Account mangaement method and registration and authentication methods thereof

Abstract

An account management method includes the following operations: a first user application searches for first user device information and transmits the first user device information to a server application; the server application generates first user identity information containing the first user device information and generates a first user account in a database based on the first user identity information; in response to an authentication request from a second user application, the server application provides the first user identity information for zero-knowledge proof; in response to performing the zero-knowledge proof, the second user application searches for second user device information and generates second user identity information containing the second user device information; if the first user identity information and the second user identity information are the same, it is determined that the zero-knowledge proof has passed; and at least based on the zero-knowledge proof, it is determined whether the second user application is allowed to receive at least one service from the server application through the first user account.

Description

[Technical Field]

[0001] This disclosure relates to an account management method and its registration and authentication method, and in particular to a passwordless account management method and its registration and authentication method. [Previous Technology]

[0002] In this internet age, using mobile apps or web apps to access services such as online shopping, online bank transfers, online mobile payments, and stock trading has become an integral part of almost everyone's daily life.

[0003] However, due to information security considerations, while enjoying the convenience of these services, users must register and authenticate to set a password and use it as a layer of protection for information access when using the services in the future. However, the practice of using passwords to enhance information security also causes some inconvenience to users, such as the need to remember passwords, and if multiple systems use the same password, it will lead to credential stuffing attacks. In addition, the transmission of passwords over the network during authentication is itself an information security vulnerability.

[0004] Therefore, a passwordless account management method is needed to avoid the above problems. Although passwordless login is currently possible through Open ID, using Open ID still requires registering on the website that provides the Open ID identity and setting a password. It is not a truly passwordless account management method. Therefore, this disclosure aims to provide a passwordless account management method. [Summary of the Invention]

[0005] This disclosure provides an account management method. The account management method includes the following operations: a first user application searches for first user device information and transmits the first user device information to a server application; the server application generates first user identity information containing the first user device information, and generates a first user account corresponding to the first user application in a database based on the first user identity information; a second user application transmits an authentication request to the server application; in response to the authentication request, the server application provides the first user identity information for zero-knowledge proof; in response to performing zero-knowledge proof, the second user application searches for second user device information and generates second user identity information containing the second user device information; through zero-knowledge proof, the first user identity information and the second user identity information are compared, and if the first user identity information and the second user identity information are the same, it is determined that the zero-knowledge proof has passed; and at least based on the zero-knowledge proof, it is determined whether the second user application is allowed to receive at least one service from the server application through the first user account.

[0006] This disclosure provides a registration method. The registration method includes the following operations: after the user application passes the authorization verification related to the server application's service, the server application sends random information to the user application; the user application searches for user device information and sends the user device information to the server application; and the server application combines the user device information and the random information to form user identity information, and generates a user account corresponding to the user application based on the user identity information.

[0007] This disclosure provides an authentication method. The authentication method includes the following operations: a server application provides first user identity information for zero-knowledge proof; in response to performing zero-knowledge proof, a user application searches for at least second user device information; through zero-knowledge proof, the first user identity information is compared with the second user identity information, and if the first user identity information and the second user identity information are the same, it is determined that the zero-knowledge proof has passed; and at least based on the zero-knowledge proof, it is determined whether to allow the user application to receive at least one service from the server application through a specific user account.

Implementation Method

[0009] The following disclosure provides numerous different embodiments or examples for implementing various features of this disclosure. Elements and configurations in the specific examples are used in the following discussion to simplify this disclosure. Any examples discussed are for illustrative purposes only and do not in any way limit the scope or meaning of this disclosure or its examples. Where appropriate, the same reference numerals are used between figures and in corresponding text descriptions to represent the same or similar elements.

[0010] The terms 'include', 'include', 'have', 'contain', etc. used in this document are all open-ended terms, meaning that they include but are not limited to.

[0011] The terms used herein, unless otherwise specified, generally have their ordinary meaning in the context of the art, the subject matter, and the specific content. Certain terms used to describe the subject matter will be discussed below or elsewhere in this specification to provide additional guidance to those skilled in the art in describing the subject matter.

[0012] Please refer to Figure 1. Figure 1 is a flowchart of an account management method 100 according to some embodiments of the present disclosure. As shown in Figure 1, the account management method 100 includes a registration method 200 and an authentication method 400. In other words, in the account management method 100, the registration method 200 first generates user accounts for using services such as online shopping, online banking transfers, mobile payments, and online stock trading, and then the authentication method 400 ensures that the services are accessed through the registered accounts. The specific implementation of the registration method 200 and the authentication method 400 will be described in detail in the following paragraphs.

[0013] Please refer to Figures 2 and 3 together. Figures 2 and 3 are flowcharts and schematic diagrams, respectively, of a registration method 200 according to some embodiments of the present disclosure. The registration method 200 shown in Figure 2 includes operations 210, 220, 230, 240, and 250. However, the operations of the registration method 200 are not necessarily performed in the order shown in Figure 2. In other words, within the scope of the various embodiments of the present disclosure, operations can be appropriately added, replaced, rearranged, and / or deleted.

[0014] Furthermore, as shown in Figure 3, the registration method 200 can be implemented through, but is not limited to, the user device CD1 and the server device SD. The user device CD1 includes the user application CA1 and the database CDB1, while the server device SD includes the server application SA and the database SDB.

[0015] For example, the user device CD1 can be an electronic device such as a mobile phone or a personal computer, while the server device SD can be an electronic device such as a bank host or a web server. Specifically, the user application CA1 and the database CDB1 are stored in at least one storage unit of the user device CD1, such as memory or a hard drive. The server application SA and the database SDB are stored in at least one storage unit of the server device SD, such as memory or a hard drive. More specifically, the user application CA1 can be run by the processor in the user device CD1 and the processor in the server device SD respectively to perform the registration method 200.

[0016] In operation 210, the user application CA1 in the user device CD1 transmits the registration request 310 to the server application SA in the server device SD.

[0017] In some embodiments, after the server application SA receives the registration request 310, the server application SA sends a request to the user application CA1 requesting basic user information such as ID card number, registered address, date of birth, occupation, and contact information. In some embodiments, in response to the above request from the server application SA, the user application CA1 returns the basic user information to the server application SA.

[0018] In operation 220, the server application SA uses multi-factor authentication (MFA) to determine whether to provide services to the user application CA1 and to authenticate the user application. MFA refers to obtaining authorization through authentication mechanisms other than reviewing basic information in order to improve security.

[0019] Specifically, in some embodiments, the server application SA performs MFA based on contact information such as email address and mobile phone number provided by the user application CA1 in operation 210.

[0020] For example, server application SA sends a verification email containing a verification URL to the email address provided by user application CA1. The user then enters and clicks the verification URL, and user application CA1 completes the verification. As another example, server application SA sends a verification SMS containing a verification code to the mobile phone number provided by user application CA1. The user then enters the verification code into user application CA1, and user application CA1 completes the verification.

[0021] However, in some embodiments, where security requirements are lower, only basic information may be provided to complete the verification, thus omitting operation 220. In some embodiments, the server application SA is used to promote certain information and does not prioritize user identity and security, so operations 210 and 220 described above may be omitted.

[0022] In operation 230, after the user application CA1 passes the above-mentioned authorization verification, the server application SA transmits random information 330 to the user application CA1. In some embodiments, the user application CA1 further stores the random information 330 in the database CDB1.

[0023] In operation 240, the user application CA1 locates the user device information 340 and transmits the user device information 340 to the server application SA. In some embodiments, the user device information 340 includes constant device information 341 and current device information 342.

[0024] Constant device information 341 refers to information related to user device CD1 that does not change over time, such as the device ID (i.e., the identification code used to distinguish the device). However, some information related to user device CD1 is time-varying. For example, if user device CD1 is a mobile device such as a mobile phone, laptop, tablet, or in-vehicle computer, the location of user device CD1 will change over time. Current device information 342 refers to the information related to the time-varying state of user device CD1, which sets user application CA1, at the current time.

[0025] In some embodiments, the current user device information 340 is the current location x1 (not shown) of user device CD1. The current time is the time when user application CA1 finds the location information of user device CD1 from database CDB1. In some embodiments, the current location x1 is obtained by Global Positioning System (GPS).

[0026] In operation 250, the server application SA combines the user device information 340 with the random information 330 to form user identity information CID1, and generates a user account corresponding to the user application CA1 based on the user identity information CID1. The user account includes the user identity information CID1 and is stored in the database SDB.

[0027] In some embodiments, the user identity information CID1 does not need to include random information 330 to enhance security. Therefore, the operation of combining the user device information 340 with the random information 330 in operation 250 and the aforementioned operation 230 can be omitted. For example, when the service of the server application SA is open to user device CD1 in a specific area, only the current location x1 of user device CD1 can be used for registration to increase convenience. Conversely, in some embodiments, due to the need for high security, user identity information CID1 containing more information can be used for registration.

[0028] Please refer to Figures 4 and 5 together. Figures 4 and 5 are flowcharts and schematic diagrams of authentication method 400 according to some embodiments of the present disclosure. Authentication method 400 includes operations 410, 420, 430, 440, 451, and 452. However, the operations of authentication method 400 are not necessarily performed in the order shown in Figure 4. In other words, within the scope of the various embodiments of the present disclosure, operations can be appropriately added, replaced, changed in order, and / or deleted.

[0029] In step 410, as shown in Figure 5, the user application CA2, located on user device CD2, transmits the authentication request 510 to the server application SA. User device CD2 may be an electronic device that is the same as or different from user device CD1. However, the configuration of user device CD2 is similar to that of user device CD1; for example, user device CD2 includes a database CDB2 and the user application CA2.

[0030] In operation 420, the server application SA provides user identity information CID1 to perform zero-knowledge proof (ZKP proof) 530 related to whether or not the user application CA2 is allowed to receive services from the server application SA through a specific user account, wherein the specific user account is a user account generated based on the user identity information CID1.

[0031] In operation 430, in response to performing zero-knowledge proof 530, the user application CA2 searches for at least user device information 340-2 (not shown). In some embodiments, user device information 340-2 includes constant device information 341-2 (not shown) and current device information 342-2 (not shown), wherein constant device information 341-2 is searched by user application CA2 from database CDB2.

[0032] In some embodiments, the current device information 342-2 includes the current location x2 (not shown in the figure), which is located by the user application CA2 via GPS. The user device information 340-2 in the above embodiments is similar to the user device information 340 in operation 240 of the registration method 200, except that the user device information 340-2 is located by the user application CA2. The constant device information 341-2 in the above embodiments is similar to the constant device information 341 in operation 240 of the registration method 200, except that the constant device information 341-2 is located by the user application CA2. The current device information 342-2 in the above embodiments is similar to the current device information 342 in operation 240 of the registration method 200, except that the current device information 342-2 is located by the user application CA2.

[0033] In some embodiments, if user application CA2 has registered with server application SA through registration method 200 and the user identity information CID2 corresponding to user application CA2 includes other information besides user device information 340-2, such as random information 330-2 (not shown in the figure), in response to performing zero-knowledge proof 530, in addition to user device information 340-2, user application CA2 searches for other information from database CDB2. The random information 330-2 is similar to the random information 330 in operations 230 and 250 of registration method 200, except that the random information 330-2 is transmitted from server application SA to user application CA2.

[0034] In some embodiments, after searching for user device information 340-2 and random information 330-2, user application CA2 further combines user device information 340-2 and random information 330-2 to generate user identity information CID2.

[0035] In operation 440, user identity information CID1 and user identity information CID2 are compared using zero-knowledge proof 530, and operation 540 is performed: if user identity information CID1 and user identity information CID2 are the same, it is determined that the zero-knowledge proof 530 has been passed. In some embodiments, when the current location x1 of user device CD1 in user identity information CID1 and the current location x2 of user device CD2 in user identity information CID2 are both within the same country, it is determined that the current location x1 and the current location x2 are the same. In some embodiments, the distance between the current location x2 and the current location x1 is within a specific range, for example, within 100 kilometers, it is determined that the current location x1 and the current location x2 are the same.

[0036] Furthermore, the aforementioned zero-knowledge proof is a method of proving the existence of real information without disclosing real information. Therefore, using zero-knowledge proof can effectively improve information security. In detail, the zero-knowledge proof 530 used in operations 420, 430, and 440 can be a non-interactive zero-knowledge proof, such as ZK-SNARK, or an interactive zero-knowledge proof as shown in Figure 6.

[0037] Please refer to Figures 5 and 6 together. Figure 6 is a flowchart of a zero-knowledge proof method 600 according to some embodiments of this disclosure. The zero-knowledge proof method 600 includes operations 610, 611, 620, 621, and 630. However, the operations of the zero-knowledge proof method 600 are not necessarily performed in the order shown in Figure 6. In other words, within the scope of the various embodiments of this disclosure, operations can be appropriately added, replaced, rearranged, and / or deleted.

[0038] In operation 610, the server application SA generates random information 520 and transmits it to the user application CA2. At least user identity information CID1 is provided as seed data for the hash function HF to hash the random information 520 to generate a hash result HR1. The seed data refers to the initial value at which the hash function HF begins generating random numbers. The random information 520 can be implemented using various data types such as chart, string, integer, and float.

[0039] In operation 620, the user application CA2 provides user identity information CID2 as another seed data for the hash function HF to hash the random information 520 to generate a hash result HR2, and the second hash result HR2 is sent back to the server application SA. Due to the irreversibility of the hashing process, hashing in operations 610 and 620 can improve the security of information transmission.

[0040] In some embodiments, operation 610 further includes operation 611. In operation 611, a session ID having time limits t1~t2 (i.e., from time point t1 to time point t2) is transmitted together with random information 520 to the user application CA2. Accordingly, operation 620 further includes operation 621. In operation 621, the session ID is sent back to the server application SA together with the second hash result HR2.

[0041] In operation 630, the server application SA compares the hash result HR1 with the hash result HR2. When the hash result HR1 and the hash result HR2 are the same (i.e., the user identity information CID1 and the user identity information CID2 are the same), it is determined at time point t3 that the user application CA2 has passed the zero-knowledge proof 530. After determining that the user application CA2 has passed the zero-knowledge proof 530, operation 451 or operation 452 shown in Figure 4 is performed. In operation 451 and operation 452, at least based on the zero-knowledge proof 530, it is determined whether the user application CA2 is allowed to receive at least one service from the server application SA through a specific user account. The specific implementation of operation 451 and operation 452 will be described in detail in the following paragraphs.

[0042] Please refer to Figure 4 again, and also refer to Figure 5. In operation 451, when the time point t3 of passing zero-knowledge proof 530 is within the time limit t1~t2 of the session identifier, it is determined that passing zero-knowledge proof 530 is valid, and the user application CA2 is allowed to receive at least one service from the server application SA through a specific user account.

[0043] In operation 452, when the time point t3 of the zero-knowledge proof 530 is outside the time limit t1~t2 of the session identifier, it is determined that the zero-knowledge proof 530 is invalid, and the user application CA2 is denied from receiving at least one service from the server application SA through the specific user account.

[0044] Therefore, by using session identifiers, the zero-knowledge proof 530 can be restricted to passing between time point t1 and time point t2. Even if random information 520 or user device information 340-2 is stolen, it can only be used to pass authentication within a limited time, thus improving information security.

[0045] However, if operation 540 determines that user identity information CID1 and user identity information CID2 are different, then operation 460 is executed. Furthermore, in some embodiments, operation 470 may be further executed after operation 460. In other words, the account management method 100 and authentication method 400 may further include operations 460 and 470.

[0046] Please refer to Figures 5 and 7 together. Figure 7 is a flowchart of part of the operation of the authentication method according to some embodiments of the present disclosure. In operation 460, if user identity information CID1 and user identity information CID2 are different, user application CA2 is denied from receiving at least one service from server application SA through the user account corresponding to user identity information CID1, and registration operation including at least operations 240 and 250 is performed on user application CA2 by registration method 200 (i.e., user application CA2 replaces user application CA1 in registration method 200). Through operation 460, a user account corresponding to user identity information CID2 is generated in database SDB.

[0047] When user identity information CID1 and user identity information CID2 correspond to the same user but different devices, in some embodiments, the same user is allowed to use the service on different devices. Therefore, the user account corresponding to user identity information CID1 and the user account corresponding to user identity information CID2 are allowed to exist together in the database SDB.

[0048] In some embodiments, the same user is prohibited from using the service on different devices. Therefore, in operation 470, after a user account corresponding to user identity information CID2 is generated, the server application SA removes the user account corresponding to user identity information CID1 from the database SDB.

[0049] In summary, this disclosure provides a passwordless account management method and its registration and authentication method, and the content of this disclosure can take into account both user convenience and information security.

[0050] Although the present disclosure has been described above with reference to embodiments, it is not intended to limit the present disclosure. Anyone skilled in the art can make various modifications and refinements without departing from the spirit and scope of the present disclosure. The scope of protection of the present disclosure shall be determined by the appended claims. [Simplified Explanation of the Diagram]

[0008] To make the above and other objects, features, advantages and embodiments of this disclosure more apparent and understandable, the accompanying drawings are described as follows: Figure 1 is a flowchart of an account management method according to some embodiments of this disclosure; Figure 2 is a flowchart of a registration method according to some embodiments of this disclosure; Figure 3 is a schematic diagram of a registration method according to some embodiments of this disclosure; Figure 4 is a flowchart of an authentication method according to some embodiments of this disclosure; Figure 5 is a schematic diagram of an authentication method according to some embodiments of this disclosure; Figure 6 is a flowchart of a zero-knowledge proof method according to some embodiments of this disclosure; and Figure 7 is a flowchart of a portion of the operation of the authentication method according to some embodiments of this disclosure.

Claims

1. An account management method, comprising: a first user application searching for first user device information and transmitting the first user device information to a server application; the server application generating first user identity information including the first user device information, and generating a first user account corresponding to the first user application in a database based on the first user identity information; a second user application transmitting an authentication request to the server application; in response to the authentication request, the server application providing the first user identity information to perform a zero-knowledge proof; in response to performing the zero-knowledge proof, the second user application searching for second user device information and generating second user identity information including the second user device information; comparing the first user identity information with the second user identity information through the zero-knowledge proof, and determining that the zero-knowledge proof is passed if the first user identity information is the same as the second user identity information; and at least based on the zero-knowledge proof, determining whether the second user application is allowed to receive at least one service from the server application through the first user account.

2. The account management method as described in claim 1 further includes: if the first user identity information is different from the second user identity information, refusing the second user application from receiving the at least one service from the server application through the first user account, and performing a registration operation, the registration operation including: the second user application transmitting the second user device information to the server application; and the server application generating a third user identity information including the second user device information, and generating a second user account corresponding to the user application based on the third user identity information.

3. The account management method as described in claim 2 further includes: after the second user account is generated, the server application removes the first user account from the database.

4. A registration method, comprising: after a user application passes an authorization verification related to a service of a server application, the server application transmits random information to the user application; the user application locates user device information and transmits the user device information to the server application; and the server application combines the user device information and the random information into user identity information, and generates a user account corresponding to the user application based on the user identity information.

5. The registration method as described in claim 4, wherein the user device information includes current device information related to the time-varying state of a user device that sets the user application.

6. The registration method as described in claim 5, wherein the current device information includes the current location of the user device.

7. The registration method as described in Request 4, wherein the authorization verification is a multi-factor verification.

8. An authentication method comprising: providing first user identity information from a server application to perform a zero-knowledge proof; in response to performing the zero-knowledge proof, the user application searching for at least one second user device information; comparing the first user identity information with second user identity information including the second user device information using the zero-knowledge proof, and determining that the zero-knowledge proof is passed if the first user identity information is the same as the second user identity information; and determining, at least based on the zero-knowledge proof, whether the user application is allowed to receive at least one service from the server application through a specific user account.

9. The authentication method as described in claim 8, wherein performing the zero-knowledge proof comprises: generating random information by the server application and transmitting the random information to the user application, and providing the first user identity information as a sub-data of a hash function to hash the random information to generate a first hash result; providing the second user identity information as another sub-data of the hash function by the user application to hash the random information to generate a second hash result, and sending the second hash result back to the server application; and comparing the first hash result with the second hash result by the server application, and determining that the user application has passed the zero-knowledge proof when the first hash result is the same as the second hash result.

10. The authentication method as described in claim 9 further comprises: transmitting a session identifier with a time limit along with the random information to the user application; sending the session identifier along with the second hash result back to the server application; when the zero-knowledge proof is passed within the time limit, determining that the zero-knowledge proof is valid based on the session identifier, and allowing the user application to receive at least one service from the server application through the specific user account; and when the zero-knowledge proof is passed outside the time limit, determining that the zero-knowledge proof is invalid based on the session identifier, and denying the user application from receiving at least one service from the server application through the specific user account.

Images