Security authentication

Abstract

The present application relates to the technical field of information security, and specifically provides a security authentication method and apparatus, an electronic device, and a storage medium. The security authentication method comprises: when it is determined that a security authentication request sent by a user equipment for a target service is received, acquiring target device information and target service information in the security authentication request; on the basis of the target device information, performing device authentication to obtain a device authentication result; on the basis of the service binding relationship among a service, the user equipment, and a user account, the target device information, and the target service information, performing service authentication to obtain a service authentication result; on the basis of the device authentication result and the service authentication result, determining a security authentication result; and returning to the user equipment the security authentication result. In this way, the authentication security is improved.

Description

Security Certification Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a security authentication method, device, electronic device, and storage medium. Background Art

[0002] With the development of Internet technology, people's requirements for network information security are getting higher and higher.

[0003] Under the existing technology, security authentication is mainly performed by verifying the identity of the user. Specifically, security authentication is usually performed based on the user's account information or biometric information.

[0004] However, using this approach, it is difficult to meet authentication security in some scenarios where specific services (such as payment or viewing of confidential information) need to be provided through specific devices (such as devices with higher security factors or devices in designated areas).

[0005] Summary of the Invention

[0006] The purpose of the embodiments of the present application is to provide a method, device, electronic device and storage medium for security authentication, so as to improve authentication security when performing security authentication.

[0007] On the one hand, an embodiment of the present application provides a method for security authentication, the method including: when determining that a security authentication request sent by a user device for a target service is received, obtaining the target device information and target service information in the security authentication request; performing device authentication based on the target device information to obtain a device authentication result; performing service authentication based on the service binding relationship between the service, user device and user account, as well as the target device information and target service information, to obtain a service authentication result; determining a security authentication result based on the device authentication result and the service authentication result; and returning the security authentication result to the user device.

[0008] In one embodiment, device authentication is performed based on target device information to obtain a device authentication result, including: obtaining a device authentication status corresponding to the target device information; if the device authentication status indicates that the authentication is passed, determining that the device authentication is successful; otherwise, determining that the device authentication fails.

[0009] In one embodiment, before obtaining the device authentication status corresponding to the target device information, the method further includes: when determining that the online status sent by the user device is received, returning a challenge code to the user device; when receiving the device signature information of the user device, performing signature verification on the device signature information; the device signature information is obtained by signing the target device information and the challenge code; if it is determined that the signature verification is successful, the challenge code is consistent with the local challenge code, and the target device information is included in the device registration information set, then setting the device authentication status to authentication passed, otherwise, setting the device authentication status to authentication failed.

[0010] In one embodiment, service authentication is performed based on the service binding relationship between the service, user device and user account, as well as the target device information and target service information, to obtain a service authentication result, including: when the security authentication request does not contain user account information, if the user account information corresponding to the target device information and the target service information is successfully obtained based on the service binding relationship, then the service authentication is determined to be successful; otherwise, the service authentication is determined to be failed; or, based on the service binding relationship, the user account information corresponding to the target device information and the target service information is obtained, if the user account information corresponding to the target device information and the target service information matches the user account information also included in the security authentication request, then the service authentication is determined to be successful; otherwise, the service authentication is determined to be failed.

[0011] In one embodiment, before performing service authentication based on the service binding relationship between the service, user device and user account, and the target device information, and obtaining the service authentication result, the method also includes: when it is determined that a user binding request is received, obtaining the user binding signature in the user binding request; performing signature verification on the user binding signature; if it is determined that the signature verification is successful, obtaining the user account information and target device information in the user binding signature; performing device authentication based on the target device information to obtain a device authentication result; if the device authentication result indicates that the authentication is successful, establishing a service binding relationship between the user account information and the target device information.

[0012] In one embodiment, the security authentication result is determined based on the device authentication result and the service authentication result, including: if the device authentication result indicates that the authentication is passed and the service authentication result indicates that the authentication is passed, then the security authentication is determined to be passed; otherwise, the security authentication is determined to be failed.

[0013] In one embodiment, before obtaining the target device information and target service information in the security authentication request, the method also includes: performing signature verification on the security authentication request; determining the security authentication result based on the device authentication result and the service authentication result, including: if it is determined that the security authentication request signature verification is passed, the device authentication result indicates that the authentication is passed, and the service authentication result indicates that the authentication is passed, then it is determined that the security authentication is passed; otherwise, it is determined that the security authentication has failed.

[0014] On the one hand, an embodiment of the present application provides a method for security authentication, the method comprising: sending a security authentication request for a target service to a security server; the security authentication request includes target device information and target service information; receiving a security authentication result returned by the security server; the security authentication result is returned based on the device authentication result and the service authentication result; the device authentication result is obtained by performing device authentication based on the target device information, and the service authentication result is obtained by performing service authentication based on the service binding relationship between the service, user device and user account, and the target device information and target service information.

[0015] In one embodiment, before receiving the security authentication result returned by the security server, the method also includes: when it is determined that the device authentication conditions are met, sending the online status to the security server; when it is determined that a challenge code returned by the security server based on the online status is received, signing the target device information and the challenge code to obtain device signature information; sending the device signature information to the security server; and receiving the device authentication result returned by the security server based on the device signature information.

[0016] On the one hand, an embodiment of the present application provides a security authentication device, including: an acquisition unit, used to determine when a security authentication request sent by a user device for a target service is received, and to obtain the target device information and target service information in the security authentication request; an authentication unit, used to perform device authentication based on the target device information and obtain a device authentication result; an acquisition unit, used to perform service authentication based on the service binding relationship between the service, user device and user account, as well as the target device information and target service information, and obtain a service authentication result; a determination unit, used to determine the security authentication result based on the device authentication result and the service authentication result; and a return unit, used to return the security authentication result to the user device.

[0017] In one embodiment, the authentication unit is further configured to: obtain a device authentication status corresponding to the target device information; if the device authentication status indicates that the authentication is passed, determine that the device authentication is successful; otherwise, determine that the device authentication fails.

[0018] In one embodiment, the authentication unit is further used to: return a challenge code to the user device when determining that the online status sent by the user device is received; perform signature verification on the device signature information when receiving the device signature information of the user device; the device signature information is obtained by signing the target device information and the challenge code; if it is determined that the signature verification is successful, the challenge code is consistent with the local challenge code, and the target device information is included in the device registration information set, then set the device authentication status to authentication passed, otherwise, set the device authentication status to authentication failed.

[0019] In one embodiment, the obtaining unit is used to: when the security authentication request does not include user account information, if the user account information corresponding to the target device information and the target service information is successfully obtained based on the service binding relationship, then the service authentication is determined to be successful; otherwise, the service authentication is determined to be failed; or, based on the service binding relationship, the user account information corresponding to the target device information and the target service information is obtained, if the user account information corresponding to the target device information and the target service information matches the user account information also included in the security authentication request, then the service authentication is determined to be successful; otherwise, the service authentication is determined to be failed.

[0020] In one embodiment, the obtaining unit is also used to: obtain the user binding signature in the user binding request when it is determined that a user binding request has been received; perform signature verification on the user binding signature; if it is determined that the signature verification is passed, obtain the user account information and target device information in the user binding signature; perform device authentication based on the target device information to obtain a device authentication result; if the device authentication result indicates that the authentication is passed, establish a service binding relationship between the user account information and the target device information.

[0021] In one embodiment, the determining unit is configured to: determine that the security authentication is passed if the device authentication result indicates that the authentication is passed and the service authentication result indicates that the authentication is passed; otherwise, determine that the security authentication is failed.

[0022] In one embodiment, the acquisition unit is further used to: perform signature verification on the security authentication request; the determination unit is used to: if it is determined that the security authentication request signature verification is passed, the device authentication result indicates that the authentication is passed, and the service authentication result indicates that the authentication is passed, then determine that the security authentication is passed; otherwise, determine that the security authentication has failed.

[0023] On the one hand, an embodiment of the present application provides a security authentication device, including: a sending unit, used to send a security authentication request for a target service to a security server; the security authentication request includes target device information and target service information; a receiving unit, used to receive a security authentication result returned by the security server; the security authentication result is returned based on the device authentication result and the service authentication result; the device authentication result is obtained by performing device authentication based on the target device information, and the service authentication result is obtained by performing service authentication based on the service binding relationship between the service, user device and user account, and the target device information and target service information.

[0024] In one embodiment, the sending unit is further used to: when it is determined that the device authentication conditions are met, send the online status to the security server; when it is determined that a challenge code returned by the security server based on the online status is received, sign the target device information and the challenge code to obtain device signature information; send the device signature information to the security server; and receive the device authentication result returned by the security server based on the device signature information.

[0025] On the one hand, an embodiment of the present application provides an electronic device, comprising: a processor; and a memory storing computer instructions, the computer instructions being used to enable the processor to execute the steps of the method provided in any of the various optional implementations of security authentication described above.

[0026] On the one hand, an embodiment of the present application provides a storage medium storing computer instructions, which are used to enable a computer to execute the steps of the method provided in any of the various optional implementations of security authentication as described above.

[0027] In the security authentication method, device, electronic device and storage medium provided by the embodiment of the present application, when it is determined that a security authentication request sent by a user device for a target service is received, the target device information and target service information in the security authentication request are obtained; device authentication is performed based on the target device information to obtain a device authentication result; service authentication is performed based on the service binding relationship between the service, user device and user account, as well as the target device information and target service information, to obtain a service authentication result; security authentication results are determined based on the device authentication result and the service authentication result; and security authentication results are returned to the user device. In this way, device authentication is first performed based on the target device information, and then service authentication is performed based on the target device information and the target service information. This comprehensively considers the restrictions of different services on devices and users, improves the performance of security authentication, and meets the security needs of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the specific implementation methods or the description of the prior art. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0029] FIG1 is an interactive flow chart of a device initialization method according to some embodiments of the present application.

[0030] FIG2 is a flowchart of an implementation method of a device registration according to some embodiments of the present application.

[0031] FIG3 is a flowchart of an implementation method of a device authentication method according to some embodiments of the present application.

[0032] FIG4 is a flowchart illustrating an implementation of a service binding method according to some embodiments of the present application.

[0033] FIG5 is a flowchart of a security authentication method according to some embodiments of the present application.

[0034] FIG6 is a structural block diagram of a security authentication device according to some embodiments of the present application.

[0035] FIG7 is a structural block diagram of another security authentication device according to some embodiments of the present application.

[0036] FIG8 is a schematic structural diagram of an electronic device according to some embodiments of the present application. DETAILED DESCRIPTION

[0037] The technical solutions of the present application will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0038] First, some of the terms involved in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0039] Terminal device: can be a mobile terminal, fixed terminal or portable terminal, such as a mobile phone, station, unit, device, multimedia computer, multimedia tablet, Internet node, communicator, desktop computer, laptop computer, notebook computer, netbook computer, tablet computer, personal communication system device, personal navigation device, personal digital assistant, audio / video player, digital camera / camcorder, positioning device, television receiver, radio broadcast receiver, e-book device, gaming device or any combination thereof, including accessories and peripherals of these devices or any combination thereof. It is also foreseeable that the terminal device can support any type of user interface (such as wearable device), etc.

[0040] Server: It can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms.

[0041] With the development of Internet technology, people have higher and higher requirements for network information security. Under existing technology, when users request services, security authentication is usually performed based on the user's account information and biometric information.

[0042] However, this approach still poses some security risks in some scenarios. For example, in actual Extended Reality (XR) business scenarios, due to the high cost of XR equipment, businesses usually operate on a leasing basis.

[0043] When a user requests a service through the XR client on an XR device, security authentication is typically performed using the user's biometric information or account information to ensure service security. However, this approach only verifies the user's identity and fails to consider the device and user restrictions imposed by different services, thus failing to guarantee user security.

[0044] Based on the defects of the above-mentioned related technologies, the embodiments of the present application provide a method, device, electronic device and storage medium for security authentication, aiming to improve the security authentication performance when performing security authentication. The embodiments of the present application provide a method for security authentication, which can be applied to electronic devices. The present application does not limit the type of electronic device, which can be any type of device suitable for implementation, such as a smartphone, tablet computer, etc., and the present application will not elaborate on this.

[0045] The following is an example of an application scenario of the embodiment of the present application.

[0046] In one application scenario, before executing a user's service request, the user device first undergoes security authentication with a security server to enhance information security. Specifically, in response to a user's request to download a file (i.e., a target service), the user device sends a security authentication request containing file download information and the device serial number (i.e., target service information and target device information) to the security server. The security server then performs security authentication based on the security authentication request and obtains a security authentication result. The user device receives the security authentication result returned by the security server and, if it determines that the security authentication is successful, responds to the download request and executes the file download operation, allowing the user to obtain the desired file.

[0047] In one application scenario, the user device is a service server. When receiving a service request sent by a terminal device, it first performs security authentication through a security server. After the security authentication is passed, the requested service is returned to the terminal device. Specifically, the terminal device sends a file download request to the user device in response to the user's download operation for file download (i.e., target service). Based on the file download request, the user device sends a security authentication request containing file download information and a device serial number (i.e., target service information and target device information) to the security server. The security server performs security authentication based on the security authentication request, obtains a security authentication result, and returns the security authentication result to the user device. If it is determined that the security authentication is passed, the user device responds to the file download request of the terminal device. The terminal device performs a file download operation based on the file download response message returned by the user device, so that the user can obtain the file to be downloaded.

[0048] In one application scenario, a user device sends a service request to a security server. Upon receiving the service request, the security server issues a security authentication instruction (i.e., a security authentication request) to its own security authentication module. The security authentication module performs security authentication based on the security authentication request, obtains a security authentication result, and returns the security authentication result to the service module in the security server. If the service module determines that the security authentication succeeds, it returns a service response message to the user device; otherwise, it returns a failure response message.

[0049] In the embodiment of the present application, before security authentication is performed, the user device is first registered, the device is authenticated, and the service is bound. Optionally, the user device can be a terminal device or a server for providing services.

[0050] Refer to Figure 1 for a flowchart of the device initialization method. Figure 2 shows the client, a secure software development kit (SDK), and a secure server. The client and secure SDK reside on the same user device. The device initialization method described above is described below in conjunction with Figure 1. The specific implementation process of this method is as follows.

[0051] Step 100: The client sends an initialization request for target device information to the security SDK.

[0052] In one embodiment, after the client determines that the production line assembly is complete and the power-on initialization is complete, it sends an initialization request to the security SDK.

[0053] The initialization request includes target device information. Optionally, the target device information may include the user device's product serial number (SN) and central processing unit number (CPU Num). In practice, the target device information can be set based on the actual application scenario and is not limited here.

[0054] Step 101: The security SDK generates a device certificate.

[0055] In one implementation, the security SDK obtains target device information in the initialization request and generates a device certificate based on the target device information according to preset rules.

[0056] The device certificate private key and the device certificate public key can be obtained and stored through the device certificate. Optionally, the device certificate private key and the device certificate public key can be symmetric encryption keys or asymmetric encryption keys.

[0057] Optionally, the user equipment may also generate a TID according to a preset rule, and add the TID to the target device information.

[0058] Step 102: The security SDK encrypts the target device information to obtain encrypted device information.

[0059] In one implementation, the security SDK encrypts the target device information using the device certificate private key to obtain encrypted device information.

[0060] Step 103: The security SDK returns the encrypted device information and the device certificate public key to the user device.

[0061] Step 104: The user device sends the encrypted device information and the device certificate public key to the security server.

[0062] Step 105: The security server decrypts the encrypted device information based on the device key to obtain the target device information.

[0063] Step 106: The security server saves the target device information and the device certificate public key.

[0064] Furthermore, the security server returns an initialization result to the security server, and the security server sends the initialization result to the client.

[0065] In this way, the user equipment can be initialized first.

[0066] After the device is initialized, the user device can be registered. Refer to Figure 2, which is a flowchart of the device registration method. The device registration method is described below in conjunction with Figure 2. The specific implementation process of the method is as follows.

[0067] Step 200: The client sends a re-initialization request to the security SDK.

[0068] Step 201: The security SDK obtains the initialization detection result.

[0069] In one embodiment, the secure SDK obtains the target device information included in the re-initialization request and the initialization status corresponding to the target device information. If the initialization status is determined to be complete, an initialization detection result indicating completion is returned to the client. Otherwise, the device initialization process described above, i.e., steps 100-106, is executed.

[0070] Step 202: The security SDK returns the initialization detection result to the client.

[0071] Step 203: The client sends a registration request to the security server.

[0072] In one embodiment, the client determines that initialization is complete based on the initialization detection result, and then sends a registration request to the security server, wherein the registration request may include target device information.

[0073] Step 204: The security server performs device registration record.

[0074] In one implementation, the security server registers and records the target device information to implement registration of the user device.

[0075] In one embodiment, the security server obtains the target device information based on the device registration request and, based on the target device information and initialization record, determines whether the user device has been initialized. If so, the target device information is registered and recorded. Alternatively, device registration can be performed using AntChain on-chain. Furthermore, the target device information can be added to the device registration information set.

[0076] In this way, the user device can be registered with the security server.

[0077] After the device registration is completed, the online user device can be authenticated. Refer to Figure 3, which is a flowchart of the device authentication method. The device authentication method is described below in conjunction with Figure 3. The specific implementation process of the method is as follows.

[0078] Step 300: The client sends the online status to the security server.

[0079] In one embodiment, when the client determines that the device authentication conditions are met, the client sends the online status to the security server.

[0080] Optionally, the device authentication condition can be when the device is activated, when a set authentication time is reached, or when an authentication instruction from the user is received. In actual applications, the device authentication condition can be set according to the actual application scenario and is not limited here.

[0081] Step 301: The security server sends a challenge code to the client.

[0082] In one implementation, when the security server determines that it has received the online status sent by the user device, it sends a challenge code to the client.

[0083] Among them, the challenge code, also known as the challenge password, refers to a set of encrypted passwords generated in accordance with the handshake verification protocol. It is used to ensure that the user's real password is not leaked during the transmission process, thereby improving data security.

[0084] Step 302: The client sends an authentication encryption request to the security SDK.

[0085] The authentication encryption request may include a challenge code and target device information.

[0086] Step 303: Secure SDK to sign and obtain device signature information.

[0087] In one implementation, the security SDK signs the challenge code and target device information using the device certificate private key to obtain device signature information.

[0088] Step 304: The security SDK sends the device signature information to the client.

[0089] Step 305: The client sends the device signature information to the security server.

[0090] In one implementation, the client sends the device signature information to the security server.

[0091] Step 306: The security server performs signature verification on the device signature information.

[0092] Step 307: If it is determined that the signature verification is successful, device authentication is performed based on the challenge code and the target device information.

[0093] Specifically, if the signature verification is determined to be successful, the challenge code is consistent with the local challenge code, and the device registration information set contains the target device information, the device authentication status is set to authentication passed; otherwise, the device authentication status is set to authentication failed.

[0094] In one embodiment, the security server performs signature verification on the device signature information based on the device certificate public key. If the verification is successful, the target device information and challenge code in the device signature information are obtained. If the challenge code is consistent with the local challenge code and the target device information is included in the device registration information set, it is determined that the device authentication is successful.

[0095] Furthermore, the device authentication result is sent to the client. If the client determines that the authentication fails, the device authentication process is repeated, that is, steps 300 to 306, until the device authentication is determined to be successful.

[0096] In this way, the user device can be authenticated in advance by the security server.

[0097] In one embodiment, after device authentication is complete, service binding can be performed, establishing an association between the service, the user device, and the user account. FIG4 shows a flowchart illustrating the implementation of the service binding method. The service binding method described above is described below with reference to FIG4 . The specific implementation process of the method is as follows.

[0098] Step 400: The client sends a binding encryption request to the security SDK.

[0099] In one implementation, the client may guide the user to perform service binding, and in response to the user's service binding operation, call the service binding interface and send a binding encryption request to the security SDK.

[0100] The binding encryption request may include target service information, user account information, and target device information.

[0101] Furthermore, before sending the binding encryption request, to improve security, the client can also guide the user to enter the operation password, and perform password verification in response to the user's password input operation. If the verification is successful, the binding encryption request is sent to the security SDK.

[0102] Furthermore, an operation password may be pre-set before executing step 400. In one embodiment, the client may pre-set an operation password through the following steps.

[0103] In response to the user's security center login operation, the system logs in to the security center, and in response to the user's password setting operation, obtains the operation password entered by the user, determines whether the device binding with the user's terminal device has been completed, and if it is determined that the device binding has not been completed, performs the terminal device binding operation. If it is determined that the device binding has been completed, the system obtains the verification code entered by the user (such as a mobile phone verification code) in response to the user's verification input operation. If it is determined that the verification code is successfully verified, it is determined that the password setting is successful; otherwise, it is determined that the password setting has failed. The verification code is obtained by the user through the terminal device.

[0104] Furthermore, if the user forgets the operation password, the operation password can be reset. In one embodiment, the following steps can be used to reset the operation password.

[0105] In response to the user's security center login operation, the system logs in to the security center, and in response to the user's password reset operation, obtains the new operation password entered by the user. In response to the user's verification input operation, the system obtains the verification code entered by the user (such as a mobile phone verification code). If the verification code is successfully verified, the password setting is determined to be successful. Otherwise, the password setting is determined to be unsuccessful. Furthermore, if it is determined that the terminal device cannot be used, the verification code can also be obtained by email.

[0106] Furthermore, to improve account security, at least one of the following methods may be adopted.

[0107] Method 1: According to the user's operation, the terminal device replacement binding process is carried out to replace the terminal device bound to the user.

[0108] Method 2: Identify whether the account is logged in from a different location to detect whether the login device is an unbound terminal device or an abnormal IP.

[0109] Method 3: Use the lock screen to verify the operation password.

[0110] Method 4: When a user registers, the user is authenticated for service through biometric features such as iris and palm print within the client.

[0111] Step 401: The security SDK performs encryption based on the user certificate private key to obtain binding encryption information.

[0112] In one implementation, the security SDK generates a user certificate and encrypts target server information, target device information, and user account information using the user certificate private key.

[0113] The user certificate public key and the user certificate private key used for encryption and decryption can be obtained through the user certificate.

[0114] Step 402: The security SDK sends the user certificate public key and the binding encryption information to the client.

[0115] Step 403: The client sends the user certificate public key and binding encryption information to the security server.

[0116] Step 404: The security server decrypts the binding encryption information based on the user certificate public key to obtain binding decryption information.

[0117] The binding decryption information includes target service information, target device information and user account information.

[0118] Step 405: The security server verifies the binding decryption information.

[0119] In one embodiment, the security server performs device authentication based on the target device information. If the device authentication is successful, an association relationship is established between the target service information, user account information and target device information, and a service binding relationship between the service, user device and user account is obtained. If the device authentication fails or the device is decrypted, a binding failure result is returned to the client.

[0120] Furthermore, the security server may return a binding success result including the service binding relationship to the client. If the client receives a binding failure result, the user binding process, ie, steps 400 to 405, is repeated until the service binding is successful.

[0121] Furthermore, the user certificate can be cancelled based on the user's unbinding operation, and the service binding relationship can be deleted through the unbinding interface to release the trusted binding relationship.

[0122] It should be noted that in the embodiment of the present application, the security SDK provides a key generation interface in the Trusted Execution Environment (TEE), so that the key generation interface can be called and digital certificates, namely device certificates and user certificates, can be generated using rules that are not disclosed to the outside world. In this way, an immutable key pair can be obtained, and the public key in the key pair can be uploaded to the payment authentication platform, so that the transmitted data can be encrypted and decrypted using the key pair, ensuring the security and authenticity of the transmitted data. In addition, to further improve security, instructions for repeated generation of digital certificates are not processed, the security level of the digital certificate can be set to a higher level, the key pair can be set to the global default, and the key pair can be set one-to-one with the device.

[0123] In the embodiment of the present application, only one service is used as an example for illustration. In actual applications, service binding relationships can be established for multiple different services, which will not be elaborated here.

[0124] After establishing the service binding relationship, security authentication can be performed. Referring to FIG5 , which is a flow chart of a security authentication method in some embodiments of the present application, the method will be described below in conjunction with FIG5 . The specific implementation process of the method is as follows.

[0125] Step 500: When the security server determines that it has received a security authentication request sent by a terminal device for a target service, it obtains target device information and target service information in the security authentication request.

[0126] In one implementation, when the user equipment determines that the security authentication condition is met, it sends a security authentication request to the security server.

[0127] Optionally, the security authentication condition may be receiving a service request operation for the target service from the user, or may be receiving a service request instruction for the target service.

[0128] Optionally, the target service may be services such as viewing information, downloading files, calling service interfaces, and payment.

[0129] Furthermore, to improve security, the user equipment may also sign the security authentication request and send the signed security authentication request to the security server.

[0130] Step 501: The security server performs device authentication based on the target device information and obtains a device authentication result.

[0131] In one embodiment, a device authentication status corresponding to the target device information is obtained; if the device authentication status indicates that the authentication is passed, the device authentication is determined to be successful; otherwise, the device authentication is determined to be failed.

[0132] In this way, the pre-set device authentication status can be obtained, which improves the efficiency of device authentication determination.

[0133] Step 502: Based on the service binding relationship between the service, the user device and the user account, as well as the target device information and the target service, perform service authentication and obtain a service authentication result.

[0134] Specifically, when executing step 502, any of the following methods may be used.

[0135] Method 1: When the security authentication request does not include user account information, if the user account information corresponding to the target device information and the target service information is successfully obtained based on the service binding relationship, the service authentication is determined to be successful; otherwise, the service authentication is determined to be failed.

[0136] In this way, whether the service authentication is successful can be determined based on whether the user account information corresponding to the target device information exists.

[0137] Method 2: Based on the service binding relationship, obtain the user account information corresponding to the target device information and the target service information. If the user account information corresponding to the target device information and the target service information matches the user account information also included in the security authentication request, the service authentication is determined to be successful. Otherwise, the service authentication is determined to have failed.

[0138] In this way, whether the service authentication is successful can be determined based on whether the service binding relationship contains the association relationship between the user account information and the target device information.

[0139] Step 503: Determine the security authentication result based on the device authentication result and the service authentication result.

[0140] In one implementation, if the device authentication result indicates that the authentication is passed and the service authentication result indicates that the authentication is passed, then it is determined that the security authentication is passed; otherwise, it is determined that the security authentication has failed.

[0141] Furthermore, if signature verification of the security authentication request is required, if the security authentication request signature verification is determined to be successful, the device authentication result representation authentication is successful, and the service authentication result representation authentication is successful, then the security authentication is determined to be successful; otherwise, the security authentication is determined to have failed.

[0142] In this way, secure authentication can be achieved.

[0143] Step 504: Return the security authentication result to the terminal device.

[0144] In the embodiment of the present application, traditional biometrics or accounts are not used for security authentication. Instead, device authentication is performed based on the target device information to ensure the security of the device, and service authentication is performed based on the service binding relationship between the service, user device and user account, as well as the target service information and target device information. This allows verification of the security of different users using various services on different devices, and can meet the security authentication requirements in specific device scenarios. Furthermore, whether the device authentication is successful is determined by directly obtaining the device authentication status, thereby improving the efficiency of device authentication. Furthermore, whether the service authentication is successful can be determined by whether the user account information corresponding to the target device information and the target service information is successfully obtained, or by whether the binding relationship between the target device information, the target service information and the user account information is pre-registered, thereby increasing the diversity of service authentication. Furthermore, the security authentication result is determined by combining the signature verification result, the device authentication result and the service verification result, thereby further improving the accuracy of the security authentication and improving security.

[0145] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0146] Based on the same inventive concept, the embodiments of this application also provide a device for security authentication. Since the principles of the above-mentioned device and equipment for solving the problem are similar to those of a method for security authentication, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated. The device can be applied to electronic devices. This application does not limit the type of electronic device. It can be any type of device suitable for implementation, such as a smartphone, tablet computer, etc. This application will not repeat this.

[0147] Refer to Figure 6, which is a structural block diagram of a security authentication device in an embodiment of the present application. In some embodiments, the security authentication device of the present application example includes: an acquisition unit 601, which is used to determine when receiving a security authentication request sent by a user device for a target service, and obtain the target device information and target service information in the security authentication request; an authentication unit 602, which is used to perform device authentication based on the target device information and obtain a device authentication result; an acquisition unit 603, which is used to perform service authentication based on the service binding relationship between the service, the user device, and the user account, as well as the target device information and the target service information, and obtain a service authentication result; a determination unit 604, which is used to determine the security authentication result based on the device authentication result and the service authentication result; and a return unit 605, which is used to return the security authentication result to the user device.

[0148] In one embodiment, the authentication unit 602 is further configured to: obtain a device authentication status corresponding to the target device information; if the device authentication status indicates that the authentication is successful, determine that the device authentication is successful; otherwise, determine that the device authentication is failed.

[0149] In one embodiment, the authentication unit 602 is further used to: return a challenge code to the user device when determining that the online status sent by the user device is received; perform signature verification on the device signature information when receiving the device signature information of the user device; the device signature information is obtained by signing the target device information and the challenge code; if it is determined that the signature verification is successful, the challenge code is consistent with the local challenge code, and the target device information is included in the device registration information set, then set the device authentication status to authentication passed, otherwise, set the device authentication status to authentication failed.

[0150] In one embodiment, the obtaining unit 603 is used to: when the security authentication request does not include user account information, if the user account information corresponding to the target device information and the target service information is successfully obtained based on the service binding relationship, then the service authentication is determined to be successful; otherwise, the service authentication is determined to be failed; or, based on the service binding relationship, the user account information corresponding to the target device information and the target service information is obtained, if the user account information corresponding to the target device information and the target service information matches the user account information also included in the security authentication request, then the service authentication is determined to be successful; otherwise, the service authentication is determined to be failed.

[0151] In one embodiment, the obtaining unit 603 is also used to: obtain the user binding signature in the user binding request when it is determined that a user binding request has been received; perform signature verification on the user binding signature; if it is determined that the signature verification is successful, obtain the user account information and target device information in the user binding signature; perform device authentication based on the target device information to obtain a device authentication result; if the device authentication result indicates that the authentication is successful, establish a service binding relationship between the user account information and the target device information.

[0152] In one embodiment, the determining unit 604 is configured to: determine that the security authentication is passed if the device authentication result indicates that the authentication is passed and the service authentication result indicates that the authentication is passed; otherwise, determine that the security authentication is failed.

[0153] In one embodiment, the acquisition unit 601 is also used to: perform signature verification on the security authentication request; the determination unit 604 is used to: if it is determined that the signature verification of the security authentication request is passed, the device authentication result indicates that the authentication is passed, and the service authentication result indicates that the authentication is passed, then it is determined that the security authentication is passed; otherwise, it is determined that the security authentication has failed.

[0154] Refer to Figure 7, which is a block diagram of another security authentication device in an embodiment of the present application. In some embodiments, the security authentication device of the present application example includes: a sending unit 701, configured to send a security authentication request for a target service to a security server; the security authentication request includes target device information and target service information; a receiving unit 702, configured to receive a security authentication result returned by the security server; the security authentication result is returned based on the device authentication result and the service authentication result; the device authentication result is obtained by performing device authentication based on the target device information, and the service authentication result is obtained by performing service authentication based on the service binding relationship between the service, the user device, and the user account, as well as the target device information and the target service information.

[0155] In one embodiment, the sending unit 701 is further used to: send the online status to the security server when it is determined that the device authentication conditions are met; when it is determined that the challenge code returned by the security server based on the online status is received, sign the target device information and the challenge code to obtain device signature information; send the device signature information to the security server; and receive the device authentication result returned by the security server based on the device signature information.

[0156] In the security authentication method, device, electronic device and storage medium provided by the embodiment of the present application, when it is determined that a security authentication request sent by a user device for a target service is received, the target device information and target service information in the security authentication request are obtained; device authentication is performed based on the target device information to obtain a device authentication result; service authentication is performed based on the service binding relationship between the service, user device and user account, as well as the target device information and target service information, to obtain a service authentication result; security authentication results are determined based on the device authentication result and the service authentication result; and security authentication results are returned to the user device. In this way, device authentication is first performed based on the target device information, and then service authentication is performed based on the target device information and the target service information. This comprehensively considers the restrictions of different services on devices and users, improves the performance of security authentication, and meets the user's security authentication needs.

[0157] An embodiment of the present application provides an electronic device, including: a processor; and a memory storing computer instructions, wherein the computer instructions are used to enable the processor to execute a method in any of the above embodiments.

[0158] An embodiment of the present application provides a storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method of any of the above embodiments.

[0159] FIG8 shows a schematic structural diagram of an electronic device 8000. Referring to FIG8, the electronic device 8000 includes a processor 8010 and a memory 8020, and optionally, may further include a power supply 8030, a display unit 8040, and an input unit 8050.

[0160] The processor 8010 is the control center of the electronic device 8000 , which connects various components using various interfaces and lines, and performs various functions of the electronic device 8000 by running or executing software programs and / or data stored in the memory 8020 .

[0161] In the embodiment of the present application, the processor 8010 executes the various steps in the above embodiment when calling the computer program stored in the memory 8020.

[0162] Optionally, the processor 8010 may include one or more processing units. Preferably, the processor 8010 may integrate an application processor and a modem processor, wherein the application processor primarily processes the operating system, user interface, and applications, and the modem processor primarily processes wireless communications. It is understood that the modem processor may not be integrated into the processor 8010. In some embodiments, the processor and memory may be implemented on a single chip. In some embodiments, they may also be implemented on separate chips.

[0163] The memory 8020 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, various applications, etc., and the data storage area may store data created based on the use of the electronic device 8000. In addition, the memory 8020 may include a high-speed random access memory and a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0164] The electronic device 8000 also includes a power supply 8030 (such as a battery) for supplying power to various components. The power supply can be logically connected to the processor 8010 through a power management system, thereby managing functions such as charging, discharging, and power consumption through the power management system.

[0165] The display unit 8040 can be used to display information input by the user or information provided to the user, as well as various menus of the electronic device 8000. In the embodiment of the present application, it is mainly used to display the display interface of each application in the electronic device 8000 and objects such as text and pictures displayed on the display interface. The display unit 8040 may include a display panel 8041. The display panel 8041 can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc.

[0166] The input unit 8050 can be used to receive information such as numbers or characters input by the user. The input unit 8050 may include a touch panel 8051 and other input devices 8052. The touch panel 8051, also known as a touch screen, can receive user touch operations on or near it (for example, operations performed by the user using a finger, a stylus, or any other suitable object or accessory on or near the touch panel 8051).

[0167] Specifically, the touch panel 8051 can detect user touch operations and the signals generated by the touch operations, convert these signals into touch point coordinates, and send them to the processor 8010. It can also receive and execute commands sent by the processor 8010. In addition, the touch panel 8051 can be implemented using various types, such as resistive, capacitive, infrared, and surface acoustic wave. Other input devices 8052 can include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, power buttons, etc.), a trackball, a mouse, a joystick, etc.

[0168] Of course, the touch panel 8051 can cover the display panel 8041. When the touch panel 8051 detects a touch operation on or near it, it transmits the information to the processor 8010 to determine the type of touch event. The processor 8010 then provides a corresponding visual output on the display panel 8041 based on the type of touch event. Although in Figure 8, the touch panel 8051 and the display panel 8041 are used as two independent components to implement the input and output functions of the electronic device 8000, in some embodiments, the touch panel 8051 and the display panel 8041 can be integrated to implement the input and output functions of the electronic device 8000.

[0169] The electronic device 8000 may further include one or more sensors, such as a pressure sensor, a gravity acceleration sensor, a proximity light sensor, etc. Of course, according to the needs of specific applications, the electronic device 8000 may also include other components such as a camera. Since these components are not the key components used in the embodiments of the present application, they are not shown in FIG8 and will not be described in detail.

[0170] Those skilled in the art will understand that FIG8 is merely an example of an electronic device and does not limit the electronic device. The electronic device may include more or fewer components than shown in the figure, or may combine certain components, or different components.

[0171] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0172] Obviously, the above embodiments are merely examples for clarity of explanation and are not intended to limit the embodiments. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Obvious variations or modifications arising therefrom remain within the scope of protection of this application.

Claims

1. A security authentication method, the method comprising: When determining that a security authentication request sent by a user device for a target service is received, obtaining target device information and target service information in the security authentication request; Perform device authentication based on the target device information to obtain a device authentication result; Based on the service binding relationship between the service, the user device and the user account, as well as the target device information and the target service information, perform service authentication to obtain a service authentication result; Determining a security authentication result based on the device authentication result and the service authentication result; Return the security authentication result to the user equipment.

2. The method according to claim 1, wherein performing device authentication based on the target device information to obtain a device authentication result comprises: Obtaining the device authentication status corresponding to the target device information; If the device authentication status indicates that the authentication is passed, it is determined that the device authentication is successful; otherwise, it is determined that the device authentication has failed.

3. The method according to claim 2, before obtaining the device authentication status corresponding to the target device information, the method further comprises: When determining that the online status sent by the user equipment is received, returning a challenge code to the user equipment; When receiving the device signature information of the user device, performing signature verification on the device signature information; the device signature information is obtained by signing the target device information and the challenge code; If it is determined that the signature verification is successful, the challenge code is consistent with the local challenge code, and the target device information is included in the device registration information set, the device authentication status is set to authentication passed, otherwise, the device authentication status is set to authentication failed.

4. The method according to any one of claims 1 to 3, wherein the service authentication is performed based on the service binding relationship between the service, the user device and the user account, as well as the target device information and the target service information, and the service authentication result is obtained, comprising: In the case where the security authentication request does not include user account information, if the user account information corresponding to the target device information and the target service information is successfully obtained based on the service binding relationship, then it is determined that the service authentication is successful, otherwise, it is determined that the service authentication fails; Alternatively, based on the service binding relationship, the user account information corresponding to the target device information and the target service information is obtained; if the user account information corresponding to the target device information and the target service information matches the user account information also included in the security authentication request, then it is determined that the service authentication is successful; otherwise, it is determined that the service authentication is unsuccessful. Certificate failed.

5. The method according to any one of claims 1 to 3, before performing service authentication based on the service binding relationship between the service, the user device and the user account, and the target device information, and obtaining the service authentication result, the method further comprises: When it is determined that a user binding request is received, obtaining a user binding signature in the user binding request; Performing signature verification on the user binding signature; If it is determined that the signature verification is passed, the user account information and the target device information in the user binding signature are obtained; Perform device authentication based on the target device information to obtain a device authentication result; If the device authentication result indicates that the authentication is successful, a service binding relationship between the user account information and the target device information is established.

6. The method according to any one of claims 1 to 3, wherein determining a security authentication result based on the device authentication result and the service authentication result comprises: If the device authentication result indicates that the authentication is passed and the service authentication result indicates that the authentication is passed, it is determined that the security authentication is passed; otherwise, it is determined that the security authentication fails.

7. The method according to any one of claims 1 to 3, before obtaining the target device information and the target service information in the security authentication request, the method further comprises: Performing signature verification on the security authentication request; The determining of a security authentication result based on the device authentication result and the service authentication result includes: If it is determined that the security authentication request signature verification is passed, the device authentication result representation authentication is passed, and the service authentication result representation authentication is passed, then it is determined that the security authentication is passed; otherwise, it is determined that the security authentication has failed.

8. A method for security authentication, the method comprising: Sending a security authentication request for the target service to the security server; The security authentication request includes target device information and target service information; Receiving a security authentication result returned by the security server; The security authentication result is returned based on the device authentication result and the service authentication result; The device authentication result is obtained by performing device authentication based on the target device information, and the service authentication result is obtained by performing service authentication based on the service binding relationship between the service, user device and user account, as well as the target device information and the target service information.

9. The method according to claim 8, before receiving the security authentication result returned by the security server, the method further comprises: When it is determined that the device authentication condition is met, sending the online status to the security server; When determining that a challenge code returned by the security server based on the online status is received, signing the target device information and the challenge code to obtain device signature information; Sending the device signature information to the security server; Receive a device authentication result returned by the security server based on the device signature information.

10. A security authentication device, comprising: an acquiring unit, configured to acquire target device information and target service information in the security authentication request when determining that a security authentication request sent by a user device for a target service is received; An authentication unit, configured to perform device authentication based on the target device information and obtain a device authentication result; An obtaining unit, configured to perform service authentication based on a service binding relationship between a service, a user device, and a user account, as well as the target device information and the target service information, and obtain a service authentication result; A determination unit, configured to determine a security authentication result based on the device authentication result and the service authentication result; The returning unit is used to return the security authentication result to the user equipment.

11. A security authentication device, comprising: A sending unit, used to send a security authentication request for a target service to a security server; The security authentication request includes target device information and target service information; A receiving unit, configured to receive a security authentication result returned by the security server; The security authentication result is returned based on the device authentication result and the service authentication result; The device authentication result is obtained by performing device authentication based on the target device information, and the service authentication result is obtained by performing service authentication based on the service binding relationship between the service, user device and user account, as well as the target device information and the target service information.

12. An electronic device comprising: processor; as well as A memory storing computer instructions, wherein the computer instructions are used to enable the processor to execute the method according to any one of claims 1-7 or 8-9.

13. A storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method according to any one of claims 1-7 or 8-9.

Images