intercepts the message, they cannot obtain the plaintext information. Furthermore, the authentication function... The use of [this technology] can resist spoofing attacks by attackers.

[0118] The authentication scheme provided in this application does not store any authentication token information on the server, thus maintaining the lightweight nature of authentication and aligning with the original intention of JWT's lightweight approach.

[0119] The identity authentication device provided in this application is described below. The identity authentication device described below can be referred to in correspondence with the identity authentication method described above. It should be noted that the device provided in the following embodiments belongs to the same concept as the method provided in the above embodiments, and the specific way in which each module and unit performs its operation has been described in detail in the method embodiments, and will not be repeated here.

[0120] In one exemplary embodiment of this application, please refer to Figure 3 , Figure 3 An identity authentication device for a server, as illustrated in an exemplary embodiment, includes the following modules:

[0121] The first determining module 310 is configured to determine the authentication key corresponding to the authentication request if the user's login state is determined to be a first state based on the authentication request sent by the client; wherein the authentication key is obtained based on the user's password;

[0122] The first decryption processing module 320 is used to decrypt the authentication request based on the authentication key to obtain authentication information;

[0123] The authentication processing module 330 is used to perform authentication processing on the authentication token in the authentication information if the authentication information is determined to pass the initial authentication based on the authentication function, to obtain the authentication result, and to return the authentication result to the client.

[0124] In one exemplary embodiment of this application, the authentication processing module 330 includes:

[0125] The detection submodule is used to detect whether each piece of authentication data in the authentication token meets the authentication requirements corresponding to each piece of authentication data.

[0126] The calculation submodule is used to calculate the authentication signature of the authentication token if the conditions are met, and to verify whether the authentication signature meets the authentication requirements corresponding to the authentication signature.

[0127] The determination submodule is used to determine that the authentication result is successful if the authentication requirements corresponding to the authentication signature are met.

[0128] In one exemplary embodiment of this application, the authentication information further includes first random data and first time data; the identity authentication device further includes:

[0129] The first detection module is used to detect, based on the first time data, whether the authentication information is within the authentication period in the authentication function;

[0130] The second detection module is used to detect whether the first random data exists in the random number sequence of the authentication function if the authentication information is detected to be within the authentication period.

[0131] If the first random data is detected not to exist in the random number sequence, the authentication information is determined to have passed the initial authentication, and the first random data is added to the random number sequence.

[0132] In one exemplary embodiment of this application, the identity authentication device further includes:

[0133] The cleaning module is used to periodically clean up the first random data in the random number sequence that has been stored for longer than the authentication period.

[0134] In one exemplary embodiment of this application, the identity authentication device further includes:

[0135] The second decryption processing module is used to decrypt the login request based on the authentication key if the user's login status is determined to be the first status based on the received login request, thereby obtaining login application information.

[0136] A generation module is used to generate authenticated login information if the login application information is determined to pass the initial authentication based on the authentication function; wherein the authenticated login information includes an authentication token;

[0137] The second encryption processing module is used to encrypt the authentication login information using the authentication key and send the encrypted authentication login information to the client.

[0138] In one exemplary embodiment of this application, please refer to Figure 4 , Figure 4 An identity authentication device for a client, as illustrated in an exemplary embodiment, includes the following modules:

[0139] The first encryption processing module 410 is used to generate authentication information and encrypt the authentication information using an authentication key; wherein the authentication key is obtained based on the user password.

[0140] The first sending module 420 is configured to send the username and the encrypted authentication information as an authentication request to the server for authentication.

[0141] In one exemplary embodiment of this application, the identity authentication device further includes:

[0142] The third encryption processing module is used to obtain login application information and encrypt the login application information based on the authentication key;

[0143] The second sending module is used to send the username and the encrypted login application information as a login request to the server.

[0144] In one exemplary embodiment of this application, the identity authentication device further includes:

[0145] The third decryption processing module is used to decrypt the authentication login information using the authentication key if authentication login information is received, to obtain authentication token, confirmation data and second time data;

[0146] The time verification module is used to perform time verification based on the second time data;

[0147] The verification module is used to generate confirmation verification data if the time verification passes, and to verify whether the confirmation verification data and the confirmation data match.

[0148] A storage module is used to save the authentication token if a match is found.

[0149] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute an authentication method applied to the server and an authentication method applied to the client. The authentication method applied to the server includes: if the user's login state is determined to be a first state based on the authentication request sent by the client, determining the authentication key corresponding to the authentication request; wherein the authentication key is obtained based on the user's password.

[0150] The authentication request is decrypted based on the authentication key to obtain authentication information;

[0151] If the authentication information passes the initial authentication based on the authentication function, the authentication token in the authentication information is processed to obtain the authentication result, and the authentication result is returned to the client.

[0152] Authentication methods applied to clients include:

[0153] Authentication information is generated and encrypted using an authentication key; wherein the authentication key is obtained based on the user's password.

[0154] The username and the encrypted authentication information are sent to the server as an authentication request for authentication.

[0155] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0156] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the authentication method for the server and the authentication method for the client provided by the above methods. The authentication method for the server includes: if the user's login state is determined to be a first state based on the authentication request sent by the client, determining the authentication key corresponding to the authentication request; wherein the authentication key is obtained based on the user's password.

[0157] The authentication request is decrypted based on the authentication key to obtain authentication information;

[0158] If the authentication information passes the initial authentication based on the authentication function, the authentication token in the authentication information is processed to obtain the authentication result, and the authentication result is returned to the client.

[0159] Authentication methods applied to clients include:

[0160] Authentication information is generated and encrypted using an authentication key; wherein the authentication key is obtained based on the user's password.

[0161] The username and the encrypted authentication information are sent to the server as an authentication request for authentication.

[0162] In another aspect, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the authentication method for a server and the authentication method for a client provided by the above methods. The authentication method for a server includes: if the user's login state is determined to be a first state based on the authentication request sent by the client, determining the authentication key corresponding to the authentication request; wherein the authentication key is obtained based on the user's password.

[0163] The authentication request is decrypted based on the authentication key to obtain authentication information;

[0164] If the authentication information passes the initial authentication based on the authentication function, the authentication token in the authentication information is processed to obtain the authentication result, and the authentication result is returned to the client.

[0165] Authentication methods applied to clients include:

[0166] Authentication information is generated and encrypted using an authentication key; wherein the authentication key is obtained based on the user's password.

[0167] The username and the encrypted authentication information are sent to the server as an authentication request for authentication.

[0168] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0169] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0170] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0171] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An identity authentication method, characterized in that, Applied to a server, the method includes: If the user's login status is determined to be in the first state based on the authentication request sent by the client, the authentication key corresponding to the authentication request is determined; wherein, the authentication key is obtained based on the user's password; The authentication request is decrypted based on the authentication key to obtain authentication information; wherein, the authentication information is generated by the client. If the authentication information passes the initial authentication based on the authentication function, the authentication token in the authentication information is processed to obtain the authentication result, and the authentication result is returned to the client. The authentication information further includes first random data and first time data; before the authentication token in the authentication information is processed for authentication based on the authentication function to obtain the authentication result, the method further includes: Based on the first time data, it is determined whether the authentication information is within the authentication period in the authentication function; If the authentication information is detected to be within the authentication period, check whether the first random data exists in the random number sequence of the authentication function; If it is detected that the first random data does not exist in the random number sequence, it is determined that the authentication information has passed the initial authentication, and the first random data is added to the random number sequence; The authentication process of the authentication token in the authentication information to obtain the authentication result includes: Detect whether each piece of authentication data in the authentication token meets the authentication requirements corresponding to each piece of authentication data; If it meets the requirements, calculate the authentication signature of the authentication token and verify whether the authentication signature meets the authentication requirements corresponding to the authentication signature. If the authentication requirements corresponding to the authentication signature are met, the authentication result is determined to be successful.

2. The identity authentication method according to claim 1, characterized in that, The method further includes: Periodically clean up the first random data in the random number sequence that has been stored for longer than the authentication period.

3. The identity authentication method according to any one of claims 1 to 2, characterized in that, If the user's login status is determined to be in the first state based on the authentication request sent by the client, before determining the authentication key corresponding to the authentication request, the method further includes: If the user's login status is determined to be the first state based on the received login request, the login request is decrypted based on the authentication key to obtain the login application information; If the login application information is determined to pass the initial authentication based on the authentication function, authenticated login information is generated; wherein, the authenticated login information includes an authentication token; The authentication login information is encrypted using the authentication key, and the encrypted authentication login information is sent to the client.

4. An identity authentication method, characterized in that, Applied to a client, the method includes: Authentication information is generated based on the authentication token, first-time data, and first-random data, and the authentication information is encrypted using an authentication key; wherein, the authentication key is obtained based on the user's password; The username and the encrypted authentication information are sent to the server as an authentication request for authentication, so that the server implements the identity authentication method according to any one of claims 1 to 3.

5. The identity authentication method according to claim 4, characterized in that, Before generating authentication information and encrypting the authentication information using an authentication key, the method further includes: Obtain login application information and encrypt the login application information based on the authentication key; The username and the encrypted login application information are sent to the server as a login request.

6. The identity authentication method according to claim 4, characterized in that, The method further includes: If authentication login information is received, the authentication login information is decrypted using the authentication key to obtain the authentication token, confirmation data, and second time data; Time verification is performed based on the second time data; If the time verification passes, generate confirmation verification data and verify whether the confirmation verification data and the confirmation data match. If a match is found, the authentication token is saved.

7. An identity authentication device, characterized in that, Applied to a server, the device includes: The first determining module is configured to determine the authentication key corresponding to the authentication request if the user's login state is determined to be a first state based on the authentication request sent by the client; wherein the authentication key is obtained based on the user's password; The first decryption processing module is used to decrypt the authentication request based on the authentication key to obtain authentication information; wherein the authentication information is generated by the client. The authentication processing module is used to perform authentication processing on the authentication token in the authentication information if the authentication information is determined to pass the initial authentication based on the authentication function, obtain the authentication result, and return the authentication result to the client; The authentication information further includes first random data and first time data; the identity authentication device further includes: The first detection module is used to detect, based on the first time data, whether the authentication information is within the authentication period in the authentication function; The second detection module is used to detect whether the first random data exists in the random number sequence of the authentication function if the authentication information is detected to be within the authentication period. If it is detected that the first random data does not exist in the random number sequence, it is determined that the authentication information has passed the initial authentication, and the first random data is added to the random number sequence; The authentication processing module includes: The detection submodule is used to detect whether each piece of authentication data in the authentication token meets the authentication requirements corresponding to each piece of authentication data. The calculation submodule is used to calculate the authentication signature of the authentication token if the conditions are met, and to verify whether the authentication signature meets the authentication requirements corresponding to the authentication signature. The determination submodule is used to determine that the authentication result is successful if the authentication requirements corresponding to the authentication signature are met.

8. An identity authentication device, characterized in that, Applied to a client, the device includes: The first encryption processing module is used to generate authentication information based on the authentication token, first time data, and first random data, and to encrypt the authentication information using an authentication key; wherein the authentication key is obtained based on the user password. The first sending module is configured to send the username and the encrypted authentication information as an authentication request to the server for authentication, so that the server implements the identity authentication method according to any one of claims 1 to 3.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the authentication method as described in any one of claims 1 to 6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the authentication method as described in any one of claims 1 to 6.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the authentication method as described in any one of claims 1 to 6.

Images